promptfoo 0.120.25 → 0.120.26

package/dist/src/main.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 import "./chunk-DHDDz29n.js";
 import { C as getEnvString, D as isNonInteractive, E as isCI, O as cliState_default, S as getEnvInt, b as getEnvBool, c as setLogLevel, d as extractFirstJsonObject, f as extractJsonObjects, h as orderKeys, i as isDebugEnabled, l as sanitizeObject, n as getLogLevel, o as logger_default, r as initializeRunLogging, s as setLogCallback, t as closeLogger, v as getConfigDirectoryPath, x as getEnvFloat, y as setConfigDirectoryPath } from "./logger-BotXmWKW.js";
-import { A as getDefaultShareViewBaseUrl, I as HUMAN_ASSERTION_TYPE, M as getShareViewBaseUrl, O as TERMINAL_MAX_WIDTH, P as VERSION, S as CLOUD_PROVIDER_PREFIX, T as DEFAULT_QUERY_LIMIT, d as REQUEST_TIMEOUT_MS, h as isPromptfooSampleTarget, i as fetchWithTimeout, j as getShareApiBaseUrl, k as getDefaultPort, l as sleep, n as fetchWithProxy, r as fetchWithRetries, t as clearAgentCache, w as DEFAULT_MAX_CONCURRENCY } from "./fetch-BuP-gm0E.js";
+import { A as getDefaultShareViewBaseUrl, I as HUMAN_ASSERTION_TYPE, M as getShareViewBaseUrl, O as TERMINAL_MAX_WIDTH, P as VERSION, S as CLOUD_PROVIDER_PREFIX, T as DEFAULT_QUERY_LIMIT, d as REQUEST_TIMEOUT_MS, h as isPromptfooSampleTarget, i as fetchWithTimeout, j as getShareApiBaseUrl, k as getDefaultPort, l as sleep, n as fetchWithProxy, r as fetchWithRetries, t as clearAgentCache, w as DEFAULT_MAX_CONCURRENCY } from "./fetch-SRsE6Ctl.js";
 import { t as invariant } from "./invariant-DT20jrBd.js";
-import { a as getAuthor, d as EMAIL_OK_STATUS, l as promptForEmailUnverified, n as checkEmailStatusAndMaybeExit, o as getUserEmail, r as clearUserEmail, s as getUserId, t as checkEmailStatus, u as setUserEmail } from "./accounts-Bzx8GnL6.js";
-import { a as readGlobalConfig, i as cloudConfig, r as CloudConfig, s as writeGlobalConfigPartial } from "./cloud-lRosK6Nk.js";
-import { n as TelemetryEventSchema, r as telemetry_default } from "./telemetry-wXyCQ1Nz.js";
-import { $ as HARM_PLUGINS, B as Severity, D as ADDITIONAL_STRATEGIES, E as isUuid, F as STRATEGY_COLLECTION_MAPPINGS, G as ALIASED_PLUGIN_MAPPINGS, I as getDefaultNFanout, J as BIAS_PLUGINS, K as ADDITIONAL_PLUGINS, M as DEFAULT_STRATEGIES, P as STRATEGY_COLLECTIONS, Q as FOUNDATION_PLUGINS, R as isFanoutStrategy, S as PluginConfigSchema, U as riskCategorySeverityMap, V as categoryAliases, W as subCategoryDescriptions, X as DEFAULT_PLUGINS, Y as DATASET_EXEMPT_PLUGINS, Z as FINANCIAL_PLUGINS, _ as PromptSchema, a as EvaluateOptionsSchema, at as MULTI_INPUT_VAR, b as ConversationMessageSchema, c as TestSuiteConfigSchema, dt as REMOTE_ONLY_PLUGIN_IDS, et as INSURANCE_PLUGINS, g as RedteamGenerateOptionsSchema, h as RedteamConfigSchema, i as EvalResultsFilterMode, it as MULTI_INPUT_EXCLUDED_PLUGINS, j as DEFAULT_MULTI_TURN_MAX_TURNS, k as ALL_STRATEGIES, l as TestSuiteSchema, lt as REDTEAM_MODEL, mt as UNALIGNED_PROVIDER_HARM_PLUGINS, n as BaseAssertionTypesSchema, nt as LLAMA_GUARD_REPLICATE_PROVIDER, o as OutputFileExtension, ot as PHARMACY_PLUGINS, p as isApiProvider, pt as TELECOM_PLUGINS, q as ALL_PLUGINS, r as CommandLineOptionsSchema, rt as MEDICAL_PLUGINS, s as ResultFailureReason, st as PII_PLUGINS, t as AssertionOrSetSchema, tt as LLAMA_GUARD_ENABLED_CATEGORIES, u as UnifiedConfigSchema, ut as REDTEAM_PROVIDER_HARM_PLUGINS, v as ProviderOptionsSchema, w as StrategyConfigSchema, x as PartialGenerationError, y as ProvidersSchema, z as isMultiTurnStrategy } from "./types-CMDs7Kzu.js";
