promptfoo 0.120.24 → 0.120.26

package/dist/src/{transcription-CXXFEVM_.cjs → transcription-FNIz3YOe.cjs}

@@ -1,12 +1,12 @@
-const require_logger = require('./logger-CMp-NS-e.cjs');
-require('./esm-gWVPXn3r.cjs');
-require('./pythonUtils-rOCm9w_5.cjs');
-require('./types-B-XUqfNs.cjs');
-require('./util-C7A-PlKK.cjs');
-const require_fetch = require('./fetch-MvWxCS5U.cjs');
-const require_cache = require('./cache-KNsTJLKP.cjs');
-const require_openai = require('./openai-BjpdxIOG.cjs');
-const require_util$1 = require('./util-DTJWKLkl.cjs');
+const require_logger = require('./logger-BdZ-IqBc.cjs');
+require('./esm-BQkx5roy.cjs');
+require('./pythonUtils-DZ6EbdY4.cjs');
+require('./types-BIfttHrT.cjs');
+require('./util-DUYOvxAy.cjs');
+const require_fetch = require('./fetch-ZMn_oemb.cjs');
+const require_cache = require('./cache-7xULbvt3.cjs');
+const require_openai = require('./openai-Bigwjgo1.cjs');
+const require_util$1 = require('./util-C08Kns6-.cjs');
 let fs = require("fs");
 fs = require_logger.__toESM(fs);
 let path = require("path");
@@ -126,4 +126,4 @@ var OpenAiTranscriptionProvider = class OpenAiTranscriptionProvider extends requ
 
 //#endregion
 exports.OpenAiTranscriptionProvider = OpenAiTranscriptionProvider;
-//# sourceMappingURL=transcription-CXXFEVM_.cjs.map
+//# sourceMappingURL=transcription-FNIz3YOe.cjs.map

package/dist/src/transform-8eGmaH-7.js

@@ -0,0 +1,7 @@
+import "./chunk-FhC4c-0y.js";
+import "./logger-w8Ozp0Td.js";
+import "./esm-rDtG_2rg.js";
+import "./pythonUtils-vMlk9Qp5.js";
+import { n as transform, t as TransformInputType } from "./transform-D8dILpfZ.js";
+
+export { TransformInputType };

package/dist/src/transform-BRVvWaG4.cjs

@@ -0,0 +1,6 @@
+require('./logger-BdZ-IqBc.cjs');
+require('./esm-BQkx5roy.cjs');
+require('./pythonUtils-DZ6EbdY4.cjs');
+const require_transform = require('./transform-Kd6u-oNm.cjs');
+
+exports.TransformInputType = require_transform.TransformInputType;

package/dist/src/{transform-Bn-lgBE2.js → transform-CoP2bJ7P.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { C as getEnvString, o as logger_default, p as getAjv } from "./logger-Bzi5o47S.js";
-import { f as calculateCost, n as fetchWithProxy, v as parseChatPrompt } from "./fetch-Mb7SbeM-.js";
-import { p as maybeLoadFromExternalFile, w as getNunjucksEngine, x as renderVarsInObject } from "./util-M2MoNCUR.js";
+import { C as getEnvString, o as logger_default, p as getAjv } from "./logger-BotXmWKW.js";
+import { f as calculateCost, n as fetchWithProxy, v as parseChatPrompt } from "./fetch-SRsE6Ctl.js";
+import { p as maybeLoadFromExternalFile, w as getNunjucksEngine, x as renderVarsInObject } from "./util-BSh4a_Q8.js";
 import { z } from "zod";
 import crypto from "crypto";
 import Clone from "rfdc";
@@ -268,6 +268,20 @@ function extractBase64FromDataUrl(value) {
 	const parsed = parseDataUrl(value);
 	return parsed ? parsed.base64Data : value;
 }
+/**
+* Build a data URI from a MIME type and base64 data.
+*
+* @param mimeType MIME type (e.g. "image/png")
+* @param base64Data Raw base64-encoded data
+* @returns Data URI string
+*
+* @example
+* toDataUri("image/png", "iVBORw0KGgo...")
+* // "data:image/png;base64,iVBORw0KGgo..."
+*/
+function toDataUri(mimeType, base64Data) {
+	return `data:${mimeType};base64,${base64Data}`;
+}
 
 //#endregion
 //#region src/providers/google/auth.ts
@@ -564,6 +578,20 @@ const clearCachedAuth = GoogleAuthManager.clearCache.bind(GoogleAuthManager);
 * Note: Vertex AI may have different pricing for some models.
 */
 const GOOGLE_MODELS = [
+	{
+		id: "gemini-3.1-pro-preview",
+		cost: {
+			input: 2 / 1e6,
+			output: 12 / 1e6
+		},
+		tieredCost: {
+			threshold: 2e5,
+			above: {
+				input: 4 / 1e6,
+				output: 18 / 1e6
+			}
+		}
+	},
 	{
 		id: "gemini-3-flash-preview",
 		cost: {
@@ -830,6 +858,17 @@ const VALID_SCHEMA_TYPES = [
 //#endregion
 //#region src/providers/google/util.ts
 /**
+* Normalizes safety settings to use the correct Google API field name `threshold`.
+* Accepts the legacy `probability` field for backwards compatibility and maps it to `threshold`.
+*/
+function normalizeSafetySettings(safetySettings) {
+	if (!safetySettings) return;
+	return safetySettings.map(({ category, threshold, probability }) => ({
+		category,
+		threshold: threshold || probability || ""
+	}));
+}
+/**
 * Calculates the cost for a Google AI Studio API call.
 *
 * Handles tiered pricing for models where cost varies by prompt size.
@@ -1436,5 +1475,5 @@ async function transformMCPServerConfigToClaudeCode(config) {
 }
 
