@arcjet/protocol - npm Package Compare versions

Comparing version 1.9.1 to 1.10.0-rc.0

dist/metadata.d.ts

+//#region src/metadata.d.ts
+/**
+ * Nested-JSON `metadata` encoding for `@arcjet/protocol`.
+ *
+ * `metadata` is a record of string keys to arbitrary JSON-serializable values
+ * (nested objects, arrays, numbers, booleans, `null`, strings). The wire format
+ * is `map<string, string>`: each **top-level** value is JSON-encoded
+ * independently and stored verbatim, so value formatting survives the round
+ * trip.
+ *
+ * Encoding is the SDK's only client-side responsibility here. The limits — 128
+ * top-level keys, 4 KiB per serialized value, 10 levels of nesting, and
+ * key-name validity — are enforced server-side (they are configurable per
+ * account and can be raised), and every key the server drops is recorded with
+ * the decision. The one drop the SDK must make itself is a value
+ * `JSON.stringify` cannot represent faithfully: `undefined`, a function, a
+ * symbol, a `BigInt`, a circular reference, or a non-finite number (`NaN`,
+ * `Infinity`). Those are dropped with an `AJ1017` warning
+ * reported to the server in `local_warnings` so the drop is never silent.
+ *
+ * Encoding never throws and never affects a decision: a bad value costs you
+ * that one key, not the call.
+ *
+ * `@arcjet/guard` carries a copy of this logic. The two packages are
+ * deliberately independent (guard vendors its own proto copy), so the
+ * duplication mirrors what is already there rather than adding a dependency.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Metadata for correlation and analytics: string keys mapped to any
+ * JSON-serializable value, including nested objects and arrays.
+ *
+ * Typed as `unknown` values rather than a recursive JSON type on purpose — a
+ * strict type rejects ordinary interfaces (they do not satisfy an index
+ * signature), which would make a fail-open field a compile error. Values that
+ * cannot be JSON-encoded are dropped at runtime with a warning instead.
+ *
+ * Two JavaScript-specific notes:
+ *
+ * - Numbers are IEEE-754 doubles, so an integer above `Number.MAX_SAFE_INTEGER`
+ *   loses precision before it reaches the wire. Pass such values as strings.
+ * - `BigInt` cannot be JSON-encoded and is dropped; convert it yourself.
+ */
+type ArcjetMetadata = Record<string, unknown>;
+/**
+ * A client-side validation warning reported to the server in `local_warnings`.
+ */
+interface LocalWarning {
+  /** Machine-readable code (currently always `"AJ1017"`). */
+  code: string;
+  /**
+   * Human-readable description. Names only the offending keys, never the
+   * values, and only after escaping and length-bounding them — warnings are
+   * persisted and reach application logs, so they must not become a PII sink or
+   * a log-forging vector.
+   */
+  message: string;
+}
+/** Warning code for a metadata key the SDK dropped before sending. */
+declare const METADATA_ENCODE_FAILED_CODE = "AJ1017";
+/**
+ * SDK-side ceiling on the total metadata bytes in one request.
+ *
+ * This is a **protocol** backstop, not a copy of the server's policy limits, and
+ * it is deliberately well above them: the server caps a metadata map at 128 keys
+ * of 4 KiB (~512 KiB) and those caps are per-account and can be raised, so the
+ * SDK must never pre-empt them.
+ *
+ * What it protects against is the one immutable limit: a request over 1 MiB is
+ * rejected outright, before any per-key validation runs. A rejected request means
+ * no decision, which means a fail open — so without this ceiling, oversized
+ * attacker-derived metadata could change the security outcome, contrary to the
+ * guarantee that metadata never affects a decision. Counted as UTF-8 bytes of
+ * keys plus JSON-encoded values before compression, so the estimate is
+ * conservative.
+ */
+declare const MAX_METADATA_BYTES: number;
+/**
+ * JSON-encode each top-level value of `metadata` for the wire.
+ *
+ * @param metadata
+ *   User-supplied nested metadata, or `undefined`.
+ * @param messagePrefix
+ *   Prepended to the warning message to identify the source (such as
+ *   `"rules[0]."`), matching the server's convention.
+ * @returns
+ *   `metadataJson` maps each surviving key to its JSON-encoded value, ready for
+ *   the proto `metadata_json` field. `localWarnings` holds **at most one** entry,
+ *   naming every key that had to be dropped, so one call can never flood the
+ *   warning channel. Both are empty when `metadata` is missing, empty, or not a
+ *   plain object.
+ */
+declare function encodeMetadata(metadata: ArcjetMetadata | undefined, messagePrefix?: string): {
+  metadataJson: Record<string, string>;
+  localWarnings: LocalWarning[];
+};
+/**
+ * Trim already-encoded metadata maps to {@linkcode MAX_METADATA_BYTES} in total.
+ *
+ * The maps are trimmed **in place**, in the order given, and within each map in
+ * insertion order: keys are kept until the running total would exceed the budget,
+ * and every key after that is dropped. Pass the request envelope's map first and
+ * each rule's map after it, so the order is stable across calls.
+ *
+ * One request can carry several metadata maps (a guard request has one per rule
+ * plus the envelope), so the ceiling has to be enforced across all of them rather
+ * than per map. See {@linkcode MAX_METADATA_BYTES} for why this exists at all.
+ *
+ * @param maps
+ *   Encoded metadata maps, in request order.
+ * @returns
+ *   At most one warning, naming the keys that were dropped.
+ */
+declare function enforceMetadataBudget(maps: ReadonlyArray<Record<string, string>>): LocalWarning[];
+//#endregion
+export { ArcjetMetadata, LocalWarning, MAX_METADATA_BYTES, METADATA_ENCODE_FAILED_CODE, encodeMetadata, enforceMetadataBudget };

dist/metadata.js

+//#region src/metadata.ts
+/** Warning code for a metadata key the SDK dropped before sending. */
+const METADATA_ENCODE_FAILED_CODE = "AJ1017";
+/** Longest key name echoed into a warning, matching the server's key cap. */
+const MAX_REPORTED_KEY_LENGTH = 64;
+/** Most key names listed in a single warning before the list is elided. */
+const MAX_REPORTED_KEYS = 10;
+/**
+* SDK-side ceiling on the total metadata bytes in one request.
+*
+* This is a **protocol** backstop, not a copy of the server's policy limits, and
+* it is deliberately well above them: the server caps a metadata map at 128 keys
+* of 4 KiB (~512 KiB) and those caps are per-account and can be raised, so the
+* SDK must never pre-empt them.
+*
+* What it protects against is the one immutable limit: a request over 1 MiB is
+* rejected outright, before any per-key validation runs. A rejected request means
+* no decision, which means a fail open — so without this ceiling, oversized
+* attacker-derived metadata could change the security outcome, contrary to the
+* guarantee that metadata never affects a decision. Counted as UTF-8 bytes of
+* keys plus JSON-encoded values before compression, so the estimate is
+* conservative.
+*/
+const MAX_METADATA_BYTES = 768 * 1024;
+/**
+* Whether `value` is a plain object usable as metadata.
+*
+* Arrays would encode as numeric string keys, and exotic objects (`Map`, `Date`,
+* class instances) yield no own enumerable entries, so metadata would be
+* silently ignored. Rejecting them up front keeps that from looking like it
+* worked.
+*/
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	try {
+		const prototype = Object.getPrototypeOf(value);
+		return prototype === Object.prototype || prototype === null;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether a code point must be escaped before it goes in a warning message.
+*
+* C0 controls, DEL, the C1 range, and the Unicode line/paragraph separators are
+* the characters that can break a log line or a JSON-ish log record. Everything
+* else, including ordinary non-ASCII text, is echoed as-is.
+*
+* Kept identical to `_needs_escape` in arcjet-py so both SDKs render the same
+* warning for the same key.
+*/
+function needsEscape(code) {
+	return code < 32 || code >= 127 && code <= 159 || code >= 55296 && code <= 57343 || code === 8232 || code === 8233;
+}
+/**
+* Render a metadata key for inclusion in a warning message.
+*
+* Keys are user-controlled, and warnings end up in application logs and in
+* server-side storage, so control characters are escaped (a newline in a key
+* could otherwise forge a log entry) and the result is length-bounded.
+*/
+function sanitizeKey(key) {
+	let escaped = "";
+	let length = 0;
+	for (const character of key) {
+		const code = character.codePointAt(0) ?? 0;
+		let token;
+		if (!needsEscape(code)) token = character;
+		else if (code <= 255) token = `\\x${code.toString(16).padStart(2, "0")}`;
+		else token = `\\u${code.toString(16).padStart(4, "0")}`;
+		const cost = needsEscape(code) ? token.length : 1;
+		if (length + cost > MAX_REPORTED_KEY_LENGTH) return `${escaped}...`;
+		escaped += token;
+		length += cost;
+	}
+	return escaped;
+}
+/**
+* `JSON.stringify` replacer that refuses values arcjet-py would refuse.
+*
+* - Non-finite numbers: `JSON.stringify` turns `NaN` and `Infinity` into `null`,
+*   silently changing the value. Throwing drops the key instead, matching
+*   arcjet-py's `json.dumps(allow_nan=False)`.
+* - Lone surrogates: not encodable as UTF-8, so arcjet-py drops the key rather
+*   than let protobuf raise. `\p{Surrogate}` with the `u` flag matches only lone
+*   surrogates, since a valid pair is a single code point.
+*
+* The replacer runs inside the serialization `JSON.stringify` already performs,
+* so this costs no extra traversal. It sees every key and value, including
+* nested ones.
+*/
+function rejectUnencodable(key, value) {
+	if (typeof value === "number" && !Number.isFinite(value)) throw new TypeError("non-finite number");
+	if (typeof value === "string" && loneSurrogate.test(value)) throw new TypeError("lone surrogate in value");
+	if (loneSurrogate.test(key)) throw new TypeError("lone surrogate in key");
+	return value;
+}
+/** Matches a surrogate not part of a valid pair (the `u` flag pairs them up). */
+const loneSurrogate = /\p{Surrogate}/u;
+/**
+* JSON-encode each top-level value of `metadata` for the wire.
+*
+* @param metadata
+*   User-supplied nested metadata, or `undefined`.
+* @param messagePrefix
+*   Prepended to the warning message to identify the source (such as
+*   `"rules[0]."`), matching the server's convention.
+* @returns
+*   `metadataJson` maps each surviving key to its JSON-encoded value, ready for
+*   the proto `metadata_json` field. `localWarnings` holds **at most one** entry,
+*   naming every key that had to be dropped, so one call can never flood the
+*   warning channel. Both are empty when `metadata` is missing, empty, or not a
+*   plain object.
+*/
+function encodeMetadata(metadata, messagePrefix = "") {
+	const encodedEntries = /* @__PURE__ */ new Map();
+	if (!isPlainObject(metadata)) return {
+		metadataJson: {},
+		localWarnings: []
+	};
+	const dropped = [];
+	let entries;
+	try {
+		entries = Object.entries(metadata);
+	} catch {
+		return {
+			metadataJson: {},
+			localWarnings: []
+		};
+	}
+	for (const [key, value] of entries) {
+		if (loneSurrogate.test(key)) {
+			dropped.push(sanitizeKey(key));
+			continue;
+		}
+		let encoded;
+		try {
+			encoded = JSON.stringify(value, rejectUnencodable);
+		} catch {
+			encoded = void 0;
+		}
+		if (typeof encoded === "string") encodedEntries.set(key, encoded);
+		else dropped.push(sanitizeKey(key));
+	}
+	const metadataJson = Object.fromEntries(encodedEntries);
+	if (dropped.length === 0) return {
+		metadataJson,
+		localWarnings: []
+	};
+	return {
+		metadataJson,
+		localWarnings: [{
+			code: METADATA_ENCODE_FAILED_CODE,
+			message: formatDropped(messagePrefix, "could not be JSON-encoded and were dropped", dropped)
+		}]
+	};
+}
+/** Render the key list for a warning, eliding once it gets long. */
+function formatDropped(prefix, reason, keys) {
+	let listed = keys.slice(0, MAX_REPORTED_KEYS).map(function(key) {
+		return `"${key}"`;
+	}).join(", ");
+	if (keys.length > MAX_REPORTED_KEYS) listed += ", ...";
+	return `${prefix}metadata: ${keys.length} key(s) ${reason}: ${listed}`;
+}
+/**
+* Trim already-encoded metadata maps to {@linkcode MAX_METADATA_BYTES} in total.
+*
+* The maps are trimmed **in place**, in the order given, and within each map in
+* insertion order: keys are kept until the running total would exceed the budget,
+* and every key after that is dropped. Pass the request envelope's map first and
+* each rule's map after it, so the order is stable across calls.
+*
+* One request can carry several metadata maps (a guard request has one per rule
+* plus the envelope), so the ceiling has to be enforced across all of them rather
+* than per map. See {@linkcode MAX_METADATA_BYTES} for why this exists at all.
+*
+* @param maps
+*   Encoded metadata maps, in request order.
+* @returns
+*   At most one warning, naming the keys that were dropped.
+*/
+function enforceMetadataBudget(maps) {
+	const encoder = new TextEncoder();
+	const dropped = [];
+	let total = 0;
+	for (const map of maps) {
+		const over = [];
+		for (const [key, value] of Object.entries(map)) {
+			if (total > 786432) {
+				over.push(key);
+				continue;
+			}
+			const size = encoder.encode(key).length + encoder.encode(value).length;
+			if (total + size > 786432) {
+				over.push(key);
+				total = 786433;
+				continue;
+			}
+			total += size;
+		}
+		for (const key of over) {
+			delete map[key];
+			dropped.push(sanitizeKey(key));
+		}
+	}
+	if (dropped.length === 0) return [];
+	return [{
+		code: METADATA_ENCODE_FAILED_CODE,
+		message: formatDropped("", `exceeded the ${MAX_METADATA_BYTES}-byte request metadata budget and were dropped`, dropped)
+	}];
+}
+//#endregion
+export { MAX_METADATA_BYTES, METADATA_ENCODE_FAILED_CODE, encodeMetadata, enforceMetadataBudget };

dist/client.d.ts

 import { ArcjetContext, ArcjetDecision, ArcjetRequestDetails, ArcjetRule, ArcjetStack } from "./index.js";
 import { Transport } from "@connectrpc/connect";
-
 //#region src/client.d.ts
@@ -17,12 +16,12 @@ interface Client {
 /**
-* Compute the timeout for a `Decide` request based on the configured rules.
-*
-* @internal Exported for testing only.
-* @param timeout
-*   Base timeout in milliseconds.
-* @param rules
-*   Rules that will be evaluated in this request.
-* @returns
-*   Adjusted timeout in milliseconds.
-*/
+ * Compute the timeout for a `Decide` request based on the configured rules.
+ *
+ * @internal Exported for testing only.
+ * @param timeout
+ *   Base timeout in milliseconds.
+ * @param rules
+ *   Rules that will be evaluated in this request.
+ * @returns
+ *   Adjusted timeout in milliseconds.
+ */
 declare function decideTimeout(timeout: number, rules: ArcjetRule[]): number;
@@ -29,0 +28,0 @@ declare function createClient(options: ClientOptions): Client;

