@arcjet/bun 1.11.0 → 1.13.0

package/README.md

@@ -35,9 +35,9 @@ Your app's AI features and agents take real actions, calling tools, reading data
    ```sh
    npx @arcjet/cli auth login
    ```
-2. Install the Arcjet skill to give your coding agent the docs it needs:
+2. Install versioned Agent Skills so your coding agent matches this SDK:
    ```sh
-   npx skills add arcjet/skills
+   npx @tanstack/intent@latest install
    ```
 3. Tell your agent what to protect — it handles the rest.
 

package/dist/index.d.ts

@@ -15,7 +15,7 @@ type MaybeProperties<T> = { [P in keyof T]?: T[P]; } extends T ? [properties?: T
 /**
  * Configuration for {@linkcode createRemoteClient}.
  */
-type RemoteClientOptions = {
+export type RemoteClientOptions = {
   /**
    * Base URI for HTTP requests to Decide API (optional).
    *
@@ -38,7 +38,7 @@ type RemoteClientOptions = {
  * @returns
  *   Client.
  */
-declare function createRemoteClient(options?: RemoteClientOptions): ReturnType<typeof createClient>;
+export declare function createRemoteClient(options?: RemoteClientOptions): ReturnType<typeof createClient>;
 /**
  * Configuration for the Bun integration of Arcjet.
  *
@@ -47,7 +47,7 @@ declare function createRemoteClient(options?: RemoteClientOptions): ReturnType<t
  * @template Characteristics
  *   Characteristics to track a user by.
  */
-type ArcjetOptions<Rules extends [...Array<Primitive | Product>], Characteristics extends readonly string[]> = Simplify<ArcjetOptions$1<Rules, Characteristics> & {
+export type ArcjetOptions<Rules extends [...Array<Primitive | Product>], Characteristics extends readonly string[]> = Simplify<ArcjetOptions$1<Rules, Characteristics> & {
   /**
    * IP addresses and CIDR ranges of trusted load balancers and proxies
    * (optional, example: `["100.100.100.100", "100.100.100.0/24"]`).
@@ -67,7 +67,7 @@ type ArcjetOptions<Rules extends [...Array<Primitive | Product>], Characteristic
  * @template Props
  *   Configuration.
  */
-interface ArcjetBun<Props extends PlainObject> {
+export interface ArcjetBun<Props extends PlainObject> {
   /**
    * Make a decision about how to handle a request.
    *
@@ -129,6 +129,6 @@ interface ArcjetBun<Props extends PlainObject> {
  * @returns
  *   Bun integration of Arcjet.
  */
-declare function arcjet<const Rules extends (Primitive | Product)[], const Characteristics extends readonly string[]>(options: ArcjetOptions<Rules, Characteristics>): ArcjetBun<ExtraProps<Rules> & CharacteristicProps<Characteristics>>;
+export default function arcjet<const Rules extends (Primitive | Product)[], const Characteristics extends readonly string[]>(options: ArcjetOptions<Rules, Characteristics>): ArcjetBun<ExtraProps<Rules> & CharacteristicProps<Characteristics>>;
 //#endregion
-export { ArcjetBun, ArcjetOptions, type ProxyService, RemoteClientOptions, cloudflare, createRemoteClient, arcjet as default };
+export { type ProxyService, cloudflare };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { cloudflare, findIp, parseProxies } from "@arcjet/ip";
+import { cloudflare, createClientIpDiagnostics, hasTrustAllProxy, parseProxies, resolveClientIp } from "@arcjet/ip";
 import core from "arcjet";
 import { readBodyWeb } from "@arcjet/body";
 import { baseUrl, isDevelopment, logLevel, platform } from "@arcjet/env";
@@ -10,7 +10,7 @@ import { env } from "bun";
 export * from "arcjet";
 //#region src/index.ts
 /** SDK version. Updated by the release process. */
-const VERSION = "1.11.0";
+const VERSION = "1.13.0";
 let warnedForAutomaticBodyRead = false;
 /**
 * Create a remote client.
@@ -49,19 +49,24 @@ function arcjet(options) {
 	const ipCache = /* @__PURE__ */ new WeakMap();
 	const log = options.log ? options.log : new Logger({ level: logLevel(env) });
 	const proxies = Array.isArray(options.proxies) ? parseProxies(options.proxies) : void 0;
+	const reportClientIp = createClientIpDiagnostics(log);
+	if (proxies && hasTrustAllProxy(proxies)) log.warn({ trustAll: true }, "Arcjet proxy configuration trusts an entire IP address family; use the narrowest proxy CIDRs possible.");
 	if (isDevelopment(env)) log.warn("Arcjet will use 127.0.0.1 when missing public IP address in development mode");
 	function toArcjetRequest(request, props, ipSrc) {
 		const cookies = request.headers.get("cookie") ?? "";
 		const headers = new ArcjetHeaders(request.headers);
 		const url = new URL(request.url);
-		const xArcjetIp = isDevelopment(env) ? headers.get("x-arcjet-ip") : void 0;
-		let ip = ipSrc || xArcjetIp || findIp({
+		const ipDetails = resolveClientIp({
 			ip: ipCache.get(request),
 			headers
 		}, {
+			development: isDevelopment(env),
+			ipSrc,
 			platform: platform(env),
 			proxies
 		});
+		reportClientIp(ipDetails);
+		let ip = ipDetails.ip;
 		if (ip === "") {
 			if (isDevelopment(env)) ip = "127.0.0.1";
 			else log.warn(`Client IP address is missing. If this is a dev environment set the ARCJET_ENV env var to "development"`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/bun",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "Arcjet runtime security SDK for Bun — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF",
   "keywords": [
     "ai",
@@ -59,20 +59,20 @@
     "test": "npm run build"
   },
   "dependencies": {
-    "@arcjet/body": "1.11.0",
-    "@arcjet/env": "1.11.0",
-    "@arcjet/headers": "1.11.0",
-    "@arcjet/ip": "1.11.0",
-    "@arcjet/logger": "1.11.0",
-    "@arcjet/protocol": "1.11.0",
-    "@arcjet/transport": "1.11.0",
-    "arcjet": "1.11.0"
+    "@arcjet/body": "1.13.0",
+    "@arcjet/env": "1.13.0",
+    "@arcjet/headers": "1.13.0",
+    "@arcjet/ip": "1.13.0",
+    "@arcjet/logger": "1.13.0",
+    "@arcjet/protocol": "1.13.0",
+    "@arcjet/transport": "1.13.0",
+    "arcjet": "1.13.0"
   },
   "devDependencies": {
-    "bun-types": "1.3.14",
-    "tsdown": "0.22.14",
+    "bun-types": "1.4.2",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2",
-    "undici-types": "7.29.0"
+    "undici-types": "7.29.1"
   },
   "engines": {}
 }