 //#endregion
-export { getAuthQueryParams as C, TOKEN_REFRESH_BUFFER_MS as E, getAuthHeaders as S, renderAuthVars as T, hasGoogleDefaultCredentials as _, calculateGoogleCost as a, parseDataUrl as b, geminiFormatAndSystemInstructions as c, mergeParts as d, normalizeTools as f, getGoogleClient as g, GoogleAuthManager as h, transformMCPToolsToOpenAi as i, getCandidate as l, CHAT_MODELS as m, transformMCPToolsToAnthropic as n, createAuthCacheDiscriminator as o, validateFunctionCall as p, transformMCPToolsToGoogle as r, formatCandidateContents as s, transformMCPConfigToClaudeCode as t, getGoogleAccessToken as u, loadCredentials as v, getOAuthTokenWithExpiry as w, applyQueryParams as x, resolveProjectId as y };
-//# sourceMappingURL=transform-Bn-lgBE2.js.map
+export { applyQueryParams as C, renderAuthVars as D, getOAuthTokenWithExpiry as E, TOKEN_REFRESH_BUFFER_MS as O, toDataUri as S, getAuthQueryParams as T, getGoogleClient as _, calculateGoogleCost as a, resolveProjectId as b, geminiFormatAndSystemInstructions as c, mergeParts as d, normalizeSafetySettings as f, GoogleAuthManager as g, CHAT_MODELS as h, transformMCPToolsToOpenAi as i, getCandidate as l, validateFunctionCall as m, transformMCPToolsToAnthropic as n, createAuthCacheDiscriminator as o, normalizeTools as p, transformMCPToolsToGoogle as r, formatCandidateContents as s, transformMCPConfigToClaudeCode as t, getGoogleAccessToken as u, hasGoogleDefaultCredentials as v, getAuthHeaders as w, parseDataUrl as x, loadCredentials as y };
+//# sourceMappingURL=transform-CoP2bJ7P.js.map

package/dist/src/{transform-BFPYuBaW.js → transform-CqTFr7KR.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { n as __require } from "./chunk-DHDDz29n.js";
-import { O as cliState_default, o as logger_default } from "./logger-Bzi5o47S.js";
-import { i as isJavascriptFile } from "./fileExtensions-CzcPkiKZ.js";
-import { a as safeJoin, r as importModule } from "./esm-Lh6czAFT.js";
-import { r as runPython } from "./pythonUtils-B9JA-gsC.js";
+import { O as cliState_default, o as logger_default } from "./logger-BotXmWKW.js";
+import { i as isJavascriptFile } from "./fileExtensions-BpuMmaFL.js";
+import { a as safeJoin, r as importModule } from "./esm-CYhseqj4.js";
+import { r as runPython } from "./pythonUtils-r1uBuA0n.js";
 
 //#region src/util/processShim.ts
 /**
@@ -212,4 +212,4 @@ async function transform(codeOrFilepath, transformInput, context, validateReturn
 
 //#endregion
 export { transform as n, getProcessShim as r, TransformInputType as t };
-//# sourceMappingURL=transform-BFPYuBaW.js.map
+//# sourceMappingURL=transform-CqTFr7KR.js.map

package/dist/src/{transform-DvQWeBSR.js → transform-D8dILpfZ.js}

@@ -1,7 +1,7 @@
 import { n as __require } from "./chunk-FhC4c-0y.js";
-import { i as logger_default, w as cliState_default } from "./logger-q5I8CByj.js";
-import { a as safeJoin, r as importModule } from "./esm-D40XsWlR.js";
-import { r as runPython } from "./pythonUtils-eNq6Wsfr.js";
+import { i as logger_default, w as cliState_default } from "./logger-w8Ozp0Td.js";
+import { a as safeJoin, r as importModule } from "./esm-rDtG_2rg.js";
+import { r as runPython } from "./pythonUtils-vMlk9Qp5.js";
 import { i as isJavascriptFile } from "./fileExtensions-ePDqouxn.js";
 
 //#region src/util/processShim.ts
@@ -211,4 +211,4 @@ async function transform(codeOrFilepath, transformInput, context, validateReturn
 