dist/client.js

 import "./index.js";
 import { ArcjetDecisionFromProtocol, ArcjetDecisionToProtocol, ArcjetRuleToProtocol, ArcjetStackToProtocol } from "./convert.js";
+import { encodeMetadata, enforceMetadataBudget } from "./metadata.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient as createClient$1 } from "@connectrpc/connect";
-import { DecideRequestSchema, DecideService, ReportRequestSchema } from "./proto/decide/v1alpha1/decide_pb.js";
+import { DecideRequestSchema, DecideService, ReportRequestSchema, WarningSchema } from "./proto/decide/v1alpha1/decide_pb.js";
 //#region src/client.ts
+/**
+* Build the metadata and warning fields shared by the Decide and Report
+* requests, so a decision and its report describe the same metadata.
+*
+* The server enforces the count, size, depth, and key-name limits on what
+* survives. Neither the metadata nor the warnings can affect the decision.
+*/
+function requestFields(details, log) {
+	const encoded = encodeMetadata(details.metadata);
+	const warnings = [...encoded.localWarnings];
+	warnings.push(...enforceMetadataBudget([encoded.metadataJson]));
+	for (const warning of warnings) log.warn("%s", warning.message);
+	return {
+		metadataJson: encoded.metadataJson,
+		localWarnings: warnings.map(function(warning) {
+			return create(WarningSchema, warning);
+		})
+	};
+}
 function errorMessage(err) {
@@ -61,2 +81,3 @@ if (err) {
 				characteristics: context.characteristics,
+				...requestFields(details, log),
 				details: typeof details.email === "string" ? {
@@ -103,2 +124,3 @@ ...cleanDetails,
 				characteristics: context.characteristics,
+				...requestFields(details, log),
 				details: typeof details.email === "string" ? {
@@ -105,0 +127,0 @@ ...cleanDetails,

dist/convert.d.ts

 import { ArcjetConclusion, ArcjetDecision, ArcjetEmailType, ArcjetIpDetails, ArcjetMode, ArcjetReason, ArcjetRule, ArcjetRuleResult, ArcjetRuleState, ArcjetStack } from "./index.js";
 import { Conclusion, Decision, EmailType, IpDetails, Mode, Reason, Rule, RuleResult, RuleState, SDKStack } from "./proto/decide/v1alpha1/decide_pb.js";
-
 //#region src/convert.d.ts
@@ -5,0 +4,0 @@ declare function ArcjetModeToProtocol(mode: ArcjetMode): Mode;

