Anthropic SDK for TypeScript 0.124

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 746 lines · 1.5K tokens
  4. Anthropic SDK for TypeScript 0.12469 lines · 2.7K tokens
Total318 lines · 12.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 200
  • 208
  • 209
  • 214
  • 250
  • 294
  • 295
  • 297
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 639
  • 653
  • 732
  • 754
  • 770
  • 807
  • 829
  • 838
  • 841
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333
  • 1427

Prompt Preview

Apply the Node.js 24 and TypeScript 7 prompts first. These rules target exactly @anthropic-ai/sdk 0.124.0: clients and credentials, Messages and streams, local and remote tools, files and batches, workspace-scoped resources, beta administration, and webhooks.

Runtime, client, and credential policy

  • Deploy only on a runtime the 0.124 README supports; for Node.js, use a non-EOL release at least as new as Node 20. Do not silently substitute React Native or Jest's jsdom environment.
  • Instantiate Anthropic in trusted server, worker, or edge code. Keep dangerouslyAllowBrowser false whenever the client has an API key, bearer token, webhook key, or other reusable secret.
  • Configure exactly one intended authentication route and reject ambiguous deployments. The client can consume API-key and auth-token environment variables, credential providers, in-memory configuration, named profiles, identity-token files, and cached OAuth credentials.
  • Protect profile, configuration, identity-token, and credential-cache paths as secrets. Validate their ownership and permissions before startup, and do not accept a profile name or path from a request.
  • Keep federation credential-cache files separate for each endpoint, organization, workspace, and identity. Reconstructing the client or changing a profile does not invalidate a fresh token in that file.
  • Pin the expected HTTPS API origin. Treat ANTHROPIC_BASE_URL, profile base_url, baseURL, fetch, fetchOptions, defaultHeaders, defaultQuery, custom middleware, and custom-header environment values as privileged