From 5accf9fca3ceff73a9729711abf1d9532e79f16c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 31 Jul 2026 01:36:41 +0000
Subject: [PATCH] feat(credentials): re-key team vaults, and reach sh1pt's
 vault as a provider

Two additions to Credential Sharing.

`logicsrc credentials rotate` (alias `logicsrc secrets rotate`) re-keys a
team vault: fresh DEK, re-sealed to the members who keep access, every
secret re-encrypted under it. Values do not change, so nothing that
consumes them breaks; what changes is that every wrapped key issued
before the rotation is dead. --active (the default) keeps only active
members and revokes the rest -- the "someone left" rotation. --all keeps
everyone who holds access, for plain hygiene. Dry run by default, like
`sync`.

The DEK is recoverable ONLY through the grants, so a half-applied
rotation makes a vault permanently unreadable by everyone. The whole next
state therefore goes to the server in one request and commits in one
transaction (new db.batch helper). The server also requires every
submitted fingerprint to equal the stored one: it cannot see values, but
it can prove a re-key did not swap any. Rotations that would leave the
caller ungranted, grant nobody, or cover the wrong secret count are
rejected before anything is written. GET /vaults/:id/grants now returns
publicKey and status so a client can re-seal in one pass instead of N+1
user lookups, and revocation finally deletes the grant row rather than
leaving one that reports access it no longer confers.

The sh1pt adapter is the fifth provider. It is the only one driven
through a CLI rather than HTTP, because sh1pt publishes
`sh1pt secret set|get|list|rm` as the interface to its vault and
documents no REST endpoint. Values go over the child's stdin, never argv
-- a secret in argv is readable by any user on the host via ps. Since
`sh1pt secret get` needs interactive confirmation it cannot be scripted,
so the adapter is write-only for values like github-secrets: a sync
target, never a source, no value-restoring rollback.

Tests drive a real fake sh1pt binary rather than a mocked execFile, which
is how the hang surfaced: with nothing to pipe, stdin was left open and
any subcommand that reads it would wait forever. It is now always closed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 apps/logicsrc-web/src/lib/page-markup.ts      |   3 +-
 apps/pwa/src/db.mjs                           |   8 +
 apps/pwa/src/routes/credshare.mjs             | 111 ++++++++-
 apps/pwa/test/credshare-rekey.test.mjs        | 228 ++++++++++++++++++
 docs/credential-sharing.md                    |  60 +++++
 packages/cli/src/index.ts                     |  28 ++-
 packages/cli/src/rotate.ts                    | 156 ++++++++++++
 plugins/credential-sharing/src/client.ts      |  25 ++
 plugins/credential-sharing/src/index.ts       |   7 +
 .../credential-sharing/src/providers/index.ts |   5 +-
 .../src/providers/sh1pt.test.ts               | 171 +++++++++++++
 .../credential-sharing/src/providers/sh1pt.ts | 156 ++++++++++++
 plugins/credential-sharing/src/rekey.test.ts  | 170 +++++++++++++
 plugins/credential-sharing/src/rekey.ts       | 155 ++++++++++++
 plugins/credential-sharing/src/types.ts       |   2 +-
 15 files changed, 1278 insertions(+), 7 deletions(-)
 create mode 100644 apps/pwa/test/credshare-rekey.test.mjs
 create mode 100644 packages/cli/src/rotate.ts
 create mode 100644 plugins/credential-sharing/src/providers/sh1pt.test.ts
 create mode 100644 plugins/credential-sharing/src/providers/sh1pt.ts
 create mode 100644 plugins/credential-sharing/src/rekey.test.ts
 create mode 100644 plugins/credential-sharing/src/rekey.ts

diff --git a/apps/logicsrc-web/src/lib/page-markup.ts b/apps/logicsrc-web/src/lib/page-markup.ts
index 9e2ca8a..c9bdace 100644
--- a/apps/logicsrc-web/src/lib/page-markup.ts
+++ b/apps/logicsrc-web/src/lib/page-markup.ts
@@ -48,7 +48,8 @@ const credentialProviders = [
   { name: ".env", detail: "Parse, diff, redact, and write local env files without leaking values into logs." },
   { name: "Doppler", detail: "Sync project/config scoped secrets through provider adapters and auditable key fingerprints." },
   { name: "Railway", detail: "Read and write service variables as a deployment target with explicit approval gates." },
-  { name: "GitHub Secrets", detail: "Manage repo, organization, and environment secrets through provider-neutral operations." }
+  { name: "GitHub Secrets", detail: "Manage repo, organization, and environment secrets through provider-neutral operations." },
+  { name: "sh1pt", detail: "Sync the distribution credential vault — App Store Connect, Play, npm, Docker, and Cloudflare tokens — through the sh1pt CLI." }
 ];
 
 const credentialSurfaces = [
diff --git a/apps/pwa/src/db.mjs b/apps/pwa/src/db.mjs
index 9515986..037b35e 100644
--- a/apps/pwa/src/db.mjs
+++ b/apps/pwa/src/db.mjs
@@ -27,3 +27,11 @@ export async function all(sql, args = []) {
   const r = await db.execute({ sql, args });
   return r.rows;
 }
+
+/**
+ * Run many statements in ONE write transaction — all of them commit, or none
+ * do. Needed anywhere a partial write would leave unrecoverable state, e.g.
+ * re-keying a vault, where new grants over old ciphertext locks out every
+ * member permanently.
+ */
+export const batch = (statements) => db.batch(statements, "write");
diff --git a/apps/pwa/src/routes/credshare.mjs b/apps/pwa/src/routes/credshare.mjs
index 75f862c..b4c5015 100644
--- a/apps/pwa/src/routes/credshare.mjs
+++ b/apps/pwa/src/routes/credshare.mjs
@@ -6,7 +6,7 @@
 // Auth: the acting user comes from a browser session (req.user) OR a
 // `Bearer lsk_…` API key (the logicsrc CLI). Mounted at /api/credshare.
 import { Router } from "express";
-import { get, all, run } from "../db.mjs";
+import { get, all, run, batch } from "../db.mjs";
 import { id, token, sha256 } from "../lib/crypto.mjs";
 import { bearer, userForApiKey } from "../lib/apikey.mjs";
 import { config } from "../config.mjs";
@@ -200,10 +200,117 @@ credshareRouter.get("/api/credshare/vaults/:id/grants", api(async (req, res, use
   const granted = new Set((await all(`SELECT user_id FROM credshare_vault_grants WHERE vault_id = ?`, [vault.id])).map((r) => r.user_id));
   const members = await all(`SELECT * FROM credshare_members WHERE team_id = ?`, [vault.team_id]);
   const grants = [];
-  for (const m of members) grants.push({ email: m.email, hasPublicKey: m.user_id ? Boolean(await publicKeyFor(m.user_id)) : false, hasAccess: Boolean(m.user_id && granted.has(m.user_id)) });
+  for (const m of members) {
+    // The public key is included so a client can re-seal the vault key to every
+    // member in one pass (see rekey). Public keys are public by construction --
+    // they exist to be sealed against -- and this route is already member-only.
+    const publicKey = m.user_id ? await publicKeyFor(m.user_id) : null;
+    grants.push({
+      email: m.email,
+      publicKey,
+      status: m.status,
+      hasPublicKey: Boolean(publicKey),
+      hasAccess: Boolean(m.user_id && granted.has(m.user_id))
+    });
+  }
   res.json({ grants });
 }));
 
