@arcjet/skills 1.12.0 → 1.14.0

package/dist/index.d.ts

@@ -3,18 +3,18 @@ import { VERSION } from "./version.js";
 /**
  * npm package name that TanStack Intent discovers as a skill source.
  */
-declare const PACKAGE_NAME: "@arcjet/skills";
+export declare const PACKAGE_NAME: "@arcjet/skills";
 /**
  * Leaf skill names shipped in this package. Each matches
  * `skills/<name>/SKILL.md`.
  */
-type SkillName = "choose-protections" | "cli" | "guard" | "mcp" | "protect";
+export type SkillName = "choose-protections" | "cli" | "guard" | "mcp" | "protect";
 /**
  * Static manifest for one shipped skill. Intent reads the `SKILL.md` files
  * themselves; this export is for TypeScript consumers who want identities
  * without scanning `node_modules`.
  */
-interface SkillManifest {
+export interface SkillManifest {
   readonly name: SkillName;
   /**
    * When to load this skill. Kept in sync with the `SKILL.md` description.
@@ -34,18 +34,18 @@ interface SkillManifest {
  * Skills shipped in this package version. Load only the entry that matches
  * the current task (`@arcjet/skills#<name>`).
  */
-declare const skills: readonly SkillManifest[];
+export declare const skills: readonly SkillManifest[];
 /**
  * Format a TanStack Intent load identity (`@arcjet/skills#protect`).
  */
-declare function skillIdentity(name: SkillName): string;
+export declare function skillIdentity(name: SkillName): string;
 /**
  * Look up one shipped skill by leaf name.
  */
-declare function getSkill(name: SkillName): SkillManifest | undefined;
+export declare function getSkill(name: SkillName): SkillManifest | undefined;
 /**
  * Package version these skills were published with.
  */
-declare function skillLibraryVersion(): string;
+export declare function skillLibraryVersion(): string;
 //#endregion
-export { PACKAGE_NAME, SkillManifest, SkillName, VERSION, getSkill, skillIdentity, skillLibraryVersion, skills };
+export { VERSION };

package/dist/index.js

@@ -11,7 +11,7 @@ const PACKAGE_NAME = "@arcjet/skills";
 const skills = [
 	{
 		name: "protect",
-		description: "Add Arcjet request protection to JavaScript and TypeScript HTTP handlers. Use when protecting Next.js, Express, Fastify, SvelteKit, Remix, Astro, Nuxt, Bun, Deno, NestJS, or Node.js routes with rate limiting, bot detection, Shield, email validation, or sensitive info detection.",
+		description: "Add Arcjet request protection to JavaScript and TypeScript HTTP handlers. Use when protecting Next.js, Express, Fastify, SvelteKit, Remix, React Router, Hono, Astro, Nuxt, Bun, Deno, NestJS, or Node.js routes with rate limiting, bot detection, Shield, email validation, or sensitive info detection.",
 		file: "skills/protect/SKILL.md",
 		sources: ["docs/protect.md"]
 	},

package/dist/version.d.ts

@@ -1,5 +1,4 @@
 //#region src/version.d.ts
 /** Package version. Updated by the release process. */
-declare const VERSION: string;
-//#endregion
-export { VERSION };
+export declare const VERSION: string;
+//#endregion

package/dist/version.js

@@ -1,5 +1,5 @@
 //#region src/version.ts
 /** Package version. Updated by the release process. */
-const VERSION = "1.12.0";
+const VERSION = "1.14.0";
 //#endregion
 export { VERSION };

package/docs/choose-protections.md

@@ -68,3 +68,10 @@ rate limiting.
 
 **Rule:** `filter` (request-based only). Can also be a remote rule via CLI or
 MCP.
+
+## Claude Code / Copilot (no application SDK)
+
+Not `protect()` or `@arcjet/guard`. Publish a coding-agent policy attached
+to **Execute on** (Tool call, Prompt, or Model switch) via `@arcjet/skills#mcp`, then
+install HTTP hooks from https://docs.arcjet.com/coding-agents. Copy the
+templates: the hook URL must not name a policy and must omit `?surface=`.

package/docs/guard.md

@@ -11,6 +11,10 @@ MCP server handlers, queue workers, and background jobs.
 The word "server" on MCP is misleading. MCP tools are invoked over stdio or
 SSE and do not receive an HTTP request.
 
