chore(guard): update protobuf by qw-in · Pull Request #5986 · arcjet/arcjet-js

qw-in · 2026-04-07T15:52:21Z

After experimental.1 decided it made sense to break the protobuf. This brings arcjet-js in line. It also drastically improves the jsdoc and fixes the types for custom local rules.

…ocs and tests - Namespace user data under `data:` in defineCustomRule config and input to avoid collision with reserved fields (mode, label, metadata) - Update metadata key constraints docs for capital letter support - Add default case to reasonFromProto for unknown proto enum values - Fix async evaluate test to actually be async - Clarify mixedRuleAllow mock handler doc comment - Update README getting started to show env var pattern - Expand test coverage with mixed-rule and multi-custom-rule e2e tests - Add new mock handlers: mixedRuleAllow, mixedRuleCustomDeny, multiCustomAllow

qw-in · 2026-04-08T16:02:38Z

Review: `chore(guard): update protobuf`

Summary

The PR aligns @arcjet/guard with the decide/v2 proto breaking changes from experimental.1, introduces a fully-typed defineCustomRule() API, and improves the public surface (docs, result inspection helpers).

Protobuf Changes

inputKey → inputKeyHash (all rate limit rules)
Correctly renamed in both the generated .js/.d.ts descriptor files and all callers in ruleBodyToProto. Tests verify the new field name.

New configBucket field
Optional on all three rate-limit config types; defaults correctly applied in ruleBodyToProto ("default-token-bucket", "default-fixed-window", "default-sliding-window"). These defaults are applied at proto conversion time, not stored on the config, so rule.config.bucket can be undefined — which is tested and expected.

GuardReason on GuardDecision
The old approach derived reason from the first DENY rule-result case in the SDK. Now the server sends it authoritatively as decision.reason. The new reasonFromProto() is clean, has a default case for future enum values (addressing Copilot's comment), and all 7 values are tested.

errors[] on GuardResponse
hasError() now also returns true when response.errors.length > 0, which is the right place to surface non-fatal validation errors without blocking the decision.

`defineCustomRule()` API

The three-level call chain (defineCustomRule({evaluate})({data})({data})) separates concerns cleanly:

Define — captures the typed evaluate function once
Configure — creates a module-scope config instance with a stable configId
Submit — creates a per-request input with a fresh inputId

Generic parameters TConfig, TInput, TData flow through end-to-end. The compile-time assertions in custom-rules.test.ts give strong confidence in the type narrowing.

One nit: The evaluate as unknown as CustomEvaluateFn cast is necessary and documented, but note that the internal CustomEvaluateFn type (the untyped one) is still exported. Since defineCustomRule wraps it, consumers shouldn't need the raw type — worth considering whether to un-export it in a follow-up.

`AbortSignal` Forwarding

Propagated from guard() → ruleToProto(rule, signal) → ruleBodyToProto(rule, signal) → evaluate(config, input, { signal }). The signal === undefined ? {} : { signal } pattern correctly avoids sending signal: undefined in the options object.

Result Inspection Symmetry

The PR adds results() to all RuleWithInput types (single-element or empty array) and result() to all RuleWithConfig types (first result, any conclusion). This makes the API table in the README accurate. One minor observation: results() on a RuleWithInput returning a [T] | [] array is somewhat odd compared to just using result(), but it's useful for iteration symmetry when writing generic code.

Potential Issues

reasonFromProto is called for every decision, including ALLOW. The returned value is only attached to the InternalDecision on DENY paths (correctly), but for ALLOW decisions GuardReason.UNSPECIFIED will return "UNKNOWN" and the value is discarded. This is fine as-is.
multiRuleAllow mock handler uses GuardRuleType.TOKEN_BUCKET for all submissions including custom rules. The new mixedRuleAllow properly handles this case. Tests use the right handler for the right scenario — no issue.
Metadata key constraints were relaxed in the docs (from "lowercase letters" to "ASCII letters"). This should be verified against the actual server-side validation to avoid users hitting unexpected rejections from the API if uppercase isn't actually accepted server-side.
localCustom function is fully removed from public exports ✓. LocalCustomConfig and LocalCustomInput remain as internal types used only within rules.ts.

Documentation

The README is substantially improved. The lifecycle section, anti-pattern (don't wrap launchArcjet() in a helper), bucket guidance, and three-level decision inspection table are all accurate.

