Summary
@cipherstash/stack/wasm-inline exposes no bulk operations. Decrypting an N-row list on the edge is N separate ZeroKMS calls, which defeats the bulk-speed property the native entry relies on and makes list endpoints impractical on Deno/Workers.
Source
rc.3 skilltester run (2026-07-19/20), finding M1 (major), supabase-edge surface. Measured alongside ~6.6s cold start and ~4.3MB inline WASM.
Verified in tree
Confirmed absent — packages/stack/src/wasm-inline.ts contains no occurrence of bulkDecrypt or bulkEncrypt (grep returns nothing). The native entry offers bulkEncrypt / bulkDecrypt / bulkEncryptModels / bulkDecryptModels; the WASM entry offers none of them.
This matters more than a missing convenience wrapper: per AGENTS.md, bulk operations are the documented way to exercise ZeroKMS bulk speed ("prefer bulk operations (bulkEncrypt* / bulkDecrypt*) to exercise ZeroKMS bulk speed"). The edge surface currently has no access to that path at all.
Impact
Any edge function rendering a list of encrypted rows pays one ZeroKMS round-trip per row. Combined with the cold-start cost, this is the difference between the WASM surface being viable for real read paths and being limited to single-record operations.
Proposed fix
Add bulkDecrypt / bulkEncrypt (and the *Models variants, for parity with the native entry) to the wasm-inline surface, so a list read is one call.
Related
Summary
@cipherstash/stack/wasm-inlineexposes no bulk operations. Decrypting an N-row list on the edge is N separate ZeroKMS calls, which defeats the bulk-speed property the native entry relies on and makes list endpoints impractical on Deno/Workers.Source
rc.3 skilltester run (2026-07-19/20), finding M1 (major),
supabase-edgesurface. Measured alongside ~6.6s cold start and ~4.3MB inline WASM.Verified in tree
Confirmed absent —
packages/stack/src/wasm-inline.tscontains no occurrence ofbulkDecryptorbulkEncrypt(grep returns nothing). The native entry offersbulkEncrypt/bulkDecrypt/bulkEncryptModels/bulkDecryptModels; the WASM entry offers none of them.This matters more than a missing convenience wrapper: per
AGENTS.md, bulk operations are the documented way to exercise ZeroKMS bulk speed ("prefer bulk operations (bulkEncrypt*/bulkDecrypt*) to exercise ZeroKMS bulk speed"). The edge surface currently has no access to that path at all.Impact
Any edge function rendering a list of encrypted rows pays one ZeroKMS round-trip per row. Combined with the cold-start cost, this is the difference between the WASM surface being viable for real read paths and being limited to single-record operations.
Proposed fix
Add
bulkDecrypt/bulkEncrypt(and the*Modelsvariants, for parity with the native entry) to thewasm-inlinesurface, so a list read is one call.Related
wasm-inlineis not credential-free. Reopened separately; the two together are what make the edge surface hard to adopt.encryptQuerymissing on WASM) — searchable encryption now works on the edge, which is what makes the bulk gap the next thing in the way.