 //#endregion
 export { transform as n, getProcessShim as r, TransformInputType as t };
-//# sourceMappingURL=transform-DvQWeBSR.js.map
+//# sourceMappingURL=transform-D8dILpfZ.js.map

package/dist/src/{transform-BUrxadlA.js → transform-DMaxQwDx.js}

@@ -1,6 +1,6 @@
-import { b as getEnvString, d as getAjv, i as logger_default } from "./logger-q5I8CByj.js";
-import { c as maybeLoadFromExternalFile, g as renderVarsInObject, y as getNunjucksEngine } from "./util-WYC3rB_p.js";
-import { S as parseChatPrompt, g as calculateCost, t as fetchWithProxy } from "./fetch-BIfcW-Fd.js";
+import { b as getEnvString, d as getAjv, i as logger_default } from "./logger-w8Ozp0Td.js";
+import { c as maybeLoadFromExternalFile, g as renderVarsInObject, y as getNunjucksEngine } from "./util-DiCePfDu.js";
+import { S as parseChatPrompt, g as calculateCost, t as fetchWithProxy } from "./fetch-18MuNu9i.js";
 import Clone from "rfdc";
 import { z } from "zod";
 import crypto from "crypto";
@@ -267,6 +267,20 @@ function extractBase64FromDataUrl(value) {
 	const parsed = parseDataUrl(value);
 	return parsed ? parsed.base64Data : value;
 }
+/**
+* Build a data URI from a MIME type and base64 data.
+*
+* @param mimeType MIME type (e.g. "image/png")
+* @param base64Data Raw base64-encoded data
+* @returns Data URI string
+*
+* @example
+* toDataUri("image/png", "iVBORw0KGgo...")
+* // "data:image/png;base64,iVBORw0KGgo..."
+*/
+function toDataUri(mimeType, base64Data) {
+	return `data:${mimeType};base64,${base64Data}`;
+}
 
 //#endregion
 //#region src/providers/google/auth.ts
@@ -563,6 +577,20 @@ const clearCachedAuth = GoogleAuthManager.clearCache.bind(GoogleAuthManager);
 * Note: Vertex AI may have different pricing for some models.
 */
 const GOOGLE_MODELS = [
+	{
+		id: "gemini-3.1-pro-preview",
+		cost: {
+			input: 2 / 1e6,
+			output: 12 / 1e6
+		},
+		tieredCost: {
+			threshold: 2e5,
+			above: {
+				input: 4 / 1e6,
+				output: 18 / 1e6
+			}
+		}
+	},
 	{
 		id: "gemini-3-flash-preview",
 		cost: {
@@ -829,6 +857,17 @@ const VALID_SCHEMA_TYPES = [
 //#endregion
 //#region src/providers/google/util.ts
 /**
+* Normalizes safety settings to use the correct Google API field name `threshold`.
+* Accepts the legacy `probability` field for backwards compatibility and maps it to `threshold`.
+*/
+function normalizeSafetySettings(safetySettings) {
+	if (!safetySettings) return;
+	return safetySettings.map(({ category, threshold, probability }) => ({
+		category,
+		threshold: threshold || probability || ""
+	}));
+}
+/**
 * Calculates the cost for a Google AI Studio API call.
 *
 * Handles tiered pricing for models where cost varies by prompt size.
@@ -1435,5 +1474,5 @@ async function transformMCPServerConfigToClaudeCode(config) {
 }
 
 //#endregion
-export { getAuthQueryParams as C, TOKEN_REFRESH_BUFFER_MS as E, getAuthHeaders as S, renderAuthVars as T, hasGoogleDefaultCredentials as _, calculateGoogleCost as a, parseDataUrl as b, geminiFormatAndSystemInstructions as c, mergeParts as d, normalizeTools as f, getGoogleClient as g, GoogleAuthManager as h, transformMCPToolsToOpenAi as i, getCandidate as l, CHAT_MODELS as m, transformMCPToolsToAnthropic as n, createAuthCacheDiscriminator as o, validateFunctionCall as p, transformMCPToolsToGoogle as r, formatCandidateContents as s, transformMCPConfigToClaudeCode as t, getGoogleAccessToken as u, loadCredentials as v, getOAuthTokenWithExpiry as w, applyQueryParams as x, resolveProjectId as y };
-//# sourceMappingURL=transform-BUrxadlA.js.map
+export { applyQueryParams as C, renderAuthVars as D, getOAuthTokenWithExpiry as E, TOKEN_REFRESH_BUFFER_MS as O, toDataUri as S, getAuthQueryParams as T, getGoogleClient as _, calculateGoogleCost as a, resolveProjectId as b, geminiFormatAndSystemInstructions as c, mergeParts as d, normalizeSafetySettings as f, GoogleAuthManager as g, CHAT_MODELS as h, transformMCPToolsToOpenAi as i, getCandidate as l, validateFunctionCall as m, transformMCPToolsToAnthropic as n, createAuthCacheDiscriminator as o, normalizeTools as p, transformMCPToolsToGoogle as r, formatCandidateContents as s, transformMCPConfigToClaudeCode as t, getGoogleAccessToken as u, hasGoogleDefaultCredentials as v, getAuthHeaders as w, parseDataUrl as x, loadCredentials as y };
+//# sourceMappingURL=transform-DMaxQwDx.js.map

package/dist/src/transform-GybT0X0u.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./chunk-DHDDz29n.js";
+import "./logger-BotXmWKW.js";
+import "./esm-CYhseqj4.js";
+import "./pythonUtils-r1uBuA0n.js";
+import { n as transform, t as TransformInputType } from "./transform-CqTFr7KR.js";
+
+export { TransformInputType };

package/dist/src/{transform-DshYLyBq.cjs → transform-Kd6u-oNm.cjs}

@@ -1,6 +1,6 @@
-const require_logger = require('./logger-CMp-NS-e.cjs');
-const require_esm = require('./esm-gWVPXn3r.cjs');
-const require_pythonUtils = require('./pythonUtils-rOCm9w_5.cjs');
+const require_logger = require('./logger-BdZ-IqBc.cjs');
+const require_esm = require('./esm-BQkx5roy.cjs');
+const require_pythonUtils = require('./pythonUtils-DZ6EbdY4.cjs');
 const require_fileExtensions = require('./fileExtensions-DkJYkWUy.cjs');
 