dist/index.d.ts

@@ -0,571 +1,571 @@
+import { ArcjetMetadata } from "./metadata.js";
 import { ArcjetBotCategory, ArcjetWellKnownBot, categories } from "./well-known-bots.js";
 import { Cache } from "@arcjet/cache";
-
 //#region src/index.d.ts
-type RequiredProps<T, K extends keyof T> = { [P in K]-?: Exclude<T[P], undefined> };
+type RequiredProps<T, K extends keyof T> = { [P in K]-?: Exclude<T[P], undefined>; };
 /**
-* Mode of a rule.
-*/
+ * Mode of a rule.
+ */
 type ArcjetMode = "LIVE" | "DRY_RUN";
 /**
-* Names of different rate limit algorithms.
-*/
+ * Names of different rate limit algorithms.
+ */
 type ArcjetRateLimitAlgorithm = "TOKEN_BUCKET" | "FIXED_WINDOW" | "SLIDING_WINDOW";
 /**
-* Kinds of email addresses.
-*/
+ * Kinds of email addresses.
+ */
 type ArcjetEmailType = "DISPOSABLE" | "FREE" | "NO_MX_RECORDS" | "NO_GRAVATAR" | "INVALID";
 /**
-* Sensitive info identified by Arcjet.
-*/
+ * Sensitive info identified by Arcjet.
+ */
 type ArcjetIdentifiedEntity = {
   /**
-  * Start index into value.
-  */
+   * Start index into value.
+   */
   start: number;
   /**
-  * End index into value.
-  */
+   * End index into value.
+   */
   end: number;
   /**
-  * Kind of the identified entity.
-  */
+   * Kind of the identified entity.
+   */
   identifiedType: string;
 };
 /**
-* Names of integrations supported by Arcjet.
-*/
+ * Names of integrations supported by Arcjet.
+ */
 type ArcjetStack = "ASTRO" | "BUN" | "DENO" | "FASTIFY" | "NESTJS" | "NEXTJS" | "NODEJS" | "NUXT" | "REACT_ROUTER" | "REMIX" | "SVELTEKIT";
 /**
-* State of a rule after calling it.
-*/
+ * State of a rule after calling it.
+ */
 type ArcjetRuleState = "RUN" | "NOT_RUN" | "CACHED" | "DRY_RUN";
 /**
-* Conclusion of a rule after calling it.
-*/
+ * Conclusion of a rule after calling it.
+ */
 type ArcjetConclusion = "ALLOW" | "DENY" | "CHALLENGE" | "ERROR";
 /**
-* Kinds of sensitive info.
-*
-* The first four types — `"EMAIL"`, `"PHONE_NUMBER"`, `"IP_ADDRESS"`, and
-* `"CREDIT_CARD_NUMBER"` — are detected by the default WebAssembly backend
-* bundled with `@arcjet/analyze`.
-*
-* The remaining types are detected by alternative detection backends such as
-* `@arcjet/sensitive-info-rampart`, which runs an on-device named-entity
-* recognition model. They are recognized everywhere a sensitive info type is
-* accepted, but the default WebAssembly backend never emits them. The
-* `sensitiveInfo` rule and `@arcjet/guard` therefore reject a configuration
-* that lists one of these types without a supporting `backend`, rather than
-* silently never matching.
-*/
+ * Kinds of sensitive info.
+ *
+ * The first four types — `"EMAIL"`, `"PHONE_NUMBER"`, `"IP_ADDRESS"`, and
+ * `"CREDIT_CARD_NUMBER"` — are detected by the default WebAssembly backend
+ * bundled with `@arcjet/analyze`.
+ *
+ * The remaining types are detected by alternative detection backends such as
+ * `@arcjet/sensitive-info-rampart`, which runs an on-device named-entity
+ * recognition model. They are recognized everywhere a sensitive info type is
+ * accepted, but the default WebAssembly backend never emits them. The
+ * `sensitiveInfo` rule and `@arcjet/guard` therefore reject a configuration
+ * that lists one of these types without a supporting `backend`, rather than
+ * silently never matching.
+ */
 type ArcjetSensitiveInfoType = "EMAIL" | "PHONE_NUMBER" | "IP_ADDRESS" | "CREDIT_CARD_NUMBER" | "GIVEN_NAME" | "SURNAME" | "SSN" | "URL" | "TAX_ID" | "BANK_ACCOUNT" | "ROUTING_NUMBER" | "GOVERNMENT_ID" | "PASSPORT" | "DRIVERS_LICENSE" | "BUILDING_NUMBER" | "STREET_NAME" | "SECONDARY_ADDRESS" | "CITY" | "STATE" | "ZIP_CODE";
 /**
-* Reason returned by a rule.
-*/
+ * Reason returned by a rule.
+ */
 declare class ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type?: "RATE_LIMIT" | "BOT" | "EDGE_RULE" | "SHIELD" | "EMAIL" | "ERROR" | "FILTER" | "SENSITIVE_INFO" | "PROMPT_INJECTION_DETECTION" | undefined;
   /**
-  * Check if this reason is a sensitive info reason.
-  *
-  * @returns
-  *   Whether this reason is a sensitive info reason.
-  */
+   * Check if this reason is a sensitive info reason.
+   *
+   * @returns
+   *   Whether this reason is a sensitive info reason.
+   */
   isSensitiveInfo(): this is ArcjetSensitiveInfoReason;
   /**
-  * Check if this reason is a rate limit reason.
-  *
-  * @returns
-  *   Whether this reason is a rate limit reason.
-  */
+   * Check if this reason is a rate limit reason.
+   *
+   * @returns
+   *   Whether this reason is a rate limit reason.
+   */
   isRateLimit(): this is ArcjetRateLimitReason;
   /**
-  * Check if this reason is a bot reason.
-  *
-  * @returns
-  *   Whether this reason is a bot reason.
-  */
+   * Check if this reason is a bot reason.
+   *
+   * @returns
+   *   Whether this reason is a bot reason.
+   */
   isBot(): this is ArcjetBotReason;
   /**
-  * Check if this reason is an edge rule reason.
-  *
-  * @returns
-  *   Whether this reason is an edge rule reason.
-  */
+   * Check if this reason is an edge rule reason.
+   *
+   * @returns
+   *   Whether this reason is an edge rule reason.
+   */
   isEdgeRule(): this is ArcjetEdgeRuleReason;
   /**
-  * Check if this reason is a shield reason.
-  *
-  * @returns
-  *   Whether this reason is a shield reason.
-  */
+   * Check if this reason is a shield reason.
+   *
+   * @returns
+   *   Whether this reason is a shield reason.
+   */
   isShield(): this is ArcjetShieldReason;
   /**
-  * Check if this reason is an email reason.
-  *
-  * @returns
-  *   Whether this reason is an email reason.
-  */
+   * Check if this reason is an email reason.
+   *
+   * @returns
+   *   Whether this reason is an email reason.
+   */
   isEmail(): this is ArcjetEmailReason;
   /**
-  * Check if this reason is an error reason.
-  *
-  * @returns
-  *   Whether this reason is an error reason.
-  */
+   * Check if this reason is an error reason.
+   *
+   * @returns
+   *   Whether this reason is an error reason.
+   */
   isError(): this is ArcjetErrorReason;
   /**
-  * Check if this is a filter reason.
-  *
-  * @returns
-  *   Whether this is a filter reason.
-  */
+   * Check if this is a filter reason.
+   *
+   * @returns
+   *   Whether this is a filter reason.
+   */
   isFilter(): this is ArcjetFilterReason;
   /**
-  * Check if this is a prompt injection reason.
-  *
-  * @returns
-  *   Whether this is a prompt injection reason.
-  */
+   * Check if this is a prompt injection reason.
+   *
+   * @returns
+   *   Whether this is a prompt injection reason.
+   */
   isPromptInjection(): this is ArcjetPromptInjectionReason;
 }
 /**
-* Configuration for `ArcjetFilterReason`.
-*/
+ * Configuration for `ArcjetFilterReason`.
+ */
 interface ArcjetFilterReasonInit {
   /**
-  * Expression that matched.
-  */
+   * Expression that matched.
+   */
   matchedExpressions: Array<string>;
   /**
-  * Expression that could not be matched.
-  */
+   * Expression that could not be matched.
+   */
   undeterminedExpressions: Array<string>;
 }
 /**
-* Filter reason.
-*/
+ * Filter reason.
+ */
 declare class ArcjetFilterReason extends ArcjetReason {
   /**
-  * Expressions that matched.
-  */
+   * Expressions that matched.
+   */
   matchedExpressions: ArcjetFilterReasonInit["matchedExpressions"];
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "FILTER";
   /**
-  * Expression that could not be matched.
-  */
+   * Expression that could not be matched.
+   */
   undeterminedExpressions: ArcjetFilterReasonInit["undeterminedExpressions"];
   /**
-  * Create a filter reason.
-  *
-  * @param init
-  *   Expression that matched.
-  * @returns
-  *   Filter reason.
-  */
+   * Create a filter reason.
+   *
+   * @param init
+   *   Expression that matched.
+   * @returns
+   *   Filter reason.
+   */
   constructor(init: ArcjetFilterReasonInit);
 }
 /**
-* Configuration for `ArcjetPromptInjectionReason`.
-*/
+ * Configuration for `ArcjetPromptInjectionReason`.
+ */
 interface ArcjetPromptInjectionReasonInit {
   /**
-  * Whether a prompt injection attempt was detected in the input.
-  */
+   * Whether a prompt injection attempt was detected in the input.
+   */
   injectionDetected?: boolean | undefined;
   /**
-  * The prompt injection confidence score, scaled to [0, 1].
-  *
-  * @deprecated
-  *   This field is no longer respected by the server and will be removed in
-  *   a future release.
-  */
+   * The prompt injection confidence score, scaled to [0, 1].
+   *
+   * @deprecated
+   *   This field is no longer respected by the server and will be removed in
+   *   a future release.
+   */
   score?: number | undefined;
 }
 /**
-* Prompt injection reason.
-*/
+ * Prompt injection reason.
+ */
 declare class ArcjetPromptInjectionReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "PROMPT_INJECTION_DETECTION";
   /**
-  * Whether a prompt injection attempt was detected.
-  */
+   * Whether a prompt injection attempt was detected.
+   */
   injectionDetected: boolean;
   /**
-  * The prompt injection confidence score.
-  *
-  * @deprecated
-  *   This field is no longer respected by the server and will be removed in
-  *   a future release.
-  */
+   * The prompt injection confidence score.
+   *
+   * @deprecated
+   *   This field is no longer respected by the server and will be removed in
+   *   a future release.
+   */
   score?: number;
   /**
-  * Create a prompt injection reason.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Prompt injection reason.
-  */
+   * Create a prompt injection reason.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Prompt injection reason.
+   */
   constructor(init: ArcjetPromptInjectionReasonInit);
 }
 /**
-* Configuration for `ArcjetSensitiveInfoReason`.
-*/
+ * Configuration for `ArcjetSensitiveInfoReason`.
+ */
 interface ArcjetSensitiveInfoReasonInit {
   /**
-  * List of allowed entities.
-  */
+   * List of allowed entities.
+   */
   allowed: ArcjetIdentifiedEntity[];
   /**
-  * List of denied entities.
-  */
+   * List of denied entities.
+   */
   denied: ArcjetIdentifiedEntity[];
 }
 /**
-* Sensitive info reason.
-*/
+ * Sensitive info reason.
+ */
 declare class ArcjetSensitiveInfoReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "SENSITIVE_INFO";
   /**
-  * List of denied entities.
-  */
+   * List of denied entities.
+   */
   denied: ArcjetIdentifiedEntity[];
   /**
-  * List of allowed entities.
-  */
+   * List of allowed entities.
+   */
   allowed: ArcjetIdentifiedEntity[];
   /**
-  * Create an `ArcjetSensitiveInfoReason`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Sensitive info reason.
-  */
+   * Create an `ArcjetSensitiveInfoReason`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Sensitive info reason.
+   */
   constructor(init: ArcjetSensitiveInfoReasonInit);
 }
 /**
-* Configuration for `ArcjetRateLimitReason`.
-*/
+ * Configuration for `ArcjetRateLimitReason`.
+ */
 interface ArcjetRateLimitReasonInit {
   /**
-  * Maximum number of allowed requests.
-  */
+   * Maximum number of allowed requests.
+   */
   max: number;
   /**
-  * Remaining number of requests.
-  */
+   * Remaining number of requests.
+   */
   remaining: number;
   /**
-  * Time in seconds until reset.
-  */
+   * Time in seconds until reset.
+   */
   reset: number;
   /**
-  * Time in seconds until the window resets.
-  */
+   * Time in seconds until the window resets.
+   */
   window: number;
   /**
-  * Time when the rate limit resets.
-  */
+   * Time when the rate limit resets.
+   */
   resetTime?: Date | undefined;
 }
 /**
-* Rate limit reason.
-*/
+ * Rate limit reason.
+ */
 declare class ArcjetRateLimitReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "RATE_LIMIT";
   /**
-  * Maximum number of allowed requests.
-  */
+   * Maximum number of allowed requests.
+   */
   max: number;
   /**
-  * Remaining number of requests.
-  */
+   * Remaining number of requests.
+   */
   remaining: number;
   /**
-  * Time in seconds until reset.
-  */
+   * Time in seconds until reset.
+   */
   reset: number;
   /**
-  * Time in seconds until the window resets.
-  */
+   * Time in seconds until the window resets.
+   */
   window: number;
   /**
-  * Time when the rate limit resets.
-  */
+   * Time when the rate limit resets.
+   */
   resetTime?: Date | undefined;
   /**
-  * Create an `ArcjetRateLimitReason`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Rate limit reason.
-  */
+   * Create an `ArcjetRateLimitReason`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Rate limit reason.
+   */
   constructor(init: ArcjetRateLimitReasonInit);
 }
 /**
-* Configuration for `ArcjetBotReason`.
-*/
+ * Configuration for `ArcjetBotReason`.
+ */
 interface ArcjetBotReasonInit {
   /**
-  * List of allowed bot identifiers.
-  */
+   * List of allowed bot identifiers.
+   */
   allowed: Array<string>;
   /**
-  * List of denied bot identifiers.
-  */
+   * List of denied bot identifiers.
+   */
   denied: Array<string>;
   /**
-  * Whether the bot is verified.
-  */
+   * Whether the bot is verified.
+   */
   verified: boolean;
   /**
-  * Whether the bot is spoofed.
-  */
+   * Whether the bot is spoofed.
+   */
   spoofed: boolean;
 }
 /**
-* Bot reason.
-*/
+ * Bot reason.
+ */
 declare class ArcjetBotReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "BOT";
   /**
-  * List of allowed bot identifiers.
-  */
+   * List of allowed bot identifiers.
+   */
   allowed: Array<string>;
   /**
-  * List of denied bot identifiers.
-  */
+   * List of denied bot identifiers.
+   */
   denied: Array<string>;
   /**
-  * Whether the bot is verified.
-  */
+   * Whether the bot is verified.
+   */
   verified: boolean;
   /**
-  * Whether the bot is spoofed.
-  */
+   * Whether the bot is spoofed.
+   */
   spoofed: boolean;
   /**
-  * Create an `ArcjetBotReason`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Bot reason.
-  */
+   * Create an `ArcjetBotReason`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Bot reason.
+   */
   constructor(init: ArcjetBotReasonInit);
   /**
-  * Check if the bot is verified.
-  *
-  * @returns
-  *   Whether the bot is verified.
-  */
+   * Check if the bot is verified.
+   *
+   * @returns
+   *   Whether the bot is verified.
+   */
   isVerified(): boolean;
   /**
-  * Check if the bot is spoofed.
-  *
-  * @returns
-  *   Whether the bot is spoofed.
-  */
+   * Check if the bot is spoofed.
+   *
+   * @returns
+   *   Whether the bot is spoofed.
+   */
   isSpoofed(): boolean;
 }
 /**
-* Edge rule reason.
-*
-* @deprecated
-*   This reason is currently not used.
-*/
+ * Edge rule reason.
+ *
+ * @deprecated
+ *   This reason is currently not used.
+ */
 declare class ArcjetEdgeRuleReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "EDGE_RULE";
 }
 /**
-* Configuration for `ArcjetShieldReason`.
-*/
+ * Configuration for `ArcjetShieldReason`.
+ */
 interface ArcjetShieldReasonInit {
   /**
-  * Whether the shield was triggered.
-  */
+   * Whether the shield was triggered.
+   */
   shieldTriggered?: boolean | undefined;
 }
 /**
-* Shield reason.
-*/
+ * Shield reason.
+ */
 declare class ArcjetShieldReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "SHIELD";
   /**
-  * Whether the shield was triggered.
-  */
+   * Whether the shield was triggered.
+   */
   shieldTriggered: boolean;
   /**
-  * Create an `ArcjetShieldReason`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Shield reason.
-  */
+   * Create an `ArcjetShieldReason`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Shield reason.
+   */
   constructor(init: ArcjetShieldReasonInit);
 }
 /**
-* Configuration for `ArcjetEmailReason`.
-*/
+ * Configuration for `ArcjetEmailReason`.
+ */
 interface ArcjetEmailReasonInit {
   /**
-  * List of email types that are allowed.
-  */
+   * List of email types that are allowed.
+   */
   emailTypes?: ArcjetEmailType[] | undefined;
 }
 /**
-* Email reason.
-*/
+ * Email reason.
+ */
 declare class ArcjetEmailReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "EMAIL";
   /**
-  * List of email types that are allowed.
-  */
+   * List of email types that are allowed.
+   */
   emailTypes: ArcjetEmailType[];
   /**
-  * Create an `ArcjetEmailReason`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Email reason.
-  */
+   * Create an `ArcjetEmailReason`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Email reason.
+   */
   constructor(init: ArcjetEmailReasonInit);
 }
 /**
-* Error reason.
-*/
+ * Error reason.
+ */
 declare class ArcjetErrorReason extends ArcjetReason {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "ERROR";
   /**
-  * Error message.
-  */
+   * Error message.
+   */
   message: string;
   /**
-  * Create an `ArcjetErrorReason`.
-  *
-  * @param error
-  *   Error that occurred.
-  * @returns
-  *   Error reason.
-  */
+   * Create an `ArcjetErrorReason`.
+   *
+   * @param error
+   *   Error that occurred.
+   * @returns
+   *   Error reason.
+   */
   constructor(error: unknown);
 }
 /**
-* Configuration for `ArcjetRuleResult`.
-*/
+ * Configuration for `ArcjetRuleResult`.
+ */
 interface ArcjetRuleResultInit {
   /**
-  * Stable, deterministic, and unique identifier of the rule that generated
-  * this result.
-  */
+   * Stable, deterministic, and unique identifier of the rule that generated
+   * this result.
+   */
   ruleId: string;
   /**
-  * Fingerprint calculated for this rule, which can be used to cache the
-  * result for the amount of time specified by `ttl`.
-  */
+   * Fingerprint calculated for this rule, which can be used to cache the
+   * result for the amount of time specified by `ttl`.
+   */
   fingerprint: string;
   /**
-  * Duration in seconds this result should be considered valid, also known
-  * as time-to-live.
-  */
+   * Duration in seconds this result should be considered valid, also known
+   * as time-to-live.
+   */
   ttl: number;
   /**
-  * State of the rule.
-  */
+   * State of the rule.
+   */
   state: ArcjetRuleState;
   /**
-  * Conclusion of the rule.
-  */
+   * Conclusion of the rule.
+   */
   conclusion: ArcjetConclusion;
   /**
-  * Reason for the conclusion.
-  */
+   * Reason for the conclusion.
+   */
   reason: ArcjetReason;
 }
 /**
-* Result of calling a rule.
-*/
+ * Result of calling a rule.
+ */
 declare class ArcjetRuleResult {
   /**
-  * Stable, deterministic, and unique identifier of the rule that generated
-  * this result.
-  */
+   * Stable, deterministic, and unique identifier of the rule that generated
+   * this result.
+   */
   ruleId: string;
   /**
-  * Fingerprint calculated for this rule, which can be used to cache the
-  * result for the amount of time specified by `ttl`.
-  */
+   * Fingerprint calculated for this rule, which can be used to cache the
+   * result for the amount of time specified by `ttl`.
+   */
   fingerprint: string;
   /**
-  * Duration in seconds this result should be considered valid, also known
-  * as time-to-live.
-  */
+   * Duration in seconds this result should be considered valid, also known
+   * as time-to-live.
+   */
   ttl: number;
   /**
-  * State of the rule.
-  */
+   * State of the rule.
+   */
   state: ArcjetRuleState;
   /**
-  * Conclusion of the rule.
-  */
+   * Conclusion of the rule.
+   */
   conclusion: ArcjetConclusion;
   /**
-  * Reason for the conclusion.
-  */
+   * Reason for the conclusion.
+   */
   reason: ArcjetReason;
   /**
-  * Create an `ArcjetRuleResult`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Rule result.
-  */
+   * Create an `ArcjetRuleResult`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Rule result.
+   */
   constructor(init: ArcjetRuleResultInit);
   /**
-  * Check if the rule result is denied.
-  *
-  * @returns
-  *   Whether the rule result is denied.
-  */
+   * Check if the rule result is denied.
+   *
+   * @returns
+   *   Whether the rule result is denied.
+   */
   isDenied(): boolean;
 }
 /**
-* Configuration for `ArcjetIpDetails`.
-*/
+ * Configuration for `ArcjetIpDetails`.
+ */
 interface ArcjetIpDetailsInit {
@@ -597,460 +597,460 @@ latitude?: number | undefined;
 /**
-* Info about an IP address.
-*/
+ * Info about an IP address.
+ */
 declare class ArcjetIpDetails {
   /**
-  * Estimated latitude of the IP address within the `accuracyRadius` margin
-  * of error.
-  */
+   * Estimated latitude of the IP address within the `accuracyRadius` margin
+   * of error.
+   */
   latitude?: number | undefined;
   /**
-  * Estimated longitude of the IP address - see accuracy_radius for the
-  * margin of error.
-  */
+   * Estimated longitude of the IP address - see accuracy_radius for the
+   * margin of error.
+   */
   longitude?: number | undefined;
   /**
-  * Accuracy radius of the IP address location in kilometers.
-  */
+   * Accuracy radius of the IP address location in kilometers.
+   */
   accuracyRadius?: number | undefined;
   /**
-  * Timezone of the IP address.
-  */
+   * Timezone of the IP address.
+   */
   timezone?: string | undefined;
   /**
-  * Postal code of the IP address.
-  */
+   * Postal code of the IP address.
+   */
   postalCode?: string | undefined;
   /**
-  * City the IP address is located in.
-  */
+   * City the IP address is located in.
+   */
   city?: string | undefined;
   /**
-  * Region the IP address is located in.
-  */
+   * Region the IP address is located in.
+   */
   region?: string | undefined;
   /**
-  * Country code the IP address is located in.
-  */
+   * Country code the IP address is located in.
+   */
   country?: string | undefined;
   /**
-  * Country name the IP address is located in.
-  */
+   * Country name the IP address is located in.
+   */
   countryName?: string | undefined;
   /**
-  * Continent code the IP address is located in.
-  */
+   * Continent code the IP address is located in.
+   */
   continent?: string | undefined;
   /**
-  * Continent name the IP address is located in.
-  */
+   * Continent name the IP address is located in.
+   */
   continentName?: string | undefined;
   /**
-  * AS number the IP address belongs to.
-  */
+   * AS number the IP address belongs to.
+   */
   asn?: string | undefined;
   /**
-  * AS name the IP address belongs to.
-  */
+   * AS name the IP address belongs to.
+   */
   asnName?: string | undefined;
   /**
-  * ASN domain the IP address belongs to.
-  */
+   * ASN domain the IP address belongs to.
+   */
   asnDomain?: string | undefined;
   /**
-  * ASN type: ISP, hosting, business, or education
-  */
+   * ASN type: ISP, hosting, business, or education
+   */
   asnType?: string | undefined;
   /**
-  * ASN country code the IP address belongs to.
-  */
+   * ASN country code the IP address belongs to.
+   */
   asnCountry?: string | undefined;
   /**
-  * Name of service the IP address belongs to.
-  */
+   * Name of service the IP address belongs to.
+   */
   service?: string | undefined;
   /**
-  * Create an `ArcjetIpDetails`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   IP details.
-  */
+   * Create an `ArcjetIpDetails`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   IP details.
+   */
   constructor(init?: ArcjetIpDetailsInit);
   /**
-  * Check if the IP address has geo `latitude` info.
-  * This also implies that `accuracyRadius` is available.
-  *
-  * @returns
-  *   Whether the IP address has latitude info.
-  */
+   * Check if the IP address has geo `latitude` info.
+   * This also implies that `accuracyRadius` is available.
+   *
+   * @returns
+   *   Whether the IP address has latitude info.
+   */
   hasLatitude(): this is RequiredProps<this, "latitude" | "accuracyRadius">;
   /**
-  * Check if the IP address has geo `longitude` info.
-  * This also implies that `accuracyRadius` is available.
-  *
-  * @returns
-  *   Whether the IP address has longitude info.
-  */
+   * Check if the IP address has geo `longitude` info.
+   * This also implies that `accuracyRadius` is available.
+   *
+   * @returns
+   *   Whether the IP address has longitude info.
+   */
   hasLongitude(): this is RequiredProps<this, "longitude" | "accuracyRadius">;
   /**
-  * Check if the IP address has geo accuracy radius info.
-  * This also implies that `latitude` and `longitude` are available.
-  *
-  * @returns
-  *   Whether the IP address has accuracy info.
-  */
+   * Check if the IP address has geo accuracy radius info.
+   * This also implies that `latitude` and `longitude` are available.
+   *
+   * @returns
+   *   Whether the IP address has accuracy info.
+   */
   hasAccuracyRadius(): this is RequiredProps<this, "latitude" | "longitude" | "accuracyRadius">;
   /**
-  * Check if the IP address has timezone info.
-  *
-  * @returns
-  *   Whether the IP address has timezone info.
-  */
+   * Check if the IP address has timezone info.
+   *
+   * @returns
+   *   Whether the IP address has timezone info.
+   */
   hasTimezone(): this is RequiredProps<this, "timezone">;
   /**
-  * Check if the IP address has postcal code info.
-  *
-  * @returns
-  *   Whether the IP address has postcal code info.
-  */
+   * Check if the IP address has postcal code info.
+   *
+   * @returns
+   *   Whether the IP address has postcal code info.
+   */
   hasPostalCode(): this is RequiredProps<this, "postalCode">;
   /**
-  * Check if the IP address has city info.
-  *
-  * @returns
-  *   Whether the IP address has city info.
-  */
+   * Check if the IP address has city info.
+   *
+   * @returns
+   *   Whether the IP address has city info.
+   */
   hasCity(): this is RequiredProps<this, "city">;
   /**
-  * Check if the IP address has region info.
-  *
-  * @returns
-  *   Whether the IP address has region info.
-  */
+   * Check if the IP address has region info.
+   *
+   * @returns
+   *   Whether the IP address has region info.
+   */
   hasRegion(): this is RequiredProps<this, "region">;
   /**
-  * Check if the IP address has country info:
-  * `countryName` and `country`.
-  *
-  * @returns
-  *   Whether the IP address has country info.
-  */
+   * Check if the IP address has country info:
+   * `countryName` and `country`.
+   *
+   * @returns
+   *   Whether the IP address has country info.
+   */
   hasCountry(): this is RequiredProps<this, "country" | "countryName">;
   /**
-  * Check if the IP address has continent info:
-  * `continentName` and `continent`.
-  *
-  * @returns
-  *   Whether the IP address has continent info.
-  */
+   * Check if the IP address has continent info:
+   * `continentName` and `continent`.
+   *
+   * @returns
+   *   Whether the IP address has continent info.
+   */
   hasContintent(): this is RequiredProps<this, "continent" | "continentName">;
   /**
-  * Check if the IP address has ASN info.
-  *
-  * @deprecated
-  *   Use `hasAsn()` instead.
-  *
-  * @returns
-  *   Whether the IP address has ASN info.
-  */
+   * Check if the IP address has ASN info.
+   *
+   * @deprecated
+   *   Use `hasAsn()` instead.
+   *
+   * @returns
+   *   Whether the IP address has ASN info.
+   */
   hasASN(): this is RequiredProps<this, "asn" | "asnName" | "asnDomain" | "asnType" | "asnCountry">;
   /**
-  * Check if the IP address has ASN info:
-  * `asnCountry`, `asnDomain`, `asnName`, `asnType`, and `asn` fields.
-  *
-  * @returns
-  *   Whether the IP address has ASN info.
-  */
+   * Check if the IP address has ASN info:
+   * `asnCountry`, `asnDomain`, `asnName`, `asnType`, and `asn` fields.
+   *
+   * @returns
+   *   Whether the IP address has ASN info.
+   */
   hasAsn(): this is RequiredProps<this, "asn" | "asnName" | "asnDomain" | "asnType" | "asnCountry">;
   /**
-  * Check if the IP address has a service.
-  *
-  * @returns
-  *   Whether the IP address has a service.
-  */
+   * Check if the IP address has a service.
+   *
+   * @returns
+   *   Whether the IP address has a service.
+   */
   hasService(): this is RequiredProps<this, "service">;
   /**
-  * Check if the IP address belongs to a hosting provider.
-  *
-  * @returns
-  *   Whether the IP address belongs to a hosting provider.
-  */
+   * Check if the IP address belongs to a hosting provider.
+   *
+   * @returns
+   *   Whether the IP address belongs to a hosting provider.
+   */
   isHosting(): boolean;
   /**
-  * Check if the IP address belongs to a VPN provider.
-  *
-  * @returns
-  *   Whether the IP address belongs to a VPN provider.
-  */
+   * Check if the IP address belongs to a VPN provider.
+   *
+   * @returns
+   *   Whether the IP address belongs to a VPN provider.
+   */
   isVpn(): boolean;
   /**
-  * Check if the IP address belongs to a proxy provider.
-  *
-  * @returns
-  *   Whether the IP address belongs to a proxy provider.
-  */
+   * Check if the IP address belongs to a proxy provider.
+   *
+   * @returns
+   *   Whether the IP address belongs to a proxy provider.
+   */
   isProxy(): boolean;
   /**
-  * Check if the IP address belongs to a Tor node.
-  *
-  * @returns
-  *   Whether the IP address belongs to a Tor node.
-  */
+   * Check if the IP address belongs to a Tor node.
+   *
+   * @returns
+   *   Whether the IP address belongs to a Tor node.
+   */
   isTor(): boolean;
   /**
-  * Check if the IP address belongs to a relay service.
-  *
-  * @returns
-  *   Whether the IP address belongs to a relay service.
-  */
+   * Check if the IP address belongs to a relay service.
+   *
+   * @returns
+   *   Whether the IP address belongs to a relay service.
+   */
   isRelay(): boolean;
   /**
-  * Check if the IP address has been flagged as an abuser.
-  *
-  * @returns
-  *   Whether the IP address has been flagged as an abuser.
-  */
+   * Check if the IP address has been flagged as an abuser.
+   *
+   * @returns
+   *   Whether the IP address has been flagged as an abuser.
+   */
   isAbuser(): boolean;
 }
 /**
-* Configuration for the basic `ArcjetDecision`.
-*/
+ * Configuration for the basic `ArcjetDecision`.
+ */
 interface ArcjetDecisionInitAbstract {
   /**
-  * Unique identifier of the decision.
-  */
+   * Unique identifier of the decision.
+   */
   id?: string;
   /**
-  * List of results from calling rules.
-  */
+   * List of results from calling rules.
+   */
   results: ArcjetRuleResult[];
   /**
-  * Duration in milliseconds this decision should be considered valid.
-  */
+   * Duration in milliseconds this decision should be considered valid.
+   */
   ttl: number;
   /**
-  * Details about the IP address.
-  */
+   * Details about the IP address.
+   */
   ip?: ArcjetIpDetails;
 }
 /**
-* Configuration for most `ArcjetDecision`s.
-*/
+ * Configuration for most `ArcjetDecision`s.
+ */
 interface ArcjetDecisionInit extends ArcjetDecisionInitAbstract {
   /**
-  * Reason for the decision.
-  */
+   * Reason for the decision.
+   */
   reason: ArcjetReason;
 }
 /**
-* Configuration for `ArcjetErrorDecision`.
-*/
+ * Configuration for `ArcjetErrorDecision`.
+ */
 interface ArcjetErrorDecisionInit extends ArcjetDecisionInitAbstract {
   /**
-  * Reason for the decision.
-  */
+   * Reason for the decision.
+   */
   reason: ArcjetErrorReason;
 }
 /**
-* Decision returned by the Arcjet SDK.
-*/
+ * Decision returned by the Arcjet SDK.
+ */
 declare abstract class ArcjetDecision {
   /**
-  * Unique identifier of the decision.
-  * This can be used to look up the decision in the Arcjet dashboard.
-  */
+   * Unique identifier of the decision.
+   * This can be used to look up the decision in the Arcjet dashboard.
+   */
   id: string;
   /**
-  * Duration in milliseconds this decision should be considered valid, also
-  * known as time-to-live.
-  */
+   * Duration in milliseconds this decision should be considered valid, also
+   * known as time-to-live.
+   */
   ttl: number;
   /**
-  * List of results from calling rules.
-  * Can also be found by logging into the Arcjet dashboard and searching for the decision `id`.
-  */
+   * List of results from calling rules.
+   * Can also be found by logging into the Arcjet dashboard and searching for the decision `id`.
+   */
   results: ArcjetRuleResult[];
   /**
-  * Details about the IP address that informed the `conclusion`.
-  */
+   * Details about the IP address that informed the `conclusion`.
+   */
   ip: ArcjetIpDetails;
   /**
-  * Conclusion about the request.
-  */
+   * Conclusion about the request.
+   */
   abstract conclusion: ArcjetConclusion;
   /**
-  * Reason for the decision.
-  */
+   * Reason for the decision.
+   */
   abstract reason: ArcjetReason;
   /**
-  * Create an `ArcjetDecision`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Decision.
-  */
+   * Create an `ArcjetDecision`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Decision.
+   */
   constructor(init: ArcjetDecisionInitAbstract);
   /**
-  * Check if the decision is allowed.
-  * This considers `ERROR` decisions as allowed too.
-  *
-  * @returns
-  *   Whether the decision is allowed.
-  */
+   * Check if the decision is allowed.
+   * This considers `ERROR` decisions as allowed too.
+   *
+   * @returns
+   *   Whether the decision is allowed.
+   */
   isAllowed(): this is ArcjetAllowDecision | ArcjetErrorDecision;
   /**
-  * Check if the decision is denied.
-  *
-  * @returns
-  *   Whether the decision is denied.
-  */
+   * Check if the decision is denied.
+   *
+   * @returns
+   *   Whether the decision is denied.
+   */
   isDenied(): this is ArcjetDenyDecision;
   /**
-  * Check if the decision is challenged.
-  *
-  * @returns
-  *   Whether the decision is challenged.
-  */
+   * Check if the decision is challenged.
+   *
+   * @returns
+   *   Whether the decision is challenged.
+   */
   isChallenged(): this is ArcjetChallengeDecision;
   /**
-  * Check if the decision is errored.
-  * This does **not** consider `ALLOW` as errored.
-  *
-  * @returns
-  *   Whether the decision is errored.
-  */
+   * Check if the decision is errored.
+   * This does **not** consider `ALLOW` as errored.
+   *
+   * @returns
+   *   Whether the decision is errored.
+   */
   isErrored(): this is ArcjetErrorDecision;
 }
 /**
-* Allow decision.
-*/
+ * Allow decision.
+ */
 declare class ArcjetAllowDecision extends ArcjetDecision {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   conclusion: "ALLOW";
   /**
-  * Reason for decision.
-  */
+   * Reason for decision.
+   */
   reason: ArcjetReason;
   /**
-  * Create an `ArcjetAllowDecision`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Allow decision.
-  */
+   * Create an `ArcjetAllowDecision`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Allow decision.
+   */
   constructor(init: ArcjetDecisionInit);
 }
 /**
-* Deny decision.
-*/
+ * Deny decision.
+ */
 declare class ArcjetDenyDecision extends ArcjetDecision {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   conclusion: "DENY";
   /**
-  * Reason for decision.
-  */
+   * Reason for decision.
+   */
   reason: ArcjetReason;
   /**
-  * Create an `ArcjetDenyDecision`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Deny decision.
-  */
+   * Create an `ArcjetDenyDecision`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Deny decision.
+   */
   constructor(init: ArcjetDecisionInit);
 }
 /**
-* Challenge decision.
-*/
+ * Challenge decision.
+ */
 declare class ArcjetChallengeDecision extends ArcjetDecision {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   conclusion: "CHALLENGE";
   /**
-  * Reason for decision.
-  */
+   * Reason for decision.
+   */
   reason: ArcjetReason;
   /**
-  * Create an `ArcjetChallengeDecision`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Challenge decision.
-  */
+   * Create an `ArcjetChallengeDecision`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Challenge decision.
+   */
   constructor(init: ArcjetDecisionInit);
 }
 /**
-* Error decision.
-*/
+ * Error decision.
+ */
 declare class ArcjetErrorDecision extends ArcjetDecision {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   conclusion: "ERROR";
   /**
-  * Reason for decision.
-  */
+   * Reason for decision.
+   */
   reason: ArcjetErrorReason;
   /**
-  * Create an `ArcjetErrorDecision`.
-  *
-  * @param init
-  *   Configuration.
-  * @returns
-  *   Error decision.
-  */
+   * Create an `ArcjetErrorDecision`.
+   *
+   * @param init
+   *   Configuration.
+   * @returns
+   *   Error decision.
+   */
   constructor(init: ArcjetErrorDecisionInit);
 }
 /**
-* Request details.
-*/
+ * Request details.
+ */
 interface ArcjetRequestDetails {
   /**
-  * IP address (IPv4 or IPv6).
-  */
+   * IP address (IPv4 or IPv6).
+   */
   ip: string;
   /**
-  * HTTP method (such as `GET`).
-  */
+   * HTTP method (such as `GET`).
+   */
   method: string;
   /**
-  * Protocol (such as `"http:"`).
-  */
+   * Protocol (such as `"http:"`).
+   */
   protocol: string;
   /**
-  * Hostname (such as `"example.com"`).
-  */
+   * Hostname (such as `"example.com"`).
+   */
   host: string;
   /**
-  * Path (such as `"/path/to/resource"`).
-  */
+   * Path (such as `"/path/to/resource"`).
+   */
   path: string;
   /**
-  * Headers of the request.
-  *
-  * This is a [`Headers`](https://developer.mozilla.org/en-US/docs/Web/API/Headers) object.
-  * This never includes cookies: those are stored separately.
-  */
+   * Headers of the request.
+   *
+   * This is a [`Headers`](https://developer.mozilla.org/en-US/docs/Web/API/Headers) object.
+   * This never includes cookies: those are stored separately.
+   */
   headers: Headers;
   /**
-  * Cookies of the request (such as `"cookie1=value1; cookie2=value2"`).
-  */
+   * Cookies of the request (such as `"cookie1=value1; cookie2=value2"`).
+   */
   cookies: string;
   /**
-  * Query string of the request (such as `"?q=alpha"`).
-  */
+   * Query string of the request (such as `"?q=alpha"`).
+   */
   query: string;
   /**
-  * Extra info.
-  */
+   * Extra info.
+   */
   extra: {
@@ -1060,145 +1060,155 @@ [key: string]: string;
   /**
-  * Email address of the user making the request.
-  */
+   * Email address of the user making the request.
+   */
   email?: string | undefined;
   /**
-  * Optional, caller-supplied opaque identifier used to correlate this request
-  * with other `protect()` and `guard()` calls that belong to the same
-  * workflow, agent run, or multi-step task.
-  *
-  * It does not affect the decision and is excluded from the fingerprint (and
-  * therefore the decision cache key); it is stored alongside the recorded
-  * decision so a chain of actions can be reconstructed.
-  */
+   * Optional, caller-supplied opaque identifier used to correlate this request
+   * with other `protect()` and `guard()` calls that belong to the same
+   * workflow, agent run, or multi-step task.
+   *
+   * It does not affect the decision and is excluded from the fingerprint (and
+   * therefore the decision cache key); it is stored alongside the recorded
+   * decision so a chain of actions can be reconstructed.
+   */
   correlationId?: string | undefined;
+  /**
+   * Structured metadata for correlation and analytics: string keys mapped to
+   * any JSON-serializable value, including nested objects and arrays.
+   *
+   * Each top-level value is JSON-encoded by the SDK and stored verbatim. It
+   * does not affect the decision and is excluded from the fingerprint (and
+   * therefore the decision cache key). Untrusted and never redacted — do not
+   * put secrets or PII in it.
+   */
+  metadata?: ArcjetMetadata | undefined;
 }
 /**
-* Arcjet rule.
-*
-* @template Props
-*   Extra properties passed to the rule.
-*/
+ * Arcjet rule.
+ *
+ * @template Props
+ *   Extra properties passed to the rule.
+ */
 type ArcjetRule<Props extends {} = {}> = {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "RATE_LIMIT" | "BOT" | "EMAIL" | "FILTER" | "SHIELD" | "SENSITIVE_INFO" | string;
   /**
-  * Mode.
-  */
+   * Mode.
+   */
   mode: ArcjetMode;
   /**
-  * Priority.
-  */
+   * Priority.
+   */
   priority: number;
   /**
-  * Version of rule.
-  */
+   * Version of rule.
+   */
   version: number;
   /**
-  * Validate locally whether the rule can run.
-  *
-  * For example, the email rule requires an `email` field and throws if it is
-  * not passed.
-  *
-  * @param context
-  *   Arcjet context.
-  * @param details
-  *   Request details and extra properties.
-  * @returns
-  *   Nothing.
-  * @throws
-  *   If the rule cannot run.
-  */
+   * Validate locally whether the rule can run.
+   *
+   * For example, the email rule requires an `email` field and throws if it is
+   * not passed.
+   *
+   * @param context
+   *   Arcjet context.
+   * @param details
+   *   Request details and extra properties.
+   * @returns
+   *   Nothing.
+   * @throws
+   *   If the rule cannot run.
+   */
   validate(context: ArcjetContext, details: unknown): asserts details is ArcjetRequestDetails & Props;
   /**
-  * Run a rule locally.
-  *
-  * The result is used if it is a `LIVE` `DENY` result.
-  * In other cases the server is contacted to get results.
-  *
-  * @param context
-  *   Arcjet context.
-  * @param details
-  *   Request details and extra properties.
-  * @returns
-  *   Promise to a rule result.
-  */
+   * Run a rule locally.
+   *
+   * The result is used if it is a `LIVE` `DENY` result.
+   * In other cases the server is contacted to get results.
+   *
+   * @param context
+   *   Arcjet context.
+   * @param details
+   *   Request details and extra properties.
+   * @returns
+   *   Promise to a rule result.
+   */
   protect(context: ArcjetContext, details: ArcjetRequestDetails & Props): Promise<ArcjetRuleResult>;
 };
 /**
-* Abstract rate limit rule.
-*/
+ * Abstract rate limit rule.
+ */
 interface ArcjetRateLimitRule<Props extends {}> extends ArcjetRule<Props> {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "RATE_LIMIT";
   /**
-  * Algorithm used for rate limiting.
-  */
+   * Algorithm used for rate limiting.
+   */
   algorithm: ArcjetRateLimitAlgorithm;
   /**
-  * Characteristics of the rule.
-  */
+   * Characteristics of the rule.
+   */
   characteristics?: string[] | undefined;
 }
 /**
-* Token bucket rate limit rule.
-*/
+ * Token bucket rate limit rule.
+ */
 interface ArcjetTokenBucketRateLimitRule<Props extends {}> extends ArcjetRateLimitRule<Props> {
   /**
-  * Algorithm kind.
-  */
+   * Algorithm kind.
+   */
   algorithm: "TOKEN_BUCKET";
   /**
-  * Tokens to add to the bucket at each interval.
-  */
+   * Tokens to add to the bucket at each interval.
+   */
   refillRate: number;
   /**
-  * Interval in seconds to add tokens to the bucket.
-  */
+   * Interval in seconds to add tokens to the bucket.
+   */
   interval: number;
   /**
-  * Max tokens the bucket can hold.
-  */
+   * Max tokens the bucket can hold.
+   */
   capacity: number;
 }
 /**
-* Fixed window rate limit rule.
-*/
+ * Fixed window rate limit rule.
+ */
 interface ArcjetFixedWindowRateLimitRule<Props extends {}> extends ArcjetRateLimitRule<Props> {
   /**
-  * Algorithm kind.
-  */
+   * Algorithm kind.
+   */
   algorithm: "FIXED_WINDOW";
   /**
-  * Max requests allowed in the time window.
-  */
+   * Max requests allowed in the time window.
+   */
   max: number;
   /**
-  * Time window in seconds the rate limit applies to.
-  */
+   * Time window in seconds the rate limit applies to.
+   */
   window: number;
 }
 /**
-* Sliding window rate limit rule.
-*/
+ * Sliding window rate limit rule.
+ */
 interface ArcjetSlidingWindowRateLimitRule<Props extends {}> extends ArcjetRateLimitRule<Props> {
   /**
-  * Algorithm kind.
-  */
+   * Algorithm kind.
+   */
   algorithm: "SLIDING_WINDOW";
   /**
-  * Max requests allowed in the time window.
-  */
+   * Max requests allowed in the time window.
+   */
   max: number;
   /**
-  * Time interval in seconds for the rate limit.
-  */
+   * Time interval in seconds for the rate limit.
+   */
   interval: number;
 }
 /**
-* Email rule.
-*/
+ * Email rule.
+ */
 interface ArcjetEmailRule<Props extends {
@@ -1208,29 +1218,29 @@ email: string;
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "EMAIL";
   /**
-  * Email types that are allowed.
-  */
+   * Email types that are allowed.
+   */
   allow: ArcjetEmailType[];
   /**
-  * Email types that are not allowed.
-  */
+   * Email types that are not allowed.
+   */
   deny: ArcjetEmailType[];
   /**
-  * Whether to allow email addresses that contain a single domain segment.
-  * Something like `foo@bar` is not allowed when `true`.
-  * It is allowed when `false`.
-  */
+   * Whether to allow email addresses that contain a single domain segment.
+   * Something like `foo@bar` is not allowed when `true`.
+   * It is allowed when `false`.
+   */
   requireTopLevelDomain: boolean;
   /**
-  * Whether to allow email addresses that contain a domain literal.
-  * Something like `foo@[192.168.1.1]` is allowed when `true`.
-  * It is not allowed when `false`.
-  */
+   * Whether to allow email addresses that contain a domain literal.
+   * Something like `foo@[192.168.1.1]` is allowed when `true`.
+   * It is not allowed when `false`.
+   */
   allowDomainLiteral: boolean;
 }
 /**
-* Filter rule.
-*/
+ * Filter rule.
+ */
 interface ArcjetFilterRule extends ArcjetRule<{
@@ -1240,60 +1250,60 @@ filterLocal?: Record<string, string> | null | undefined;
   /**
-  * List of expressions that allow a request when one matches and deny otherwise.
-  */
+   * List of expressions that allow a request when one matches and deny otherwise.
+   */
   allow: ReadonlyArray<string>;
   /**
-  * List of expressions that deny a request when one matches and allow otherwise.
-  */
+   * List of expressions that deny a request when one matches and allow otherwise.
+   */
   deny: ReadonlyArray<string>;
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "FILTER";
 }
 /**
-* Sensitive info rule.
-*/
+ * Sensitive info rule.
+ */
 interface ArcjetSensitiveInfoRule<Props extends {}> extends ArcjetRule<Props> {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "SENSITIVE_INFO";
   /**
-  * Allowed entities.
-  */
+   * Allowed entities.
+   */
   allow: string[];
   /**
-  * Denied entities.
-  */
+   * Denied entities.
+   */
   deny: string[];
 }
 /**
-* Bot rule.
-*/
+ * Bot rule.
+ */
 interface ArcjetBotRule<Props extends {}> extends ArcjetRule<Props> {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "BOT";
   /**
-  * Allowed bots.
-  */
+   * Allowed bots.
+   */
   allow: Array<string>;
   /**
-  * Denied bots.
-  */
+   * Denied bots.
+   */
   deny: Array<string>;
 }
 /**
-* Shield rule.
-*/
+ * Shield rule.
+ */
 interface ArcjetShieldRule<Props extends {}> extends ArcjetRule<Props> {
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "SHIELD";
 }
 /**
-* Prompt injection detection rule.
-*/
+ * Prompt injection detection rule.
+ */
 interface ArcjetPromptInjectionDetectionRule extends ArcjetRule<{
@@ -1303,184 +1313,184 @@ detectPromptInjectionMessage: string;
   /**
-  * Kind.
-  */
+   * Kind.
+   */
   type: "PROMPT_INJECTION_DETECTION";
   /**
-  * The score threshold above which a request is considered a prompt
-  * injection attempt.
-  *
-  * @deprecated
-  *   This field is no longer respected by the server and will be removed in
-  *   a future release.
-  */
+   * The score threshold above which a request is considered a prompt
+   * injection attempt.
+   *
+   * @deprecated
+   *   This field is no longer respected by the server and will be removed in
+   *   a future release.
+   */
   threshold?: number;
 }
 /**
-* Arcjet logger interface.
-*
-* Some Pino-compatible functions are required but most of its interface is
-* omitted.
-*
-* See `@arcjet/logger` for an implementation.
-*/
+ * Arcjet logger interface.
+ *
+ * Some Pino-compatible functions are required but most of its interface is
+ * omitted.
+ *
+ * See `@arcjet/logger` for an implementation.
+ */
 interface ArcjetLogger {
   /**
-  * Debug.
-  *
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Debug.
+   *
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   debug(msg: string, ...args: unknown[]): void;
   /**
-  * Debug.
-  *
-  * @param obj
-  *   Merging object copied into the JSON log line.
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Debug.
+   *
+   * @param obj
+   *   Merging object copied into the JSON log line.
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   debug(obj: Record<string, unknown>, msg?: string, ...args: unknown[]): void;
   /**
-  * Info.
-  *
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Info.
+   *
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   info(msg: string, ...args: unknown[]): void;
   /**
-  * Info.
-  *
-  * @param obj
-  *   Merging object copied into the JSON log line.
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Info.
+   *
+   * @param obj
+   *   Merging object copied into the JSON log line.
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   info(obj: Record<string, unknown>, msg?: string, ...args: unknown[]): void;
   /**
-  * Warn.
-  *
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Warn.
+   *
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   warn(msg: string, ...args: unknown[]): void;
   /**
-  * Warn.
-  *
-  * @param obj
-  *   Merging object copied into the JSON log line.
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Warn.
+   *
+   * @param obj
+   *   Merging object copied into the JSON log line.
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   warn(obj: Record<string, unknown>, msg?: string, ...args: unknown[]): void;
   /**
-  * Error.
-  *
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Error.
+   *
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   error(msg: string, ...args: unknown[]): void;
   /**
-  * Error.
-  *
-  * @param obj
-  *   Merging object copied into the JSON log line.
-  * @param msg
-  *   Template.
-  * @param args
-  *   Parameters to interpolate.
-  * @returns
-  *   Nothing.
-  */
+   * Error.
+   *
+   * @param obj
+   *   Merging object copied into the JSON log line.
+   * @param msg
+   *   Template.
+   * @param args
+   *   Parameters to interpolate.
+   * @returns
+   *   Nothing.
+   */
   error(obj: Record<string, unknown>, msg?: string, ...args: unknown[]): void;
 }
 /**
-* Objects that Arcjet core puts in the cache.
-*
-* Local results from `rule.protect` calls and remote results from
-* `client.decide` are stored when they have a non-zero `ttl` and are a `DENY`.
-*/
+ * Objects that Arcjet core puts in the cache.
+ *
+ * Local results from `rule.protect` calls and remote results from
+ * `client.decide` are stored when they have a non-zero `ttl` and are a `DENY`.
+ */
 interface ArcjetCacheEntry {
   /**
-  * Conclusion.
-  */
+   * Conclusion.
+   */
   conclusion: ArcjetConclusion;
   /**
-  * Reason.
-  */
+   * Reason.
+   */
   reason: ArcjetReason;
 }
 /**
-* Arcjet context.
-*/
+ * Arcjet context.
+ */
 type ArcjetContext = {
   /**
-  * Arbitrary indexing into context is currently allowed but not typed.
-  */
+   * Arbitrary indexing into context is currently allowed but not typed.
+   */
   [key: string]: unknown;
   /**
-  * API key.
-  */
+   * API key.
+   */
   key: string;
   /**
-  * Fingerprint of request.
-  */
+   * Fingerprint of request.
+   */
   fingerprint: string;
   /**
-  * Detected runtime.
-  */
+   * Detected runtime.
+   */
   runtime: string;
   /**
-  * Logger to use.
-  */
+   * Logger to use.
+   */
   log: ArcjetLogger;
   /**
-  * Global characteristics.
-  */
+   * Global characteristics.
+   */
   characteristics: string[];
   /**
-  * Cache to use.
-  */
+   * Cache to use.
+   */
   cache: Cache<ArcjetCacheEntry>;
   /**
-  * Function to use to read a request.
-  */
+   * Function to use to read a request.
+   */
   getBody(): Promise<string>;
   /**
-  * Function called to wait for something.
-  *
-  * @param promise
-  *   Promise to wait for.
-  * @returns
-  *   Nothing.
-  */
+   * Function called to wait for something.
+   *
+   * @param promise
+   *   Promise to wait for.
+   * @returns
+   *   Nothing.
+   */
   waitUntil?: ((promise: Promise<unknown>) => void) | undefined;
 };
 //#endregion
-export { ArcjetAllowDecision, type ArcjetBotCategory, ArcjetBotReason, ArcjetBotRule, ArcjetCacheEntry, ArcjetChallengeDecision, ArcjetConclusion, ArcjetContext, ArcjetDecision, ArcjetDenyDecision, ArcjetEdgeRuleReason, ArcjetEmailReason, ArcjetEmailRule, ArcjetEmailType, ArcjetErrorDecision, ArcjetErrorReason, ArcjetFilterReason, ArcjetFilterRule, ArcjetFixedWindowRateLimitRule, ArcjetIdentifiedEntity, ArcjetIpDetails, ArcjetLogger, ArcjetMode, ArcjetPromptInjectionDetectionRule, ArcjetPromptInjectionReason, ArcjetRateLimitAlgorithm, ArcjetRateLimitReason, ArcjetRateLimitRule, ArcjetReason, ArcjetRequestDetails, ArcjetRule, ArcjetRuleResult, ArcjetRuleState, ArcjetSensitiveInfoReason, ArcjetSensitiveInfoRule, ArcjetSensitiveInfoType, ArcjetShieldReason, ArcjetShieldRule, ArcjetSlidingWindowRateLimitRule, ArcjetStack, ArcjetTokenBucketRateLimitRule, type ArcjetWellKnownBot, categories as botCategories, type categories };
+export { ArcjetAllowDecision, type ArcjetBotCategory, ArcjetBotReason, ArcjetBotRule, ArcjetCacheEntry, ArcjetChallengeDecision, ArcjetConclusion, ArcjetContext, ArcjetDecision, ArcjetDenyDecision, ArcjetEdgeRuleReason, ArcjetEmailReason, ArcjetEmailRule, ArcjetEmailType, ArcjetErrorDecision, ArcjetErrorReason, ArcjetFilterReason, ArcjetFilterRule, ArcjetFixedWindowRateLimitRule, ArcjetIdentifiedEntity, ArcjetIpDetails, ArcjetLogger, type ArcjetMetadata, ArcjetMode, ArcjetPromptInjectionDetectionRule, ArcjetPromptInjectionReason, ArcjetRateLimitAlgorithm, ArcjetRateLimitReason, ArcjetRateLimitRule, ArcjetReason, ArcjetRequestDetails, ArcjetRule, ArcjetRuleResult, ArcjetRuleState, ArcjetSensitiveInfoReason, ArcjetSensitiveInfoRule, ArcjetSensitiveInfoType, ArcjetShieldReason, ArcjetShieldRule, ArcjetSlidingWindowRateLimitRule, ArcjetStack, ArcjetTokenBucketRateLimitRule, type ArcjetWellKnownBot, categories as botCategories, type categories };

dist/proto/decide/v1alpha1/decide_pb.d.ts

@@ -1239,2 +1239,31 @@ // @generated by protoc-gen-es v2.2.0
 /**
+ * Warning is a non-fatal validation warning ({code, message}). Used for
+ * client-reported local_warnings (e.g. metadata keys the SDK dropped before
+ * sending).
+ *
+ * @generated from message proto.decide.v1alpha1.Warning
+ */
+export declare type Warning = Message<"proto.decide.v1alpha1.Warning"> & {
+  /**
+   * Machine-readable code ("AJ" + 4 digits).
+   *
+   * @generated from field: string code = 1;
+   */
+  code: string;
+
+  /**
+   * Human-readable message.
+   *
+   * @generated from field: string message = 2;
+   */
+  message: string;
+};
+
+/**
+ * Describes the message proto.decide.v1alpha1.Warning.
+ * Use `create(WarningSchema)` to create a new message.
+ */
+export declare const WarningSchema: GenMessage<Warning>;
+
+/**
  * Details about a request under investigation.
@@ -1417,2 +1446,20 @@ *
   characteristics: string[];
+
+  /**
+   * Nested-JSON metadata for protect(): key -> JSON-encoded value. Carried on
+   * the request so both Decide and Report receive it. protect had no metadata
+   * field before.
+   *
+   * @generated from field: map<string, string> metadata_json = 7;
+   */
+  metadataJson: { [key: string]: string };
+
+  /**
+   * Client-side validation warnings the SDK reports (e.g. metadata keys it
+   * dropped before sending). Untrusted; the server bounds count/length and
+   * persists them alongside its own warnings.
+   *
+   * @generated from field: repeated proto.decide.v1alpha1.Warning local_warnings = 8;
+   */
+  localWarnings: Warning[];
 };
@@ -1496,2 +1543,18 @@
   characteristics: string[];
+
+  /**
+   * Nested-JSON metadata for protect(): key -> JSON-encoded value. Carried on
+   * the request so both Decide and Report receive it.
+   *
+   * @generated from field: map<string, string> metadata_json = 9;
+   */
+  metadataJson: { [key: string]: string };
+
+  /**
+   * Client-side validation warnings the SDK reports. Untrusted; the server
+   * bounds count/length and persists them alongside its own warnings.
+   *
+   * @generated from field: repeated proto.decide.v1alpha1.Warning local_warnings = 10;
+   */
+  localWarnings: Warning[];
 };
@@ -1498,0 +1561,0 @@