Verdict

The implementation is correct and well-tested. All Copilot review comments from CI were resolved. The only actionable item is 3 above (verify server-side acceptance of uppercase metadata keys given the relaxed constraint docs). Everything else is clean.

qw-in · 2026-04-08T16:03:56Z

verify server-side acceptance of uppercase metadata keys given the relaxed constraint docs

This change is live

Automatically generated with [Release Please](https://github.com/googleapis/release-please). --- <details><summary>@arcjet/analyze: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/analyze-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/analyze:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/analyze-wasm bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/analyze-wasm: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/analyze-wasm-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * regenerate wasm binaries after aws-lc-rs update ([#5969](#5969)) ([bda5448](bda5448)) ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/astro: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/astro-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/body: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/body-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/body:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/bun: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/bun-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/cache: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/cache-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/cache:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/decorate: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/decorate-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/decorate:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/sprintf bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/deno: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/deno-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/cache bumped from 1.3.1 to 1.4.0 * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/duration: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/duration-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/duration:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/env: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/env-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/env:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/eslint-config: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/eslint-config-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/eslint-config:** Synchronize arcjet-js versions </details> <details><summary>@arcjet/fastify: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/fastify-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/cache bumped from 1.3.1 to 1.4.0 * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/guard: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/guard-v1.4.0) (2026-04-14) ### 🚀 New Features * **guard:** promote @arcjet/guard from experimental to stable release ([#5996](#5996)) ([f511f44](f511f44)) ### 📝 Documentation * add MCP server mentions to @arcjet/guard ([#5974](#5974)) ([cd398c0](cd398c0)) ### 🧹 Miscellaneous Chores * **guard:** add legacy type resolution for typescript@<=5 ([#5978](#5978)) ([fd6ad6d](fd6ad6d)) * **guard:** introduce arcjet guard js ([#5957](#5957)) ([53ff2e2](53ff2e2)) * **guard:** update protobuf ([#5986](#5986)) ([25f0e9e](25f0e9e)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/analyze bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/headers: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/headers-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/headers:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/inspect: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/inspect-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/inspect:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/ip: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/ip-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/ip:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/logger: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/logger-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/logger:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/sprintf bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/nest: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/nest-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * @arcjet/body bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/next: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/next-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/node: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/node-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * @arcjet/body bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/cache bumped from 1.3.1 to 1.4.0 * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/nuxt: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/nuxt-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/protocol: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/protocol-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) * **proto:** sync generated proto ([#5994](#5994)) ([25b11fe](25b11fe)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/cache bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/react-router: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/react-router-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/cache bumped from 1.3.1 to 1.4.0 * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/redact: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/redact-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/redact:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/redact-wasm bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/redact-wasm: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/redact-wasm-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * regenerate wasm binaries after aws-lc-rs update ([#5969](#5969)) ([bda5448](bda5448)) ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/remix: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/remix-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/rollup-config: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/rollup-config-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/rollup-config:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/runtime: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/runtime-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/runtime:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/sprintf: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/sprintf-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/sprintf:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/stable-hash: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/stable-hash-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/stable-hash:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/sveltekit: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/sveltekit-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/body bumped from 1.3.1 to 1.4.0 * @arcjet/env bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/ip bumped from 1.3.1 to 1.4.0 * @arcjet/logger bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/transport bumped from 1.3.1 to 1.4.0 * arcjet bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@arcjet/transport: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@arcjet/transport-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@arcjet/transport:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@nosecone/next: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@nosecone/next-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **@nosecone/next:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * dependencies * nosecone bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>@nosecone/sveltekit: 1.4.0</summary> ## [1.4.0](https://github.com/arcjet/arcjet-js/compare/v1.3.1...@nosecone/sveltekit-v1.4.0) (2026-04-14) ### 🔨 Build System * **deps-dev:** bump vite from 7.3.1 to 7.3.2 ([#5980](#5980)) ([8a253f6](8a253f6)) ### Dependencies * The following workspace dependencies were updated * dependencies * nosecone bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>arcjet: 1.4.0</summary> ## [1.4.0](v1.3.1...arcjet-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) ### Dependencies * The following workspace dependencies were updated * dependencies * @arcjet/analyze bumped from 1.3.1 to 1.4.0 * @arcjet/cache bumped from 1.3.1 to 1.4.0 * @arcjet/duration bumped from 1.3.1 to 1.4.0 * @arcjet/headers bumped from 1.3.1 to 1.4.0 * @arcjet/protocol bumped from 1.3.1 to 1.4.0 * @arcjet/runtime bumped from 1.3.1 to 1.4.0 * @arcjet/stable-hash bumped from 1.3.1 to 1.4.0 * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> <details><summary>1.4.0</summary> ## [1.4.0](v1.3.1...v1.4.0) (2026-04-14) ### 🚀 New Features * **guard:** promote @arcjet/guard from experimental to stable release ([#5996](#5996)) ([f511f44](f511f44)) ### 📝 Documentation * add @arcjet/guard documentation to root README ([#5993](#5993)) ([4be39c8](4be39c8)) * add MCP server mentions to @arcjet/guard ([#5974](#5974)) ([cd398c0](cd398c0)) ### 🧹 Miscellaneous Chores * add `.claude/` to .gitignore ([#5988](#5988)) ([6f0f922](6f0f922)) * always trigger workflows on release-please branch ([#5998](#5998)) ([6554cd1](6554cd1)) * delete astro-5 example ([#5995](#5995)) ([38487cb](38487cb)) * Deprecate `score` and `threshold` fields in `detectPromptInjection` ([#5987](#5987)) ([de46cb7](de46cb7)) * **examples:** Add Astro 5 example, upgrade main Astro example to v6 ([#5975](#5975)) ([a77c077](a77c077)) * **guard:** add legacy type resolution for typescript@<=5 ([#5978](#5978)) ([fd6ad6d](fd6ad6d)) * **guard:** introduce arcjet guard js ([#5957](#5957)) ([53ff2e2](53ff2e2)) * **guard:** update protobuf ([#5986](#5986)) ([25f0e9e](25f0e9e)) * **proto:** sync generated proto ([#5994](#5994)) ([25b11fe](25b11fe)) * regenerate wasm binaries after aws-lc-rs update ([#5969](#5969)) ([bda5448](bda5448)) ### 🔨 Build System * **deps-dev:** bump vite from 7.3.1 to 7.3.2 ([#5980](#5980)) ([8a253f6](8a253f6)) * **deps-dev:** bump vite from 7.3.1 to 7.3.2 in /examples/react-router ([#5982](#5982)) ([ddf3416](ddf3416)) * **deps-dev:** bump vite from 7.3.1 to 7.3.2 in /examples/react-router-middleware ([#5985](#5985)) ([e36cf35](e36cf35)) * **deps:** bump @nestjs/core from 11.1.17 to 11.1.18 in /examples/nestjs ([#5983](#5983)) ([514ae8b](514ae8b)) * **deps:** bump unhead and @unhead/vue in /examples/nuxt ([#5989](#5989)) ([6add894](6add894)) * **deps:** bump vite from 7.3.1 to 7.3.2 in /examples/nuxt ([#5981](#5981)) ([97138bc](97138bc)) * **deps:** bump vite in /examples/remix-express ([#5977](#5977)) ([3b97d6f](3b97d6f)) </details> <details><summary>nosecone: 1.4.0</summary> ## [1.4.0](v1.3.1...nosecone-v1.4.0) (2026-04-14) ### 🧹 Miscellaneous Chores * **nosecone:** Synchronize arcjet-js versions ### Dependencies * The following workspace dependencies were updated * devDependencies * @arcjet/eslint-config bumped from 1.3.1 to 1.4.0 * @arcjet/rollup-config bumped from 1.3.1 to 1.4.0 </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

