@arcjet/astro 1.10.0 → 1.12.0

package/README.md

@@ -35,9 +35,9 @@ Your app's AI features and agents take real actions, calling tools, reading data
    ```sh
    npx @arcjet/cli auth login
    ```
-2. Install the Arcjet skill to give your coding agent the docs it needs:
+2. Install versioned Agent Skills so your coding agent matches this SDK:
    ```sh
-   npx skills add arcjet/skills
+   npx @tanstack/intent@latest install
    ```
 3. Tell your agent what to protect — it handles the rest.
 

package/dist/index.d.ts

@@ -334,7 +334,7 @@ type RemoteClientOptions = {
   /**
    * Timeout in milliseconds for the Decide API (optional).
    *
-   * Defaults to `500` in production and `1000` in development.
+   * Defaults to `2000` (2 seconds) to allow for API cold starts.
    */
   timeout?: number | undefined;
 };

package/dist/index.js

@@ -78,10 +78,7 @@ const validateProtectSignupOptions = z.object({
 	bots: validateBotOptions,
 	email: validateEmailOptions
 }).strict();
-const validateDetectPromptInjectionOptions = z.object({
-	mode: validateMode.optional(),
-	threshold: z.number().optional()
-}).strict();
+const validateDetectPromptInjectionOptions = z.object({ mode: validateMode.optional() }).strict();
 function validateAndSerialize(schema, value) {
 	const v = schema.parse(value);
 	return v ? JSON.stringify(v) : "";

package/dist/internal.d.ts

@@ -24,7 +24,7 @@ type RemoteClientOptions = {
   /**
    * Timeout in milliseconds for the Decide API (optional).
    *
-   * Defaults to `500` in production and `1000` in development.
+   * Defaults to `2000` (2 seconds) to allow for API cold starts.
    */
   timeout?: number;
 };

package/dist/internal.js

@@ -1,16 +1,16 @@
-import { findIp, parseProxies } from "@arcjet/ip";
+import { createClientIpDiagnostics, hasTrustAllProxy, parseProxies, resolveClientIp } from "@arcjet/ip";
 import { readBodyWeb } from "@arcjet/body";
 import { baseUrl, isDevelopment, logLevel, platform } from "@arcjet/env";
 import { ArcjetHeaders } from "@arcjet/headers";
 import { Logger } from "@arcjet/logger";
-import { createClient } from "@arcjet/protocol/client.js";
+import { createClient, resolveClientTimeout } from "@arcjet/protocol/client.js";
 import { createTransport } from "@arcjet/transport";
 import core from "arcjet";
 import { ARCJET_BASE_URL, ARCJET_ENV, ARCJET_KEY, ARCJET_LOG_LEVEL, FIREBASE_CONFIG, FLY_APP_NAME, RENDER, VERCEL } from "astro:env/server";
 export * from "arcjet";
 //#region src/internal.ts
 /** SDK version. Updated by the release process. */
-const VERSION = "1.10.0";
+const VERSION = "1.12.0";
 let warnedForAutomaticBodyRead = false;
 const ipSymbol = Symbol.for("arcjet.ip");
 const env = {
@@ -34,9 +34,10 @@ const env = {
 */
 function createRemoteClient(options) {
 	const url = options?.baseUrl ?? baseUrl(env);
-	const timeout = options?.timeout ?? (isDevelopment(env) ? 1e3 : 500);
+	const timeout = resolveClientTimeout(options?.timeout);
+	const transport = createTransport(url);
 	return createClient({
-		transport: createTransport(url),
+		transport,
 		baseUrl: url,
 		timeout,
 		sdkStack: "ASTRO",
@@ -59,6 +60,8 @@ function createArcjetClient(options) {
 	const client = options.client ?? createRemoteClient();
 	const log = options.log ? options.log : new Logger({ level: logLevel(env) });
 	const proxies = Array.isArray(options.proxies) ? parseProxies(options.proxies) : void 0;
+	const reportClientIp = createClientIpDiagnostics(log);
+	if (proxies && hasTrustAllProxy(proxies)) log.warn({ trustAll: true }, "Arcjet proxy configuration trusts an entire IP address family; use the narrowest proxy CIDRs possible.");
 	if (isDevelopment(process.env)) log.warn("Arcjet will use 127.0.0.1 when missing public IP address in development mode");
 	function toArcjetRequest(request, props, ipSrc) {
 		const clientAddress = ipSrc ? void 0 : Reflect.get(request, ipSymbol);
@@ -66,16 +69,21 @@ function createArcjetClient(options) {
 		const cookies = request.headers.get("cookie") ?? "";
 		const headers = new ArcjetHeaders(request.headers);
 		const url = new URL(request.url);
-		const xArcjetIp = isDevelopment(env) ? headers.get("x-arcjet-ip") : void 0;
-		let ip = ipSrc || xArcjetIp || findIp({
+		const ipDetails = resolveClientIp({
 			ip: clientAddress,
 			headers
 		}, {
+			development: isDevelopment(env),
+			ipSrc,
 			platform: platform(env),
 			proxies
 		});
-		if (ip === "") if (isDevelopment(env)) ip = "127.0.0.1";
-		else log.warn(`Client IP address is missing. If this is a dev environment set the ARCJET_ENV env var to "development"`);
+		reportClientIp(ipDetails);
+		let ip = ipDetails.ip;
+		if (ip === "") {
+			if (isDevelopment(env)) ip = "127.0.0.1";
+			else log.warn(`Client IP address is missing. If this is a dev environment set the ARCJET_ENV env var to "development"`);
+		}
 		return {
 			...props,
 			ip,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/astro",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "Arcjet runtime security SDK for Astro — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF",
   "keywords": [
     "ai",
@@ -62,18 +62,18 @@
     "test": "npm run build && npm run test-coverage"
   },
   "dependencies": {
-    "@arcjet/body": "1.10.0",
-    "@arcjet/env": "1.10.0",
-    "@arcjet/headers": "1.10.0",
-    "@arcjet/ip": "1.10.0",
-    "@arcjet/logger": "1.10.0",
-    "@arcjet/protocol": "1.10.0",
-    "@arcjet/transport": "1.10.0",
-    "arcjet": "1.10.0"
+    "@arcjet/body": "1.12.0",
+    "@arcjet/env": "1.12.0",
+    "@arcjet/headers": "1.12.0",
+    "@arcjet/ip": "1.12.0",
+    "@arcjet/logger": "1.12.0",
+    "@arcjet/protocol": "1.12.0",
+    "@arcjet/transport": "1.12.0",
+    "arcjet": "1.12.0"
   },
   "devDependencies": {
-    "astro": "7.1.0",
-    "tsdown": "0.22.7",
+    "astro": "7.2.2",
+    "tsdown": "0.22.14",
     "typescript": "7.0.2"
   },
   "peerDependencies": {