Summary
The WASM Encryption factory (@cipherstash/stack/wasm-inline, 1.0.0-rc.1) hard-requires an explicit accessKey or authStrategy — resolveStrategy has no auto path (no CS_* env fallback chain ending in the ~/.cipherstash dev profile like the native entry has).
Impact
The credential-free developer story ("run npx stash auth login once, never touch raw credentials") does not extend to any WASM surface. In the 2026-07-16 skilltester eval, the Deno edge implementer could not run encrypt/decrypt locally without provisioning explicit CS_* credentials — flagged as a DX gap by both the implementer and the independent assessor.
Note the distinction: a production edge function legitimately configures explicit credentials/env. The gap is local development, where every other surface works off the CLI-managed device session.
Fix
Give the WASM factory the same strategy-resolution chain as the native entry where the environment allows (env vars at minimum; dev-profile where a filesystem exists — e.g. deno run locally), or provide an explicit documented dev-mode path.
Evidence: cipherstash/skilltester branch 20260716-01-claude, docs/evals/supabase-edge/2026-07-16-bug-wasm-inline-no-devprofile-auth.md.
Summary
The WASM
Encryptionfactory (@cipherstash/stack/wasm-inline, 1.0.0-rc.1) hard-requires an explicitaccessKeyorauthStrategy—resolveStrategyhas noautopath (noCS_*env fallback chain ending in the~/.cipherstashdev profile like the native entry has).Impact
The credential-free developer story ("run
npx stash auth loginonce, never touch raw credentials") does not extend to any WASM surface. In the 2026-07-16 skilltester eval, the Deno edge implementer could not run encrypt/decrypt locally without provisioning explicitCS_*credentials — flagged as a DX gap by both the implementer and the independent assessor.Note the distinction: a production edge function legitimately configures explicit credentials/env. The gap is local development, where every other surface works off the CLI-managed device session.
Fix
Give the WASM factory the same strategy-resolution chain as the native entry where the environment allows (env vars at minimum; dev-profile where a filesystem exists — e.g.
deno runlocally), or provide an explicit documented dev-mode path.Evidence: cipherstash/skilltester branch
20260716-01-claude,docs/evals/supabase-edge/2026-07-16-bug-wasm-inline-no-devprofile-auth.md.