dist/proto/decide/v1alpha1/decide_pb.js

@@ -12,3 +12,3 @@ // @generated by protoc-gen-es v2.2.0
 export const file_proto_decide_v1alpha1_decide = /*@__PURE__*/
-  fileDesc("CiJwcm90by9kZWNpZGUvdjFhbHBoYTEvZGVjaWRlLnByb3RvEhVwcm90by5kZWNpZGUudjFhbHBoYTEinQQKCUlwRGV0YWlscxIQCghsYXRpdHVkZRgBIAEoARIRCglsb25naXR1ZGUYAiABKAESFwoPYWNjdXJhY3lfcmFkaXVzGAMgASgFEhAKCHRpbWV6b25lGAQgASgJEhMKC3Bvc3RhbF9jb2RlGAUgASgJEgwKBGNpdHkYBiABKAkSDgoGcmVnaW9uGAcgASgJEg8KB2NvdW50cnkYCCABKAkSFAoMY291bnRyeV9uYW1lGAkgASgJEhEKCWNvbnRpbmVudBgKIAEoCRIWCg5jb250aW5lbnRfbmFtZRgLIAEoCRILCgNhc24YDCABKAkSEAoIYXNuX25hbWUYDSABKAkSEgoKYXNuX2RvbWFpbhgOIAEoCRIQCghhc25fdHlwZRgPIAEoCRITCgthc25fY291bnRyeRgQIAEoCRIPCgdzZXJ2aWNlGBEgASgJEhIKCmlzX2hvc3RpbmcYEiABKAgSDgoGaXNfdnBuGBMgASgIEhAKCGlzX3Byb3h5GBQgASgIEg4KBmlzX3RvchgVIAEoCBIQCghpc19yZWxheRgWIAEoCBIRCglpc19hYnVzZXIYFyABKAgSOAoEYm90cxgYIAMoCzIqLnByb3RvLmRlY2lkZS52MWFscGhhMS5JcERldGFpbHMuQm90c0VudHJ5GisKCUJvdHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIt8ECgZSZWFzb24SPAoKcmF0ZV9saW1pdBgBIAEoCzImLnByb3RvLmRlY2lkZS52MWFscGhhMS5SYXRlTGltaXRSZWFzb25IABI+CgllZGdlX3J1bGUYAiABKAsyJS5wcm90by5kZWNpZGUudjFhbHBoYTEuRWRnZVJ1bGVSZWFzb25CAhgBSAASLwoDYm90GAMgASgLMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFJlYXNvbkgAEjUKBnNoaWVsZBgEIAEoCzIjLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSZWFzb25IABIzCgVlbWFpbBgFIAEoCzIiLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFJlYXNvbkgAEjMKBWVycm9yGAYgASgLMiIucHJvdG8uZGVjaWRlLnYxYWxwaGExLkVycm9yUmVhc29uSAASRAoOc2Vuc2l0aXZlX2luZm8YByABKAsyKi5wcm90by5kZWNpZGUudjFhbHBoYTEuU2Vuc2l0aXZlSW5mb1JlYXNvbkgAEjQKBmJvdF92MhgIIAEoCzIiLnByb3RvLmRlY2lkZS52MWFscGhhMS5Cb3RWMlJlYXNvbkgAEjUKBmZpbHRlchgJIAEoCzIjLnByb3RvLmRlY2lkZS52MWFscGhhMS5GaWx0ZXJSZWFzb25IABJIChBwcm9tcHRfaW5qZWN0aW9uGAogASgLMiwucHJvdG8uZGVjaWRlLnYxYWxwaGExLlByb21wdEluamVjdGlvblJlYXNvbkgAQggKBnJlYXNvbiKtAQoPUmF0ZUxpbWl0UmVhc29uEgsKA21heBgBIAEoDRIRCgVjb3VudBgCIAEoBUICGAESEQoJcmVtYWluaW5nGAMgASgNEjIKCnJlc2V0X3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgIYARIYChByZXNldF9pbl9zZWNvbmRzGAUgASgNEhkKEXdpbmRvd19pbl9zZWNvbmRzGAYgASgNIhQKDkVkZ2VSdWxlUmVhc29uOgIYASLCAQoJQm90UmVhc29uEjAKCGJvdF90eXBlGAEgASgOMh4ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFR5cGUSEQoJYm90X3Njb3JlGAIgASgFEhgKEHVzZXJfYWdlbnRfbWF0Y2gYAyABKAgSEgoKaXBfaG9zdGluZxgFIAEoCBIOCgZpcF92cG4YBiABKAgSEAoIaXBfcHJveHkYByABKAgSDgoGaXBfdG9yGAggASgIEhAKCGlwX3JlbGF5GAkgASgIIlEKC0JvdFYyUmVhc29uEg8KB2FsbG93ZWQYASADKAkSDgoGZGVuaWVkGAIgAygJEhAKCHZlcmlmaWVkGAMgASgIEg8KB3Nwb29mZWQYBCABKAgiPAoMU2hpZWxkUmVhc29uEhgKEHNoaWVsZF90cmlnZ2VyZWQYASABKAgSEgoKc3VzcGljaW91cxgCIAEoCCJtCgxGaWx0ZXJSZWFzb24SHgoSbWF0Y2hlZF9leHByZXNzaW9uGAEgASgJQgIYARIbChNtYXRjaGVkX2V4cHJlc3Npb25zGAIgAygJEiAKGHVuZGV0ZXJtaW5lZF9leHByZXNzaW9ucxgDIAMoCSJECgtFbWFpbFJlYXNvbhI1CgtlbWFpbF90eXBlcxgBIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUiHgoLRXJyb3JSZWFzb24SDwoHbWVzc2FnZRgBIAEoCSJcChVQcm9tcHRJbmplY3Rpb25SZWFzb24SGgoSaW5qZWN0aW9uX2RldGVjdGVkGAEgASgIEhEKBXNjb3JlGAIgASgBQgIYARIUCgx0b3RhbF90b2tlbnMYAyABKA0iRwoQSWRlbnRpZmllZEVudGl0eRIXCg9pZGVudGlmaWVkX3R5cGUYASABKAkSDQoFc3RhcnQYAiABKA0SCwoDZW5kGAMgASgNIogBChNTZW5zaXRpdmVJbmZvUmVhc29uEjgKB2FsbG93ZWQYASADKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuSWRlbnRpZmllZEVudGl0eRI3CgZkZW5pZWQYAiADKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuSWRlbnRpZmllZEVudGl0eSL1AgoNUmF0ZUxpbWl0UnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFbWF0Y2gYAiABKAkSFwoPY2hhcmFjdGVyaXN0aWNzGAMgAygJEhIKBndpbmRvdxgEIAEoCUICGAESCwoDbWF4GAUgASgNEg8KB3RpbWVvdXQYBiABKAkSPAoJYWxnb3JpdGhtGAcgASgOMikucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJhdGVMaW1pdEFsZ29yaXRobRITCgtyZWZpbGxfcmF0ZRgIIAEoDRIQCghpbnRlcnZhbBgJIAEoDRIQCghjYXBhY2l0eRgKIAEoDRIZChF3aW5kb3dfaW5fc2Vjb25kcxgMIAEoDRI8Cgd2ZXJzaW9uGA0gASgOMisucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJhdGVMaW1pdFJ1bGVWZXJzaW9uSgQICxAMUglyZXF1ZXN0ZWQixgIKB0JvdFJ1bGUSKQoEbW9kZRgBIAEoDjIbLnByb3RvLmRlY2lkZS52MWFscGhhMS5Nb2RlEi0KBWJsb2NrGAIgAygOMh4ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFR5cGUSOQoIcGF0dGVybnMYAyABKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90UnVsZS5QYXR0ZXJucxqlAQoIUGF0dGVybnMSPQoDYWRkGAEgAygLMjAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFJ1bGUuUGF0dGVybnMuQWRkRW50cnkSDgoGcmVtb3ZlGAIgAygJGkoKCEFkZEVudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLnByb3RvLmRlY2lkZS52MWFscGhhMS5Cb3RUeXBlOgI4ASKNAQoJQm90VjJSdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRINCgVhbGxvdxgCIAMoCRIMCgRkZW55GAMgAygJEjgKB3ZlcnNpb24YBCABKA4yJy5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90VjJSdWxlVmVyc2lvbiLGAgoJRW1haWxSdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRIzCgVibG9jaxgCIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGVCAhgBEiAKGHJlcXVpcmVfdG9wX2xldmVsX2RvbWFpbhgDIAEoCBIcChRhbGxvd19kb21haW5fbGl0ZXJhbBgEIAEoCBIvCgVhbGxvdxgFIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUSLgoEZGVueRgGIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUSOAoHdmVyc2lvbhgHIAEoDjInLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFJ1bGVWZXJzaW9uIp0BChFTZW5zaXRpdmVJbmZvUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFYWxsb3cYAiADKAkSDAoEZGVueRgDIAMoCRJACgd2ZXJzaW9uGAQgASgOMi8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlNlbnNpdGl2ZUluZm9SdWxlVmVyc2lvbiKfAQoKU2hpZWxkUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSEgoKYXV0b19hZGRlZBgCIAEoCBIXCg9jaGFyYWN0ZXJpc3RpY3MYAyADKAkSOQoHdmVyc2lvbhgEIAEoDjIoLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSdWxlVmVyc2lvbiKPAQoKRmlsdGVyUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFYWxsb3cYAiADKAkSDAoEZGVueRgDIAMoCRI5Cgd2ZXJzaW9uGAQgASgOMigucHJvdG8uZGVjaWRlLnYxYWxwaGExLkZpbHRlclJ1bGVWZXJzaW9uIsABChxQcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRIaCgl0aHJlc2hvbGQYAiABKAFCAhgBSACIAQESSwoHdmVyc2lvbhgDIAEoDjI6LnByb3RvLmRlY2lkZS52MWFscGhhMS5Qcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlVmVyc2lvbkIMCgpfdGhyZXNob2xkIuoDCgRSdWxlEjoKCnJhdGVfbGltaXQYASABKAsyJC5wcm90by5kZWNpZGUudjFhbHBoYTEuUmF0ZUxpbWl0UnVsZUgAEi4KBGJvdHMYAiABKAsyHi5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90UnVsZUgAEjEKBWVtYWlsGAMgASgLMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkVtYWlsUnVsZUgAEjMKBnNoaWVsZBgEIAEoCzIhLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSdWxlSAASQgoOc2Vuc2l0aXZlX2luZm8YBSABKAsyKC5wcm90by5kZWNpZGUudjFhbHBoYTEuU2Vuc2l0aXZlSW5mb1J1bGVIABIyCgZib3RfdjIYBiABKAsyIC5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90VjJSdWxlSAASMwoGZmlsdGVyGAcgASgLMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkZpbHRlclJ1bGVIABJZChpwcm9tcHRfaW5qZWN0aW9uX2RldGVjdGlvbhgIIAEoCzIzLnByb3RvLmRlY2lkZS52MWFscGhhMS5Qcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlSABCBgoEcnVsZSLWAQoKUnVsZVJlc3VsdBIPCgdydWxlX2lkGAEgASgJEi8KBXN0YXRlGAIgASgOMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJ1bGVTdGF0ZRI1Cgpjb25jbHVzaW9uGAMgASgOMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkNvbmNsdXNpb24SLQoGcmVhc29uGAQgASgLMh0ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlYXNvbhILCgN0dGwYBSABKA0SEwoLZmluZ2VycHJpbnQYBiABKAkikwMKDlJlcXVlc3REZXRhaWxzEgoKAmlwGAEgASgJEg4KBm1ldGhvZBgCIAEoCRIQCghwcm90b2NvbBgDIAEoCRIMCgRob3N0GAQgASgJEgwKBHBhdGgYBSABKAkSQwoHaGVhZGVycxgGIAMoCzIyLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXF1ZXN0RGV0YWlscy5IZWFkZXJzRW50cnkSDAoEYm9keRgHIAEoDBI/CgVleHRyYRgIIAMoCzIwLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXF1ZXN0RGV0YWlscy5FeHRyYUVudHJ5Eg0KBWVtYWlsGAkgASgJEg8KB2Nvb2tpZXMYCiABKAkSDQoFcXVlcnkYCyABKAkSFgoOY29ycmVsYXRpb25faWQYDCABKAkaLgoMSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaLAoKRXh0cmFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIvgBCghEZWNpc2lvbhIKCgJpZBgBIAEoCRI1Cgpjb25jbHVzaW9uGAIgASgOMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkNvbmNsdXNpb24SLQoGcmVhc29uGAMgASgLMh0ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlYXNvbhI3CgxydWxlX3Jlc3VsdHMYBCADKAsyIS5wcm90by5kZWNpZGUudjFhbHBoYTEuUnVsZVJlc3VsdBILCgN0dGwYBSABKA0SNAoKaXBfZGV0YWlscxgGIAEoCzIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5JcERldGFpbHMi6AEKDURlY2lkZVJlcXVlc3QSMgoJc2RrX3N0YWNrGAEgASgOMh8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlNES1N0YWNrEhMKC3Nka192ZXJzaW9uGAIgASgJEjYKB2RldGFpbHMYBCABKAsyJS5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVxdWVzdERldGFpbHMSKgoFcnVsZXMYBSADKAsyGy5wcm90by5kZWNpZGUudjFhbHBoYTEuUnVsZRIXCg9jaGFyYWN0ZXJpc3RpY3MYBiADKAlKBAgDEARSC2ZpbmdlcnByaW50IrIBCg5EZWNpZGVSZXNwb25zZRIxCghkZWNpc2lvbhgBIAEoCzIfLnByb3RvLmRlY2lkZS52MWFscGhhMS5EZWNpc2lvbhI/CgVleHRyYRgCIAMoCzIwLnByb3RvLmRlY2lkZS52MWFscGhhMS5EZWNpZGVSZXNwb25zZS5FeHRyYUVudHJ5GiwKCkV4dHJhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4ASKuAgoNUmVwb3J0UmVxdWVzdBIyCglzZGtfc3RhY2sYASABKA4yHy5wcm90by5kZWNpZGUudjFhbHBoYTEuU0RLU3RhY2sSEwoLc2RrX3ZlcnNpb24YAiABKAkSNgoHZGV0YWlscxgEIAEoCzIlLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXF1ZXN0RGV0YWlscxIxCghkZWNpc2lvbhgFIAEoCzIfLnByb3RvLmRlY2lkZS52MWFscGhhMS5EZWNpc2lvbhIqCgVydWxlcxgGIAMoCzIbLnByb3RvLmRlY2lkZS52MWFscGhhMS5SdWxlEhcKD2NoYXJhY3RlcmlzdGljcxgIIAMoCUoECAMQBEoECAcQCFILZmluZ2VycHJpbnRSC3JlY2VpdmVkX2F0Io8BCg5SZXBvcnRSZXNwb25zZRI/CgVleHRyYRgCIAMoCzIwLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXBvcnRSZXNwb25zZS5FeHRyYUVudHJ5GiwKCkV4dHJhRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUoECAEQAlIIZGVjaXNpb24qrwEKB0JvdFR5cGUSGAoUQk9UX1RZUEVfVU5TUEVDSUZJRUQQABIZChVCT1RfVFlQRV9OT1RfQU5BTFlaRUQQARIWChJCT1RfVFlQRV9BVVRPTUFURUQQAhIdChlCT1RfVFlQRV9MSUtFTFlfQVVUT01BVEVEEAMSHQoZQk9UX1RZUEVfTElLRUxZX05PVF9BX0JPVBAEEhkKFUJPVF9UWVBFX1ZFUklGSUVEX0JPVBAFKqkBCglFbWFpbFR5cGUSGgoWRU1BSUxfVFlQRV9VTlNQRUNJRklFRBAAEhkKFUVNQUlMX1RZUEVfRElTUE9TQUJMRRABEhMKD0VNQUlMX1RZUEVfRlJFRRACEhwKGEVNQUlMX1RZUEVfTk9fTVhfUkVDT1JEUxADEhoKFkVNQUlMX1RZUEVfTk9fR1JBVkFUQVIQBBIWChJFTUFJTF9UWVBFX0lOVkFMSUQQBSo9CgRNb2RlEhQKEE1PREVfVU5TUEVDSUZJRUQQABIQCgxNT0RFX0RSWV9SVU4QARINCglNT0RFX0xJVkUQAiqCAQoJUnVsZVN0YXRlEhoKFlJVTEVfU1RBVEVfVU5TUEVDSUZJRUQQABISCg5SVUxFX1NUQVRFX1JVThABEhYKElJVTEVfU1RBVEVfTk9UX1JVThACEhYKElJVTEVfU1RBVEVfRFJZX1JVThADEhUKEVJVTEVfU1RBVEVfQ0FDSEVEEAQqgwEKCkNvbmNsdXNpb24SGgoWQ09OQ0xVU0lPTl9VTlNQRUNJRklFRBAAEhQKEENPTkNMVVNJT05fQUxMT1cQARITCg9DT05DTFVTSU9OX0RFTlkQAhIYChRDT05DTFVTSU9OX0NIQUxMRU5HRRADEhQKEENPTkNMVVNJT05fRVJST1IQBCrqAgoIU0RLU3RhY2sSGQoVU0RLX1NUQUNLX1VOU1BFQ0lGSUVEEAASFAoQU0RLX1NUQUNLX05PREVKUxABEhQKEFNES19TVEFDS19ORVhUSlMQAhIUChBTREtfU1RBQ0tfUFlUSE9OEAMSFAoQU0RLX1NUQUNLX0RKQU5HTxAEEhEKDVNES19TVEFDS19CVU4QBRISCg5TREtfU1RBQ0tfREVOTxAGEhcKE1NES19TVEFDS19TVkVMVEVLSVQQBxISCg5TREtfU1RBQ0tfSE9OTxAIEhIKDlNES19TVEFDS19OVVhUEAkSFAoQU0RLX1NUQUNLX05FU1RKUxAKEhMKD1NES19TVEFDS19SRU1JWBALEhMKD1NES19TVEFDS19BU1RSTxAMEhUKEVNES19TVEFDS19GQVNUSUZZEA0SGgoWU0RLX1NUQUNLX1JFQUNUX1JPVVRFUhAOEhAKDFNES19TVEFDS19HTxAPKrEBChJSYXRlTGltaXRBbGdvcml0aG0SJAogUkFURV9MSU1JVF9BTEdPUklUSE1fVU5TUEVDSUZJRUQQABIlCiFSQVRFX0xJTUlUX0FMR09SSVRITV9UT0tFTl9CVUNLRVQQARIlCiFSQVRFX0xJTUlUX0FMR09SSVRITV9GSVhFRF9XSU5ET1cQAhInCiNSQVRFX0xJTUlUX0FMR09SSVRITV9TTElESU5HX1dJTkRPVxADKj8KFFJhdGVMaW1pdFJ1bGVWZXJzaW9uEicKI1JBVEVfTElNSVRfUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAqNwoQQm90VjJSdWxlVmVyc2lvbhIjCh9CT1RfVjJfUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAqNgoQRW1haWxSdWxlVmVyc2lvbhIiCh5FTUFJTF9SVUxFX1ZFUlNJT05fVU5TUEVDSUZJRUQQACpHChhTZW5zaXRpdmVJbmZvUnVsZVZlcnNpb24SKwonU0VOU0lUSVZFX0lORk9fUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAqOAoRU2hpZWxkUnVsZVZlcnNpb24SIwofU0hJRUxEX1JVTEVfVkVSU0lPTl9VTlNQRUNJRklFRBAAKjgKEUZpbHRlclJ1bGVWZXJzaW9uEiMKH0ZJTFRFUl9SVUxFX1ZFUlNJT05fVU5TUEVDSUZJRUQQACpeCiNQcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlVmVyc2lvbhI3CjNQUk9NUFRfSU5KRUNUSU9OX0RFVEVDVElPTl9SVUxFX1ZFUlNJT05fVU5TUEVDSUZJRUQQADK9AQoNRGVjaWRlU2VydmljZRJVCgZEZWNpZGUSJC5wcm90by5kZWNpZGUudjFhbHBoYTEuRGVjaWRlUmVxdWVzdBolLnByb3RvLmRlY2lkZS52MWFscGhhMS5EZWNpZGVSZXNwb25zZRJVCgZSZXBvcnQSJC5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVwb3J0UmVxdWVzdBolLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXBvcnRSZXNwb25zZULKAQoZY29tLnByb3RvLmRlY2lkZS52MWFscGhhMUILRGVjaWRlUHJvdG9QAVoqYXJjamV0L2dlbi9nby9kZWNpZGUvYWxwaGExO2RlY2lkZXYxYWxwaGExogIDUERYqgIVUHJvdG8uRGVjaWRlLlYxYWxwaGExygIVUHJvdG9cRGVjaWRlXFYxYWxwaGEx4gIhUHJvdG9cRGVjaWRlXFYxYWxwaGExXEdQQk1ldGFkYXRh6gIXUHJvdG86OkRlY2lkZTo6VjFhbHBoYTFiBnByb3RvMw", [file_google_protobuf_timestamp]);
