fix(deps): migrate from deprecated @genkit-ai/googleai to @genkit-ai/google-genai

[chenyuan99]

Summary

@genkit-ai/googleai is deprecated. npm's own message: "Use @genkit-ai/google-genai package instead."

Package	Version	Last published
@genkit-ai/googleai (before)	1.28.0	2026-03-26
@genkit-ai/google-genai (after)	1.41.0	2026-08-11 — tracks genkit core

This is step one of two: swap the plugin, change no behaviour. The model mandate stays gemini-2.5-flash. Switching to gemini-3 is deliberately separate, because it needs a live test this PR cannot provide.

The change is one import

- import { googleAI } from "@genkit-ai/googleai";
+ import { googleAI } from "@genkit-ai/google-genai";

No model strings change. The new plugin registers under the same namespace: googleAI.model('gemini-2.5-flash') resolves to "googleai/gemini-2.5-flash" — the exact string already in flows/accountant.ts, flows/auditor.ts, and flows/extractor.ts.

Verification

• npx tsc --noEmit clean, 60/60 tests pass, npm run build emits lib/index.js
• Loaded the built getAI() and resolved "googleai/gemini-2.5-flash" through the real registry — it reports supports.multiturn: true and supports.tools: true
• genkit({ plugins: [googleAI()] }) and defineTool round-trip offline against the new plugin

Why this matters: the gemini-3 blocker is resolved upstream

CLAUDE.md said to revisit gemini-3 "when Genkit ships the fix." Genkit shipped it — in the successor package, which is why it never reached this project.

I traced the exact function the note names:

Old — gemini.js:718, signature dropped:

function fromFunctionCall(part, ref) {
  return { toolRequest: { name: ..., input: ..., ref } };  // no metadata
}

It handles thoughtSignature for thought parts (fromThought/toThought) but not for function-call parts, so the signature is lost on the first hop and can never be replayed. That is the 400.

New — round-tripped in both directions:

Direction	Function	Behaviour
Inbound	fromGeminiToolCall → maybeAddThoughtSignatureAndMetadata	stashes geminiPart.thoughtSignature into part.metadata.thoughtSignature
Outbound	toGeminiToolRequest → maybeAddGeminiThoughtSignatureAndMetadata	reads it back and reattaches it to the functionCall part

The helper is applied at 11 call sites covering every part type — a deliberate general fix, not a special case.

Corroborating: the old plugin knows zero gemini-3 model names; the new one ships ten, including gemini-3-flash-preview and gemini-3.5-flash. It was frozen before Gemini 3 existed.

What is NOT proven here

The above is static analysis of the published bundles, not a live run. I have not exercised a real gemini-3 tool-calling loop — that needs an API key and would spend quota.

So this PR does not switch models. CLAUDE.md now records exactly what must be demonstrated first: a real multi-turn tool-calling loop against the API with no 400s. The offline suite never reaches the model and structurally cannot catch this.

Docs updated

CLAUDE.md — plugin name, version line (also corrected a stale "Genkit 1.34"; the lockfile has been on 1.41.0 since #70), and the gemini-3 note rewritten from "blocked, revisit later" to "SDK blocker resolved, pending live verification."

README.md — plugin name.

Suggested follow-up

Step two: run one live multi-turn tool-calling check against gemini-3-flash-preview; if clean, flip the mandate and drop maxTurns guidance if it is no longer needed.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud