Arcjet's Wasm bot detector was too large for Vercel's 1 MB Edge limit due to a Wizer-snapshotted RegexSet adding ~350 KB gzipped. The team discovered that 619 of 643 user-agent patterns were plain literals, not real regexes. By replacing the literal patterns with an Aho-Corasick automaton and keeping only 24 true regexes in a small RegexSet, the gzipped Wasm shrank from ~944 KB to ~689 KB — a 27% reduction. Crucially, the Wizer snapshot remained viable, eliminating per-request parser build cost (~0.03 ms vs ~2.3 ms) while preserving per-request Wasm instantiation for memory isolation. A fixed-width bitset records matches to prevent attacker-controlled CPU/memory blowup from repeated literals. The result is one unified artifact for JS, Python, and Go SDKs that is both faster and smaller without sacrificing security invariants.
