keystead-core 0.4.3

What's new

• Vault device-key slot enrollment (core API). VaultHandle.addDeviceKey(devicePublicKey, context) wraps the current vault key for a device public key and appends a DEVICE slot to the vault header, so that device can thereafter unlock the vault without a passphrase. The data-encryption key is unchanged and no secret records are re-encrypted; existing slots are preserved. VaultHandle.removeDeviceKey(slotKeyId) revokes a device slot and refuses to remove the last remaining slot.

This is an additive API prerequisite for client-side OS-level device-key unlock (no behavioral change for existing vaults).

🤖 Generated with Claude Code