+// Re-key a vault: swap in a fresh DEK, re-seal it to the members who keep
+// access, and re-encrypt every secret under it. Values do not change, which the
+// server enforces by requiring each submitted fingerprint to equal the stored
+// one -- it cannot see values, but it can prove they were not swapped.
+//
+// This is ONE transaction on purpose. The DEK is recoverable only through the
+// grants, so a half-applied rotation (new grants over old ciphertext, or the
+// reverse) would make the vault permanently unreadable by everyone.
+credshareRouter.post("/api/credshare/vaults/:id/rekey", api(async (req, res, user) => {
+  const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
+  const iHold = await get(`SELECT 1 FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, [vault.id, user.id]);
+  if (!iHold) return res.status(403).json({ error: "Only a member with vault access can re-key it." });
+
+  const grants = Array.isArray(req.body?.grants) ? req.body.grants : null;
+  const secrets = Array.isArray(req.body?.secrets) ? req.body.secrets : null;
+  const revoke = Array.isArray(req.body?.revoke) ? req.body.revoke.map(norm) : [];
+  if (!grants || !secrets) return res.status(422).json({ error: "Expected { grants, secrets, revoke? }." });
+  if (grants.length === 0) return res.status(422).json({ error: "A re-key must keep at least one member, or the vault becomes unreadable." });
+
+  // The caller must keep their own access; otherwise they lock themselves out
+  // the moment the transaction commits.
+  const me = await get(`SELECT email FROM users WHERE id = ?`, [user.id]);
+  if (!grants.some((g) => norm(g?.email) === norm(me?.email))) {
+    return res.status(422).json({ error: "A re-key must include your own grant." });
+  }
+
+  // Every secret must be accounted for, with an unchanged fingerprint. This is
+  // what makes "re-key" distinct from "write": no value may change here.
+  const stored = await all(`SELECT name, fingerprint FROM credshare_secrets WHERE vault_id = ?`, [vault.id]);
+  const storedByName = new Map(stored.map((s) => [s.name, s.fingerprint]));
+  if (secrets.length !== stored.length) {
+    return res.status(409).json({ error: `Re-key covers ${secrets.length} secret(s) but the vault holds ${stored.length}. Re-read the vault and retry.` });
+  }
+  for (const s of secrets) {
+    if (!s || typeof s.name !== "string" || typeof s.nonce !== "string" || typeof s.ciphertext !== "string" || typeof s.fingerprint !== "string") {
+      return res.status(422).json({ error: "Each secret needs { name, nonce, ciphertext, fingerprint }." });
+    }
+    if (!storedByName.has(s.name)) {
+      return res.status(409).json({ error: `"${s.name}" is not in this vault. Re-read the vault and retry.` });
+    }
+    if (storedByName.get(s.name) !== s.fingerprint) {
+      return res.status(409).json({ error: `Re-key would change the value of "${s.name}". A re-key re-encrypts; it never changes values.` });
+    }
+  }
+
+  // Resolve grant targets before writing anything.
+  const resolved = [];
+  for (const g of grants) {
+    const email = norm(g?.email);
+    if (!email || typeof g?.wrappedDek !== "string" || !g.wrappedDek) {
+      return res.status(422).json({ error: "Each grant needs { email, wrappedDek }." });
+    }
+    const target = await get(`SELECT id FROM users WHERE email = ?`, [email]);
+    if (!target) return res.status(409).json({ error: `${email} has not logged in yet, so the vault key cannot be sealed to them.` });
+    resolved.push({ email, userId: target.id, wrappedDek: g.wrappedDek });
+  }
+
+  const revokedUsers = [];
+  for (const email of revoke) {
+    const target = await get(`SELECT id FROM users WHERE email = ?`, [email]);
+    if (target) revokedUsers.push({ email, userId: target.id });
+  }
+
+  const now = Date.now();
+  const statements = [];
+  for (const s of secrets) {
+    statements.push({
+      sql: `UPDATE credshare_secrets SET nonce = ?, ciphertext = ?, version = version + 1, updated_by = ?, updated_at = ? WHERE vault_id = ? AND name = ?`,
+      args: [s.nonce, s.ciphertext, user.id, now, vault.id, s.name]
+    });
+  }
+  for (const g of resolved) {
+    statements.push({
+      sql: `INSERT INTO credshare_vault_grants (vault_id, user_id, wrapped_dek, granted_by, created_at) VALUES (?,?,?,?,?) ON CONFLICT(vault_id, user_id) DO UPDATE SET wrapped_dek = excluded.wrapped_dek, granted_by = excluded.granted_by, created_at = excluded.created_at`,
+      args: [vault.id, g.userId, g.wrappedDek, user.id, now]
+    });
+  }
+  for (const r of revokedUsers) {
+    statements.push({ sql: `DELETE FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, args: [vault.id, r.userId] });
+  }
+  statements.push({
+    sql: `INSERT INTO credshare_audit (id, team_id, vault_id, actor_user_id, action, key_name, fingerprint, created_at) VALUES (?,?,?,?,?,?,?,?)`,
+    args: [id(), vault.team_id, vault.id, user.id, "vault:rekey", null, null, now]
+  });
+  for (const r of revokedUsers) {
+    statements.push({
+      sql: `INSERT INTO credshare_audit (id, team_id, vault_id, actor_user_id, action, key_name, fingerprint, created_at) VALUES (?,?,?,?,?,?,?,?)`,
+      args: [id(), vault.team_id, vault.id, user.id, "vault:revoke", r.email, null, now]
+    });
+  }
+
+  await batch(statements);
+  res.json({ ok: true, rekeyed: secrets.length, granted: resolved.map((g) => g.email), revoked: revokedUsers.map((r) => r.email) });
+}));
+
 credshareRouter.post("/api/credshare/vaults/:id/grants", api(async (req, res, user) => {
   const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
   const iHold = await get(`SELECT 1 FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, [vault.id, user.id]);
diff --git a/apps/pwa/test/credshare-rekey.test.mjs b/apps/pwa/test/credshare-rekey.test.mjs
new file mode 100644
index 0000000..911c121
--- /dev/null
+++ b/apps/pwa/test/credshare-rekey.test.mjs
@@ -0,0 +1,228 @@
+// Integration tests for POST /api/credshare/vaults/:id/rekey.
+//
+// The endpoint is the last line of defence on a genuinely unrecoverable
+// operation: the vault DEK exists only inside the grants, so a rotation that
+// commits half-way, drops a secret, or leaves the caller ungranted destroys the
+// vault permanently. These tests pin the guards that stop that.
+//
+// Runs against an in-memory libSQL database, so DATABASE_URL must be set before
+// anything imports db.mjs.
+process.env.DATABASE_URL = ":memory:";
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import express from "express";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const { db, run, get, all } = await import("../src/db.mjs");
+const { credshareRouter } = await import("../src/routes/credshare.mjs");
+
+/** Apply the schema this router depends on. */
+async function migrate() {
+  for (const file of ["001_auth.sql", "002_credshare.sql"]) {
+    const sql = readFileSync(join(here, "..", "src", "migrations", file), "utf8");
+    for (const statement of sql.split(/;\s*$/m).map((s) => s.trim()).filter(Boolean)) {
+      await db.execute(statement);
+    }
+  }
+}
+
+/**
+ * Mount the router with a fixed acting user, mimicking a browser session.
+ * Returns a fetch-like helper bound to an ephemeral port.
+ */
+async function serve(actingUserId) {
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.user = { id: actingUserId };
+    next();
+  });
+  app.use(credshareRouter);
+  const server = app.listen(0);
+  await new Promise((resolve) => server.once("listening", resolve));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  return {
+    async post(path, body) {
+      const res = await fetch(`${base}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+      return { status: res.status, body: await res.json() };
+    },
+    async get(path) {
+      const res = await fetch(`${base}${path}`);
+      return { status: res.status, body: await res.json() };
+    },
+    close: () => new Promise((resolve) => server.close(resolve)),
+  };
+}
+
+const now = Date.now();
+
+/** A team with one vault, two granted members, and two secrets. */
+async function seed() {
+  await run(`INSERT INTO users (id, email, created_at) VALUES (?,?,?)`, ["u_me", "me@example.com", now]);
