feat: re-add encrypted-file backend, fix body parsing, reframe messaging - #6
Merged
Conversation
Re-add encrypted-file keystore as explicit opt-in for cloud VMs:
- `amesh init --backend encrypted-file --passphrase <passphrase>`
- Auto-detected only when passphrase is provided and no hardware found
- CLI, SDK, and context all pass AUTH_MESH_PASSPHRASE through
Fix SDK body parsing footgun:
- Middleware now handles express.json(), express.text(), raw streams
- No longer requires express.text({ type: '*/*' }) workaround
- Buffers from stream if no body parser ran
Reframe messaging from "hardware-bound" to "device-bound":
- Landing page, README, protocol spec, guides, packaging
- Remove "key is in silicon", "signed by hardware" claims
- Add language limitation disclosure (TypeScript/Node.js)
- Remove Fastify from landing page CTA (doesn't exist yet)
- Remove "serverless" from protocol spec target user
- Fix ADR-003 note about encrypted-file removal
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--backend encrypted-file --passphrase) for cloud VMs and containers without hardware key storage. Hardware backends remain preferred when available.express.json(),express.text(), raw streams, and no body parser at all. No moreexpress.text({ type: '*/*' })workaround.Files changed (22)
Keystore:
detect.ts(add encrypted-file to StorageBackend, passphrase param),detect.test.ts(+2 tests),README.mdCLI:
init.ts(--passphrase flag, --backend encrypted-file, key rename),context.ts(pass AUTH_MESH_PASSPHRASE)SDK:
amesh.ts(keyAlias support, passphrase, getBody),middleware.ts(async getBody with stream/JSON/Buffer support),README.mdDocs: protocol-spec, guide, integration-guide, why-amesh, architecture-decisions, project-review
Site: app.html, +page.svelte, docs/+page.svelte
Packaging: nfpm.yaml, homebrew formula, release workflow
Test plan
bun run build— all 6 packages build cleanbun run test— 142 tests pass (including 2 new detect tests for encrypted-file)bun run lint— cleanamesh init --backend encrypted-file --passphrase teston a machine without TPM/Keychainamesh.verify()works withexpress.json()withoutexpress.text({ type: '*/*' })