eslint-plugin-vercel-ai-security 1.4.0 → 1.4.2

package/src/rules/require-rag-content-validation/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireRagContentValidation = void 0;
-/**
- * @fileoverview Require validation of RAG content before use in prompts
- * @description Detects when retrieved documents are used directly without sanitization
- * @see OWASP ASI07: Poisoned RAG Pipeline
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
@@ -78,13 +68,8 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
             'validate', 'sanitize', 'filter', 'clean',
         ];
         const sourceCode = context.sourceCode;
-        // Vercel AI SDK functions
         const aiSDKFunctions = ['generateText', 'streamText', 'generateObject', 'streamObject'];
-        // Track variables that hold RAG content
         const ragVariables = new Set();
-        /**
-         * Check if expression is a RAG retrieval call
-         */
         function isRagCall(node) {
             if (node.type !== 'CallExpression')
                 return null;
@@ -96,16 +81,10 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
             }
             return null;
         }
-        /**
-         * Check if expression is wrapped in validation
-         */
         function isValidated(node) {
             const callee = sourceCode.getText(node.callee);
             return validatorFunctions.some((fn) => callee.toLowerCase().includes(fn.toLowerCase()));
         }
-        /**
-         * Check if an expression contains RAG content
-         */
         function containsRagContent(node) {
             if (node.type === 'Identifier' && ragVariables.has(node.name)) {
                 return node.name;
@@ -117,12 +96,10 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
                         return rag;
                 }
             }
-            // Handle: ${await retrieve(query)}
             if (node.type === 'AwaitExpression') {
                 return containsRagContent(node.argument);
             }
             if (node.type === 'CallExpression') {
-                // Check if this is an unvalidated RAG call
                 const ragSource = isRagCall(node);
                 if (ragSource && !isValidated(node)) {
                     return ragSource;
@@ -131,13 +108,11 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
             return null;
         }
         return {
-            // Track RAG variable assignments
             VariableDeclarator(node) {
                 if (node.id.type !== 'Identifier')
                     return;
                 if (!node.init)
                     return;
-                // Handle: const docs = await vectorStore.search(query);
                 let initNode = node.init;
                 if (initNode.type === 'AwaitExpression') {
                     initNode = initNode.argument;
@@ -148,19 +123,16 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
             },
             CallExpression(node) {
                 const callee = sourceCode.getText(node.callee);
-                // Check if this is an AI SDK function
                 const isAIFunction = aiSDKFunctions.some(fn => callee.includes(fn));
                 if (!isAIFunction)
                     return;
-                // Check first argument (options object)
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
-                // Check prompt property
                 for (const prop of optionsArg.properties) {
                     if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                     if (keyName !== 'prompt' && !(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     const ragSource = containsRagContent(prop.value);

package/src/rules/require-request-timeout/index.js

@@ -1,16 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireRequestTimeout = void 0;
-/**
- * @fileoverview Require timeout for AI API calls to prevent DoS
- * @description Detects AI calls without timeout configuration
- * @see OWASP LLM04: Model Denial of Service
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireRequestTimeout = (0, eslint_devkit_1.createRule)({
     name: 'require-request-timeout',
@@ -59,22 +49,17 @@ exports.requireRequestTimeout = (0, eslint_devkit_1.createRule)({
         const allowInTests = options.allowInTests ?? true;
         const sourceCode = context.sourceCode;
         const filename = context.filename;
-        // Skip test files if allowed
         if (allowInTests && /\.(test|spec)\.[jt]sx?$/.test(filename)) {
             return {};
         }
-        // Vercel AI SDK functions
         const aiSDKFunctions = ['generateText', 'streamText', 'generateObject', 'streamObject'];
-        // Timeout-related property names
         const timeoutProperties = new Set(['timeout', 'abortSignal', 'signal', 'timeoutMs', 'requestTimeout']);
         return {
             CallExpression(node) {
                 const callee = sourceCode.getText(node.callee);
-                // Check if this is an AI SDK function
                 const matchedFunction = aiSDKFunctions.find(fn => callee.includes(fn));
                 if (!matchedFunction)
                     return;
-                // Check first argument (options object)
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression') {
                     context.report({
@@ -84,7 +69,6 @@ exports.requireRequestTimeout = (0, eslint_devkit_1.createRule)({
                     });
                     return;
                 }
-                // Check for timeout or abort signal properties
                 const hasTimeout = optionsArg.properties.some(prop => {
                     if (prop.type !== 'Property')
                         return false;