-import { a as openAuthBrowser, d as getRemoteHealthUrl, f as neverGenerateRemote, i as checkServerRunning, l as getRemoteGenerationUrl, m as shouldGenerateRemote, n as BrowserBehaviorNames, o as openBrowser, s as promptUser, t as BrowserBehavior } from "./server-HQtz_gUy.js";
-import { A as renderPrompt, C as extractVariablesFromJson, F as TokenUsageTracker, P as redteamProviderManager, R as PromptfooHarmfulCompletionProvider, S as extractPromptFromTags, T as getShortPluginId, _ as pluginMatchesStrategyTargets, _t as resolveTeamId, a as resolveProviderConfigs, at as getCloudDatabaseId, b as extractGoalFromPrompt, c as createTransformRequest, ct as getEvalConfigFromCloud, d as Strategies, f as loadStrategy, ft as getProviderFromCloud, g as retrieveMedia, gt as resolveTeamFromIdentifier, h as mediaExists, ht as makeRequest$1, i as resolveProvider, it as checkCloudPermissions, l as createTransformResponse, lt as getOrgContext, m as getMediaStorage, mt as isCloudProvider, n as loadApiProvider, o as MCPProvider, ot as getConfigFromCloud, p as validateStrategies, pt as getUserTeams, r as loadApiProviders, rt as canCreateTargets, s as HttpProvider, st as getDefaultTeam, t as getProviderIds, ut as getPluginSeverityOverridesFromCloud } from "./providers-BOvl9qv5.js";
-import { a as fetchWithCache, n as clearCache, r as disableCache, t as cache_exports } from "./cache-Bg1Wpvzq.js";
-import { i as isJavascriptFile } from "./fileExtensions-CzcPkiKZ.js";
-import { A as filterRuntimeVars, C as extractVariablesFromTemplates, D as setupEnv, M as resultIsForTestCase, N as doesProviderRefMatch, O as deduplicateTestCases, P as getProviderDescription, S as extractVariablesFromTemplate, a as ComparisonEvalNotFoundError, b as renderEnvOnlyInObject, c as mergeComparisonTables, f as maybeLoadConfigFromExternalFile, i as writeOutput, j as getTestCaseDeduplicationKey, k as extractRuntimeVars, l as fetchCsvFromGoogleSheet, n as createOutputMetadata, o as evalTableToJson, p as maybeLoadFromExternalFile, r as writeMultipleOutputs, s as generateEvalCsv, t as printBorder, v as readFilters, w as getNunjucksEngine, y as readOutput } from "./util-BECSJ0T_.js";
-import { r as importModule, t as getDirectory } from "./esm-79BpbQzg.js";
-import { r as runPython } from "./pythonUtils-CUPlf1H0.js";
-import "./transform-B86_0IIb.js";
-import { A as BeavertailsPlugin, C as HarmbenchPlugin, D as DebugAccessPlugin, E as DivergentRepetitionPlugin, F as retryWithDeduplication, I as sampleArray, L as fetchHuggingFaceDataset, M as RedteamGraderBase, N as RedteamPluginBase, O as CrossSessionLeakPlugin, P as getCustomPolicies, S as ImitationPlugin, T as ExcessiveAgencyPlugin, _ as makeInlinePolicyIdSync, a as UnverifiableClaimsPlugin, b as OverreliancePlugin, c as ToolDiscoveryPlugin, ct as readProviderPromptMap, d as RbacPlugin, f as PromptExtractionPlugin, g as isValidPolicyObject, h as determinePolicyTypeFromId, i as VLGuardPlugin, it as getDefaultProviders, j as AegisPlugin, k as ContractPlugin, l as SqlInjectionPlugin, m as PolicyPlugin, o as UnsafeBenchPlugin, ot as processPrompts, p as PoliticsPlugin, r as VLSUPlugin, rt as doRemoteGrading, s as ToxicChatPlugin, st as readPrompts, t as GRADERS, u as ShellInjectionPlugin, v as PlinyPlugin, w as HallucinationPlugin, x as IntentPlugin, y as getPiiLeakTestsForCategory } from "./graders-DMAzEgEF.js";
