Genkit for JavaScript 1.42.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover Genkit 1.42.0 flows, generation, tools, beta agents, retrieval, optional middleware, A2UI, and telemetry.

Version scope and capability configuration

• Treat the deployment guide's Node.js 20+ minimum as compatibility information, not a security-support policy: Node.js 20 is end of life; the included runtime baseline governs deployment.
• Use genkit for stable APIs and deliberately opt into genkit/beta and genkit/beta/client for beta features. Keep compatible core and plugin versions in a reviewed lockfile. For beta agents, sessions, interrupts, or the experimental A2UI plugin, constrain automatic updates to patches of the selected minor with a ~ range or exact versions, and review migration notes and authorization, resume, and streaming tests before changing minors; beta APIs can break in a minor release.
• Construct genkit({ plugins, model }), model references, tools, use, output schemas, and provider settings from server-controlled allowlists. Fail when required capabilities are unavailable instead of silently dropping controls.
• Never merge request bodies into generation config. Google GenAI permits per-call apiKey, baseUrl, and apiVersion overrides; compat-OAI accepts provider configuration and extra tools. An endpoint override can redirect prompts and credentials, and provider-native capabilities can escape a local tool policy.
• Set provider-specific output limits and safety settings in trusted configuration and verify their effective request representation. Generic