🚀[Feature]: `ContextVaults` - Multi-Vault Support for `Context` PowerShell Module

[MariusStorhaug]

1. Overview

This feature introduces first-class support for multiple named context vaults in the Context PowerShell module.
Each vault has its own encryption domain and isolated storage. Integrators (module authors) can onboard a vault simply by passing their module name as the -Vault parameter for all context-related commands.
All vaults and their data are stored under a fixed path:
$HOME/.contextvaults/Vaults/<VaultName>/

2. Goals

• Enable easy and isolated context storage for each PowerShell module or scenario.
• Simplify integrator experience: onboarding a new vault is as easy as passing a unique module name.
• Improve data security via per-vault encryption keys.
• Explicit and predictable: all context commands require the -Vault parameter to target a specific vault.
• Update the documentation in the readme.md with a desccription of the added functionality. Also update the description for integrators and how to set up a context vault for a new module.

3. Directory & Data Structure

$HOME/.contextvaults/
├── Vaults/
│   ├── <VaultName>/
│   │   ├── Context/
│   │   │   ├── <guid>.json
│   │   │   └── <guid2>.json
│   │   ├── shard
│   │   └── config.json
└── config.json

• Each vault is a subdirectory under Vaults/.
• Context data is stored as encrypted .json files (named by GUID) under the Context/ subfolder.
• Each vault has a shard file (encryption material) and a config.json (vault-specific metadata).
• Global config for the vault system is at $HOME/.contextvaults/config.json.
• No alternative storage location is supported.

4. Functional Requirements

4.1 Vault Management

Functionality	Description
Create vault	Create a new named vault at $HOME/.contextvaults/Vaults/<VaultName>/
List vaults	List all available vaults (names, metadata)
Remove vault	Delete an existing vault and all its context data
Rename vault	Change the name of an existing vault (and its directory)
Reset vault	Delete all contexts and reset encryption in a vault, preserving its config and name

4.2 Context Management

Functionality	Description
Set context	Store a new or update an existing context in the specified vault
Get context	Retrieve a context by ID from the specified vault
Remove context	Delete a context by ID from the specified vault
Move context	Move a context by ID from one vault to another

5. API/Commands

5.1 Vault Management (*-ContextVault)

• New-ContextVault

  New-ContextVault -Name "MyModule"

• Get-ContextVault

  Get-ContextVault

• Get-ContextVault (specific vault)

  Get-ContextVault -Name "MyModule"

• Remove-ContextVault

  Remove-ContextVault -Name "OldModule"

• Rename-ContextVault

  Rename-ContextVault -Name "OldModule" -NewName "NewModule"

• Reset-ContextVault

  Reset-ContextVault -Name "MyModule"

5.2 Context Management (*-Context)

• Set-Context

  Set-Context -ID "ApiKey" -Context @{<data>} -Vault "MyModule"

• Get-Context

  Get-Context -ID "ApiKey" -Vault "MyModule"

• Remove-Context

  Remove-Context -ID "ApiKey" -Vault "MyModule"

• Move-Context

  Move-Context -ID "ApiKey" -SourceVault "OldModule" -TargetVault "NewModule"

6. Security

• Each vault uses its own encryption key material (shard).
• Contexts are encrypted and cannot be decrypted outside their vault.
• No key sharing between vaults.
• Vault reset replaces encryption material and deletes all contexts in the vault.

7. Benefits

• Isolation: Every module or scenario can have its own secure vault.
• Simplicity: No key prefixing or manual context scoping—just use the -Vault parameter.
• Predictable & Explicit: No implicit/default vaults; all actions are explicit.
• Scalable: Designed for both simple and large/organizational use cases.

8. User experience

• Add argument completion for the -Name and -Vault parameter for *-Context functions and the -Name parameter for *-ContextVault functions.