+  await run(`INSERT INTO users (id, email, created_at) VALUES (?,?,?)`, ["u_them", "them@example.com", now]);
+  await run(`INSERT INTO credshare_keys (user_id, public_key, updated_at) VALUES (?,?,?)`, ["u_me", "pk-me", now]);
+  await run(`INSERT INTO credshare_keys (user_id, public_key, updated_at) VALUES (?,?,?)`, ["u_them", "pk-them", now]);
+  await run(`INSERT INTO credshare_teams (id, slug, name, created_by, created_at) VALUES (?,?,?,?,?)`, ["t1", "acme", "Acme", "u_me", now]);
+  await run(`INSERT INTO credshare_members (id, team_id, user_id, email, role, status, created_at) VALUES (?,?,?,?,?,?,?)`,
+    ["m1", "t1", "u_me", "me@example.com", "owner", "active", now]);
+  await run(`INSERT INTO credshare_members (id, team_id, user_id, email, role, status, created_at) VALUES (?,?,?,?,?,?,?)`,
+    ["m2", "t1", "u_them", "them@example.com", "member", "active", now]);
+  await run(`INSERT INTO credshare_vaults (id, team_id, name, created_by, created_at) VALUES (?,?,?,?,?)`, ["v1", "t1", "app--prod", "u_me", now]);
+  for (const uid of ["u_me", "u_them"]) {
+    await run(`INSERT INTO credshare_vault_grants (vault_id, user_id, wrapped_dek, granted_by, created_at) VALUES (?,?,?,?,?)`,
+      ["v1", uid, `old-wrapped-${uid}`, "u_me", now]);
+  }
+  await run(`INSERT INTO credshare_secrets (vault_id, name, nonce, ciphertext, fingerprint, version, updated_by, updated_at) VALUES (?,?,?,?,?,?,?,?)`,
+    ["v1", "API_KEY", "n1", "c1", "fp-api", 1, "u_me", now]);
+  await run(`INSERT INTO credshare_secrets (vault_id, name, nonce, ciphertext, fingerprint, version, updated_by, updated_at) VALUES (?,?,?,?,?,?,?,?)`,
+    ["v1", "DB_URL", "n2", "c2", "fp-db", 1, "u_me", now]);
+}
+
+/** A well-formed rotation: same names, same fingerprints, fresh ciphertext. */
+function validBody(overrides = {}) {
+  return {
+    grants: [
+      { email: "me@example.com", wrappedDek: "new-wrapped-me" },
+      { email: "them@example.com", wrappedDek: "new-wrapped-them" }
+    ],
+    secrets: [
+      { name: "API_KEY", nonce: "n1b", ciphertext: "c1b", fingerprint: "fp-api" },
+      { name: "DB_URL", nonce: "n2b", ciphertext: "c2b", fingerprint: "fp-db" }
+    ],
+    revoke: [],
+    ...overrides
+  };
+}
+
+await migrate();
+await seed();
+
+test("re-keys every secret and grant in one commit", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody());
+  assert.equal(res.status, 200);
+  assert.equal(res.body.rekeyed, 2);
+
+  const secrets = await all(`SELECT name, nonce, ciphertext, fingerprint, version FROM credshare_secrets WHERE vault_id = 'v1' ORDER BY name`);
+  // New ciphertext, bumped version -- and the fingerprint is untouched, which
+  // is the machine-checkable statement that no VALUE changed.
+  assert.deepEqual(secrets.map((s) => s.ciphertext), ["c1b", "c2b"]);
+  assert.deepEqual(secrets.map((s) => s.version), [2, 2]);
+  assert.deepEqual(secrets.map((s) => s.fingerprint), ["fp-api", "fp-db"]);
+
+  const grants = await all(`SELECT user_id, wrapped_dek FROM credshare_vault_grants WHERE vault_id = 'v1' ORDER BY user_id`);
+  assert.deepEqual(grants.map((g) => g.wrapped_dek), ["new-wrapped-me", "new-wrapped-them"]);
+
+  const audit = await get(`SELECT action FROM credshare_audit WHERE vault_id = 'v1' AND action = 'vault:rekey'`);
+  assert.equal(audit.action, "vault:rekey");
+});
+
+test("refuses a rotation that would change a value", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody({
+    secrets: [
+      { name: "API_KEY", nonce: "x", ciphertext: "x", fingerprint: "fp-DIFFERENT" },
+      { name: "DB_URL", nonce: "n2c", ciphertext: "c2c", fingerprint: "fp-db" }
+    ]
+  }));
+
+  assert.equal(res.status, 409);
+  assert.match(res.body.error, /never changes values/);
+  // Nothing was written.
+  const row = await get(`SELECT ciphertext FROM credshare_secrets WHERE vault_id = 'v1' AND name = 'DB_URL'`);
+  assert.equal(row.ciphertext, "c2b");
+});
+
+test("refuses a rotation that drops a secret", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody({
+    secrets: [{ name: "API_KEY", nonce: "z", ciphertext: "z", fingerprint: "fp-api" }]
+  }));
+
+  assert.equal(res.status, 409);
+  assert.match(res.body.error, /covers 1 secret\(s\) but the vault holds 2/);
+});
+
+test("refuses to let the caller lock themselves out", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody({
+    grants: [{ email: "them@example.com", wrappedDek: "new-wrapped-them" }]
+  }));
+
+  assert.equal(res.status, 422);
+  assert.match(res.body.error, /must include your own grant/);
+});
+
+test("refuses a rotation that grants nobody", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody({ grants: [] }));
+
+  assert.equal(res.status, 422);
+  assert.match(res.body.error, /at least one member/);
+});
+
+test("revoking drops the grant row so access is not merely stale", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody({
+    grants: [{ email: "me@example.com", wrappedDek: "newer-me" }],
+    secrets: [
+      { name: "API_KEY", nonce: "n1d", ciphertext: "c1d", fingerprint: "fp-api" },
+      { name: "DB_URL", nonce: "n2d", ciphertext: "c2d", fingerprint: "fp-db" }
+    ],
+    revoke: ["them@example.com"]
+  }));
+
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body.revoked, ["them@example.com"]);
+
+  const theirs = await get(`SELECT 1 AS hit FROM credshare_vault_grants WHERE vault_id = 'v1' AND user_id = 'u_them'`);
+  assert.equal(theirs, null, "revoked member should have no grant row left");
+
+  // And the revocation is on the audit trail by name.
+  const ev = await get(`SELECT key_name FROM credshare_audit WHERE vault_id = 'v1' AND action = 'vault:revoke'`);
+  assert.equal(ev.key_name, "them@example.com");
+});
+
+test("a member with no vault access cannot re-key it", async (t) => {
+  // u_them was just revoked above, so they are an active member without a grant.
+  const app = await serve("u_them");
+  t.after(() => app.close());
+
+  const res = await app.post("/api/credshare/vaults/v1/rekey", validBody());
+
+  assert.equal(res.status, 403);
+  assert.match(res.body.error, /Only a member with vault access/);
+});
+
+test("grants expose public keys and status so a client can re-seal in one pass", async (t) => {
+  const app = await serve("u_me");
+  t.after(() => app.close());
+
+  const res = await app.get("/api/credshare/vaults/v1/grants");
+
+  assert.equal(res.status, 200);
+  const me = res.body.grants.find((g) => g.email === "me@example.com");
+  assert.equal(me.publicKey, "pk-me");
+  assert.equal(me.status, "active");
+  assert.equal(me.hasAccess, true);
+});
diff --git a/docs/credential-sharing.md b/docs/credential-sharing.md
index 6d830d6..4217e33 100644
--- a/docs/credential-sharing.md
+++ b/docs/credential-sharing.md
@@ -55,12 +55,30 @@ env
 doppler
 railway
 github-secrets
+sh1pt
 ```
 
 - `.env`: read, diff, redact, and write local environment files.
 - Doppler: sync project/config scoped secrets.
 - Railway: sync service variables.
 - GitHub Secrets: sync repository, organization, and environment secrets.
+- sh1pt: sync the distribution credential vault — App Store Connect keys, Play
+  service accounts, npm and Docker tokens, Cloudflare tokens.
+
+`sh1pt` is the one adapter driven through a **CLI** rather than an HTTP API,
+because sh1pt publishes `sh1pt secret set|get|list|rm` as the interface to its
+vault and documents no REST endpoint for it. That is a transport choice inside
+an adapter, which is the layer where product-specific I/O belongs; it does not
+move product-specific commands into the core contract. Two consequences worth
+stating:
+
+- Values are written on the child process's **stdin**, never as argv. A secret
+  passed as a command-line argument is readable by any user on the host via
+  `ps` for the lifetime of the call.
+- `sh1pt secret get` requires interactive confirmation and so cannot be
+  scripted. The adapter is therefore write-only for values (`readValues:
+  false`), exactly like `github-secrets`: it can be a sync target but never a
+  source, and it supports no value-restoring rollback.
 
 ## Core Objects
 
@@ -96,11 +114,14 @@ plan
 diff
 approve
 sync
+rotate
 rollback
 audit
 export
 ```
 