package/src/rules/require-tool-confirmation/index.js

@@ -1,17 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireToolConfirmation = void 0;
-/**
- * @fileoverview Require human confirmation for destructive tool operations
- * @description Ensures tools that perform destructive actions have confirmation
- * @see OWASP ASI09: Human-Agent Trust Exploitation
- * @see OWASP LLM06: Excessive Agency
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
     name: 'require-tool-confirmation',
@@ -67,9 +56,6 @@ exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
         const destructivePatterns = options.destructivePatterns ?? [
             'delete', 'remove', 'transfer', 'execute', 'update', 'create',
         ];
-        /**
-         * Check if a tool name suggests destructive operation
-         */
         function isDestructiveTool(name) {
             const lowerName = name.toLowerCase();
             for (const pattern of destructivePatterns) {
@@ -79,15 +65,11 @@ exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
             }
             return null;
         }
-        /**
-         * Check if tool has confirmation requirement
-         */
-        // oxlint-disable-next-line consistent-function-scoping
         function hasConfirmationFlag(toolDef) {
             const confirmationProps = new Set([
                 'requiresConfirmation', 'requireConfirmation', 'confirmation',
                 'requiresApproval', 'requireApproval', 'approval',
-                'dangerouslyAllowBrowser', // If explicitly acknowledged
+                'dangerouslyAllowBrowser',
             ]);
             return toolDef.properties.some(prop => {
                 if (prop.type !== 'Property')
@@ -98,21 +80,17 @@ exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
         }
         return {
             Property(node) {
-                // Looking for tool definitions in tools object
                 if (node.key.type !== 'Identifier' && node.key.type !== 'Literal')
                     return;
                 const toolName = node.key.type === 'Identifier'
                     ? node.key.name
                     : String(node.key.value);
-                // Check if this looks like a tool definition
                 if (node.value.type !== 'ObjectExpression' && node.value.type !== 'CallExpression') {
                     return;
                 }
-                // Check if tool name suggests destructive operation
                 const destructiveOp = isDestructiveTool(toolName);
                 if (!destructiveOp)
                     return;
-                // Check the parent to ensure this is in a tools object
                 const parent = node.parent;
                 if (parent?.type !== 'ObjectExpression')
                     return;
@@ -122,7 +100,6 @@ exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
                 const toolsKey = grandparent.key;
                 if (toolsKey.type !== 'Identifier' || toolsKey.name !== 'tools')
                     return;
-                // For object expressions, check for confirmation flag
                 if (node.value.type === 'ObjectExpression') {
                     if (!hasConfirmationFlag(node.value)) {
                         context.report({
@@ -135,7 +112,6 @@ exports.requireToolConfirmation = (0, eslint_devkit_1.createRule)({
                         });
                     }
                 }
-                // For CallExpressions (tool() helper), we'll assume it might be handled
             },
         };
     },