+Claude Code / Copilot HTTP hooks are not `@arcjet/guard`. Author the
+policy via MCP and install hooks from https://docs.arcjet.com/coding-agents
+(omit `?surface=`). **Execute on** is Tool call, Prompt, or Model switch.
+
 ## Client
 
 ```ts
@@ -32,13 +36,15 @@ Declare rules at module scope so `.deniedResult(decision)` and
 Call `guard()` where you already know the operation. Hardcode the `label`.
 Do not interpolate names in a generic dispatcher.
 
-Labels are slugs: lowercase letters, digits, dash, and dot only; must start
-and end with a letter or digit; max 256 bytes. Use `tools.get-weather`, not
-`tools.get_weather`. Metadata keys may contain underscores; labels and
-rate-limit `bucket` names may not.
+Hardcode labels as slugs: lowercase letters, digits, `-`, `.`, and `_`
+(`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Prefer dash/dot in new labels. Do not interpolate user input. Check a label
+you build yourself with `validateGuardLabel` — a slug the service will not
+match reads as `ALLOW` with `hasFailedOpen()` false.
 
 ```ts
-const decision = await arcjet.guard("tools.get-weather", {
+const decision = await arcjet.guard({
+  label: "tools.get-weather",
   rules: [/* ... */],
   metadata: { user: { id: userId } },
 });
@@ -103,6 +109,7 @@ Prefer the versioned Guard namespaces over hand-wrapping every tool:
 | Google ADK JS | `@arcjet/guard/google-adk/v2` |
 | Strands Agents JS | `@arcjet/guard/strands-agents/v1` |
 | TanStack AI | `@arcjet/guard/tanstack-ai/v0` |
+| Cloudflare Think | `@arcjet/guard/cloudflare-think/v0` |
 
 Unversioned aliases do not resolve. Load the matching
 `@arcjet/guard#integrate-arcjet-guard-*` skill for the integration you are
@@ -114,8 +121,16 @@ Framework wrappers fail closed by default when Guard is unavailable. Core
 JS LangChain `createAgent` is `@arcjet/guard/langchain/v1`, not LangGraph.
 JS Google ADK is `guardPlugin` on the Runner — there is no `guardTool`.
 TanStack AI is `guardMiddleware` — do not use `guardTool` (an `execute`
-throw is swallowed). JS Strands Agents is official `@strands-agents/sdk`,
-not Python `strands`.
+throw is swallowed). Cloudflare Think is `guardHooks` on
+`beforeToolCall` — default DENY is substitute. JS Strands Agents is
+official `@strands-agents/sdk`, not Python `strands`.
+
+Every JS wrapper policy accepts optional `actor` and `inputs` (static values
+or a resolver over that adapter's native call — parsed input plus trusted
+runtime/context, like Vercel AI's `(input, ctx)`). Build each
+input with `policyInput` so a remote policy that declares those names can
+evaluate. Omit them and the remote policy has nothing to read — its rules do
+not fire.
 
 Every adapter uses one `ArcjetDenialResult` payload
 (`{ arcjetDenied: true, reason, message, retryable }`). Delivery is
@@ -123,7 +138,8 @@ per-framework: return the object (AI SDK, Mastra, OpenAI Agents, Genkit
 `toolResponse.output`, LangGraph, LangChain `guardTool`, Google ADK plugin
 dict, Strands `guardTool`); wrap it (Claude Agent SDK `isError: true`,
 LangChain `guardMiddleware` `ToolMessage`, Strands `guardHooks` cancel
-string, TanStack `onBeforeToolCall` skip); or throw `ArcjetDeniedError`
+string, TanStack `onBeforeToolCall` skip, Cloudflare Think
+`beforeToolCall` substitute); or throw `ArcjetDeniedError`
 (Eve, unless `onDeny: "result"`). A throw from a return-style adapter
 drops the fields.
 

package/docs/mcp.md

@@ -66,9 +66,12 @@ Add a custom connector named `Arcjet` with URL `https://api.arcjet.com/mcp`.
 
 OAuth. The first connection redirects to sign in with an Arcjet account.
 