+`logicsrc secrets …` is an accepted alias for `logicsrc credentials …`.
+
 Examples:
 
 ```bash
@@ -202,6 +223,45 @@ logicsrc teams members acme
 logicsrc teams vaults acme
 ```
 
+### Rotating a vault key
+
+```bash
+# Dry run (the default): show what a rotation would re-key and revoke.
+logicsrc credentials rotate acme web prod
+
+# Apply it.
+logicsrc credentials rotate acme web prod --approve
+
+# Every vault in the team that you can open.
+logicsrc secrets rotate acme --approve
+```
+
+Rotation replaces the vault DEK, re-seals it to the members who keep access, and
+re-encrypts every secret under it. **Secret values do not change** — nothing that
+consumes them breaks. What changes is that every wrapped key issued before the
+rotation is dead, so a copy of an old grant buys nothing.
+
+Who keeps access:
+
+- **`--active`** (default): only members whose team status is `active` *and* who
+  hold a grant today. This is the "someone left the team" rotation — everyone
+  else is revoked.
+- **`--all`**: everyone holding a grant today, whatever their status. Pure
+  crypto hygiene, no revocation.
+
+A member who holds access but has never uploaded a public key cannot be re-sealed
+to; they are reported under `skipped` and revoked rather than dropped silently.
+
+Safety properties, all enforced rather than documented:
+
+- The whole next state is applied in **one transaction**. The DEK is recoverable
+  only through the grants, so a half-applied rotation — new grants over old
+  ciphertext, or the reverse — would make the vault permanently unreadable.
+- The server requires every submitted fingerprint to equal the stored one. It
+  cannot see values, but it can prove a rotation did not swap any.
+- A rotation that would leave the caller ungranted, grant nobody, or cover the
+  wrong number of secrets is rejected before anything is written.
+
 `logicsrc login` picks its flow from the machine it runs on:
 
 - **Has its own browser** → loopback OAuth-PKCE: a `127.0.0.1` listener catches
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 3ae710e..dd5adc6 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -24,6 +24,7 @@ import {
   teamsPushAction,
   teamsPullAction
 } from "./teams.js";
+import { credentialsRotateAction } from "./rotate.js";
 import { boards, tasks } from "./fixtures.js";
 import { print, type OutputFormat } from "./format.js";
 import { parsePositiveInteger } from "./numeric-options.js";
@@ -404,7 +405,13 @@ program.command("plugins").option("--format <format>", "table, json, or markdown
   print(snapshot.plugins, options.format as OutputFormat);
 });
 
-const credentials = program.command("credentials").alias("creds").description("Credential Sharing OpenSpec: portable, auditable secret sync.");
+const credentials = program
+  .command("credentials")
+  .alias("creds")
+  // `secrets` is what people reach for; keep it pointing at the same group
+  // rather than growing a second, divergent surface.
+  .alias("secrets")
+  .description("Credential Sharing OpenSpec: portable, auditable secret sync.");
 
 function endpointFromOptions(options: Record<string, unknown>, prefix: "" | "from" | "to"): CredentialEndpoint {
   const pick = (name: string) => {
@@ -543,6 +550,25 @@ credentials
     print(credentialEngine().exportCredentialAudit(options.run), options.format as OutputFormat);
   });
 
+credentials
+  .command("rotate")
+  .argument("<team>", "Team slug")
+  .argument("[project]", "Project name (omit with env to rotate every vault in the team)")
+  .argument("[env]", "Environment name (prod, staging, …)")
+  .option("--all", "Re-seal to everyone who holds access today, whatever their member status")
+  .option("--active", "Re-seal only to active members, dropping the rest (default)")
+  .option("--approve", "Apply the rotation (dry run by default)")
+  .option("--format <format>", "table, json, or markdown", "table")
+  .description("Re-key a vault: new vault key, secrets re-encrypted, values unchanged.")
+  .action((team, project, env, options) =>
+    credentialsRotateAction(team, project, env, {
+      // --all widens the keep-list; --active is the default and needs no flag.
+      scope: options.all ? "all" : "active",
+      approve: Boolean(options.approve),
+      format: options.format as OutputFormat
+    })
+  );
+
 credentials
   .command("export")
   .requiredOption("--run <id>", "Sync run id")
diff --git a/packages/cli/src/rotate.ts b/packages/cli/src/rotate.ts
new file mode 100644
index 0000000..0d7e9a7
--- /dev/null
+++ b/packages/cli/src/rotate.ts
@@ -0,0 +1,156 @@
+import {
+  TeamClient,
+  TeamApiError,
+  requireAuth,
+  resolveApiUrl,
+  planVaultRekey,
+  type RekeyMember
+} from "@logicsrc/plugin-credential-sharing";
+import { print, type OutputFormat } from "./format.js";
+import { vaultName } from "./teams.js";
+
+/**
+ * `logicsrc credentials rotate` — re-key a team vault.
+ *
+ * Rotation replaces the vault's data-encryption key and re-encrypts every
+ * secret under it. Secret VALUES do not change, so nothing that consumes them
+ * breaks; what changes is that every wrapped key issued before now is dead.
+ * That is what makes it the right move after someone leaves a team, or on a
+ * schedule as plain hygiene.
+ *
+ * All crypto happens here, on the member's machine. The server receives the
+ * finished state (ciphertext plus sealed keys) and commits it in one
+ * transaction.
+ */
+
+export interface RotateOptions {
+  /** "active" (default) drops non-active members; "all" keeps everyone. */
+  scope: "active" | "all";
+  /** Rotation only writes with --approve, matching `credentials sync`. */
+  approve: boolean;
+  format: OutputFormat;
+}
+
+interface VaultTarget {
+  id: string;
+  name: string;
+}
+
+function authedClient(): { client: TeamClient; identity: ReturnType<typeof requireAuth> } {
+  const identity = requireAuth();
+  return { client: new TeamClient({ apiUrl: resolveApiUrl(identity), token: identity.apiToken }), identity };
+}
+
+/**
+ * Which vaults this invocation covers: one when a project/env pair is given,
+ * otherwise every vault in the team the caller can actually open.
+ */
+async function resolveTargets(
+  client: TeamClient,
+  slug: string,
+  project?: string,
+  env?: string
+): Promise<VaultTarget[]> {
+  const { vaults } = await client.listVaults(slug);
+  if (project || env) {
+    if (!project || !env) {
+      throw new Error("Give both a project and an env, or neither to rotate the whole team: logicsrc creds rotate <team> [project] [env]");
+    }
+    const name = vaultName(project, env);
+    const found = vaults.find((v) => v.name === name);
+    if (!found) {
+      const known = vaults.map((v) => v.name).join(", ");
+      throw new Error(`Vault "${name}" not found in team "${slug}".${known ? ` Existing vaults: ${known}.` : ""}`);
+    }
+    return [{ id: found.id, name: found.name }];
+  }
+  // Vaults the caller holds no grant on cannot be re-keyed by them; skip rather
+  // than fail the whole sweep.
+  const accessible = vaults.filter((v) => v.hasAccess);
+  if (accessible.length === 0) {
+    throw new Error(`No vaults in "${slug}" that you have access to. Ask a member to grant you, or name a vault explicitly.`);
+  }
+  return accessible.map((v) => ({ id: v.id, name: v.name }));
+}
+
+async function rotateOne(
+  client: TeamClient,
+  identity: ReturnType<typeof requireAuth>,
+  vault: VaultTarget,
+  options: RotateOptions
+): Promise<Record<string, unknown>> {
+  let myWrappedDek: string;
+  try {
+    myWrappedDek = (await client.getMyGrant(vault.id)).wrappedDek;
+  } catch (error) {
+    if (error instanceof TeamApiError && error.status === 403) {
+      throw new Error(`You don't have access to "${vault.name}", so you can't re-key it. Ask an existing member.`);
+    }
+    throw error;
+  }
+
+  const [{ secrets }, { grants }] = await Promise.all([client.listSecrets(vault.id), client.listGrants(vault.id)]);
+
+  const members: RekeyMember[] = grants.map((g) => ({
+    email: g.email,
+    publicKey: g.publicKey,
+    status: g.status,
+    hasAccess: g.hasAccess
+  }));
+
+  const plan = await planVaultRekey({
+    myWrappedDek,
+    identity: identity.keys,
+    secrets: secrets.map((s) => ({ name: s.name, nonce: s.nonce, ciphertext: s.ciphertext, fingerprint: s.fingerprint })),
+    members,
+    scope: options.scope
+  });
+
+  const summary: Record<string, unknown> = {
+    vault: vault.name,
+    secrets: plan.secrets.length,
+    keeps: plan.grants.map((g) => g.email),
+    revokes: plan.revoked,
+    skipped: plan.skipped,
+    applied: false
+  };
+
+  if (!options.approve) {
+    return summary;
+  }
+
+  const result = await client.rekeyVault(vault.id, {
+    grants: plan.grants,
+    secrets: plan.secrets,
+    revoke: plan.revoked
+  });
+  summary.applied = true;
+  summary.rekeyed = result.rekeyed;
+  return summary;
+}
+
+export async function credentialsRotateAction(
+  slug: string,
+  project: string | undefined,
+  env: string | undefined,
+  options: RotateOptions
+): Promise<void> {
+  const { client, identity } = authedClient();
+  const targets = await resolveTargets(client, slug, project, env);
+
+  const results: Array<Record<string, unknown>> = [];
+  for (const vault of targets) {
+    results.push(await rotateOne(client, identity, vault, options));
+  }
+
+  if (!options.approve) {
+    const totalRevokes = results.reduce((n, r) => n + (r.revokes as string[]).length, 0);
+    console.error(
+      `Dry run: ${results.length} vault(s) would be re-keyed${totalRevokes ? `, revoking ${totalRevokes} grant(s)` : ""}. Values are unchanged by a re-key. Re-run with --approve to apply.`
+    );
+  } else {
+    console.error(`Re-keyed ${results.length} vault(s). Every previously issued vault key is now dead.`);
+  }
+
+  print(results, options.format);
+}
diff --git a/plugins/credential-sharing/src/client.ts b/plugins/credential-sharing/src/client.ts
index f77e200..ecce645 100644
--- a/plugins/credential-sharing/src/client.ts
+++ b/plugins/credential-sharing/src/client.ts
@@ -50,10 +50,20 @@ export interface RemoteSecret {
 
 export interface RemoteGrantRow {
   email: string;
+  /** X25519 public key, so a client can re-seal to every member in one pass. */
+  publicKey: string | null;
+  status: "active" | "invited";
   hasPublicKey: boolean;
   hasAccess: boolean;
 }
 