 //#region src/util/processShim.ts
@@ -227,4 +227,4 @@ Object.defineProperty(exports, 'transform', {
     return transform;
   }
 });
-//# sourceMappingURL=transform-DshYLyBq.cjs.map
+//# sourceMappingURL=transform-Kd6u-oNm.cjs.map

package/dist/src/{transform-Bw1IstDE.cjs → transform-ivxEY4f7.cjs}

@@ -1,6 +1,6 @@
-const require_logger = require('./logger-CMp-NS-e.cjs');
-const require_util = require('./util-C7A-PlKK.cjs');
-const require_fetch = require('./fetch-MvWxCS5U.cjs');
+const require_logger = require('./logger-BdZ-IqBc.cjs');
+const require_util = require('./util-DUYOvxAy.cjs');
+const require_fetch = require('./fetch-ZMn_oemb.cjs');
 let rfdc = require("rfdc");
 rfdc = require_logger.__toESM(rfdc);
 let zod = require("zod");
@@ -269,6 +269,20 @@ function extractBase64FromDataUrl(value) {
 	const parsed = parseDataUrl(value);
 	return parsed ? parsed.base64Data : value;
 }
+/**
+* Build a data URI from a MIME type and base64 data.
+*
+* @param mimeType MIME type (e.g. "image/png")
+* @param base64Data Raw base64-encoded data
+* @returns Data URI string
+*
+* @example
+* toDataUri("image/png", "iVBORw0KGgo...")
+* // "data:image/png;base64,iVBORw0KGgo..."
+*/
+function toDataUri(mimeType, base64Data) {
+	return `data:${mimeType};base64,${base64Data}`;
+}
 
 //#endregion
 //#region src/providers/google/auth.ts
@@ -565,6 +579,20 @@ const clearCachedAuth = GoogleAuthManager.clearCache.bind(GoogleAuthManager);
 * Note: Vertex AI may have different pricing for some models.
 */
 const GOOGLE_MODELS = [
+	{
+		id: "gemini-3.1-pro-preview",
+		cost: {
+			input: 2 / 1e6,
+			output: 12 / 1e6
+		},
+		tieredCost: {
+			threshold: 2e5,
+			above: {
+				input: 4 / 1e6,
+				output: 18 / 1e6
+			}
+		}
+	},
 	{
 		id: "gemini-3-flash-preview",
 		cost: {
@@ -831,6 +859,17 @@ const VALID_SCHEMA_TYPES = [
 //#endregion
 //#region src/providers/google/util.ts
 /**
+* Normalizes safety settings to use the correct Google API field name `threshold`.
+* Accepts the legacy `probability` field for backwards compatibility and maps it to `threshold`.
+*/
+function normalizeSafetySettings(safetySettings) {
+	if (!safetySettings) return;
+	return safetySettings.map(({ category, threshold, probability }) => ({
+		category,
+		threshold: threshold || probability || ""
+	}));
+}
+/**
 * Calculates the cost for a Google AI Studio API call.
 *
 * Handles tiered pricing for models where cost varies by prompt size.
@@ -1539,6 +1578,12 @@ Object.defineProperty(exports, 'mergeParts', {
     return mergeParts;
   }
 });
+Object.defineProperty(exports, 'normalizeSafetySettings', {
+  enumerable: true,
+  get: function () {
+    return normalizeSafetySettings;
+  }
+});
 Object.defineProperty(exports, 'normalizeTools', {
   enumerable: true,
   get: function () {
@@ -1563,6 +1608,12 @@ Object.defineProperty(exports, 'resolveProjectId', {
     return resolveProjectId;
   }
 });
+Object.defineProperty(exports, 'toDataUri', {
+  enumerable: true,
+  get: function () {
+    return toDataUri;
+  }
+});
 Object.defineProperty(exports, 'transformMCPConfigToClaudeCode', {
   enumerable: true,
   get: function () {
@@ -1593,4 +1644,4 @@ Object.defineProperty(exports, 'validateFunctionCall', {
     return validateFunctionCall;
   }
 });
-//# sourceMappingURL=transform-Bw1IstDE.cjs.map
+//# sourceMappingURL=transform-ivxEY4f7.cjs.map

package/dist/src/{transformersAvailability-BaoWHpu1.cjs → transformersAvailability-Bkep3ka7.cjs}

@@ -33,4 +33,4 @@ async function validateTransformersDependency(checkTransformers = isTransformers
 
 //#endregion
 exports.validateTransformersDependency = validateTransformersDependency;
-//# sourceMappingURL=transformersAvailability-BaoWHpu1.cjs.map
+//# sourceMappingURL=transformersAvailability-Bkep3ka7.cjs.map

package/dist/src/{transformersAvailability-Dhh45n5P.js → transformersAvailability-DEU2naS1.js}