+  fileDesc("CiJwcm90by9kZWNpZGUvdjFhbHBoYTEvZGVjaWRlLnByb3RvEhVwcm90by5kZWNpZGUudjFhbHBoYTEinQQKCUlwRGV0YWlscxIQCghsYXRpdHVkZRgBIAEoARIRCglsb25naXR1ZGUYAiABKAESFwoPYWNjdXJhY3lfcmFkaXVzGAMgASgFEhAKCHRpbWV6b25lGAQgASgJEhMKC3Bvc3RhbF9jb2RlGAUgASgJEgwKBGNpdHkYBiABKAkSDgoGcmVnaW9uGAcgASgJEg8KB2NvdW50cnkYCCABKAkSFAoMY291bnRyeV9uYW1lGAkgASgJEhEKCWNvbnRpbmVudBgKIAEoCRIWCg5jb250aW5lbnRfbmFtZRgLIAEoCRILCgNhc24YDCABKAkSEAoIYXNuX25hbWUYDSABKAkSEgoKYXNuX2RvbWFpbhgOIAEoCRIQCghhc25fdHlwZRgPIAEoCRITCgthc25fY291bnRyeRgQIAEoCRIPCgdzZXJ2aWNlGBEgASgJEhIKCmlzX2hvc3RpbmcYEiABKAgSDgoGaXNfdnBuGBMgASgIEhAKCGlzX3Byb3h5GBQgASgIEg4KBmlzX3RvchgVIAEoCBIQCghpc19yZWxheRgWIAEoCBIRCglpc19hYnVzZXIYFyABKAgSOAoEYm90cxgYIAMoCzIqLnByb3RvLmRlY2lkZS52MWFscGhhMS5JcERldGFpbHMuQm90c0VudHJ5GisKCUJvdHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIt8ECgZSZWFzb24SPAoKcmF0ZV9saW1pdBgBIAEoCzImLnByb3RvLmRlY2lkZS52MWFscGhhMS5SYXRlTGltaXRSZWFzb25IABI+CgllZGdlX3J1bGUYAiABKAsyJS5wcm90by5kZWNpZGUudjFhbHBoYTEuRWRnZVJ1bGVSZWFzb25CAhgBSAASLwoDYm90GAMgASgLMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFJlYXNvbkgAEjUKBnNoaWVsZBgEIAEoCzIjLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSZWFzb25IABIzCgVlbWFpbBgFIAEoCzIiLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFJlYXNvbkgAEjMKBWVycm9yGAYgASgLMiIucHJvdG8uZGVjaWRlLnYxYWxwaGExLkVycm9yUmVhc29uSAASRAoOc2Vuc2l0aXZlX2luZm8YByABKAsyKi5wcm90by5kZWNpZGUudjFhbHBoYTEuU2Vuc2l0aXZlSW5mb1JlYXNvbkgAEjQKBmJvdF92MhgIIAEoCzIiLnByb3RvLmRlY2lkZS52MWFscGhhMS5Cb3RWMlJlYXNvbkgAEjUKBmZpbHRlchgJIAEoCzIjLnByb3RvLmRlY2lkZS52MWFscGhhMS5GaWx0ZXJSZWFzb25IABJIChBwcm9tcHRfaW5qZWN0aW9uGAogASgLMiwucHJvdG8uZGVjaWRlLnYxYWxwaGExLlByb21wdEluamVjdGlvblJlYXNvbkgAQggKBnJlYXNvbiKtAQoPUmF0ZUxpbWl0UmVhc29uEgsKA21heBgBIAEoDRIRCgVjb3VudBgCIAEoBUICGAESEQoJcmVtYWluaW5nGAMgASgNEjIKCnJlc2V0X3RpbWUYBCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQgIYARIYChByZXNldF9pbl9zZWNvbmRzGAUgASgNEhkKEXdpbmRvd19pbl9zZWNvbmRzGAYgASgNIhQKDkVkZ2VSdWxlUmVhc29uOgIYASLCAQoJQm90UmVhc29uEjAKCGJvdF90eXBlGAEgASgOMh4ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFR5cGUSEQoJYm90X3Njb3JlGAIgASgFEhgKEHVzZXJfYWdlbnRfbWF0Y2gYAyABKAgSEgoKaXBfaG9zdGluZxgFIAEoCBIOCgZpcF92cG4YBiABKAgSEAoIaXBfcHJveHkYByABKAgSDgoGaXBfdG9yGAggASgIEhAKCGlwX3JlbGF5GAkgASgIIlEKC0JvdFYyUmVhc29uEg8KB2FsbG93ZWQYASADKAkSDgoGZGVuaWVkGAIgAygJEhAKCHZlcmlmaWVkGAMgASgIEg8KB3Nwb29mZWQYBCABKAgiPAoMU2hpZWxkUmVhc29uEhgKEHNoaWVsZF90cmlnZ2VyZWQYASABKAgSEgoKc3VzcGljaW91cxgCIAEoCCJtCgxGaWx0ZXJSZWFzb24SHgoSbWF0Y2hlZF9leHByZXNzaW9uGAEgASgJQgIYARIbChNtYXRjaGVkX2V4cHJlc3Npb25zGAIgAygJEiAKGHVuZGV0ZXJtaW5lZF9leHByZXNzaW9ucxgDIAMoCSJECgtFbWFpbFJlYXNvbhI1CgtlbWFpbF90eXBlcxgBIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUiHgoLRXJyb3JSZWFzb24SDwoHbWVzc2FnZRgBIAEoCSJcChVQcm9tcHRJbmplY3Rpb25SZWFzb24SGgoSaW5qZWN0aW9uX2RldGVjdGVkGAEgASgIEhEKBXNjb3JlGAIgASgBQgIYARIUCgx0b3RhbF90b2tlbnMYAyABKA0iRwoQSWRlbnRpZmllZEVudGl0eRIXCg9pZGVudGlmaWVkX3R5cGUYASABKAkSDQoFc3RhcnQYAiABKA0SCwoDZW5kGAMgASgNIogBChNTZW5zaXRpdmVJbmZvUmVhc29uEjgKB2FsbG93ZWQYASADKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuSWRlbnRpZmllZEVudGl0eRI3CgZkZW5pZWQYAiADKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuSWRlbnRpZmllZEVudGl0eSL1AgoNUmF0ZUxpbWl0UnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFbWF0Y2gYAiABKAkSFwoPY2hhcmFjdGVyaXN0aWNzGAMgAygJEhIKBndpbmRvdxgEIAEoCUICGAESCwoDbWF4GAUgASgNEg8KB3RpbWVvdXQYBiABKAkSPAoJYWxnb3JpdGhtGAcgASgOMikucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJhdGVMaW1pdEFsZ29yaXRobRITCgtyZWZpbGxfcmF0ZRgIIAEoDRIQCghpbnRlcnZhbBgJIAEoDRIQCghjYXBhY2l0eRgKIAEoDRIZChF3aW5kb3dfaW5fc2Vjb25kcxgMIAEoDRI8Cgd2ZXJzaW9uGA0gASgOMisucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJhdGVMaW1pdFJ1bGVWZXJzaW9uSgQICxAMUglyZXF1ZXN0ZWQixgIKB0JvdFJ1bGUSKQoEbW9kZRgBIAEoDjIbLnByb3RvLmRlY2lkZS52MWFscGhhMS5Nb2RlEi0KBWJsb2NrGAIgAygOMh4ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFR5cGUSOQoIcGF0dGVybnMYAyABKAsyJy5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90UnVsZS5QYXR0ZXJucxqlAQoIUGF0dGVybnMSPQoDYWRkGAEgAygLMjAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkJvdFJ1bGUuUGF0dGVybnMuQWRkRW50cnkSDgoGcmVtb3ZlGAIgAygJGkoKCEFkZEVudHJ5EgsKA2tleRgBIAEoCRItCgV2YWx1ZRgCIAEoDjIeLnByb3RvLmRlY2lkZS52MWFscGhhMS5Cb3RUeXBlOgI4ASKNAQoJQm90VjJSdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRINCgVhbGxvdxgCIAMoCRIMCgRkZW55GAMgAygJEjgKB3ZlcnNpb24YBCABKA4yJy5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90VjJSdWxlVmVyc2lvbiLGAgoJRW1haWxSdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRIzCgVibG9jaxgCIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGVCAhgBEiAKGHJlcXVpcmVfdG9wX2xldmVsX2RvbWFpbhgDIAEoCBIcChRhbGxvd19kb21haW5fbGl0ZXJhbBgEIAEoCBIvCgVhbGxvdxgFIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUSLgoEZGVueRgGIAMoDjIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFR5cGUSOAoHdmVyc2lvbhgHIAEoDjInLnByb3RvLmRlY2lkZS52MWFscGhhMS5FbWFpbFJ1bGVWZXJzaW9uIp0BChFTZW5zaXRpdmVJbmZvUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFYWxsb3cYAiADKAkSDAoEZGVueRgDIAMoCRJACgd2ZXJzaW9uGAQgASgOMi8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlNlbnNpdGl2ZUluZm9SdWxlVmVyc2lvbiKfAQoKU2hpZWxkUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSEgoKYXV0b19hZGRlZBgCIAEoCBIXCg9jaGFyYWN0ZXJpc3RpY3MYAyADKAkSOQoHdmVyc2lvbhgEIAEoDjIoLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSdWxlVmVyc2lvbiKPAQoKRmlsdGVyUnVsZRIpCgRtb2RlGAEgASgOMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLk1vZGUSDQoFYWxsb3cYAiADKAkSDAoEZGVueRgDIAMoCRI5Cgd2ZXJzaW9uGAQgASgOMigucHJvdG8uZGVjaWRlLnYxYWxwaGExLkZpbHRlclJ1bGVWZXJzaW9uIsABChxQcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlEikKBG1vZGUYASABKA4yGy5wcm90by5kZWNpZGUudjFhbHBoYTEuTW9kZRIaCgl0aHJlc2hvbGQYAiABKAFCAhgBSACIAQESSwoHdmVyc2lvbhgDIAEoDjI6LnByb3RvLmRlY2lkZS52MWFscGhhMS5Qcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlVmVyc2lvbkIMCgpfdGhyZXNob2xkIuoDCgRSdWxlEjoKCnJhdGVfbGltaXQYASABKAsyJC5wcm90by5kZWNpZGUudjFhbHBoYTEuUmF0ZUxpbWl0UnVsZUgAEi4KBGJvdHMYAiABKAsyHi5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90UnVsZUgAEjEKBWVtYWlsGAMgASgLMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkVtYWlsUnVsZUgAEjMKBnNoaWVsZBgEIAEoCzIhLnByb3RvLmRlY2lkZS52MWFscGhhMS5TaGllbGRSdWxlSAASQgoOc2Vuc2l0aXZlX2luZm8YBSABKAsyKC5wcm90by5kZWNpZGUudjFhbHBoYTEuU2Vuc2l0aXZlSW5mb1J1bGVIABIyCgZib3RfdjIYBiABKAsyIC5wcm90by5kZWNpZGUudjFhbHBoYTEuQm90VjJSdWxlSAASMwoGZmlsdGVyGAcgASgLMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkZpbHRlclJ1bGVIABJZChpwcm9tcHRfaW5qZWN0aW9uX2RldGVjdGlvbhgIIAEoCzIzLnByb3RvLmRlY2lkZS52MWFscGhhMS5Qcm9tcHRJbmplY3Rpb25EZXRlY3Rpb25SdWxlSABCBgoEcnVsZSLWAQoKUnVsZVJlc3VsdBIPCgdydWxlX2lkGAEgASgJEi8KBXN0YXRlGAIgASgOMiAucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJ1bGVTdGF0ZRI1Cgpjb25jbHVzaW9uGAMgASgOMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkNvbmNsdXNpb24SLQoGcmVhc29uGAQgASgLMh0ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlYXNvbhILCgN0dGwYBSABKA0SEwoLZmluZ2VycHJpbnQYBiABKAkiKAoHV2FybmluZxIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAkikwMKDlJlcXVlc3REZXRhaWxzEgoKAmlwGAEgASgJEg4KBm1ldGhvZBgCIAEoCRIQCghwcm90b2NvbBgDIAEoCRIMCgRob3N0GAQgASgJEgwKBHBhdGgYBSABKAkSQwoHaGVhZGVycxgGIAMoCzIyLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXF1ZXN0RGV0YWlscy5IZWFkZXJzRW50cnkSDAoEYm9keRgHIAEoDBI/CgVleHRyYRgIIAMoCzIwLnByb3RvLmRlY2lkZS52MWFscGhhMS5SZXF1ZXN0RGV0YWlscy5FeHRyYUVudHJ5Eg0KBWVtYWlsGAkgASgJEg8KB2Nvb2tpZXMYCiABKAkSDQoFcXVlcnkYCyABKAkSFgoOY29ycmVsYXRpb25faWQYDCABKAkaLgoMSGVhZGVyc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEaLAoKRXh0cmFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIvgBCghEZWNpc2lvbhIKCgJpZBgBIAEoCRI1Cgpjb25jbHVzaW9uGAIgASgOMiEucHJvdG8uZGVjaWRlLnYxYWxwaGExLkNvbmNsdXNpb24SLQoGcmVhc29uGAMgASgLMh0ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlYXNvbhI3CgxydWxlX3Jlc3VsdHMYBCADKAsyIS5wcm90by5kZWNpZGUudjFhbHBoYTEuUnVsZVJlc3VsdBILCgN0dGwYBSABKA0SNAoKaXBfZGV0YWlscxgGIAEoCzIgLnByb3RvLmRlY2lkZS52MWFscGhhMS5JcERldGFpbHMipAMKDURlY2lkZVJlcXVlc3QSMgoJc2RrX3N0YWNrGAEgASgOMh8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLlNES1N0YWNrEhMKC3Nka192ZXJzaW9uGAIgASgJEjYKB2RldGFpbHMYBCABKAsyJS5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVxdWVzdERldGFpbHMSKgoFcnVsZXMYBSADKAsyGy5wcm90by5kZWNpZGUudjFhbHBoYTEuUnVsZRIXCg9jaGFyYWN0ZXJpc3RpY3MYBiADKAkSTQoNbWV0YWRhdGFfanNvbhgHIAMoCzI2LnByb3RvLmRlY2lkZS52MWFscGhhMS5EZWNpZGVSZXF1ZXN0Lk1ldGFkYXRhSnNvbkVudHJ5EjYKDmxvY2FsX3dhcm5pbmdzGAggAygLMh4ucHJvdG8uZGVjaWRlLnYxYWxwaGExLldhcm5pbmcaMwoRTWV0YWRhdGFKc29uRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUoECAMQBFILZmluZ2VycHJpbnQisgEKDkRlY2lkZVJlc3BvbnNlEjEKCGRlY2lzaW9uGAEgASgLMh8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkRlY2lzaW9uEj8KBWV4dHJhGAIgAygLMjAucHJvdG8uZGVjaWRlLnYxYWxwaGExLkRlY2lkZVJlc3BvbnNlLkV4dHJhRW50cnkaLAoKRXh0cmFFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIuoDCg1SZXBvcnRSZXF1ZXN0EjIKCXNka19zdGFjaxgBIAEoDjIfLnByb3RvLmRlY2lkZS52MWFscGhhMS5TREtTdGFjaxITCgtzZGtfdmVyc2lvbhgCIAEoCRI2CgdkZXRhaWxzGAQgASgLMiUucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlcXVlc3REZXRhaWxzEjEKCGRlY2lzaW9uGAUgASgLMh8ucHJvdG8uZGVjaWRlLnYxYWxwaGExLkRlY2lzaW9uEioKBXJ1bGVzGAYgAygLMhsucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJ1bGUSFwoPY2hhcmFjdGVyaXN0aWNzGAggAygJEk0KDW1ldGFkYXRhX2pzb24YCSADKAsyNi5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVwb3J0UmVxdWVzdC5NZXRhZGF0YUpzb25FbnRyeRI2Cg5sb2NhbF93YXJuaW5ncxgKIAMoCzIeLnByb3RvLmRlY2lkZS52MWFscGhhMS5XYXJuaW5nGjMKEU1ldGFkYXRhSnNvbkVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAFKBAgDEARKBAgHEAhSC2ZpbmdlcnByaW50UgtyZWNlaXZlZF9hdCKPAQoOUmVwb3J0UmVzcG9uc2USPwoFZXh0cmEYAiADKAsyMC5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVwb3J0UmVzcG9uc2UuRXh0cmFFbnRyeRosCgpFeHRyYUVudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAFKBAgBEAJSCGRlY2lzaW9uKq8BCgdCb3RUeXBlEhgKFEJPVF9UWVBFX1VOU1BFQ0lGSUVEEAASGQoVQk9UX1RZUEVfTk9UX0FOQUxZWkVEEAESFgoSQk9UX1RZUEVfQVVUT01BVEVEEAISHQoZQk9UX1RZUEVfTElLRUxZX0FVVE9NQVRFRBADEh0KGUJPVF9UWVBFX0xJS0VMWV9OT1RfQV9CT1QQBBIZChVCT1RfVFlQRV9WRVJJRklFRF9CT1QQBSqpAQoJRW1haWxUeXBlEhoKFkVNQUlMX1RZUEVfVU5TUEVDSUZJRUQQABIZChVFTUFJTF9UWVBFX0RJU1BPU0FCTEUQARITCg9FTUFJTF9UWVBFX0ZSRUUQAhIcChhFTUFJTF9UWVBFX05PX01YX1JFQ09SRFMQAxIaChZFTUFJTF9UWVBFX05PX0dSQVZBVEFSEAQSFgoSRU1BSUxfVFlQRV9JTlZBTElEEAUqPQoETW9kZRIUChBNT0RFX1VOU1BFQ0lGSUVEEAASEAoMTU9ERV9EUllfUlVOEAESDQoJTU9ERV9MSVZFEAIqggEKCVJ1bGVTdGF0ZRIaChZSVUxFX1NUQVRFX1VOU1BFQ0lGSUVEEAASEgoOUlVMRV9TVEFURV9SVU4QARIWChJSVUxFX1NUQVRFX05PVF9SVU4QAhIWChJSVUxFX1NUQVRFX0RSWV9SVU4QAxIVChFSVUxFX1NUQVRFX0NBQ0hFRBAEKoMBCgpDb25jbHVzaW9uEhoKFkNPTkNMVVNJT05fVU5TUEVDSUZJRUQQABIUChBDT05DTFVTSU9OX0FMTE9XEAESEwoPQ09OQ0xVU0lPTl9ERU5ZEAISGAoUQ09OQ0xVU0lPTl9DSEFMTEVOR0UQAxIUChBDT05DTFVTSU9OX0VSUk9SEAQq6gIKCFNES1N0YWNrEhkKFVNES19TVEFDS19VTlNQRUNJRklFRBAAEhQKEFNES19TVEFDS19OT0RFSlMQARIUChBTREtfU1RBQ0tfTkVYVEpTEAISFAoQU0RLX1NUQUNLX1BZVEhPThADEhQKEFNES19TVEFDS19ESkFOR08QBBIRCg1TREtfU1RBQ0tfQlVOEAUSEgoOU0RLX1NUQUNLX0RFTk8QBhIXChNTREtfU1RBQ0tfU1ZFTFRFS0lUEAcSEgoOU0RLX1NUQUNLX0hPTk8QCBISCg5TREtfU1RBQ0tfTlVYVBAJEhQKEFNES19TVEFDS19ORVNUSlMQChITCg9TREtfU1RBQ0tfUkVNSVgQCxITCg9TREtfU1RBQ0tfQVNUUk8QDBIVChFTREtfU1RBQ0tfRkFTVElGWRANEhoKFlNES19TVEFDS19SRUFDVF9ST1VURVIQDhIQCgxTREtfU1RBQ0tfR08QDyqxAQoSUmF0ZUxpbWl0QWxnb3JpdGhtEiQKIFJBVEVfTElNSVRfQUxHT1JJVEhNX1VOU1BFQ0lGSUVEEAASJQohUkFURV9MSU1JVF9BTEdPUklUSE1fVE9LRU5fQlVDS0VUEAESJQohUkFURV9MSU1JVF9BTEdPUklUSE1fRklYRURfV0lORE9XEAISJwojUkFURV9MSU1JVF9BTEdPUklUSE1fU0xJRElOR19XSU5ET1cQAyo/ChRSYXRlTGltaXRSdWxlVmVyc2lvbhInCiNSQVRFX0xJTUlUX1JVTEVfVkVSU0lPTl9VTlNQRUNJRklFRBAAKjcKEEJvdFYyUnVsZVZlcnNpb24SIwofQk9UX1YyX1JVTEVfVkVSU0lPTl9VTlNQRUNJRklFRBAAKjYKEEVtYWlsUnVsZVZlcnNpb24SIgoeRU1BSUxfUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAqRwoYU2Vuc2l0aXZlSW5mb1J1bGVWZXJzaW9uEisKJ1NFTlNJVElWRV9JTkZPX1JVTEVfVkVSU0lPTl9VTlNQRUNJRklFRBAAKjgKEVNoaWVsZFJ1bGVWZXJzaW9uEiMKH1NISUVMRF9SVUxFX1ZFUlNJT05fVU5TUEVDSUZJRUQQACo4ChFGaWx0ZXJSdWxlVmVyc2lvbhIjCh9GSUxURVJfUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAqXgojUHJvbXB0SW5qZWN0aW9uRGV0ZWN0aW9uUnVsZVZlcnNpb24SNwozUFJPTVBUX0lOSkVDVElPTl9ERVRFQ1RJT05fUlVMRV9WRVJTSU9OX1VOU1BFQ0lGSUVEEAAyvQEKDURlY2lkZVNlcnZpY2USVQoGRGVjaWRlEiQucHJvdG8uZGVjaWRlLnYxYWxwaGExLkRlY2lkZVJlcXVlc3QaJS5wcm90by5kZWNpZGUudjFhbHBoYTEuRGVjaWRlUmVzcG9uc2USVQoGUmVwb3J0EiQucHJvdG8uZGVjaWRlLnYxYWxwaGExLlJlcG9ydFJlcXVlc3QaJS5wcm90by5kZWNpZGUudjFhbHBoYTEuUmVwb3J0UmVzcG9uc2VCygEKGWNvbS5wcm90by5kZWNpZGUudjFhbHBoYTFCC0RlY2lkZVByb3RvUAFaKmFyY2pldC9nZW4vZ28vZGVjaWRlL2FscGhhMTtkZWNpZGV2MWFscGhhMaICA1BEWKoCFVByb3RvLkRlY2lkZS5WMWFscGhhMcoCFVByb3RvXERlY2lkZVxWMWFscGhhMeICIVByb3RvXERlY2lkZVxWMWFscGhhMVxHUEJNZXRhZGF0YeoCF1Byb3RvOjpEZWNpZGU6OlYxYWxwaGExYgZwcm90bzM", [file_google_protobuf_timestamp]);
 