+export interface RekeyResult {
+  ok: boolean;
+  rekeyed: number;
+  granted: string[];
+  revoked: string[];
+}
+
 export class TeamApiError extends Error {
   constructor(
     public readonly status: number,
@@ -158,6 +168,21 @@ export class TeamClient {
   putSecrets(vaultId: string, upserts: Array<{ name: string; nonce: string; ciphertext: string; fingerprint: string }>, deletes: string[]) {
     return this.request<{ ok: boolean; applied: string[] }>("PUT", `/vaults/${encodeURIComponent(vaultId)}/secrets`, { upserts, deletes });
   }
+  /**
+   * Swap the vault to a fresh DEK. The whole next state goes over in one call
+   * because the server applies it in a single transaction — see rekey.ts for
+   * why a partial rotation is unrecoverable.
+   */
+  rekeyVault(
+    vaultId: string,
+    body: {
+      grants: Array<{ email: string; wrappedDek: string }>;
+      secrets: Array<{ name: string; nonce: string; ciphertext: string; fingerprint: string }>;
+      revoke: string[];
+    }
+  ) {
+    return this.request<RekeyResult>("POST", `/vaults/${encodeURIComponent(vaultId)}/rekey`, body);
+  }
   listAudit(vaultId: string) {
     return this.request<{ audit: Array<Record<string, unknown>> }>("GET", `/vaults/${encodeURIComponent(vaultId)}/audit`);
   }
diff --git a/plugins/credential-sharing/src/index.ts b/plugins/credential-sharing/src/index.ts
index e43bfe9..77b28b1 100644
--- a/plugins/credential-sharing/src/index.ts
+++ b/plugins/credential-sharing/src/index.ts
@@ -101,4 +101,11 @@ export {
   type CredentialStore
 } from "./store.js";
 export { fingerprintValue, fingerprintsEqual } from "./fingerprint.js";
+export {
+  planVaultRekey,
+  type RekeyPlan,
+  type RekeyPlanInput,
+  type RekeyMember,
+  type SealedSecret
+} from "./rekey.js";
 export * from "./types.js";
diff --git a/plugins/credential-sharing/src/providers/index.ts b/plugins/credential-sharing/src/providers/index.ts
index 3c4f3f7..1b5d63b 100644
--- a/plugins/credential-sharing/src/providers/index.ts
+++ b/plugins/credential-sharing/src/providers/index.ts
@@ -3,9 +3,10 @@ import { envProvider } from "./env.js";
 import { dopplerProvider } from "./doppler.js";
 import { railwayProvider } from "./railway.js";
 import { githubSecretsProvider } from "./github-secrets.js";
+import { sh1ptProvider } from "./sh1pt.js";
 import { teamProvider } from "./team.js";
 
-export const credentialProviders: CredentialProvider[] = [envProvider, dopplerProvider, railwayProvider, githubSecretsProvider, teamProvider];
+export const credentialProviders: CredentialProvider[] = [envProvider, dopplerProvider, railwayProvider, githubSecretsProvider, sh1ptProvider, teamProvider];
 
 export const credentialProviderRegistry: Map<string, CredentialProvider> = new Map(
   credentialProviders.map((provider) => [provider.id, provider])
@@ -22,5 +23,5 @@ export function listCredentialProviderManifests(): CredentialProviderManifest[]
   }));
 }
 