-import { i as generateIdFromPrompt } from "./utils-ICP7kLcY.js";
-import { a as sha256, i as randomSequence, n as isBlobStorageEnabled } from "./extractor-BFoThUOa.js";
-import "./genaiTracer-foKtbVa2.js";
-import "./chat-D_cro0wd.js";
-import { a as createEmptyTokenUsage, i as createEmptyAssertions, n as accumulateResponseTokenUsage, r as accumulateTokenUsage, t as accumulateAssertionTokenUsage } from "./tokenUsageUtils-D2ko2eFQ.js";
-import "./transform-gpzlPrwG.js";
-import "./messages-DpoCLD_8.js";
-import "./util-Ba18wQ8e.js";
-import "./responses-B85halqh.js";
-import "./openai-jNIREoAW.js";
-import "./util-CttPoePn.js";
-import "./completion-BTbouQDz.js";
-import { n as getBlobUrl, t as getBlobByHash } from "./blobs-DlB5fwyF.js";
-import { a as evalResultsTable, c as evalsToPromptsTable, d as promptsTable, g as getDb, h as closeDbIfOpen, i as datasetsTable, l as evalsToTagsTable, n as blobReferencesTable, o as evalsTable, p as tagsTable, r as configsTable, s as evalsToDatasetsTable, t as blobAssetsTable, u as modelAuditsTable } from "./tables-ChjAuVAR.js";
-import { n as escapeRegExp, t as ellipsize } from "./text-C1cXk9ij.js";
-import { n as getTraceStore } from "./store-rueRdzcm.js";
-import "./base-DumUXbOH.js";
-import "./image-DFwp1aAV.js";
-import "./providerRegistry-DAZoFmGv.js";
-import "./rubyUtils-DYKoa7Ze.js";
-import { c as readAssertions, l as renderMetricName, o as doesPromptRefMatch, s as assertions_default, t as evaluate$1, u as runAssertions } from "./evaluator-1Tkdu8MK.js";
-import { n as setupSignalWatcher, t as readSignalEvalId } from "./signal-D4VhSJOY.js";
-import { a as createEvalId, n as EvalQueries, s as getEvalSummaries, t as Eval } from "./eval-Cxb9alW8.js";
-import { t as EvalResult } from "./evalResult-B8LbgWMA.js";
-import { t as formatDuration } from "./formatDuration-CGa0ZDQ8.js";
-import { n as shouldUseInkUI } from "./interactiveCheck-Dmm9vjpx.js";
+import { a as getAuthor, d as EMAIL_OK_STATUS, l as promptForEmailUnverified, n as checkEmailStatusAndMaybeExit, o as getUserEmail, r as clearUserEmail, s as getUserId, t as checkEmailStatus, u as setUserEmail } from "./accounts-DHHiXsy6.js";
+import { a as readGlobalConfig, i as cloudConfig, r as CloudConfig, s as writeGlobalConfigPartial } from "./cloud-BMbRVJFw.js";
+import { n as TelemetryEventSchema, r as telemetry_default } from "./telemetry-BXyVqyAg.js";
+import { $ as HARM_PLUGINS, B as Severity, D as ADDITIONAL_STRATEGIES, E as isUuid, F as STRATEGY_COLLECTION_MAPPINGS, G as ALIASED_PLUGIN_MAPPINGS, I as getDefaultNFanout, J as BIAS_PLUGINS, K as ADDITIONAL_PLUGINS, M as DEFAULT_STRATEGIES, P as STRATEGY_COLLECTIONS, Q as FOUNDATION_PLUGINS, R as isFanoutStrategy, S as PluginConfigSchema, U as riskCategorySeverityMap, V as categoryAliases, W as subCategoryDescriptions, X as DEFAULT_PLUGINS, Y as DATASET_EXEMPT_PLUGINS, Z as FINANCIAL_PLUGINS, _ as PromptSchema, a as EvaluateOptionsSchema, at as MULTI_INPUT_VAR, b as ConversationMessageSchema, c as TestSuiteConfigSchema, dt as REMOTE_ONLY_PLUGIN_IDS, et as INSURANCE_PLUGINS, g as RedteamGenerateOptionsSchema, h as RedteamConfigSchema, i as EvalResultsFilterMode, it as MULTI_INPUT_EXCLUDED_PLUGINS, j as DEFAULT_MULTI_TURN_MAX_TURNS, k as ALL_STRATEGIES, l as TestSuiteSchema, lt as REDTEAM_MODEL, mt as UNALIGNED_PROVIDER_HARM_PLUGINS, n as BaseAssertionTypesSchema, nt as