perf(#6262): eliminate net/http and crypto from WASM build - #6264
perf(#6262): eliminate net/http and crypto from WASM build#6264fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
Remove net/http, crypto/tls, crypto/rsa, crypto/x509, and math/big from the mintcore WASM dependency tree. These packages contributed ~1.1 MB gzip to the binary via net/http's transitive crypto/tls dependency. The WASM binary drops from ~2.0 MB to ~1.3 MB gzip, well within the CF Workers free-tier 3 MiB limit and providing ample headroom for PR #6255 (mintcore handler unification). Architecture: - New Doer interface replaces HTTPDoer for transport-agnostic outbound HTTP (no net/http types). Non-WASM uses HTTPClientDoer wrapping http.Client; WASM uses HostFetchDoer calling JS fetch. - RSA operations (JWT signing, JWKS signature verification) are build-tagged: Go crypto on non-WASM (!js), host Web Crypto callbacks on WASM (js). HostCryptoSigner and HostCryptoVerifier parallel the existing HostFetchDoer/HostPEMAccessor pattern. - Handler.HandleRaw provides a net/http-free entry point used by cmd/mint-wasm; ServeHTTP wraps it on non-WASM via handler_http.go. - JWKSVerifier on WASM caches raw JWK entries (not *rsa.PublicKey) and delegates signature verification to the host. - Shared JWT parsing and claim validation extracted to jwt_parse.go. - Makefile wasm-build now uses -ldflags "-s -w" and hard-fails when gzip exceeds 3 MiB (was: warn at 3 MB, fail at 10 MB). - cmd/mint-wasm initMint now takes 5 args (added cryptoSign and cryptoVerify callbacks); Worker JS adapter must be updated. Before: 7.3 MB raw / 2.0 MB gzip (net/http + crypto/tls linked) After: 4.7 MB raw / 1.3 MB gzip (no net/http, crypto, or math/big) Closes #6262
|
🤖 Finished Review · ✅ Success · Started 6:37 PM UTC · Completed 6:56 PM UTC Commit: |
ReviewFindingsHigh
Medium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| if len(args) < 3 { | ||
| return "mintcoreInitMint requires 3 arguments: configJSON, fetchCallback, pemCallback" | ||
| if len(args) < 5 { | ||
| return "mintcoreInitMint requires 5 arguments: configJSON, fetchCallback, pemCallback, cryptoSignCallback, cryptoVerifyCallback" |
There was a problem hiding this comment.
[high] breaking-api-change
mintcoreInitMint changed from 3 arguments to 5. The CF Worker adapter (workersrc/src/index.ts) must be updated atomically — the old adapter will fail to initialize with the new WASM binary. The PR does not include the adapter update.
Suggested fix: Coordinate the CF Worker JS adapter update for simultaneous deployment, or document the deployment ordering in the PR body.
| ctx := context.Background() | ||
| status, respHeaders, respBody := handler.HandleRaw(ctx, method, path, headers, []byte(body)) | ||
|
|
||
| // Build response headers JSON. |
There was a problem hiding this comment.
[low] missing-size-limit
The WASM handleFetch path passes the request body to HandleRaw without size validation. The non-WASM ServeHTTP enforces a 64 KB limit. CF Workers impose their own limits, partially mitigating this.
| } | ||
|
|
||
| // Call the JS fetch callback synchronously via Await. | ||
| // Call the JS fetch callback synchronously via awaitPromise. |
There was a problem hiding this comment.
[low] unnecessary-complexity
marshalStringMap and escapeJSONString are custom JSON serializers whose comments claim to avoid importing encoding/json. However, encoding/json is already imported by shared files that compile for the js build — the package is in the WASM dependency tree regardless.
|
🤖 Finished Retro · ✅ Success · Started 9:41 PM UTC · Completed 9:56 PM UTC Commit: |
Retro: PR #6264 —
|
1 participant
Summary
Eliminate
net/http,crypto/tls,crypto/rsa,crypto/x509, andmath/bigfrom the mintcore WASM dependency tree. These packages contributed ~1.1 MB gzip to the binary vianet/http's transitivecrypto/tlsdependency. The WASM binary drops from ~2.0 MB to ~1.3 MB gzip (4.7 MB raw), well within the CF Workers free-tier 3 MiB limit and providing ample headroom for PR refactor(#812): unify mintcore handler construction via getEnv injection #6255.New
Doerinterface replacesHTTPDoerfor transport-agnostic outbound HTTP. Non-WASM usesHTTPClientDoerwrappinghttp.Client; WASM usesHostFetchDoercalling JS fetch — no*http.Request/*http.Responsetypes needed.RSA crypto offloaded to host Web Crypto on WASM. Build-tagged implementations: Go
crypto/rsaon non-WASM (!js),HostCryptoSigner/HostCryptoVerifieron WASM (js). JWT signing delegates tocrypto.subtle.sign, JWKS verification delegates tocrypto.subtle.verify.Handler.HandleRawprovides anet/http-free entry point used bycmd/mint-wasm;ServeHTTPwraps it on non-WASM platforms.Makefile
wasm-buildnow uses-ldflags "-s -w"and hard-fails when gzip exceeds 3 MiB (was: warn at 3 MB, fail only at 10 MB paid-tier limit).Size measurements
-s -w)-s -w)Breaking change:
cmd/mint-wasminit signaturemintcoreInitMintnow requires 5 arguments (was 3):The CF Worker adapter (
workersrc/src/index.ts) must be updated to pass the two new crypto callbacks that wrapcrypto.subtle.signandcrypto.subtle.verify.Test plan
go test ./internal/mintcore/... -race— all tests passgo test ./internal/dispatch/gcf/ -run TestEmbeddedMintSource— embed sync passesgo build ./...— full repo buildsgo vet ./internal/mintcore/...— no issuesGOOS=js GOARCH=wasm go build -ldflags "-s -w"succeeds, 1.28 MB gzipgo list -depsconfirms nonet/http,crypto/rsa,crypto/tls,math/bigindex.ts)🤖 Generated with Claude Code
Closes #6262
Post-script verification
agent/6262-wasm-size-reduction)dc87d7d6484555ba91661a3e94f126287a27246f..HEAD)