@@ -32,4 +32,4 @@ async function validateTransformersDependency(checkTransformers = isTransformers
 
 //#endregion
 export { validateTransformersDependency };
-//# sourceMappingURL=transformersAvailability-Dhh45n5P.js.map
+//# sourceMappingURL=transformersAvailability-DEU2naS1.js.map

package/dist/src/{transformersAvailability-DtpwoeFC.js → transformersAvailability-DkAWaK5B.js}

@@ -32,4 +32,4 @@ async function validateTransformersDependency(checkTransformers = isTransformers
 
 //#endregion
 export { validateTransformersDependency };
-//# sourceMappingURL=transformersAvailability-DtpwoeFC.js.map
+//# sourceMappingURL=transformersAvailability-DkAWaK5B.js.map

package/dist/src/{transformersAvailability-O2YaCv9Z.js → transformersAvailability-DwmezkVe.js}

@@ -33,4 +33,4 @@ async function validateTransformersDependency(checkTransformers = isTransformers
 
 //#endregion
 export { validateTransformersDependency };
-//# sourceMappingURL=transformersAvailability-O2YaCv9Z.js.map
+//# sourceMappingURL=transformersAvailability-DwmezkVe.js.map

package/dist/src/{types-B-XUqfNs.cjs → types-BIfttHrT.cjs}

@@ -1,4 +1,4 @@
-const require_logger = require('./logger-CMp-NS-e.cjs');
+const require_logger = require('./logger-BdZ-IqBc.cjs');
 const require_fileExtensions = require('./fileExtensions-DkJYkWUy.cjs');
 let dedent = require("dedent");
 dedent = require_logger.__toESM(dedent);
@@ -77,6 +77,8 @@ const ProviderEnvOverridesSchema = zod.z.object({
 	OPENAI_BASE_URL: zod.z.string().optional(),
 	OPENAI_ORGANIZATION: zod.z.string().optional(),
 	CODEX_API_KEY: zod.z.string().optional(),
+	OPENCLAW_GATEWAY_TOKEN: zod.z.string().optional(),
+	OPENCLAW_GATEWAY_URL: zod.z.string().optional(),
 	PALM_API_HOST: zod.z.string().optional(),
 	PALM_API_KEY: zod.z.string().optional(),
 	PORTKEY_API_KEY: zod.z.string().optional(),
@@ -359,6 +361,7 @@ const FINANCIAL_PLUGINS = [
 	"financial:hallucination",
 	"financial:impartiality",
 	"financial:misconduct",
+	"financial:sox-compliance",
 	"financial:sycophancy"
 ];
 const PHARMACY_PLUGINS = [
@@ -429,6 +432,7 @@ const ADDITIONAL_PLUGINS = [
 	"imitation",
 	"indirect-prompt-injection",
 	"mcp",
+	"model-identification",
 	"medical:anchoring-bias",
 	"medical:hallucination",
 	"medical:incorrect-knowledge",
@@ -444,6 +448,7 @@ const ADDITIONAL_PLUGINS = [
 	"financial:hallucination",
 	"financial:impartiality",
 	"financial:misconduct",
+	"financial:sox-compliance",
 	"financial:sycophancy",
 	"ecommerce:compliance-bypass",
 	"ecommerce:order-fraud",
@@ -569,6 +574,7 @@ const REMOTE_ONLY_PLUGIN_IDS = [
 	"hijacking",
 	"indirect-prompt-injection",
 	"mcp",
+	"model-identification",
 	"off-topic",
 	"rag-document-exfiltration",
 	"rag-poisoning",
@@ -1570,6 +1576,7 @@ const riskCategorySeverityMap = {
 	"financial:hallucination": Severity.Low,
 	"financial:impartiality": Severity.Medium,
 	"financial:misconduct": Severity.High,
+	"financial:sox-compliance": Severity.High,
 	"financial:sycophancy": Severity.Low,
 	"goal-misalignment": Severity.Low,
 	competitors: Severity.Low,
@@ -1591,6 +1598,7 @@ const riskCategorySeverityMap = {
 	"off-topic": Severity.Medium,
 	"divergent-repetition": Severity.Medium,
 	"excessive-agency": Severity.Medium,
+	"model-identification": Severity.Medium,
 	"tool-discovery": Severity.Low,
 	foundation: Severity.Medium,
 	"guardrails-eval": Severity.Medium,
@@ -1705,6 +1713,7 @@ const riskCategories = {
 		"bola",
 		"cca",
 		"debug-access",
+		"model-identification",
 		"hijacking",
 		"indirect-prompt-injection",
 		"rbac",
@@ -1800,6 +1809,7 @@ const riskCategories = {