package/src/rules/require-tool-schema/index.js

@@ -1,17 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireToolSchema = void 0;
-/**
- * @fileoverview Require Zod schema validation for tool parameters
- * @description Ensures all tools have proper inputSchema defined with Zod
- * @see https://sdk.vercel.ai/docs/ai-sdk-core/tools-and-tool-calling
- * @see OWASP ASI02: Tool Misuse & Exploitation
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
     name: 'require-tool-schema',
@@ -70,20 +59,16 @@ exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
         const allowInTests = options.allowInTests ?? false;
         const sourceCode = context.sourceCode;
         const filename = context.filename;
-        // Skip test files if allowed
         if (allowInTests && /\.(test|spec)\.[jt]sx?$/.test(filename)) {
             return {};
         }
-        // Vercel AI SDK functions that use tools
         const functionsWithTools = ['generateText', 'streamText', 'generateObject', 'streamObject'];
         return {
             CallExpression(node) {
                 const callee = sourceCode.getText(node.callee);
-                // Check if this is a target AI function or a tool() helper
                 const isAIFunction = functionsWithTools.some(fn => callee.includes(fn));
                 const isToolHelper = callee === 'tool' || callee.endsWith('.tool');
                 if (isToolHelper) {
-                    // Check tool() helper for inputSchema
                     const toolArg = node.arguments[0];
                     if (toolArg && toolArg.type === 'ObjectExpression') {
                         const hasInputSchema = toolArg.properties.some(prop => {
@@ -104,7 +89,6 @@ exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
                 }
                 if (!isAIFunction)
                     return;
-                // Check for tools property in AI function call
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
@@ -116,7 +100,6 @@ exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
                 });
                 if (!toolsProp)
                     return;
-                // Check each tool in the tools object
                 if (toolsProp.value.type === 'ObjectExpression') {
                     for (const toolDef of toolsProp.value.properties) {
                         if (toolDef.type !== 'Property')
@@ -126,7 +109,6 @@ exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
                             : toolDef.key.type === 'Literal'
                                 ? String(toolDef.key.value)
                                 : 'unknown';
-                        // Check if tool value is an object with inputSchema
                         if (toolDef.value.type === 'ObjectExpression') {
                             const hasInputSchema = toolDef.value.properties.some(prop => {
                                 if (prop.type !== 'Property')
@@ -142,7 +124,6 @@ exports.requireToolSchema = (0, eslint_devkit_1.createRule)({
                                 });
                             }
                         }
-                        // If it's a CallExpression (tool() helper), it will be checked separately
                     }
                 }
             },

package/src/rules/require-validated-prompt/index.js

@@ -1,17 +1,6 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requireValidatedPrompt = void 0;
-/**
- * @fileoverview Require validated prompts in generateText calls
- * @description Detects when user input is passed directly to generateText without validation
- * @see https://sdk.vercel.ai/docs/ai-sdk-core/generating-text
- * @see https://owasp.org/www-project-top-10-for-large-language-model-applications/
- */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
 const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
@@ -109,42 +98,29 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
         const allowInTests = options.allowInTests ?? false;
         const sourceCode = context.sourceCode;
         const filename = context.filename;
-        // Skip test files if allowed
         if (allowInTests && /\.(test|spec)\.[jt]sx?$/.test(filename)) {
             return {};
         }
-        // Vercel AI SDK function names
         const vercelAIFunctions = [
             'generateText',
             'streamText',
             'generateObject',
             'streamObject',
         ];
-        /**
-         * Check if a node is a call to a validation function
-         */
         function isValidatedCall(node) {
             if (node.type !== 'CallExpression')
                 return false;
             const callee = sourceCode.getText(node.callee);
             return validatorFunctions.some((v) => callee.includes(v));
         }
-        /**
-         * Check if an identifier suggests user input
-         */
         function isUserInput(node) {
             const text = sourceCode.getText(node);
             return userInputPatterns.some((pattern) => text.includes(pattern));
         }
-        /**
-         * Check if a node contains unsafe user input
-         */
         function hasUnsafeUserInput(node) {
-            // If it's validated, it's safe
             if (isValidatedCall(node)) {
                 return { unsafe: false };
             }
-            // Check for template literals with user input
             if (node.type === 'TemplateLiteral') {
                 for (const expr of node.expressions) {
                     const result = hasUnsafeUserInput(expr);
@@ -152,20 +128,17 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
                         return result;
                 }
             }
-            // Check identifiers
             if (node.type === 'Identifier') {
                 if (isUserInput(node)) {
                     return { unsafe: true, input: node.name };
                 }
             }
-            // Check member expressions
             if (node.type === 'MemberExpression') {
                 const text = sourceCode.getText(node);
                 if (isUserInput(node)) {
                     return { unsafe: true, input: text };
                 }
             }
-            // Check binary expressions (concatenation)
             if (node.type === 'BinaryExpression') {
                 const leftResult = hasUnsafeUserInput(node.left);
                 if (leftResult.unsafe)
@@ -176,26 +149,20 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
             }
             return { unsafe: false };
         }
-        /**
-         * Check generateText/streamText call for unsafe prompts
-         */
         function checkAICall(node) {
             const callee = sourceCode.getText(node.callee);
-            // Get which function is being called
             const matchedFunction = vercelAIFunctions.find(fn => callee.includes(fn));
             if (!matchedFunction) {
                 return;
             }
-            // Check first argument (options object)
             const optionsArg = node.arguments[0];
             if (!optionsArg || optionsArg.type !== 'ObjectExpression') {
                 return;
             }
-            // Check for unsafe prompt property
             for (const prop of optionsArg.properties) {
                 if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                     continue;
-                const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                 if (keyName === 'prompt') {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {

package/src/types/index.js

@@ -1,7 +1,2 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });

package/src/utils/prompt-props.js

@@ -1,40 +1,20 @@
 "use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SYSTEM_PROMPT_PROPS = void 0;
 exports.isSystemPromptProp = isSystemPromptProp;
 exports.getStaticPropName = getStaticPropName;
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
-/**
- * Property names the AI SDK accepts for the system prompt.
- *
- * As of AI SDK v7 the canonical name is `instructions`; `system` still works but
- * is marked `@deprecated Use 'instructions' instead` in the SDK's own types. Both
- * must be checked — code written against current docs uses `instructions`, and
- * code predating v7 uses `system`.
- */
 exports.SYSTEM_PROMPT_PROPS = new Set(['instructions', 'system']);
-/** True when `name` is a property the AI SDK treats as the system prompt. */
 function isSystemPromptProp(name) {
     return name !== null && exports.SYSTEM_PROMPT_PROPS.has(name);
 }
-/**
- * Static name of an object property key, or `null` when it isn't statically known.
- *
- * `{ instructions: x }` and `{ 'instructions': x }` are the same property, but the
- * first parses to an `Identifier` key and the second to a string `Literal`. Reading
- * only `Identifier` silently skips the quoted form, so a rule stops firing on code
- * that is semantically identical. Computed keys (`{ [k]: x }`) stay `null` — the
- * name genuinely isn't known statically.
- */
-function getStaticPropName(key) {
-    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
-        return key.name;
-    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
-        return key.value;
+function getStaticPropName(prop) {
+    if (prop.computed)
+        return null;
+    if (prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return prop.key.name;
+    if (prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof prop.key.value === 'string') {
+        return prop.key.value;
+    }
     return null;
 }

package/AGENTS.md

@@ -1,131 +0,0 @@
-# AGENTS.md
-
-> Context for AI coding agents working on eslint-plugin-vercel-ai-security
-
-## Setup Commands
-
-```bash
-# Install dependencies (from monorepo root)
-npm install
-
-# Build this package
-nx build eslint-plugin-vercel-ai-security
-
-# Run tests
-nx test eslint-plugin-vercel-ai-security
-
-# Run tests with coverage
-nx test eslint-plugin-vercel-ai-security --coverage
-
-# Lint this package
-nx lint eslint-plugin-vercel-ai-security
-```
-
-## Code Style
-
-- TypeScript strict mode with `@interlace/eslint-devkit` types
-- Use `AST_NODE_TYPES` constants, never string literals for node types
-- Use `formatLLMMessage()` for all rule error messages
-- Include CWE, CVSS, OWASP LLM Top 10 in every security message
-- Use `c8 ignore` comments with documented reasons for untestable code
-- Single-pass AST traversal patterns (O(n) complexity)
-
-## Testing Instructions
-
-- Tests use `@typescript-eslint/rule-tester` with Vitest
-- Each rule has `index.ts` (implementation) and `*.test.ts` (tests) in same directory
-- Run specific rule test: `nx test eslint-plugin-vercel-ai-security --testPathPattern="require-validated-prompt"`
-- Coverage target: ≥90% lines, ≥95% functions
-- All tests must pass before committing
-
-## Project Structure
-
-```
-src/
-├── index.ts          # Plugin entry, exports rules and configs
-└── rules/            # Rule directories
-    └── [rule-name]/
-        ├── index.ts       # Rule implementation
-        └── *.test.ts      # Rule tests
-```
-
-## Plugin Purpose
-
-Security rules for **Vercel AI SDK** (`ai` package). Covers prompt injection, sensitive data exposure, API key security, output handling, tool security, and resource limits.
-
-## Target SDK Functions
-
-```typescript
-import {
-  generateText,
-  streamText,
-  generateObject,
-  streamObject,
-  tool,
-} from 'ai';
-import { createOpenAI, createAnthropic, createGoogle } from '@ai-sdk/*';
-```
-
-## Quick Reference: All 10 Rules
-
-| Rule                        | Severity | Fix Pattern                          |
-| --------------------------- | -------- | ------------------------------------ |
-| `require-validated-prompt`  | CRITICAL | `prompt: validateInput(userInput)`   |
-| `no-sensitive-in-prompt`    | CRITICAL | Remove password/token from prompt    |
-| `no-hardcoded-api-keys`     | CRITICAL | `apiKey: process.env.OPENAI_API_KEY` |
-| `no-unsafe-output-handling` | CRITICAL | Don't pass `result.text` to `eval()` |
-| `require-tool-schema`       | HIGH     | Add `inputSchema: z.object({...})`   |
-| `require-max-tokens`        | HIGH     | Add `maxTokens: 4096`                |
-| `require-max-steps`         | HIGH     | Add `maxSteps: 5` when using tools   |
-| `require-tool-confirmation` | HIGH     | Add `requiresConfirmation: true`     |
-| `require-error-handling`    | MEDIUM   | Wrap in `try { } catch { }`          |
-| `require-abort-signal`      | LOW      | Add `abortSignal: controller.signal` |
-
-## Common Fix Patterns
-
-```typescript
-// Prompt Injection (CWE-74)
-// BAD: await generateText({ prompt: userInput })
-// GOOD: await generateText({ prompt: validateInput(userInput) })
-
-// API Keys (CWE-798)
-// BAD: createOpenAI({ apiKey: 'sk-proj-abc123...' })
-// GOOD: createOpenAI({ apiKey: process.env.OPENAI_API_KEY })
-
-// Tool Schema (CWE-20)
-// BAD: tool({ execute: async (params) => search(params) })
-// GOOD: tool({ inputSchema: z.object({ query: z.string().max(500) }), execute: ... })
-
-// Max Tokens (CWE-770)
-// BAD: await generateText({ prompt: 'Write a story' })
-// GOOD: await generateText({ prompt: 'Write a story', maxTokens: 4096 })
-
-// Tool Confirmation (CWE-862)
-// BAD: tools: { deleteFile: { execute: async (p) => fs.unlink(p.path) } }
-// GOOD: tools: { deleteFile: { requiresConfirmation: true, execute: ... } }
-```
-
-## OWASP Reference
-
-| OWASP LLM Top 10 2025   | Rule                                      |
-| ----------------------- | ----------------------------------------- |
-| LLM01: Prompt Injection | `require-validated-prompt`                |
-| LLM02: Sensitive Info   | `no-sensitive-in-prompt`                  |
-| LLM05: Output Handling  | `no-unsafe-output-handling`               |
-| LLM06: Excessive Agency | `require-tool-confirmation`               |
-| LLM10: Unbounded        | `require-max-tokens`, `require-max-steps` |
-
-| OWASP Agentic Top 10 2026 | Rule                        |
-| ------------------------- | --------------------------- |
-| ASI02: Tool Misuse        | `require-tool-schema`       |
-| ASI03: Identity Abuse     | `no-hardcoded-api-keys`     |
-| ASI05: Code Execution     | `no-unsafe-output-handling` |
-| ASI08: Cascading Failures | `require-error-handling`    |
-
-## Suppression Patterns
-
-```typescript
-// Suppress single line
-// eslint-disable-next-line vercel-ai-security/require-validated-prompt -- Trusted internal input
-await generateText({ prompt: internalPrompt });
-```