-export { envProvider, dopplerProvider, railwayProvider, githubSecretsProvider, teamProvider };
+export { envProvider, dopplerProvider, railwayProvider, githubSecretsProvider, sh1ptProvider, teamProvider };
 export { parseEnv, applyEnv } from "./env.js";
diff --git a/plugins/credential-sharing/src/providers/sh1pt.test.ts b/plugins/credential-sharing/src/providers/sh1pt.test.ts
new file mode 100644
index 0000000..43ba9ba
--- /dev/null
+++ b/plugins/credential-sharing/src/providers/sh1pt.test.ts
@@ -0,0 +1,171 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync, existsSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parseSecretList, sh1ptProvider } from "./sh1pt.js";
+
+/**
+ * These run against a real fake `sh1pt` binary rather than a mocked execFile,
+ * so the child-process path — argv, stdin, exit codes — is genuinely exercised.
+ * That matters here: the whole point of the adapter is that secret values go
+ * over stdin and never appear in argv.
+ */
+let dir: string;
+let binPath: string;
+let logPath: string;
+
+/** Write a stub `sh1pt` that records how it was invoked, then prints `stdout`. */
+function installFakeSh1pt(body: string): void {
+  writeFileSync(
+    binPath,
+    `#!/usr/bin/env node
+const fs = require("fs");
+let stdin = "";
+process.stdin.on("data", (c) => (stdin += c));
+process.stdin.on("end", run);
+if (process.stdin.isTTY) run();
+function run() {
+  const calls = fs.existsSync(${JSON.stringify(logPath)})
+    ? JSON.parse(fs.readFileSync(${JSON.stringify(logPath)}, "utf8"))
+    : [];
+  calls.push({ argv: process.argv.slice(2), stdin });
+  fs.writeFileSync(${JSON.stringify(logPath)}, JSON.stringify(calls));
+  ${body}
+}
+`,
+    { mode: 0o755 }
+  );
+  chmodSync(binPath, 0o755);
+}
+
+function calls(): Array<{ argv: string[]; stdin: string }> {
+  return existsSync(logPath) ? JSON.parse(readFileSync(logPath, "utf8")) : [];
+}
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "sh1pt-test-"));
+  binPath = join(dir, "sh1pt");
+  logPath = join(dir, "calls.json");
+  process.env.SH1PT_BIN = binPath;
+});
+
+afterEach(() => {
+  delete process.env.SH1PT_BIN;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("parseSecretList", () => {
+  it("reads plain and decorated key lists, and never invents a key", () => {
+    expect(parseSecretList("NPM_TOKEN\nDOCKER_PAT\n")).toEqual(["NPM_TOKEN", "DOCKER_PAT"]);
+    expect(parseSecretList("  - NPM_TOKEN\n  * DOCKER_PAT\n\n")).toEqual(["NPM_TOKEN", "DOCKER_PAT"]);
+    // A value accidentally printed alongside a key has whitespace in it, so it
+    // is dropped rather than treated as a key name.
+    expect(parseSecretList("NPM_TOKEN = npm_abc123\nDOCKER_PAT\n")).toEqual(["DOCKER_PAT"]);
+    expect(parseSecretList("")).toEqual([]);
+  });
+});
+
+describe("sh1ptProvider", () => {
+  it("is declared write-only: sh1pt secret get needs a human, so values cannot be read back", () => {
+    expect(sh1ptProvider.capabilities.readValues).toBe(false);
+    expect(sh1ptProvider.capabilities.rollback).toBe(false);
+    expect(sh1ptProvider.readValues).toBeUndefined();
+    expect(sh1ptProvider.capabilities.write).toBe(true);
+  });
+
+  it("lists key names and reports values as unreadable", async () => {
+    installFakeSh1pt(`process.stdout.write("NPM_TOKEN\\nCLOUDFLARE_TOKEN\\n");`);
+
+    const snapshot = await sh1ptProvider.inspect({ provider: "sh1pt", project: "acme", config: "prod" });
+
+    expect(snapshot.valuesReadable).toBe(false);
+    expect(snapshot.keys.map((k) => k.name)).toEqual(["CLOUDFLARE_TOKEN", "NPM_TOKEN"]);
+    // Names only — a fingerprint would imply we had seen the value.
+    expect(snapshot.keys.every((k) => k.fingerprint === undefined)).toBe(true);
+    expect(calls()[0].argv).toEqual(["secret", "list", "--project", "acme", "--env", "prod"]);
+  });
+
+  it("passes secret values on stdin and NEVER in argv", async () => {
+    installFakeSh1pt("");
+    const value = "npm_supersecret_value";
+
+    const results = await sh1ptProvider.write({
+      endpoint: { provider: "sh1pt" },
+      upserts: { NPM_TOKEN: value },
+      deletes: [],
+      dryRun: false
+    });
+
+    expect(results).toEqual([{ key: "NPM_TOKEN", applied: true }]);
+    const call = calls()[0];
+    expect(call.argv).toEqual(["secret", "set", "NPM_TOKEN"]);
+    // The security property this adapter exists to hold: a value in argv is
+    // readable by any process on the box via `ps`.
+    expect(call.argv.join(" ")).not.toContain(value);
+    expect(call.stdin.trim()).toBe(value);
+  });
+
+  it("deletes through `secret rm`", async () => {
+    installFakeSh1pt("");
+
+    const results = await sh1ptProvider.write({
+      endpoint: { provider: "sh1pt" },
+      upserts: {},
+      deletes: ["OLD_TOKEN"],
+      dryRun: false
+    });
+
+    expect(results).toEqual([{ key: "OLD_TOKEN", applied: true }]);
+    expect(calls()[0].argv).toEqual(["secret", "rm", "OLD_TOKEN"]);
+  });
+
+  it("a dry run touches nothing", async () => {
+    installFakeSh1pt("");
+
+    const results = await sh1ptProvider.write({
+      endpoint: { provider: "sh1pt" },
+      upserts: { A: "1" },
+      deletes: ["B"],
+      dryRun: true
+    });
+
+    expect(results).toEqual([
+      { key: "A", applied: false },
+      { key: "B", applied: false }
+    ]);
+    expect(calls()).toEqual([]);
+  });
+
+  it("reports a per-key failure instead of aborting the whole run", async () => {
+    installFakeSh1pt(`
+      if (process.argv[4] === "BAD") { process.stderr.write("vault rejected BAD"); process.exit(1); }
+    `);
+
+    const results = await sh1ptProvider.write({
+      endpoint: { provider: "sh1pt" },
+      upserts: { GOOD: "1", BAD: "2" },
+      deletes: [],
+      dryRun: false
+    });
+
+    expect(results.find((r) => r.key === "GOOD")?.applied).toBe(true);
+    const bad = results.find((r) => r.key === "BAD");
+    expect(bad?.applied).toBe(false);
+    expect(bad?.error).toMatch(/vault rejected BAD/);
+  });
+
+  it("rejects a malformed secret name before shelling out", async () => {
+    installFakeSh1pt("");
+
+    await expect(
+      sh1ptProvider.write({ provider: "sh1pt", endpoint: { provider: "sh1pt" }, upserts: { "not a key": "x" }, deletes: [], dryRun: false } as never)
+    ).rejects.toThrow(/not a valid sh1pt secret name/);
+    expect(calls()).toEqual([]);
+  });
+
+  it("explains how to fix a missing sh1pt CLI", async () => {
+    process.env.SH1PT_BIN = join(dir, "does-not-exist");
+
+    await expect(sh1ptProvider.inspect({ provider: "sh1pt" })).rejects.toThrow(/sh1pt CLI was not found on PATH/);
+  });
+});
diff --git a/plugins/credential-sharing/src/providers/sh1pt.ts b/plugins/credential-sharing/src/providers/sh1pt.ts
new file mode 100644
index 0000000..3a7f051
--- /dev/null
+++ b/plugins/credential-sharing/src/providers/sh1pt.ts
@@ -0,0 +1,156 @@
+/**
+ * sh1pt credential provider — the distribution-credential vault.
+ *
+ * Unlike every other adapter here, sh1pt is driven through its CLI rather than
+ * a REST call. That is not a shortcut: sh1pt publishes `sh1pt secret set|get|
+ * list|rm` as the interface to its cloud vault and documents no HTTP API for
+ * it, so the CLI *is* the contract. Auth comes from `sh1pt login`, which writes
+ * ~/.sh1pt/credentials; this adapter never handles a sh1pt token itself.
+ *
+ * The vault holds delivery credentials that Doppler/Railway/GitHub generally do
+ * not — App Store Connect keys, Play service accounts, npm and Docker tokens,
+ * Cloudflare tokens — which is exactly why it is worth syncing into.
+ *
+ * Values are written on STDIN, never as argv. `sh1pt secret set <key>` prompts
+ * for the value when it is omitted, and a secret passed as a command-line
+ * argument is world-readable in `ps` for the life of the process.
+ */
+import { execFile } from "node:child_process";
+import { keysFromNames } from "../fingerprint.js";
+import type { CredentialEndpoint, CredentialProvider, CredentialWriteResult } from "../types.js";
+
+/** The binary to invoke. Overridable so CI can point at a pinned build. */
+function sh1ptBin(): string {
+  return process.env.SH1PT_BIN || "sh1pt";
+}
+
+/**
+ * Secret names sh1pt will accept. We validate before shelling out: execFile
+ * does not use a shell, so this is not injection defence, it is a clear error
+ * instead of a confusing CLI usage failure on a malformed key.
+ */
+const SECRET_NAME = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+
+function assertSecretName(name: string): void {
+  if (!SECRET_NAME.test(name)) {
+    throw new Error(
+      `"${name}" is not a valid sh1pt secret name. Use letters, digits, underscore, dot or dash, starting with a letter or underscore.`
+    );
+  }
+}
+
+interface RunResult {
+  stdout: string;
+  stderr: string;
+}
+
+/**
+ * Run the sh1pt CLI. `stdin` is written to the child when provided, which is
+ * how secret values are handed over without ever appearing in the process
+ * table. Scoping flags come from the endpoint: `project` maps to sh1pt's
+ * project, `config` to its environment.
+ */
+function runSh1pt(args: string[], endpoint: CredentialEndpoint, stdin?: string): Promise<RunResult> {
+  const scoped = [...args];
+  if (endpoint.project) scoped.push("--project", endpoint.project);
+  if (endpoint.config) scoped.push("--env", endpoint.config);
+
+  return new Promise((resolve, reject) => {
