@arcjet/bun 1.3.1 → 1.5.0

package/README.md

@@ -18,11 +18,31 @@
 
 [Arcjet][arcjet] is the runtime security platform that ships with your AI code. Stop bots and automated attacks from burning your AI budget, leaking data, or misusing tools with Arcjet's AI security building blocks. Every feature works with any Bun application.
 
-This is the [Arcjet][arcjet] SDK for [Bun][bun-sh].
+This is the [Arcjet][arcjet] SDK for [Bun][bun-sh] **request protection** —
+use it to protect HTTP route handlers and API endpoints. If you need to protect
+AI agent tool calls, MCP server handlers, or background jobs (anything without
+an HTTP request), see [`@arcjet/guard`](https://github.com/arcjet/arcjet-js/tree/main/arcjet-guard).
 
 ## Getting started
 
-1. Get your API key at [`app.arcjet.com`](https://app.arcjet.com)
+### Quick setup with an AI agent
+
+1. Log in with the CLI:
+   ```sh
+   npx @arcjet/cli auth login
+   ```
+2. Install the request protection skill to give your coding agent the docs it needs:
+   ```sh
+   npx skills add arcjet/skills --skill add-request-protection
+   ```
+3. Tell your agent what to protect — it handles the rest.
+
+### Manual setup
+
+1. **Log in** with the CLI (or at [`app.arcjet.com`](https://app.arcjet.com?utm_campaign=arcjet-js)):
+   ```sh
+   npx @arcjet/cli auth login
+   ```
 2. `bun add @arcjet/bun`
 3. Set `ARCJET_KEY=ajkey_yourkey` in your environment
 4. Add Arcjet to your server — see the [quick start](#quick-start) below
@@ -34,6 +54,23 @@ This is the [Arcjet][arcjet] SDK for [Bun][bun-sh].
 
 ## Features
 
+All features below are available with `@arcjet/bun` for request protection.
+For guard protection (tool calls, MCP servers, queues) see
+[`@arcjet/guard`](https://github.com/arcjet/arcjet-js/tree/main/arcjet-guard).
+
+| Feature                         | `@arcjet/bun` | `@arcjet/guard` |
+| ------------------------------- | :-----------: | :-------------: |
+| Rate Limiting                   |      ✅       |       ✅        |
+| Prompt Injection Detection      |      ✅       |       ✅        |
+| Sensitive Information Detection |      ✅       |       ✅        |
+| Bot Protection                  |      ✅       |        —        |
+| Shield WAF                      |      ✅       |        —        |
+| Email Validation                |      ✅       |        —        |
+| Signup Form Protection          |      ✅       |        —        |
+| Request Filters                 |      ✅       |        —        |
+| IP Analysis                     |      ✅       |        —        |
+| Custom Rules                    |       —       |       ✅        |
+
 - 🔒 [Prompt Injection Detection](#prompt-injection-detection) — detect and block
   prompt injection attacks before they reach your LLM.
 - 🤖 [Bot Protection](#bot-protection) — stop scrapers, credential stuffers, and
@@ -65,7 +102,7 @@ import { isSpoofedBot } from "@arcjet/inspect";
 import { env } from "bun";
 
 const aj = arcjet({
-  key: env.ARCJET_KEY!, // Get your site key from https://app.arcjet.com
+  key: env.ARCJET_KEY!, // Get your key with: npx @arcjet/cli sites get-key
   rules: [
     // Shield protects your app from common attacks e.g. SQL injection
     shield({ mode: "LIVE" }),
@@ -133,7 +170,7 @@ For the full reference, see the [Arcjet Bun SDK docs][arcjet-reference-bun].
 
