Module team 

Team vault — age-encrypted shared secret store for multi-user environments.

Team vaults use X25519 age encryption so each team member’s public key can decrypt the shared vault independently. Membership and key rotation are tracked in the vault’s metadata.

Functions

add_member

Add a recipient to a team vault. Re-wraps the DEK for all recipients (including the new one).

add_member_with_access_profile

Add a recipient to a team vault under an explicit access profile.

create_team_vault

Create a new team vault file encrypted to the given age recipient public keys. Returns the VaultFile and the randomly generated DEK (for the caller to use).

create_team_vault_with_access_profile

Create a new team vault file with an explicit access profile.

is_team_vault

Check if a vault is a team vault (has age recipients).

members

List the current team members (recipient public keys).

remove_member

Remove a recipient and re-key the vault (generate new DEK, re-encrypt all secrets). The removed member could have cached the old DEK, so all secrets must be re-encrypted.

remove_member_with_access_profile

Remove a recipient and re-key the vault under an explicit access profile.

unwrap_dek

Open a team vault by unwrapping the DEK with an age identity.