+Agent registration (the agent registers for its own identity): follow https://arcjet.com/auth.md — do not invent that ceremony.
+
 ## Common workflows
 
 - Bootstrap: `list-teams` → `list-sites` → `get-site-key` → write `ARCJET_KEY`
 - Investigate: `analyze-traffic` → `list-requests` → `investigate-ip`
 - Remote rules: `create-rule` (DRY_RUN) → `get-dry-run-impact` → `promote-rule`
+- Guard policies: `list-guard-policies` → `describe-guard-policy` → `validate-guard-policy` → `put-guard-policy`. Authoring is MCP-only; the CLI has no policy commands. Application policies select by `label` / wrapper `action`. Coding-agent policies attach by **Execute on** (Tool call, Prompt, or Model switch), not by label. Install Claude Code / Copilot HTTP hooks from https://docs.arcjet.com/coding-agents — copy the templates. The hook URL must not name a policy and must omit `?surface=` (managed settings reach CLI, IDE, Desktop, and cloud; a hard-coded `cli` mislabels most traffic).
 - Briefing: `get-security-briefing`

package/docs/protect.md

@@ -156,9 +156,10 @@ values are rejected. Syntax validation does not prove provenance.
 Never silence an `unverified-header` warning by copying `X-Forwarded-For` (or
 another client-controlled header) into `ipSrc`. That relabels attacker input
 as trusted. Inspect representative requests with
-`client.clientIpDetails(request)` in `@arcjet/node`, or `findIpDetails()` /
-`resolveClientIp()` from `@arcjet/ip`. Check `ip`, `provenance`, `verified`,
-and `header`. These diagnostics do not consume the once-per-client warning.
+`aj.clientIpDetails(request)` on the constructed `@arcjet/node` client, or
+`findIpDetails()` / `resolveClientIp()` from `@arcjet/ip`. Check `ip`,
+`provenance`, `verified`, and `header`. These diagnostics do not consume
+the once-per-client warning.
 
 `protect()` accepts nested-JSON `metadata`. It does not affect fingerprinting.
 Do not put secrets or PII in it. When present, request decisions also expose

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcjet/skills",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Versioned Agent Skills for the Arcjet JavaScript SDK, shipped with TanStack Intent",
   "keywords": [
     "agent-skills",
@@ -56,9 +56,9 @@
     "test": "npm run build && npm run test-coverage && npm run validate-skills && node ../.github/scripts/check-skill-source-stale.mjs"
   },
   "devDependencies": {
-    "@tanstack/intent": "0.3.8",
-    "@types/node": "22.20.1",
-    "tsdown": "0.22.14",
+    "@tanstack/intent": "0.4.0",
+    "@types/node": "22.20.4",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2"
   },
   "engines": {

package/skills/choose-protections/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.12.0" # x-release-please-version
+  library_version: "1.14.0" # x-release-please-version
 sources:
   - docs/choose-protections.md
 ---
@@ -42,3 +42,8 @@ entities never match without `backend: rampart()`.
 
 Remote bot and filter rules can be managed with the CLI or MCP without a
 redeploy — load `@arcjet/skills#cli` or `@arcjet/skills#mcp`.
+
+Claude Code / Copilot hooks are not this table. Publish a coding-agent
+policy via `@arcjet/skills#mcp` (**Execute on**: Tool call, Prompt, or
+Model switch) and install hooks from
+https://docs.arcjet.com/coding-agents (omit `?surface=`).

package/skills/cli/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.12.0" # x-release-please-version
+  library_version: "1.14.0" # x-release-please-version
 sources:
   - docs/cli.md
 ---

package/skills/guard/SKILL.md

@@ -2,12 +2,12 @@
 name: guard
 description: "Add Arcjet Guard to non-HTTP JavaScript: agent tool calls, MCP handlers, queue workers, and background jobs. Use when there is no HTTP request object, or when the user asks to guard tools, rate-limit agent actions, or block prompt injection on tool arguments."
 license: Apache-2.0
-compatibility: JavaScript and TypeScript apps using @arcjet/guard on Node.js >= 22.
+compatibility: JavaScript and TypeScript apps using @arcjet/guard on Node.js >=22.21.0 <23 || >=24.5.0.
 metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.12.0" # x-release-please-version
+  library_version: "1.14.0" # x-release-please-version
 sources:
   - docs/guard.md
 ---
@@ -20,8 +20,13 @@ and agent tool calls are Guard. HTTP routes are `@arcjet/skills#protect`.
 For a specific vendor SDK, load the matching skill from `@arcjet/guard`
 (`@arcjet/guard#integrate-arcjet-guard-agents`, `-eve`, `-mastra`,
 `-langgraph`, `-langchain`, `-openai-agents`, `-genkit`, `-google-adk`,
-`-strands-agents`, `-tanstack-ai`, `-claude-agent-sdk`,
-`-claude-managed-agents`).
+`-strands-agents`, `-tanstack-ai`, `-cloudflare-think`,
+`-claude-agent-sdk`, `-claude-managed-agents`).
+
+Claude Code / Copilot HTTP hooks are not this package. Publish a
+coding-agent policy via `@arcjet/skills#mcp` (**Execute on**: Tool call,
+Prompt, or Model switch) and install hooks from
+https://docs.arcjet.com/coding-agents (omit `?surface=`).
 