LLAMA_GUARD_REPLICATE_PROVIDER, o as OutputFileExtension, ot as PHARMACY_PLUGINS, p as isApiProvider, pt as TELECOM_PLUGINS, q as ALL_PLUGINS, r as CommandLineOptionsSchema, rt as MEDICAL_PLUGINS, s as ResultFailureReason, st as PII_PLUGINS, t as AssertionOrSetSchema, tt as LLAMA_GUARD_ENABLED_CATEGORIES, u as UnifiedConfigSchema, ut as REDTEAM_PROVIDER_HARM_PLUGINS, v as ProviderOptionsSchema, w as StrategyConfigSchema, x as PartialGenerationError, y as ProvidersSchema, z as isMultiTurnStrategy } from "./types-t52w-XsS.js";
+import { a as openAuthBrowser, d as getRemoteHealthUrl, f as neverGenerateRemote, i as checkServerRunning, l as getRemoteGenerationUrl, m as shouldGenerateRemote, n as BrowserBehaviorNames, o as openBrowser, s as promptUser, t as BrowserBehavior } from "./server-DWmZLfCy.js";
+import { A as renderPrompt, C as extractVariablesFromJson, F as TokenUsageTracker, P as redteamProviderManager, R as PromptfooHarmfulCompletionProvider, S as extractPromptFromTags, T as getShortPluginId, _ as pluginMatchesStrategyTargets, _t as resolveTeamId, a as resolveProviderConfigs, at as getCloudDatabaseId, b as extractGoalFromPrompt, c as createTransformRequest, ct as getEvalConfigFromCloud, d as Strategies, f as loadStrategy, ft as getProviderFromCloud, g as retrieveMedia, gt as resolveTeamFromIdentifier, h as mediaExists, ht as makeRequest$1, i as resolveProvider, it as checkCloudPermissions, l as createTransformResponse, lt as getOrgContext, m as getMediaStorage, mt as isCloudProvider, n as loadApiProvider, o as MCPProvider, ot as getConfigFromCloud, p as validateStrategies, pt as getUserTeams, r as loadApiProviders, rt as canCreateTargets, s as HttpProvider, st as getDefaultTeam, t as getProviderIds, ut as getPluginSeverityOverridesFromCloud } from "./providers-BlEhY5mi.js";
+import { a as fetchWithCache, n as clearCache, r as disableCache, t as cache_exports } from "./cache-mIszOnuz.js";
+import { i as isJavascriptFile } from "./fileExtensions-BpuMmaFL.js";
+import { A as filterRuntimeVars, C as extractVariablesFromTemplates, D as setupEnv, M as resultIsForTestCase, N as doesProviderRefMatch, O as deduplicateTestCases, P as getProviderDescription, S as extractVariablesFromTemplate, a as ComparisonEvalNotFoundError, b as renderEnvOnlyInObject, c as mergeComparisonTables, f as maybeLoadConfigFromExternalFile, i as writeOutput, j as getTestCaseDeduplicationKey, k as extractRuntimeVars, l as fetchCsvFromGoogleSheet, n as createOutputMetadata, o as evalTableToJson, p as maybeLoadFromExternalFile, r as writeMultipleOutputs, s as generateEvalCsv, t as printBorder, v as readFilters, w as getNunjucksEngine, y as readOutput } from "./util-BSh4a_Q8.js";
+import { r as importModule, t as getDirectory } from "./esm-CYhseqj4.js";
+import { r as runPython } from "./pythonUtils-r1uBuA0n.js";
+import "./transform-CqTFr7KR.js";
+import { A as BeavertailsPlugin, C as HarmbenchPlugin, D as DebugAccessPlugin, E as DivergentRepetitionPlugin, F as retryWithDeduplication, I as sampleArray, L as fetchHuggingFaceDataset, M as RedteamGraderBase, N as RedteamPluginBase, O as CrossSessionLeakPlugin, P as getCustomPolicies, S as ImitationPlugin, T as ExcessiveAgencyPlugin, _ as makeInlinePolicyIdSync, a as UnverifiableClaimsPlugin, b as OverreliancePlugin, c as ToolDiscoveryPlugin, ct as readProviderPromptMap, d as RbacPlugin, f as PromptExtractionPlugin, g as isValidPolicyObject, h as determinePolicyTypeFromId, i as VLGuardPlugin, it as getDefaultProviders, j as AegisPlugin, k as ContractPlugin, l as SqlInjectionPlugin, m as PolicyPlugin, o as UnsafeBenchPlugin, ot as processPrompts, p as PoliticsPlugin, r as VLSUPlugin, rt as doRemoteGrading, s as ToxicChatPlugin, st as readPrompts, t as GRADERS, u as ShellInjectionPlugin, v as PlinyPlugin, w as HallucinationPlugin, x as IntentPlugin, y as getPiiLeakTestsForCategory } from "./graders-BaMCwIKp.js";
