team_grant
Admit a principal by wrapping the current team data-encryption key to their pasted x25519 public key; they unwrap it on next sync pull. Optionally set access role; caller must be admin.
Instructions
Admit a principal to the team by wrapping the current team data-encryption key to their pasted x25519 public key. The grantee unwraps it on their next sync pull. Requires the caller to hold at least admin role. The optional role parameter sets the grantee's access level (default: member).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Access role to assign the grantee. Defaults to "member" when absent. | |
| label | No | Optional human label for local logging; never serialized into the synced recipients.jsonl. | |
| joinKey | Yes | The grantee's join-key blob (the opaque token from team_key / 'maz team key'). It carries their principal UID, wrap public key, and signing identity — this is the trust input; obtain it out of band. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| role | Yes | Effective access role assigned to the grantee. | |
| status | Yes | Always "granted" on success. | |
| dekEpoch | Yes | Highest (current) DEK epoch wrapped to the grantee. | |
| grantedEpochs | Yes | Every DEK epoch wrapped to the grantee (ascending). A full-history grant covers 0..dekEpoch; it is a subset only when this device lacks a prior epoch's DEK. | |
| granteePrincipalUid | Yes | Principal UID that was admitted. |