Genkit for JavaScript 1.41.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules target Genkit for JavaScript 1.41.0 on Node.js 24. Apply the beta agent, interrupt, and optional integration rules when those features are used.

Configuration and prompt authority

• Use the stable genkit entry point unless a feature requires genkit/beta; review beta behavior on every minor upgrade because beta APIs do not have the stable channel's compatibility guarantee.
• Build ai.generate() options from server policy. Allowlist any client-selectable model or preset; never spread a request body into model, system, config, tools, resources, use, or context.
• Protect Dotprompt files, front matter, helpers, partials, prompt names, and variants as application configuration. genkit() loads ./prompts by default; set a trusted promptDir, or promptDir: null when automatic loading is unnecessary.
• Pass user text and retrieved material as untrusted prompt data. Reconstruct conversation history from authorized state instead of accepting arbitrary client-supplied system messages, model messages, tool responses, or resumed metadata; prompt delimiters do not enforce authorization.

Flow authentication and HTTP exposure

• Authenticate exposed flows with verified credentials in expressHandler(..., { contextProvider }), fetchHandler(..., { contextProvider }), withFlowOptions(), or equivalent server middleware. An omitted context provider does not reject unauthenticated requests.
• Validate a configured key before calling apiKey(requiredKey) from genkit/context. apiKey() and