+import { i as generateIdFromPrompt } from "./utils-JaY9veb5.js";
+import { a as sha256, i as randomSequence, n as isBlobStorageEnabled } from "./extractor-LSYjrhK0.js";
+import "./genaiTracer-CqNnnXrE.js";
+import "./chat-DIywASPG.js";
+import { a as createEmptyTokenUsage, i as createEmptyAssertions, n as accumulateResponseTokenUsage, r as accumulateTokenUsage, t as accumulateAssertionTokenUsage } from "./tokenUsageUtils-DmZSD2eU.js";
+import "./transform-CoP2bJ7P.js";
+import "./messages-D61tPFQo.js";
+import "./util-vjscpUzy.js";
+import "./responses-TsdODUpm.js";
+import "./openai-CT5fwbve.js";
+import "./util-CUEt0Vum.js";
+import "./completion-BBJ6zmG3.js";
+import { n as getBlobUrl, t as getBlobByHash } from "./blobs-kt8v3UyH.js";
+import { a as evalResultsTable, c as evalsToPromptsTable, d as promptsTable, g as getDb, h as closeDbIfOpen, i as datasetsTable, l as evalsToTagsTable, n as blobReferencesTable, o as evalsTable, p as tagsTable, r as configsTable, s as evalsToDatasetsTable, t as blobAssetsTable, u as modelAuditsTable } from "./tables-C7TT2XVn.js";
+import { n as escapeRegExp, t as ellipsize } from "./text-DgMr_tiM.js";
+import { n as getTraceStore } from "./store-D4gdn9ih.js";
+import "./base-BaXmtXYp.js";
+import "./image-mhAGP07h.js";
+import "./providerRegistry-Xf0qdqGQ.js";
+import "./rubyUtils-BtjlqyXt.js";
+import { c as readAssertions, l as renderMetricName, o as doesPromptRefMatch, s as assertions_default, t as evaluate$1, u as runAssertions } from "./evaluator-3EJCMTs0.js";
+import { n as setupSignalWatcher, t as readSignalEvalId } from "./signal-Bl32q42d.js";
+import { a as createEvalId, n as EvalQueries, s as getEvalSummaries, t as Eval } from "./eval-CYrbG57o.js";
+import { t as EvalResult } from "./evalResult-6JaUIStC.js";
+import { t as formatDuration } from "./formatDuration-Doo0xq-z.js";
+import { n as shouldUseInkUI } from "./interactiveCheck-DU-MAhp5.js";
 import { fileURLToPath } from "node:url";
 import fs, { realpathSync } from "node:fs";
 import path, { resolve as resolve$1 } from "node:path";
@@ -114,7 +114,7 @@ function runCommand(program) {
 			hasGithubPr: !!cmdObj.githubPr,
 			hasGuidance: !!(cmdObj.guidance || cmdObj.guidanceFile)
 		});
-		const { executeScan } = await import("./scanner-C6QXA9Pn.js");
+		const { executeScan } = await import("./scanner-Dyw21Wg_.js");
 		await executeScan(repoPath, cmdObj);
 	});
 }
@@ -2591,7 +2591,7 @@ try {
 //#region src/util/inlineBlobsForShare.ts
 const BLOB_URI_PREFIX = "promptfoo://blob/";
 const BLOB_URI_REGEX = /promptfoo:\/\/blob\/([a-f0-9]{64})/gi;
-const BLOB_HASH_REGEX$1 = /^[a-f0-9]{64}$/i;
+const BLOB_HASH_REGEX = /^[a-f0-9]{64}$/i;
 const MAX_DEPTH = 8;
 const MAX_STRING_LENGTH_TO_SCAN = 1e5;
 function normalizeHash(hash) {
@@ -2614,7 +2614,7 @@ function extractHashFromBlobRef(value) {
 		const match = candidate.uri.match(BLOB_URI_REGEX);
 		return match?.[1] ? normalizeHash(match[1]) : null;
 	}
-	if (candidate.hash && typeof candidate.hash === "string" && BLOB_HASH_REGEX$1.test(candidate.hash) && typeof candidate.mimeType === "string") return normalizeHash(candidate.hash);
+	if (candidate.hash && typeof candidate.hash === "string" && BLOB_HASH_REGEX.test(candidate.hash) && typeof candidate.mimeType === "string") return normalizeHash(candidate.hash);
 	return null;
 }
 function collectBlobHashes(value, hashes, visited, depth) {
@@ -3275,11 +3275,31 @@ function shouldShareResults(opts) {
 * ```
 */
 function generateEvalSummary(params) {
-	const { evalId, isRedteam, writeToDatabase, shareableUrl, wantsToShare, hasExplicitDisable, cloudEnabled, activelySharing = false, tokenUsage, successes, failures, errors, duration, maxConcurrency, tracker } = params;
+	const { evalId, isRedteam, writeToDatabase, shareableUrl, wantsToShare, hasExplicitDisable, cloudEnabled, activelySharing = false, tokenUsage, successes, failures, errors, duration, maxConcurrency, tracker, targetErrorStatus } = params;
 	const lines = [];
 	const completionType = isRedteam ? "Red team" : "Eval";
-	const completionMessage = writeToDatabase && shareableUrl ? `${chalk.green("✓")} ${completionType} complete: ${shareableUrl}` : writeToDatabase && activelySharing ? `${chalk.green("✓")} ${completionType} complete` : writeToDatabase ? `${chalk.green("✓")} ${completionType} complete (ID: ${chalk.cyan(evalId)})` : `${chalk.green("✓")} ${completionType} complete`;
+	const wasAborted = targetErrorStatus != null;
+	let completionMessage;
+	if (wasAborted) {
+		completionMessage = `${chalk.red("✗")} ${completionType} aborted`;
+		if (writeToDatabase) completionMessage += ` (ID: ${chalk.cyan(evalId)})`;
+	} else if (writeToDatabase && shareableUrl) completionMessage = `${chalk.green("✓")} ${completionType} complete: ${shareableUrl}`;
+	else if (writeToDatabase && activelySharing) completionMessage = `${chalk.green("✓")} ${completionType} complete`;
+	else if (writeToDatabase) completionMessage = `${chalk.green("✓")} ${completionType} complete (ID: ${chalk.cyan(evalId)})`;
+	else completionMessage = `${chalk.green("✓")} ${completionType} complete`;
 	lines.push(completionMessage);
+	if (wasAborted && targetErrorStatus != null) {
+		lines.push("");
+		lines.push(chalk.red.bold("Scan stopped: Target is unavailable and will not recover on retry."));
+		lines.push(chalk.red(`  Target returned HTTP ${targetErrorStatus}`));
+		lines.push("");
+		lines.push(chalk.yellow("Possible causes:"));
+		lines.push(chalk.yellow("  • Invalid API key or authentication (401/403)"));
+		lines.push(chalk.yellow("  • Target endpoint does not exist (404)"));
+		lines.push(chalk.yellow("  • Server does not support the request (501)"));
+		lines.push("");
+		lines.push(chalk.cyan("To fix: Check your target configuration and credentials."));
+	}
 	if (writeToDatabase && !shareableUrl && !wantsToShare && !activelySharing) {
 		lines.push("");
 		lines.push(`» View results: ${chalk.green.bold("promptfoo view")}`);
@@ -4305,6 +4325,7 @@ async function doEval(cmdObj, defaultConfig, defaultConfigPath, evaluateOptions)
 		const isRedteam = Boolean(config.redteam);
 		const duration = Math.round((Date.now() - startTime) / 1e3);
 		const tracker = TokenUsageTracker.getInstance();
+		const targetErrorStatus = await evalRecord.findTargetErrorStatus();
 		const summaryLines = generateEvalSummary({
 			evalId: evalRecord.id,
 			isRedteam,
@@ -4320,7 +4341,8 @@ async function doEval(cmdObj, defaultConfig, defaultConfigPath, evaluateOptions)
 			errors,
 			duration,
 			maxConcurrency,
-			tracker
+			tracker,
+			targetErrorStatus
 		});
 		if (cmdObj.write && wantsToShare && !canShareEval) {
 			logger_default.info(summaryLines[0]);
@@ -4375,7 +4397,7 @@ async function doEval(cmdObj, defaultConfig, defaultConfigPath, evaluateOptions)
 			if (initialization) {
 				const configPaths = (cmdObj.config || [defaultConfigPath]).filter(Boolean);
 				if (!configPaths.length) {
-					logger_default.error("Could not locate config file(s) to watch");
+					logger_default.error(`Could not locate config file(s) to watch. Pass --config path/to/promptfooconfig.yaml or run from a directory containing promptfooconfig.{${DEFAULT_CONFIG_EXTENSIONS.join(",")}}.`);
 					process.exitCode = 1;
 					return ret;
 				}
@@ -4464,7 +4486,9 @@ function evalCommand(program, defaultConfig, defaultConfigPath) {
 				evalCmd.help();
 				return;
 			}
-			logger_default.warn(`Unknown command: ${command.args[0]}. Did you mean -c ${command.args[0]}?`);
+			logger_default.error(`Unknown command: ${command.args[0]}. Did you mean -c ${command.args[0]}?`);
+			process.exitCode = 1;
+			return;
 		}
 		if (validatedOpts.help) {
 			evalCmd.help();
@@ -4676,21 +4700,97 @@ async function checkRemoteHealth(url) {
 	}
 }
 
+//#endregion
+//#region src/server/middleware/csrfProtection.ts
+const SAFE_METHODS = new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+const KNOWN_LOCAL_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1",
+	"local.promptfoo.app"
+]);
+function isLocalHost(hostname) {
+	return KNOWN_LOCAL_HOSTS.has(hostname);
+}
+function getAllowedOrigins() {
+	const envOrigins = getEnvString("PROMPTFOO_CSRF_ALLOWED_ORIGINS", "");
+	if (!envOrigins) return /* @__PURE__ */ new Set();
+	return new Set(envOrigins.split(",").map((o) => o.trim()).filter(Boolean));
+}
+function stripPort(host) {
+	return host.replace(/:\d+$/, "");
+}
+function isAllowedCrossSite(origin, host) {
+	try {
+		const originHostname = new URL(origin).hostname;
+		const targetHostname = stripPort(host);
+		if (isLocalHost(originHostname) && isLocalHost(targetHostname)) return true;
+	} catch {
+		return false;
+	}
+	return getAllowedOrigins().has(origin);
+}
+function csrfProtection(req, res, next) {
+	if (SAFE_METHODS.has(req.method)) return next();
+	const secFetchSite = req.headers["sec-fetch-site"];
+	const origin = req.headers["origin"];
+	const host = req.headers.host || "";
+	if (secFetchSite) {
+		if (secFetchSite !== "cross-site") return next();
+		if (origin && isAllowedCrossSite(origin, host)) return next();
+		logger_default.warn("[CSRF] Blocked cross-site request", {
+			method: req.method,
+			path: req.path,
+			origin,
+			host,
+			secFetchSite
+		});
+		res.status(403).json({ error: "Cross-site requests are not allowed" });
+		return;
+	}
+	if (origin) {
+		try {
+			if (new URL(origin).hostname === stripPort(host)) return next();
+			if (isAllowedCrossSite(origin, host)) return next();
+		} catch {}
+		logger_default.warn("[CSRF] Blocked cross-origin request", {
+			method: req.method,
+			path: req.path,
+			origin,
+			host
+		});
+		res.status(403).json({ error: "Cross-origin requests are not allowed" });
+		return;
+	}
+	return next();
+}
+
+//#endregion
+//#region src/types/api/blobs.ts
+const GetBlobParamsSchema = z.object({ hash: z.string().regex(/^[a-f0-9]{64}$/i, "Invalid blob hash") });