 ## Client
 
@@ -38,11 +43,14 @@ Declare rules at module scope so `.deniedResult(decision)` works.
 
 Hardcode the `label`. Do not interpolate in a generic dispatcher.
 
-Labels: lowercase letters, digits, `-`, `.` only; start and end with a letter
-or digit. `tools.get-weather`, not `tools.get_weather`.
+Hardcode labels as slugs: lowercase letters, digits, `-`, `.`, and `_`
+(`tools.get-weather`). Start and end with a letter or digit; max 256 bytes.
+Prefer dash/dot in new labels. Check a label you build yourself with
+`validateGuardLabel`.
 
 ```ts
-const decision = await arcjet.guard("tools.get-weather", {
+const decision = await arcjet.guard({
+  label: "tools.get-weather",
   rules: [/* ... */],
   metadata: { user: { id: userId } },
 });
@@ -77,6 +85,12 @@ Wrappers fail closed by default. HITL (`needsApproval`, `interrupt()`,
 `requireConfirmation`, `canUseTool`) is not a policy gate; Guard still runs
 after a human yes.
 
+Every wrapper policy accepts optional `actor` and `inputs` (static or a
+resolver over that adapter's native call — parsed input plus trusted
+runtime/context) so a remote policy that declares those names can evaluate. Build
+each input with `policyInput`. Omit them and the remote policy has nothing
+to read — its rules do not fire.
+
 Google ADK is `guardPlugin` (no `guardTool`). TanStack AI is
 `guardMiddleware` (do not wrap `execute`). LangChain `createAgent` is
 `/langchain/v1`, not LangGraph.

package/skills/mcp/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.12.0" # x-release-please-version
+  library_version: "1.14.0" # x-release-please-version
 sources:
   - docs/mcp.md
 ---
@@ -39,6 +39,13 @@ claude mcp add arcjet --transport http https://api.arcjet.com/mcp
 ```
 
 Bootstrap: `list-teams` → `list-sites` → `get-site-key` → write `ARCJET_KEY`.
+Agent identity (not human browser OAuth): follow https://arcjet.com/auth.md.
 Investigate: `analyze-traffic`, `list-requests`, `list-guards`,
 `investigate-ip`. Remote rules: `create-rule` (DRY_RUN) →
-`get-dry-run-impact` → `promote-rule`.
+`get-dry-run-impact` → `promote-rule`. Guard policies (MCP-only; no CLI
+commands): `list-guard-policies` → `describe-guard-policy` →
+`validate-guard-policy` → `put-guard-policy`. Application policies select by
+`label` / `action`. Coding-agent policies attach by **Execute on** (Tool call,
+Prompt, or Model switch). Install Claude Code / Copilot hooks from
+https://docs.arcjet.com/coding-agents — copy the templates. The hook URL
+must not name a policy and must omit `?surface=`.

package/skills/protect/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: protect
-description: Add Arcjet request protection to JavaScript and TypeScript HTTP handlers. Use when protecting Next.js, Express, Fastify, SvelteKit, Remix, Astro, Nuxt, Bun, Deno, NestJS, or Node.js routes with rate limiting, bot detection, Shield, email validation, or sensitive info detection.
+description: Add Arcjet request protection to JavaScript and TypeScript HTTP handlers. Use when protecting Next.js, Express, Fastify, SvelteKit, Remix, React Router, Hono, Astro, Nuxt, Bun, Deno, NestJS, or Node.js routes with rate limiting, bot detection, Shield, email validation, or sensitive info detection.
 license: Apache-2.0
 compatibility: JavaScript and TypeScript HTTP apps using an @arcjet/* framework adapter.
 metadata:
   author: arcjet
   type: core
   library: "@arcjet/skills"
-  library_version: "1.12.0" # x-release-please-version
+  library_version: "1.14.0" # x-release-please-version
 sources:
   - docs/protect.md
 ---
@@ -94,7 +94,7 @@ input as trusted.
 When no usable public address is available, adapters may fall back to
 forwarding headers and log one `unverified-header` warning per client.
 Configure `proxies` (or `cloudflare()`). Inspect with
-`clientIpDetails()` (`@arcjet/node`) or `findIpDetails()` /
+`aj.clientIpDetails(request)` (`@arcjet/node`) or `findIpDetails()` /
 `resolveClientIp()` (`@arcjet/ip`) before shipping.
 
 Nested `metadata` is for the Console — no secrets, no PII.