Google Gen AI SDK for TypeScript 2.19

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 746 lines · 1.5K tokens
  4. Google Gen AI SDK for TypeScript 2.1954 lines · 1.3K tokens
Total303 lines · 11.3K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 200
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 639
  • 653
  • 732
  • 754
  • 770
  • 807
  • 829
  • 838
  • 841
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 923
  • 942
  • 943
  • 1004
  • 1321
  • 1333
  • 1427

Prompt Preview

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover Google Gen AI SDK for TypeScript 2.19 clients, content, function calls, safety, grounding, files, caches, live sessions, and operations.

Clients and credentials

  • Construct GoogleGenAI server-side from trusted Gemini API-key settings or trusted Vertex project and location; callers never switch backends.
  • Keep keys out of browser bundles; the SDK permits web use, but its guidance warns client-side keys are exposed.
  • Set apiVersion: "v1" where the needed stable API supports it; 2.19 otherwise defaults to beta endpoints.
  • Keep httpOptions.baseUrl, headers, proxy, and transport in deployment configuration so input can't redirect credentials.
  • Propagate workload deadlines; an AbortSignal stops only the client request, not server-side generation or charges.

Content

  • Build system instructions from trusted policy; construct user, file, and function-response parts with explicit roles.
  • Allowlist model IDs, modalities, generation settings, and output-token limits instead of accepting raw GenerateContentConfig.
  • Bound history and every inline text, image, audio, video, document, and function-response part before serialization.
  • Treat candidates, executable code, URLs, grounding metadata, and media as untrusted destination input; handle absent candidates, blocked content, truncation, and incomplete streams instead of trusting convenience text.

Functions

  • Define bounded function declarations; map returned names through a fixed implementation registry.
  • Set