Google Gen AI SDK for TypeScript 2

Last reviewed Oct 20, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 746 lines · 1.5K tokens
  4. Google Gen AI SDK for TypeScript 256 lines · 3.9K tokens
Total305 lines · 13.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 94
  • 95
  • 113
  • 117
  • 200
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 613
  • 639
  • 653
  • 732
  • 754
  • 770
  • 772
  • 807
  • 829
  • 837
  • 838
  • 841
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 923
  • 942
  • 943
  • 1004
  • 1321
  • 1333
  • 1427

Prompt Preview

Apply the Node.js 24 and TypeScript 7 baselines first. These rules cover the active @google/genai 2.x stream, including Gemini Developer API and Gemini Enterprise Agent Platform clients. Apply optional-feature rules only when that API is present and used. When connecting MCP servers, also apply the MCP SDK for TypeScript prompt for its installed version.

Client configuration

  • Construct GoogleGenAI from trusted startup configuration. Explicitly select the backend with enterprise, or the legacy vertexai flag, and fix its project, location, credentials, API version and allowed models. Reject conflicting flags and environment settings; do not let request data select a billing project, credential or backend. SDK defaults use beta endpoints; select apiVersion: 'v1' when the required methods support it, and deliberately configure preview methods separately.
  • Keep ordinary Gemini API keys on the server. Use a dedicated application identity with narrowly scoped Google Cloud permissions for enterprise access, and restrict API keys to their intended API and application. Browser package exports do not protect a bundled key. Authenticate and quota the application's proxy or token-minting endpoint before it spends provider credentials.
  • Build SDK request objects from allowed application fields. Never spread an incoming body into config, client options or Interactions request options: httpOptions.extraBody, custom headers, API-version overrides and transport options can bypass the reviewed configuration.

Prompt injection

  • Keep config.systemInstruction,