perf(wasm): Shrink the WebAssembly module by 81%

[benmandrew]

Summary

The optimised WebAssembly module drops from 25,059 to 4,833 bytes, or 9,659 to 2,933 gzipped. Two commits: the size work, and an independent build-time change that moves zero bytes.

Where the weight was

Attributing the code section by symbol, before any change:

Bucket	Bytes	Share
dlmalloc (allocator)	7,125	40.3%
fmt / panic machinery	4,746	26.9%
wasm-bindgen glue	2,715	15.4%
other / unnamed	2,363	13.4%
tiber AES core	548	3.1%
serde / serde-wasm-bindgen	173	1.0%

The AES implementation was 3% of its own binary. That reframed the problem: the wins were in what the module pulls in, not in how the AES code is compiled.

Steps

Stage	Raw
Original	25,059
wasm-release profile + explicit wasm-opt	19,910
talc replacing dlmalloc	12,858
-Cpanic=immediate-abort	4,833

Three details that are not obvious:

• opt-level = "z" is confined to a separate profile. In profile.release it would also apply to tiber and tiber-bench, costing native AES throughput.
• wasm-opt is invoked directly. wasm-pack bundles a binaryen too old to validate the memory.copy that opt-level = "z" emits, and it ignores package.metadata wasm-opt settings for custom profile names, so --no-opt plus an explicit call is the only route.
• -O beats -Oz here. -Oz measures 70 bytes larger on this module. Likewise panic = "abort" alone measures 68 bytes larger, so it is not set.

Verification

• All four NIST SP 800-38A AES-128 vectors, both directions, 11 rounds each.
• 50,000 encrypt/decrypt pairs against the new allocator, checked per iteration.
• cargo test --all-targets (62) and --no-default-features (44), make fmt-ci, make lint, make build-native, make site.
• Each commit builds and passes in isolation.

Trade-offs worth a reviewer's attention

build-wasm now needs nightly. -Cpanic=immediate-abort is unstable and was spelled -Zbuild-std-features=panic_immediate_abort until recently. flake.nix tracks a floating nightly, so a toolchain bump can rename it and break this target. Pinning a dated nightly would fix that, but the fuzz targets also use +nightly, so it belongs in its own change. Every other target stays on stable.

Panics are now bare traps, surfacing as RuntimeError: unreachable with no message. main.js:164 already rejects malformed keys and plaintext before calling in, so the site cannot reach one — but this is a debugging cost when extending the wasm API.

talc is a new dependency under key material. A hand-written bump allocator measured ~1 KB smaller and passed every functional test, and was rejected: resetting the bump pointer per call depends on no allocation outliving an exported call, which nothing enforces. Caching a key in a static — a change a reviewer would wave through — silently overwrote live key bytes with round-key material while the AES vectors kept passing. lol_alloc measured 679 bytes smaller than talc and clean, but its README opens with "I wrote lol_alloc to learn about allocators (I hadn't written one before)"; talc is actively maintained and ships wasm-specific size tuning.

Also fixed

tests/expect.rs shelled out to cargo build --bin tiber, which required-features breaks under --no-default-features. It now passes --features cli. Untouched, that test would have reported success whenever a stale binary happened to exist.

Rejected, with numbers

• Dropping serde for a flat Vec<u8> — 18,497 bytes (−7.1%) and −47% on the JS glue gzipped, but it makes the 176-byte layout an implicit contract between lib.rs and main.js.
• trim-paths / --remap-path-prefix — −132 bytes, fully subsumed by immediate-abort, which removes every path string anyway.
• Gating rayon — −1.0 s wall on its own; costs a shim module and a permanent 2× feature matrix.