+    const child = execFile(
+      sh1ptBin(),
+      scoped,
+      { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 },
+      (error, stdout, stderr) => {
+        if (error) {
+          const code = (error as NodeJS.ErrnoException).code;
+          if (code === "ENOENT") {
+            reject(
+              new Error(
+                `The sh1pt CLI was not found on PATH. Install it and run "sh1pt login", or set SH1PT_BIN to its path.`
+              )
+            );
+            return;
+          }
+          // stderr carries sh1pt's own message (not logged in, unknown project, …).
+          reject(new Error(`sh1pt ${scoped[0]} ${scoped[1] ?? ""} failed: ${(stderr || error.message).trim().slice(0, 300)}`));
+          return;
+        }
+        resolve({ stdout, stderr });
+      }
+    );
+    // Always close stdin, even with nothing to send. Leaving it open hangs any
+    // sh1pt subcommand that waits on input (a confirmation prompt, say) until
+    // the process is killed.
+    child.stdin?.end(stdin ?? "");
+  });
+}
+
+/**
+ * `sh1pt secret list` prints key names, one per line, and never values. We
+ * tolerate a decorated list (bullets, blank lines) but refuse anything with
+ * whitespace inside it, which would mean the output format changed under us.
+ */
+export function parseSecretList(stdout: string): string[] {
+  return stdout
+    .split("\n")
+    .map((line) => line.replace(/^[\s*\-•]+/, "").trim())
+    .filter((line) => line.length > 0 && SECRET_NAME.test(line));
+}
+
+export const sh1ptProvider: CredentialProvider = {
+  id: "sh1pt",
+  name: "sh1pt",
+  description: "Distribution credential vault (App Store, Play, npm, Docker, Cloudflare) via the sh1pt CLI.",
+  // readValues is false by design, not by omission: `sh1pt secret get` requires
+  // interactive confirmation, so it cannot be scripted. That also makes this a
+  // write-only target -- no rollback pre-image can be captured, same as
+  // github-secrets.
+  capabilities: { readValues: false, readNames: true, write: true, delete: true, rollback: false, audit: false },
+  authRequirements: ["sh1pt login"],
+  status: "available",
+
+  async inspect(endpoint) {
+    const { stdout } = await runSh1pt(["secret", "list"], endpoint);
+    return {
+      provider: "sh1pt",
+      endpoint,
+      valuesReadable: false,
+      keys: keysFromNames(parseSecretList(stdout)),
+      inspectedAt: new Date().toISOString()
+    };
+  },
+
+  async write({ endpoint, upserts, deletes, dryRun }) {
+    for (const key of [...Object.keys(upserts), ...deletes]) {
+      assertSecretName(key);
+    }
+
+    const results: CredentialWriteResult[] = [];
+    if (dryRun) {
+      return [
+        ...Object.keys(upserts).map((key) => ({ key, applied: false })),
+        ...deletes.map((key) => ({ key, applied: false }))
+      ];
+    }
+
+    // One invocation per key: the CLI has no bulk form, and a partial failure
+    // should report per-key rather than abort the whole run.
+    for (const [key, value] of Object.entries(upserts)) {
+      try {
+        await runSh1pt(["secret", "set", key], endpoint, `${value}\n`);
+        results.push({ key, applied: true });
+      } catch (error) {
+        results.push({ key, applied: false, error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    for (const key of deletes) {
+      try {
+        await runSh1pt(["secret", "rm", key], endpoint);
+        results.push({ key, applied: true });
+      } catch (error) {
+        results.push({ key, applied: false, error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    return results;
+  }
+};
diff --git a/plugins/credential-sharing/src/rekey.test.ts b/plugins/credential-sharing/src/rekey.test.ts
new file mode 100644
index 0000000..b960243
--- /dev/null
+++ b/plugins/credential-sharing/src/rekey.test.ts
@@ -0,0 +1,170 @@
+import { describe, expect, it } from "vitest";
+import {
+  generateIdentityKeyPair,
+  generateVaultKey,
+  encryptValue,
+  decryptValue,
+  wrapVaultKey,
+  unwrapVaultKey,
+  type IdentityKeyPair
+} from "./crypto.js";
+import { fingerprintValue } from "./fingerprint.js";
+import { planVaultRekey, type RekeyMember, type SealedSecret } from "./rekey.js";
+
+/** Build a vault sealed under a fresh DEK, plus a grant for each holder. */
+async function makeVault(values: Record<string, string>, holders: IdentityKeyPair[]) {
+  const dek = await generateVaultKey();
+  const secrets: SealedSecret[] = [];
+  for (const [name, value] of Object.entries(values)) {
+    const sealed = await encryptValue(value, dek);
+    secrets.push({ name, nonce: sealed.nonce, ciphertext: sealed.ciphertext, fingerprint: fingerprintValue(value) });
+  }
+  const wrapped = await Promise.all(holders.map((h) => wrapVaultKey(dek, h.publicKey)));
+  return { dek, secrets, wrapped };
+}
+
+function member(email: string, keys: IdentityKeyPair | null, over: Partial<RekeyMember> = {}): RekeyMember {
+  return { email, publicKey: keys?.publicKey ?? null, status: "active", hasAccess: true, ...over };
+}
+
+describe("planVaultRekey", () => {
+  it("re-encrypts every secret under a new key without changing any value", async () => {
+    const me = await generateIdentityKeyPair();
+    const values = { API_KEY: "sk-live-abc123", DB_URL: "postgres://u:p@h/db" };
+    const { dek: oldDek, secrets, wrapped } = await makeVault(values, [me]);
+
+    const plan = await planVaultRekey({
+      myWrappedDek: wrapped[0],
+      identity: me,
+      secrets,
+      members: [member("me@example.com", me)]
+    });
+
+    // The new grant opens a DEK that is genuinely different...
+    const newDek = await unwrapVaultKey(plan.grants[0].wrappedDek, me);
+    expect(newDek).not.toBe(oldDek);
+
+    // ...and every value survives the trip unchanged.
+    for (const secret of plan.secrets) {
+      const roundTripped = await decryptValue({ nonce: secret.nonce, ciphertext: secret.ciphertext }, newDek);
+      expect(roundTripped).toBe(values[secret.name as keyof typeof values]);
+    }
+    // Fingerprints are the contract the server checks: same value, same print.
+    expect(plan.secrets.map((s) => s.fingerprint).sort()).toEqual(secrets.map((s) => s.fingerprint).sort());
+  });
+
+  it("makes the OLD key useless against the rotated ciphertext", async () => {
+    const me = await generateIdentityKeyPair();
+    const { dek: oldDek, secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me]);
+
+    const plan = await planVaultRekey({ myWrappedDek: wrapped[0], identity: me, secrets, members: [member("me@example.com", me)] });
+
+    // This is the entire point of rotating: a leaked old DEK buys nothing.
+    await expect(
+      decryptValue({ nonce: plan.secrets[0].nonce, ciphertext: plan.secrets[0].ciphertext }, oldDek)
+    ).rejects.toThrow();
+  });
+
+  it("drops a departed member, and their old grant no longer opens the vault", async () => {
+    const me = await generateIdentityKeyPair();
+    const leaver = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me, leaver]);
+    const leaverOldGrant = wrapped[1];
+
+    const plan = await planVaultRekey({
+      myWrappedDek: wrapped[0],
+      identity: me,
+      secrets,
+      // The leaver is still on the vault but is no longer an active member.
+      members: [member("me@example.com", me), member("leaver@example.com", leaver, { status: "invited" })]
+    });
+
+    expect(plan.grants.map((g) => g.email)).toEqual(["me@example.com"]);
+    expect(plan.revoked).toEqual(["leaver@example.com"]);
+
+    // The leaver's old grant still opens the OLD dek — but that dek is now
+    // worthless against the re-encrypted ciphertext.
+    const staleDek = await unwrapVaultKey(leaverOldGrant, leaver);
+    await expect(
+      decryptValue({ nonce: plan.secrets[0].nonce, ciphertext: plan.secrets[0].ciphertext }, staleDek)
+    ).rejects.toThrow();
+  });
+
+  it("--all keeps a non-active member who holds access", async () => {
+    const me = await generateIdentityKeyPair();
+    const other = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me, other]);
+
+    const plan = await planVaultRekey({
+      myWrappedDek: wrapped[0],
+      identity: me,
+      secrets,
+      members: [member("me@example.com", me), member("other@example.com", other, { status: "invited" })],
+      scope: "all"
+    });
+
+    expect(plan.grants.map((g) => g.email).sort()).toEqual(["me@example.com", "other@example.com"]);
+    expect(plan.revoked).toEqual([]);
+    // And the kept member can actually read the rotated vault.
+    const theirDek = await unwrapVaultKey(plan.grants.find((g) => g.email === "other@example.com")!.wrappedDek, other);
+    expect(await decryptValue({ nonce: plan.secrets[0].nonce, ciphertext: plan.secrets[0].ciphertext }, theirDek)).toBe("hunter2");
+  });
+
+  it("never drops a member silently when they have no key to re-seal to", async () => {
+    const me = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me]);
+
+    const plan = await planVaultRekey({
+      myWrappedDek: wrapped[0],
+      identity: me,
+      secrets,
+      members: [member("me@example.com", me), member("keyless@example.com", null)]
+    });
+
+    expect(plan.skipped).toEqual([{ email: "keyless@example.com", reason: "no public key on file" }]);
+    expect(plan.revoked).toContain("keyless@example.com");
+  });
+