@@ -185,2 +185,9 @@ /**
 /**
+ * Describes the message proto.decide.v1alpha1.Warning.
+ * Use `create(WarningSchema)` to create a new message.
+ */
+export const WarningSchema = /*@__PURE__*/
+  messageDesc(file_proto_decide_v1alpha1_decide, 23);
+
+/**
  * Describes the message proto.decide.v1alpha1.RequestDetails.
@@ -190,3 +197,3 @@ * Use `create(RequestDetailsSchema)` to create a new message.
 export const RequestDetailsSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 23);
+  messageDesc(file_proto_decide_v1alpha1_decide, 24);
 
@@ -198,3 +205,3 @@ /**
 export const DecisionSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 24);
+  messageDesc(file_proto_decide_v1alpha1_decide, 25);
 
@@ -206,3 +213,3 @@ /**
 export const DecideRequestSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 25);
+  messageDesc(file_proto_decide_v1alpha1_decide, 26);
 
@@ -214,3 +221,3 @@ /**
 export const DecideResponseSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 26);
+  messageDesc(file_proto_decide_v1alpha1_decide, 27);
 
@@ -222,3 +229,3 @@ /**
 export const ReportRequestSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 27);
+  messageDesc(file_proto_decide_v1alpha1_decide, 28);
 
@@ -230,3 +237,3 @@ /**
 export const ReportResponseSchema = /*@__PURE__*/
-  messageDesc(file_proto_decide_v1alpha1_decide, 28);
+  messageDesc(file_proto_decide_v1alpha1_decide, 29);
 
@@ -233,0 +240,0 @@ /**

dist/typeid.d.ts

 //#region src/typeid.d.ts
 /**
-* Minimal, dependency-free TypeID generator for local request IDs.
-*
-* Replaces the external `typeid-js` package (and its transitive `uuid`
-* dependency) with an inline implementation. We only ever mint new IDs with a
-* fixed prefix, so this covers generation — not parsing or decoding.
-*
-* The suffix is the 26-character Crockford base32 encoding of a UUIDv7
-* (RFC 9562), matching the TypeID specification
-* (https://github.com/jetify-com/typeid). Mirrors the vendored implementation
-* in the Arcjet Python SDK so both SDKs produce identical IDs.
-*/
+ * Minimal, dependency-free TypeID generator for local request IDs.
+ *
+ * Replaces the external `typeid-js` package (and its transitive `uuid`
+ * dependency) with an inline implementation. We only ever mint new IDs with a
+ * fixed prefix, so this covers generation — not parsing or decoding.
+ *
+ * The suffix is the 26-character Crockford base32 encoding of a UUIDv7
+ * (RFC 9562), matching the TypeID specification
+ * (https://github.com/jetify-com/typeid). Mirrors the vendored implementation
+ * in the Arcjet Python SDK so both SDKs produce identical IDs.
+ */
 /** Crockford base32 alphabet (lowercase, excludes `i`, `l`, `o`, `u`). */
 declare const CROCKFORD_ALPHABET = "0123456789abcdefghjkmnpqrstvwxyz";
 /**
-* Generate the 16 raw bytes of a UUIDv7 (RFC 9562): a 48-bit big-endian
-* millisecond timestamp, version `7`, the RFC 4122 variant (`10`), and random
-* bits filling the remainder.
-*
-* `nowMs` and `random` are injectable for deterministic testing; production
-* callers use the defaults.
-*
-* @throws {RangeError}
-*   If `nowMs` is not an integer in the 48-bit range `[0, 2 ** 48)`, or if
-*   `random` is not exactly 10 bytes. Both would otherwise silently produce a
-*   malformed ID (a wrapped timestamp or zero-filled entropy).
-*/
+ * Generate the 16 raw bytes of a UUIDv7 (RFC 9562): a 48-bit big-endian
+ * millisecond timestamp, version `7`, the RFC 4122 variant (`10`), and random
+ * bits filling the remainder.
+ *
+ * `nowMs` and `random` are injectable for deterministic testing; production
+ * callers use the defaults.
+ *
+ * @throws {RangeError}
+ *   If `nowMs` is not an integer in the 48-bit range `[0, 2 ** 48)`, or if
+ *   `random` is not exactly 10 bytes. Both would otherwise silently produce a
+ *   malformed ID (a wrapped timestamp or zero-filled entropy).
+ */
 declare function uuidV7Bytes(nowMs?: number, random?: Uint8Array): Uint8Array;
 /**
-* Generate a new TypeID string — `<prefix>_<suffix>`, where the suffix is the
-* Crockford base32 encoding of a freshly generated UUIDv7.
-*
-* `nowMs` and `random` are injectable for deterministic testing.
-*/
+ * Generate a new TypeID string — `<prefix>_<suffix>`, where the suffix is the
+ * Crockford base32 encoding of a freshly generated UUIDv7.
+ *
+ * `nowMs` and `random` are injectable for deterministic testing.
+ */
 declare function typeid(prefix: string, nowMs?: number, random?: Uint8Array): string;
 //#endregion
 export { CROCKFORD_ALPHABET, typeid, uuidV7Bytes };

package.json

 {
   "name": "@arcjet/protocol",
-  "version": "1.9.1",
+  "version": "1.10.0-rc.0",
   "description": "The TypeScript & JavaScript interface into the Arcjet protocol",
@@ -78,3 +78,3 @@ "keywords": [
     "build": "tsdown",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsc --noEmit",
     "test-api": "node --test -- test/*.test.ts",
@@ -85,10 +85,10 @@ "test-coverage": "node --experimental-test-coverage --test -- test/*.test.ts",
   "dependencies": {
-    "@arcjet/cache": "1.9.1",
-    "@bufbuild/protobuf": "2.12.0",
+    "@arcjet/cache": "1.10.0-rc.0",
+    "@bufbuild/protobuf": "2.12.1",
     "@connectrpc/connect": "2.1.2"
   },
   "devDependencies": {
-    "@types/node": "22.19.21",
-    "tsdown": "0.22.3",
-    "typescript": "6.0.3"
+    "@types/node": "22.20.1",
+    "tsdown": "0.22.7",
+    "typescript": "7.0.2"
   },
@@ -95,0 +95,0 @@ "engines": {

New alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Improved metrics

Total package byte prevSize

223992

9.03%

Number of package files

17

13.33%

Lines of code

6663

6.85%

Worsened metrics

Number of low quality alerts

1

Infinity%

Dependency changes

• + Added

  @arcjet/cache@1.10.0-rc.0
  (transitive)

• + Added

  @bufbuild/protobuf@2.12.1
  (transitive)

• - Removed

  @arcjet/cache@1.9.1
  (transitive)

• - Removed

  @bufbuild/protobuf@2.12.0
  (transitive)

• Updated

  @arcjet/cache@1.10.0-rc.0

• Updated

  @bufbuild/protobuf@2.12.1