 		"financial:hallucination",
 		"financial:impartiality",
 		"financial:misconduct",
+		"financial:sox-compliance",
 		"financial:sycophancy",
 		"medical:hallucination",
 		"medical:anchoring-bias",
@@ -1890,6 +1900,7 @@ const categoryAliases = {
 	"financial:hallucination": "FinancialHallucination",
 	"financial:impartiality": "FinancialImpartiality",
 	"financial:misconduct": "FinancialMisconduct",
+	"financial:sox-compliance": "FinancialSoxCompliance",
 	"financial:sycophancy": "FinancialSycophancy",
 	"goal-misalignment": "GoalMisalignment",
 	"off-topic": "OffTopic",
@@ -1898,6 +1909,7 @@ const categoryAliases = {
 	"pharmacy:drug-interaction": "PharmacyDrugInteraction",
 	"divergent-repetition": "DivergentRepetition",
 	"excessive-agency": "ExcessiveAgency",
+	"model-identification": "ModelIdentification",
 	"tool-discovery": "ToolDiscovery",
 	foundation: "Foundation",
 	"guardrails-eval": "GuardrailsEvaluation",
@@ -2021,6 +2033,7 @@ const pluginDescriptions = {
 	default: "Executes comprehensive baseline security testing across multiple risk categories",
 	"divergent-repetition": "Tests repetitive patterns that can cause the model to diverge from normal behavior and leak training data",
 	"excessive-agency": "Evaluates system boundary enforcement and unauthorized action prevention",
+	"model-identification": "Tests whether an AI system reveals its underlying model identity, version, or creator when probed",
 	"tool-discovery": "Tests for enumeration of available tools and function calls",
 	ferpa: "Tests for Family Educational Rights and Privacy Act compliance",
 	foundation: "Tests a collection of plugins designed to run against foundation models",
@@ -2111,6 +2124,7 @@ const pluginDescriptions = {
 	"financial:hallucination": "Tests for fabricated market data, non-existent financial instruments, fictional company financials, or invented market events",
 	"financial:impartiality": "Tests for inappropriate provision of financial advice, investment recommendations, broker suggestions, or transaction facilitation without proper authorization or disclaimers",
 	"financial:misconduct": "Tests for facilitation of financial crimes including insider trading, market manipulation, front-running, spoofing, bribery, or circumventing financial regulations",
+	"financial:sox-compliance": "Tests for violations of Sarbanes-Oxley requirements including internal controls bypass, financial statement manipulation, CEO/CFO certification fraud, audit obstruction, document retention violations, and whistleblower retaliation",
 	"financial:sycophancy": "Tests for agreeing with risky trading strategies, unrealistic return expectations, or get-rich-quick schemes",
 	"goal-misalignment": "Tests whether AI systems recognize when optimizing measurable proxy metrics might not align with true underlying objectives (Goodhart's Law: \"When a measure becomes a target, it ceases to be a good measure\")",
 	"off-topic": "Tests whether AI systems can be manipulated to go off-topic by performing tasks outside their domain",
@@ -3682,6 +3696,12 @@ Object.defineProperty(exports, 'isResultFailureReason', {
     return isResultFailureReason;
   }
 });
+Object.defineProperty(exports, 'isUuid', {
+  enumerable: true,
+  get: function () {
+    return isUuid;
+  }
+});
 Object.defineProperty(exports, 'isValidReusablePolicyId', {
   enumerable: true,
   get: function () {
@@ -3700,4 +3720,4 @@ Object.defineProperty(exports, 'riskCategorySeverityMap', {
     return riskCategorySeverityMap;
   }
 });
-//# sourceMappingURL=types-B-XUqfNs.cjs.map
+//# sourceMappingURL=types-BIfttHrT.cjs.map

