@arcjet/bun 1.4.0 → 1.6.0

package/README.md

@@ -18,11 +18,31 @@
 
 [Arcjet][arcjet] is the runtime security platform that ships with your AI code. Stop bots and automated attacks from burning your AI budget, leaking data, or misusing tools with Arcjet's AI security building blocks. Every feature works with any Bun application.
 
-This is the [Arcjet][arcjet] SDK for [Bun][bun-sh].
+This is the [Arcjet][arcjet] SDK for [Bun][bun-sh] **request protection** —
+use it to protect HTTP route handlers and API endpoints. If you need to protect
+AI agent tool calls, MCP server handlers, or background jobs (anything without
+an HTTP request), see [`@arcjet/guard`](https://github.com/arcjet/arcjet-js/tree/main/arcjet-guard).
 
 ## Getting started
 
-1. Get your API key at [`app.arcjet.com`](https://app.arcjet.com)
+### Quick setup with an AI agent
+
+1. Log in with the CLI:
+   ```sh
+   npx @arcjet/cli auth login
+   ```
+2. Install the Arcjet skill to give your coding agent the docs it needs:
+   ```sh
+   npx skills add arcjet/skills
+   ```
+3. Tell your agent what to protect — it handles the rest.
+
+### Manual setup
+
+1. **Log in** with the CLI (or at [`app.arcjet.com`](https://app.arcjet.com?utm_campaign=arcjet-js)):
+   ```sh
+   npx @arcjet/cli auth login
+   ```
 2. `bun add @arcjet/bun`
 3. Set `ARCJET_KEY=ajkey_yourkey` in your environment
 4. Add Arcjet to your server — see the [quick start](#quick-start) below
@@ -34,6 +54,23 @@ This is the [Arcjet][arcjet] SDK for [Bun][bun-sh].
 
 ## Features
 
+All features below are available with `@arcjet/bun` for request protection.
+For guard protection (tool calls, MCP servers, queues) see
+[`@arcjet/guard`](https://github.com/arcjet/arcjet-js/tree/main/arcjet-guard).
+
+| Feature                         | `@arcjet/bun` | `@arcjet/guard` |
+| ------------------------------- | :-----------: | :-------------: |
+| Rate Limiting                   |      ✅       |       ✅        |
+| Prompt Injection Detection      |      ✅       |       ✅        |
+| Sensitive Information Detection |      ✅       |       ✅        |
+| Bot Protection                  |      ✅       |        —        |
+| Shield WAF                      |      ✅       |        —        |
+| Email Validation                |      ✅       |        —        |
+| Signup Form Protection          |      ✅       |        —        |
+| Request Filters                 |      ✅       |        —        |
+| IP Analysis                     |      ✅       |        —        |
+| Custom Rules                    |       —       |       ✅        |
+
 - 🔒 [Prompt Injection Detection](#prompt-injection-detection) — detect and block
   prompt injection attacks before they reach your LLM.
 - 🤖 [Bot Protection](#bot-protection) — stop scrapers, credential stuffers, and
@@ -65,7 +102,7 @@ import { isSpoofedBot } from "@arcjet/inspect";
 import { env } from "bun";
 
 const aj = arcjet({
-  key: env.ARCJET_KEY!, // Get your site key from https://app.arcjet.com
+  key: env.ARCJET_KEY!, // Get your key with: npx @arcjet/cli sites get-key
   rules: [
     // Shield protects your app from common attacks e.g. SQL injection
     shield({ mode: "LIVE" }),

package/index.d.ts

@@ -1,4 +1,7 @@
 import type { ArcjetDecision, ArcjetOptions as CoreOptions, ArcjetRule, Primitive, Product, ExtraProps, CharacteristicProps } from "arcjet";
+import { type ProxyService } from "@arcjet/ip";
+export { cloudflare } from "@arcjet/ip";
+export type { ProxyService } from "@arcjet/ip";
 import type { Server } from "bun";
 export * from "arcjet";
 type Simplify<T> = {
@@ -60,8 +63,12 @@ export type ArcjetOptions<Rules extends [...Array<Primitive | Product>], Charact
     /**
      * IP addresses and CIDR ranges of trusted load balancers and proxies
      * (optional, example: `["100.100.100.100", "100.100.100.0/24"]`).
+     *
+     * Proxy services such as {@linkcode cloudflare} can also be included to read
+     * the real client IP from a service-specific header when the request comes
+     * from that service.
      */
-    proxies?: Array<string>;
+    proxies?: Array<string | ProxyService>;
 }>;
 /**
  * Instance of the Bun integration of Arcjet.
@@ -90,7 +97,9 @@ export interface ArcjetBun<Props extends PlainObject> {
      *   Promise that resolves to an {@linkcode ArcjetDecision} indicating
      *   Arcjet’s decision about the request.
      */
-    protect(request: Request, ...properties: MaybeProperties<Props>): Promise<ArcjetDecision>;
+    protect(request: Request, ...properties: MaybeProperties<Props & {
+        correlationId?: string;
+    }>): Promise<ArcjetDecision>;
     /**
      * Augment the client with another rule.
      *

package/index.js

@@ -1,7 +1,8 @@
 import * as core from 'arcjet';
 import core__default from 'arcjet';
 export * from 'arcjet';
-import { parseProxy, findIp } from '@arcjet/ip';
+import { parseProxies, findIp } from '@arcjet/ip';
+export { cloudflare } from '@arcjet/ip';
 import { ArcjetHeaders } from '@arcjet/headers';
 import { env } from 'bun';
 import { readBodyWeb } from '@arcjet/body';
@@ -26,7 +27,7 @@ function createRemoteClient(options) {
     // Transport is the HTTP client that the client uses to make requests.
     const transport = createTransport(url);
     const sdkStack = "BUN";
-    const sdkVersion = "1.4.0";
+    const sdkVersion = "1.6.0";
     return createClient({
         transport,
         baseUrl: url,
@@ -59,7 +60,7 @@ function arcjet(options) {
             level: logLevel(env),
         });
     const proxies = Array.isArray(options.proxies)
-        ? options.proxies.map(parseProxy)
+        ? parseProxies(options.proxies)
         : undefined;
     if (isDevelopment(env)) {
         log.warn("Arcjet will use 127.0.0.1 when missing public IP address in development mode");
@@ -109,8 +110,11 @@ function arcjet(options) {
                 return withClient(client);
             },
             async protect(request, props) {
+                // `correlationId` is a request-independent option, not a rule prop, so
+                // pull it out before building the request from the rule properties.
+                const { correlationId, ...properties } = props ?? {};
                 // Cast of `{}` because here we switch from `undefined` to `Properties`.
-                const req = toArcjetRequest(request, props || {});
+                const req = toArcjetRequest(request, (properties || {}));
                 const getBody = async () => {
                     if (request.bodyUsed) {
                         throw new Error("Cannot read body: already read");
@@ -131,7 +135,7 @@ function arcjet(options) {
                     }
                     return readBodyWeb(clonedRequest.body, { expectedLength });
                 };
-                return aj.protect({ getBody }, req);
+                return aj.protect({ getBody }, { ...req, correlationId });
             },
             handler(fetch) {
                 return async function (request, server) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/bun",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Arcjet runtime security SDK for Bun — bot protection, rate limiting, prompt injection detection, PII blocking, and WAF",
   "keywords": [
     "ai",
@@ -51,23 +51,23 @@
     "test": "npm run build && npm run lint"
   },
   "dependencies": {
-    "@arcjet/body": "1.4.0",
-    "@arcjet/env": "1.4.0",
-    "@arcjet/headers": "1.4.0",
-    "@arcjet/ip": "1.4.0",
-    "@arcjet/logger": "1.4.0",
-    "@arcjet/protocol": "1.4.0",
-    "@arcjet/transport": "1.4.0",
-    "arcjet": "1.4.0"
+    "@arcjet/body": "1.6.0",
+    "@arcjet/env": "1.6.0",
+    "@arcjet/headers": "1.6.0",
+    "@arcjet/ip": "1.6.0",
+    "@arcjet/logger": "1.6.0",
+    "@arcjet/protocol": "1.6.0",
+    "@arcjet/transport": "1.6.0",
+    "arcjet": "1.6.0"
   },
   "devDependencies": {
-    "@arcjet/eslint-config": "1.4.0",
-    "@arcjet/rollup-config": "1.4.0",
-    "@rollup/wasm-node": "4.59.0",
-    "bun-types": "1.3.10",
-    "eslint": "9.39.3",
+    "@arcjet/eslint-config": "1.6.0",
+    "@arcjet/rollup-config": "1.6.0",
+    "@rollup/wasm-node": "4.62.2",
+    "bun-types": "1.3.14",
+    "eslint": "9.39.4",
     "typescript": "5.9.3",
-    "undici-types": "7.22.0"
+    "undici-types": "7.28.0"
   },
   "publishConfig": {
     "access": "public",