+  it("refuses to rotate a vault into a state nobody can read", async () => {
+    const me = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me]);
+
+    await expect(
+      planVaultRekey({
+        myWrappedDek: wrapped[0],
+        identity: me,
+        secrets,
+        members: [member("me@example.com", me, { status: "invited" })]
+      })
+    ).rejects.toThrow(/no member would keep access/i);
+  });
+
+  it("aborts on a secret that does not decrypt rather than dropping it", async () => {
+    const me = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ GOOD: "value" }, [me]);
+    const corrupted = [...secrets, { name: "BAD", nonce: secrets[0].nonce, ciphertext: secrets[0].ciphertext.replace(/^./, "A"), fingerprint: fingerprintValue("x") }];
+
+    await expect(
+      planVaultRekey({ myWrappedDek: wrapped[0], identity: me, secrets: corrupted, members: [member("me@example.com", me)] })
+    ).rejects.toThrow(/did not decrypt|inconsistent/i);
+  });
+
+  it("aborts when a stored fingerprint disagrees with its ciphertext", async () => {
+    const me = await generateIdentityKeyPair();
+    const { secrets, wrapped } = await makeVault({ TOKEN: "hunter2" }, [me]);
+    const tampered = [{ ...secrets[0], fingerprint: fingerprintValue("something-else") }];
+
+    await expect(
+      planVaultRekey({ myWrappedDek: wrapped[0], identity: me, secrets: tampered, members: [member("me@example.com", me)] })
+    ).rejects.toThrow(/fingerprint/i);
+  });
+
+  it("rotates an empty vault without inventing secrets", async () => {
+    const me = await generateIdentityKeyPair();
+    const { wrapped } = await makeVault({}, [me]);
+
+    const plan = await planVaultRekey({ myWrappedDek: wrapped[0], identity: me, secrets: [], members: [member("me@example.com", me)] });
+    expect(plan.secrets).toEqual([]);
+    expect(plan.grants).toHaveLength(1);
+  });
+});
diff --git a/plugins/credential-sharing/src/rekey.ts b/plugins/credential-sharing/src/rekey.ts
new file mode 100644
index 0000000..ac8ff35
--- /dev/null
+++ b/plugins/credential-sharing/src/rekey.ts
@@ -0,0 +1,155 @@
+/**
+ * Vault re-keying (rotation) for LogicSRC team vaults.
+ *
+ * Re-keying replaces a vault's data-encryption key. Every secret is decrypted
+ * with the old DEK and re-encrypted under a new one, and the new DEK is sealed
+ * afresh to each member who should keep access. Secret VALUES never change --
+ * that is the whole point. Nothing downstream breaks; what changes is that
+ * every previously-issued wrapped DEK becomes useless, so anyone dropped from
+ * the grant list can no longer read the vault even if they kept a copy of their
+ * old grant.
+ *
+ * This module is deliberately pure: it takes the current sealed state plus the
+ * caller's identity and returns the complete next state. All of it runs on the
+ * member's machine -- the server receives ciphertext and sealed keys only, and
+ * never sees either DEK.
+ *
+ * Ordering matters and is NOT this module's problem: a half-applied rotation
+ * (new grants, old ciphertext, or the reverse) locks everyone out permanently,
+ * because the DEK is recoverable only through the grants. The server applies
+ * the result of `planVaultRekey` in a single transaction; see the
+ * /vaults/:id/rekey endpoint.
+ */
+import { decryptValue, encryptValue, generateVaultKey, unwrapVaultKey, wrapVaultKey, type IdentityKeyPair } from "./crypto.js";
+import { fingerprintValue, fingerprintsEqual } from "./fingerprint.js";
+
+/** A secret as the server stores it. */
+export interface SealedSecret {
+  name: string;
+  nonce: string;
+  ciphertext: string;
+  fingerprint: string;
+}
+
+/** A member who is a candidate to receive the new DEK. */
+export interface RekeyMember {
+  email: string;
+  /** X25519 public key, or null if they have never uploaded one. */
+  publicKey: string | null;
+  /** Team membership status. Only "active" members are kept by default. */
+  status: "active" | "invited";
+  /** Whether they hold a grant on this vault today. */
+  hasAccess: boolean;
+}
+
+export interface RekeyPlanInput {
+  /** The caller's own wrapped DEK, which bootstraps the whole operation. */
+  myWrappedDek: string;
+  /** The caller's identity keypair. */
+  identity: IdentityKeyPair;
+  /** Every secret currently in the vault. */
+  secrets: SealedSecret[];
+  /** Every team member, with their current access. */
+  members: RekeyMember[];
+  /**
+   * Who keeps access.
+   * - "active" (default): only members whose team status is "active" AND who
+   *   hold a grant today. This is the "someone left the team" rotation.
+   * - "all": everyone holding a grant today, whatever their status. Pure
+   *   crypto hygiene -- re-key without revoking anyone.
+   */
+  scope?: "active" | "all";
+}
+
+export interface RekeyPlan {
+  /** Re-encrypted secrets, ready to write. Values are identical to the input. */
+  secrets: SealedSecret[];
+  /** New sealed DEKs, one per retained member. */
+  grants: Array<{ email: string; wrappedDek: string }>;
+  /** Members whose access this rotation removes. */
+  revoked: string[];
+  /** Members skipped because they have no public key to seal to. */
+  skipped: Array<{ email: string; reason: string }>;
+}
+
+/** Members who have no key yet cannot be sealed to, whatever the scope. */
+function sealable(member: RekeyMember): boolean {
+  return typeof member.publicKey === "string" && member.publicKey.length > 0;
+}
+
+/**
+ * Build the complete next state of a vault under a fresh DEK.
+ *
+ * Throws rather than returning a partial plan: a rotation that silently dropped
+ * a secret it could not decrypt would destroy it on write.
+ */
+export async function planVaultRekey(input: RekeyPlanInput): Promise<RekeyPlan> {
+  const scope = input.scope ?? "active";
+
+  const oldDek = await unwrapVaultKey(input.myWrappedDek, input.identity);
+  const newDek = await generateVaultKey();
+
+  // Decrypt everything BEFORE encrypting anything. If one secret fails to open
+  // we abort with the vault untouched, rather than writing a half-rotated set.
+  const plaintext = new Map<string, string>();
+  for (const secret of input.secrets) {
+    let value: string;
+    try {
+      value = await decryptValue({ nonce: secret.nonce, ciphertext: secret.ciphertext }, oldDek);
+    } catch {
+      throw new Error(
+        `Cannot rotate: "${secret.name}" did not decrypt with your vault key. The vault may already be mid-rotation, or your grant is stale — re-run after a member with access re-grants you.`
+      );
+    }
+    // The fingerprint is a deterministic hash of the value, so a mismatch here
+    // means the stored row was already inconsistent. Refuse to propagate it.
+    if (!fingerprintsEqual(secret.fingerprint, fingerprintValue(value))) {
+      throw new Error(
+        `Cannot rotate: "${secret.name}" has a fingerprint that does not match its ciphertext. Refusing to re-encrypt a record that is already inconsistent.`
+      );
+    }
+    plaintext.set(secret.name, value);
+  }
+
+  const secrets: SealedSecret[] = [];
+  for (const secret of input.secrets) {
+    const value = plaintext.get(secret.name) as string;
+    const sealed = await encryptValue(value, newDek);
+    secrets.push({
+      name: secret.name,
+      nonce: sealed.nonce,
+      ciphertext: sealed.ciphertext,
+      // Unchanged by construction -- the value did not change. Recomputed
+      // rather than copied so a bug here surfaces as a server-side rejection.
+      fingerprint: fingerprintValue(value)
+    });
+  }
+
+  const grants: Array<{ email: string; wrappedDek: string }> = [];
+  const revoked: string[] = [];
+  const skipped: Array<{ email: string; reason: string }> = [];
+
+  for (const member of input.members) {
+    const keep = member.hasAccess && (scope === "all" || member.status === "active");
+    if (!keep) {
+      if (member.hasAccess) revoked.push(member.email);
+      continue;
+    }
+    if (!sealable(member)) {
+      // Holds access today but has no key to re-seal to. Rotating would cut
+      // them off silently, so surface it instead of burying it.
+      skipped.push({ email: member.email, reason: "no public key on file" });
+      revoked.push(member.email);
+      continue;
+    }
+    grants.push({ email: member.email, wrappedDek: await wrapVaultKey(newDek, member.publicKey as string) });
+  }
+
+  if (grants.length === 0) {
+    throw new Error(
+      "Cannot rotate: no member would keep access, which would make the vault permanently unreadable. Grant at least one active member with a registered key first."
+    );
+  }
+
+  return { secrets, grants, revoked, skipped };
+}
diff --git a/plugins/credential-sharing/src/types.ts b/plugins/credential-sharing/src/types.ts
index 655a95e..957d9d0 100644
--- a/plugins/credential-sharing/src/types.ts
+++ b/plugins/credential-sharing/src/types.ts
@@ -11,7 +11,7 @@ import type { LogicSrcPrincipal, LogicSrcPolicyDecision } from "@logicsrc/accoun
  * - Adapters declare read/write capabilities before a plan is generated.
  */
 
-export type CredentialProviderId = "env" | "doppler" | "railway" | "github-secrets" | (string & {});
+export type CredentialProviderId = "env" | "doppler" | "railway" | "github-secrets" | "sh1pt" | "team" | (string & {});
 
 export interface CredentialProviderCapabilities {
   /** Adapter can read raw secret values (enables value-level fingerprint diffs). */