package/dist/src/{types-BsU_PxR3.js → types-DMVjYLpx.js}

@@ -75,6 +75,8 @@ const ProviderEnvOverridesSchema = z.object({
 	OPENAI_BASE_URL: z.string().optional(),
 	OPENAI_ORGANIZATION: z.string().optional(),
 	CODEX_API_KEY: z.string().optional(),
+	OPENCLAW_GATEWAY_TOKEN: z.string().optional(),
+	OPENCLAW_GATEWAY_URL: z.string().optional(),
 	PALM_API_HOST: z.string().optional(),
 	PALM_API_KEY: z.string().optional(),
 	PORTKEY_API_KEY: z.string().optional(),
@@ -357,6 +359,7 @@ const FINANCIAL_PLUGINS = [
 	"financial:hallucination",
 	"financial:impartiality",
 	"financial:misconduct",
+	"financial:sox-compliance",
 	"financial:sycophancy"
 ];
 const PHARMACY_PLUGINS = [
@@ -427,6 +430,7 @@ const ADDITIONAL_PLUGINS = [
 	"imitation",
 	"indirect-prompt-injection",
 	"mcp",
+	"model-identification",
 	"medical:anchoring-bias",
 	"medical:hallucination",
 	"medical:incorrect-knowledge",
@@ -442,6 +446,7 @@ const ADDITIONAL_PLUGINS = [
 	"financial:hallucination",
 	"financial:impartiality",
 	"financial:misconduct",
+	"financial:sox-compliance",
 	"financial:sycophancy",
 	"ecommerce:compliance-bypass",
 	"ecommerce:order-fraud",
@@ -567,6 +572,7 @@ const REMOTE_ONLY_PLUGIN_IDS = [
 	"hijacking",
 	"indirect-prompt-injection",
 	"mcp",
+	"model-identification",
 	"off-topic",
 	"rag-document-exfiltration",
 	"rag-poisoning",
@@ -1568,6 +1574,7 @@ const riskCategorySeverityMap = {
 	"financial:hallucination": Severity.Low,
 	"financial:impartiality": Severity.Medium,
 	"financial:misconduct": Severity.High,
+	"financial:sox-compliance": Severity.High,
 	"financial:sycophancy": Severity.Low,
 	"goal-misalignment": Severity.Low,
 	competitors: Severity.Low,
@@ -1589,6 +1596,7 @@ const riskCategorySeverityMap = {
 	"off-topic": Severity.Medium,
 	"divergent-repetition": Severity.Medium,
 	"excessive-agency": Severity.Medium,
+	"model-identification": Severity.Medium,
 	"tool-discovery": Severity.Low,
 	foundation: Severity.Medium,
 	"guardrails-eval": Severity.Medium,
@@ -1703,6 +1711,7 @@ const riskCategories = {
 		"bola",
 		"cca",
 		"debug-access",
+		"model-identification",
 		"hijacking",
 		"indirect-prompt-injection",
 		"rbac",
@@ -1798,6 +1807,7 @@ const riskCategories = {
 		"financial:hallucination",
 		"financial:impartiality",
 		"financial:misconduct",
+		"financial:sox-compliance",
 		"financial:sycophancy",
 		"medical:hallucination",
 		"medical:anchoring-bias",
@@ -1888,6 +1898,7 @@ const categoryAliases = {
 	"financial:hallucination": "FinancialHallucination",
 	"financial:impartiality": "FinancialImpartiality",
 	"financial:misconduct": "FinancialMisconduct",
+	"financial:sox-compliance": "FinancialSoxCompliance",
 	"financial:sycophancy": "FinancialSycophancy",
 	"goal-misalignment": "GoalMisalignment",
 	"off-topic": "OffTopic",
@@ -1896,6 +1907,7 @@ const categoryAliases = {
 	"pharmacy:drug-interaction": "PharmacyDrugInteraction",
 	"divergent-repetition": "DivergentRepetition",
 	"excessive-agency": "ExcessiveAgency",
+	"model-identification": "ModelIdentification",
 	"tool-discovery": "ToolDiscovery",
 	foundation: "Foundation",
 	"guardrails-eval": "GuardrailsEvaluation",
@@ -2019,6 +2031,7 @@ const pluginDescriptions = {
 	default: "Executes comprehensive baseline security testing across multiple risk categories",
 	"divergent-repetition": "Tests repetitive patterns that can cause the model to diverge from normal behavior and leak training data",
 	"excessive-agency": "Evaluates system boundary enforcement and unauthorized action prevention",
+	"model-identification": "Tests whether an AI system reveals its underlying model identity, version, or creator when probed",
 	"tool-discovery": "Tests for enumeration of available tools and function calls",
 	ferpa: "Tests for Family Educational Rights and Privacy Act compliance",
 	foundation: "Tests a collection of plugins designed to run against foundation models",
@@ -2109,6 +2122,7 @@ const pluginDescriptions = {
 	"financial:hallucination": "Tests for fabricated market data, non-existent financial instruments, fictional company financials, or invented market events",
 	"financial:impartiality": "Tests for inappropriate provision of financial advice, investment recommendations, broker suggestions, or transaction facilitation without proper authorization or disclaimers",
 	"financial:misconduct": "Tests for facilitation of financial crimes including insider trading, market manipulation, front-running, spoofing, bribery, or circumventing financial regulations",
+	"financial:sox-compliance": "Tests for violations of Sarbanes-Oxley requirements including internal controls bypass, financial statement manipulation, CEO/CFO certification fraud, audit obstruction, document retention violations, and whistleblower retaliation",
 	"financial:sycophancy": "Tests for agreeing with risky trading strategies, unrealistic return expectations, or get-rich-quick schemes",
 	"goal-misalignment": "Tests whether AI systems recognize when optimizing measurable proxy metrics might not align with true underlying objectives (Goodhart's Law: \"When a measure becomes a target, it ceases to be a good measure\")",
 	"off-topic": "Tests whether AI systems can be manipulated to go off-topic by performing tasks outside their domain",
@@ -3230,5 +3244,5 @@ const EvalResultsFilterMode = z.enum([
 ]);
 