 Detect and block prompt injection attacks — attempts to override your AI
 model's instructions — before they reach your model. Pass the user's message
-via `detectPromptInjectionMessage` on each `protect()` call. Tune sensitivity with the `threshold` parameter (0.0–1.0, default 0.5) — higher values are more conservative.
+via `detectPromptInjectionMessage` on each `protect()` call.
 
 ```ts
 import arcjet, { detectPromptInjection } from "@arcjet/bun";
@@ -144,7 +181,6 @@ const aj = arcjet({
   rules: [
     detectPromptInjection({
       mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
-      threshold: 0.5, // Score above which requests are blocked (default: 0.5)
     }),
   ],
 });

package/index.d.ts

@@ -1,4 +1,7 @@
 import type { ArcjetDecision, ArcjetOptions as CoreOptions, ArcjetRule, Primitive, Product, ExtraProps, CharacteristicProps } from "arcjet";
+import { type ProxyService } from "@arcjet/ip";
+export { cloudflare } from "@arcjet/ip";
+export type { ProxyService } from "@arcjet/ip";
 import type { Server } from "bun";
 export * from "arcjet";
 type Simplify<T> = {
@@ -60,8 +63,12 @@ export type ArcjetOptions<Rules extends [...Array<Primitive | Product>], Charact
     /**
      * IP addresses and CIDR ranges of trusted load balancers and proxies
      * (optional, example: `["100.100.100.100", "100.100.100.0/24"]`).
+     *
+     * Proxy services such as {@linkcode cloudflare} can also be included to read
+     * the real client IP from a service-specific header when the request comes
+     * from that service.
      */
-    proxies?: Array<string>;
+    proxies?: Array<string | ProxyService>;
 }>;
 /**
  * Instance of the Bun integration of Arcjet.

package/index.js

@@ -1,7 +1,8 @@
 import * as core from 'arcjet';
 import core__default from 'arcjet';
 export * from 'arcjet';
-import { parseProxy, findIp } from '@arcjet/ip';
+import { parseProxies, findIp } from '@arcjet/ip';
+export { cloudflare } from '@arcjet/ip';
 import { ArcjetHeaders } from '@arcjet/headers';
 import { env } from 'bun';
 import { readBodyWeb } from '@arcjet/body';
@@ -26,7 +27,7 @@ function createRemoteClient(options) {
     // Transport is the HTTP client that the client uses to make requests.
     const transport = createTransport(url);
     const sdkStack = "BUN";
-    const sdkVersion = "1.3.1";
+    const sdkVersion = "1.5.0";
     return createClient({
         transport,
         baseUrl: url,
@@ -59,7 +60,7 @@ function arcjet(options) {
             level: logLevel(env),
         });
     const proxies = Array.isArray(options.proxies)
-        ? options.proxies.map(parseProxy)
+        ? parseProxies(options.proxies)
         : undefined;
     if (isDevelopment(env)) {
         log.warn("Arcjet will use 127.0.0.1 when missing public IP address in development mode");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/bun",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Arcjet runtime security SDK for Bun — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF",
   "keywords": [
     "ai",
@@ -51,23 +51,23 @@
     "test": "npm run build && npm run lint"
   },
   "dependencies": {
-    "@arcjet/body": "1.3.1",
-    "@arcjet/env": "1.3.1",
-    "@arcjet/headers": "1.3.1",
-    "@arcjet/ip": "1.3.1",
-    "@arcjet/logger": "1.3.1",
-    "@arcjet/protocol": "1.3.1",
-    "@arcjet/transport": "1.3.1",
-    "arcjet": "1.3.1"
+    "@arcjet/body": "1.5.0",
+    "@arcjet/env": "1.5.0",
+    "@arcjet/headers": "1.5.0",
+    "@arcjet/ip": "1.5.0",
+    "@arcjet/logger": "1.5.0",
+    "@arcjet/protocol": "1.5.0",
+    "@arcjet/transport": "1.5.0",
+    "arcjet": "1.5.0"
   },
   "devDependencies": {
-    "@arcjet/eslint-config": "1.3.1",
-    "@arcjet/rollup-config": "1.3.1",
-    "@rollup/wasm-node": "4.59.0",
-    "bun-types": "1.3.10",
-    "eslint": "9.39.3",
+    "@arcjet/eslint-config": "1.5.0",
+    "@arcjet/rollup-config": "1.5.0",
+    "@rollup/wasm-node": "4.61.0",
+    "bun-types": "1.3.14",
+    "eslint": "9.39.4",
     "typescript": "5.9.3",
-    "undici-types": "7.22.0"
+    "undici-types": "7.27.0"
   },
   "publishConfig": {
     "access": "public",