Genkit for JavaScript 1.43

Apply the Node.js 24 and TypeScript 7 prompts first. These rules address Genkit flows, generation, beta agents, optional middleware, provider integrations, and serving surfaces.

Configure capabilities and providers

• Import stable APIs from genkit; opt into genkit/beta only for features the application has reviewed. Keep Genkit core and plugins compatible in the lockfile. When using beta agents, sessions, or interrupts, constrain automatic updates to the selected minor and review migration notes and security tests before moving to another minor.
• Build genkit({ plugins, model }), model references, prompt names, tools, use, schemas, and provider settings from trusted application configuration. A request or model response must not choose its own capabilities.
• Set model output tokens, application cost, concurrency, and total-work budgets explicitly. Check the effective provider request: compat-OAI adapters, Google GenAI's Interactions API route, and fallback models can map or reject options differently from the generic Genkit configuration. Do not treat a provider safety setting as authorization.
• Keep provider credentials and endpoints server controlled. Reject request-supplied config.apiKey, baseUrl, apiVersion, model aliases, provider-native tools, and fallback destinations. If using a tenant-supplied Google AI key, disable the ambient-key fallback with googleAI({ apiKey: false }) and authorize that tenant key before the call.
• Treat response.raw, custom, and provider-specific metadata as untrusted and version-sensitive. Validate only the