 //#endregion
-export { riskCategorySeverityMap as $, isApiProvider as A, isValidReusablePolicyId as B, TestGeneratorConfigSchema as C, CompletionTokenDetailsSchema as Ct, VarsSchema as D, UnifiedConfigSchema as E, ConversationMessageSchema as F, STRATEGY_COLLECTIONS as G, DATASET_PLUGINS as H, PartialGenerationError as I, isCustomStrategy as J, STRATEGY_COLLECTION_MAPPINGS as K, PluginConfigSchema as L, RedteamConfigSchema as M, ProviderOptionsSchema as N, isGradingResult as O, ProvidersSchema as P, pluginDescriptions as Q, PolicyObjectSchema as R, TestCasesWithMetadataSchema as S, BaseTokenUsageSchema as St, TestSuiteSchema as T, DEFAULT_STRATEGIES as U, AGENTIC_STRATEGIES as V, MULTI_TURN_STRATEGIES as W, Severity as X, isFanoutStrategy as Y, categoryAliases as Z, ScenarioSchema as _, REMOTE_ONLY_PLUGIN_IDS as _t, AtomicTestCaseSchema as a, FOUNDATION_PLUGINS as at, TestCaseWithVarsFileSchema as b, UNALIGNED_PROVIDER_HARM_PLUGINS as bt, CompletedPromptSchema as c, LLAMA_GUARD_ENABLED_CATEGORIES as ct, EvaluateOptionsSchema as d, MULTI_INPUT_EXCLUDED_PLUGINS as dt, ALIASED_PLUGIN_MAPPINGS as et, GradingConfigSchema as f, MULTI_INPUT_VAR as ft, ResultFailureReason as g, REDTEAM_PROVIDER_HARM_PLUGINS as gt, OutputFileExtension as h, PLUGIN_CATEGORIES as ht, AssertionTypeSchema as i, FINANCIAL_PLUGINS as it, isProviderOptions as j, isResultFailureReason as k, DerivedMetricSchema as l, LLAMA_GUARD_REPLICATE_PROVIDER as lt, OutputConfigSchema as m, PII_PLUGINS as mt, AssertionSchema as n, DATASET_EXEMPT_PLUGINS as nt, BaseAssertionTypesSchema as o, HARM_PLUGINS as ot, NotPrefixedAssertionTypesSchema as p, PHARMACY_PLUGINS as pt, getDefaultNFanout as q, AssertionSetSchema as r, DEFAULT_PLUGINS as rt, CommandLineOptionsSchema as s, INSURANCE_PLUGINS as st, AssertionOrSetSchema as t, BIAS_PLUGINS as tt, EvalResultsFilterMode as u, MEDICAL_PLUGINS as ut, SpecialAssertionTypesSchema as v, STRATEGY_EXEMPT_PLUGINS as vt, TestSuiteConfigSchema as w, InputsSchema as wt, TestCasesWithMetadataPromptSchema as x, PromptSchema as xt, TestCaseSchema as y, TELECOM_PLUGINS as yt, StrategyConfigSchema as z };
-//# sourceMappingURL=types-BsU_PxR3.js.map
+export { pluginDescriptions as $, isApiProvider as A, isValidReusablePolicyId as B, TestGeneratorConfigSchema as C, BaseTokenUsageSchema as Ct, VarsSchema as D, UnifiedConfigSchema as E, ConversationMessageSchema as F, MULTI_TURN_STRATEGIES as G, AGENTIC_STRATEGIES as H, PartialGenerationError as I, getDefaultNFanout as J, STRATEGY_COLLECTIONS as K, PluginConfigSchema as L, RedteamConfigSchema as M, ProviderOptionsSchema as N, isGradingResult as O, ProvidersSchema as P, categoryAliases as Q, PolicyObjectSchema as R, TestCasesWithMetadataSchema as S, PromptSchema as St, TestSuiteSchema as T, InputsSchema as Tt, DATASET_PLUGINS as U, isUuid as V, DEFAULT_STRATEGIES as W, isFanoutStrategy as X, isCustomStrategy as Y, Severity as Z, ScenarioSchema as _, REDTEAM_PROVIDER_HARM_PLUGINS as _t, AtomicTestCaseSchema as a, FINANCIAL_PLUGINS as at, TestCaseWithVarsFileSchema as b, TELECOM_PLUGINS as bt, CompletedPromptSchema as c, INSURANCE_PLUGINS as ct, EvaluateOptionsSchema as d, MEDICAL_PLUGINS as dt, riskCategorySeverityMap as et, GradingConfigSchema as f, MULTI_INPUT_EXCLUDED_PLUGINS as ft, ResultFailureReason as g, PLUGIN_CATEGORIES as gt, OutputFileExtension as h, PII_PLUGINS as ht, AssertionTypeSchema as i, DEFAULT_PLUGINS as it, isProviderOptions as j, isResultFailureReason as k, DerivedMetricSchema as l, LLAMA_GUARD_ENABLED_CATEGORIES as lt, OutputConfigSchema as m, PHARMACY_PLUGINS as mt, AssertionSchema as n, BIAS_PLUGINS as nt, BaseAssertionTypesSchema as o, FOUNDATION_PLUGINS as ot, NotPrefixedAssertionTypesSchema as p, MULTI_INPUT_VAR as pt, STRATEGY_COLLECTION_MAPPINGS as q, AssertionSetSchema as r, DATASET_EXEMPT_PLUGINS as rt, CommandLineOptionsSchema as s, HARM_PLUGINS as st, AssertionOrSetSchema as t, ALIASED_PLUGIN_MAPPINGS as tt, EvalResultsFilterMode as u, LLAMA_GUARD_REPLICATE_PROVIDER as ut, SpecialAssertionTypesSchema as v, REMOTE_ONLY_PLUGIN_IDS as vt, TestSuiteConfigSchema as w, CompletionTokenDetailsSchema as wt, TestCasesWithMetadataPromptSchema as x, UNALIGNED_PROVIDER_HARM_PLUGINS as xt, TestCaseSchema as y, STRATEGY_EXEMPT_PLUGINS as yt, StrategyConfigSchema as z };
+//# sourceMappingURL=types-DMVjYLpx.js.map