qw-in added 4 commits April 6, 2026 18:26

chore(guard): update proto

3acde73

chore(guard): update proto & docs

c179dc4

chore(guard): proto update & custom rules

d97224b

Merge branch 'main' into quinn/update-guard-proto

df91f73

qw-in self-assigned this Apr 7, 2026

qw-in requested a review from Copilot April 7, 2026 16:24

Copilot started reviewing on behalf of qw-in April 7, 2026 16:25 View session

This comment was marked as outdated.

Sign in to view

qw-in added 2 commits April 7, 2026 21:05

chore(guard): bump version to 0.1.0-experimental.2

16a6efe

chore(guard): fmt & drop snake case

fc2a7e9

qw-in marked this pull request as ready for review April 8, 2026 16:07

qw-in requested a review from a team as a code owner April 8, 2026 16:07

davidmytton approved these changes Apr 8, 2026

View reviewed changes

qw-in added this pull request to the merge queue Apr 8, 2026

Merged via the queue into main with commit 25f0e9e Apr 8, 2026
53 checks passed

qw-in deleted the quinn/update-guard-proto branch April 8, 2026 16:38

github-actions bot mentioned this pull request Apr 8, 2026

chore: Release 1.4.0 #5972

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(guard): update protobuf#5986

chore(guard): update protobuf#5986
qw-in merged 7 commits intomainfrom
quinn/update-guard-proto

qw-in commented Apr 7, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

qw-in commented Apr 8, 2026 •

edited

Loading

Uh oh!

qw-in commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

qw-in commented Apr 7, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

qw-in commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review: chore(guard): update protobuf

Summary

Protobuf Changes

defineCustomRule() API

AbortSignal Forwarding

Result Inspection Symmetry

Potential Issues

Documentation

Verdict

Uh oh!

qw-in commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

qw-in commented Apr 8, 2026 •

edited

Loading

Review: `chore(guard): update protobuf`

`defineCustomRule()` API

`AbortSignal` Forwarding