+/** Grouped schemas for server-side validation. */
+const BlobsSchemas = { Get: { Params: GetBlobParamsSchema } };
+
 //#endregion
 //#region src/server/routes/blobs.ts
 const blobsRouter = express.Router();
-const BLOB_HASH_REGEX = /^[a-f0-9]{64}$/i;
 const SAFE_MIME_TYPE_REGEX = /^[a-z]+\/[a-z0-9_+-]+$/i;
 blobsRouter.get("/:hash", async (req, res) => {
 	if (!isBlobStorageEnabled()) {
 		res.status(404).json({ error: "Blob storage disabled" });
 		return;
 	}
-	const hash = req.params.hash;
-	if (!BLOB_HASH_REGEX.test(hash)) {
-		res.status(400).json({ error: "Invalid blob hash" });
+	const paramsResult = BlobsSchemas.Get.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
 		return;
 	}
+	const { hash } = paramsResult.data;
 	const db = getDb();
 	const asset = db.select({
 		hash: blobAssetsTable.hash,
@@ -4736,14 +4836,75 @@ blobsRouter.get("/:hash", async (req, res) => {
 	}
 });
 
+//#endregion
+//#region src/types/api/common.ts
+/** Standard email validation schema. */
+const EmailSchema = z.string().email();
+/** Response containing a single message field. */
+const MessageResponseSchema = z.object({ message: z.string() });
+/** Timestamp that can be either an ISO string or Unix epoch number. */
+const TimestampSchema = z.union([z.string(), z.number()]);
+
+//#endregion
+//#region src/types/api/configs.ts
+/** Base config fields shared across list and detail responses. */
+const BaseConfigSummarySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	createdAt: TimestampSchema,
+	updatedAt: TimestampSchema
+});
+const ConfigSummarySchema = BaseConfigSummarySchema.extend({ type: z.string() });
+const ListConfigsQuerySchema = z.object({ type: z.string().min(1).optional() });
+const ListConfigsResponseSchema = z.object({ configs: z.array(ConfigSummarySchema) });
+const CreateConfigRequestSchema = z.object({
+	name: z.string().min(1),
+	type: z.string().min(1),
+	config: z.unknown().refine((v) => v != null, { message: "config is required" })
+});
+const CreateConfigResponseSchema = z.object({
+	id: z.string(),
+	createdAt: TimestampSchema
+});
+const ListConfigsByTypeParamsSchema = z.object({ type: z.string().min(1) });
+const ListConfigsByTypeResponseSchema = z.object({ configs: z.array(BaseConfigSummarySchema) });
+const GetConfigParamsSchema = z.object({
+	type: z.string().min(1),
+	id: z.string().min(1)
+});
+const GetConfigResponseSchema = ConfigSummarySchema.extend({ config: z.unknown() }).passthrough();
+/** Grouped schemas for server-side validation. */
+const ConfigSchemas = {
+	List: {
+		Query: ListConfigsQuerySchema,
+		Response: ListConfigsResponseSchema
+	},
+	Create: {
+		Request: CreateConfigRequestSchema,
+		Response: CreateConfigResponseSchema
+	},
+	ListByType: {
+		Params: ListConfigsByTypeParamsSchema,
+		Response: ListConfigsByTypeResponseSchema
+	},
+	Get: {
+		Params: GetConfigParamsSchema,
+		Response: GetConfigResponseSchema
+	}
+};
+
 //#endregion
 //#region src/server/routes/configs.ts
 const configsRouter = Router();
 configsRouter.get("/", async (req, res) => {
-	const db = await getDb();
+	const queryResult = ConfigSchemas.List.Query.safeParse(req.query);
+	if (!queryResult.success) {
+		res.status(400).json({ error: z.prettifyError(queryResult.error) });
+		return;
+	}
 	try {
-		const type = req.query.type;
-		const query = db.select({
+		const { type } = queryResult.data;
+		const query = (await getDb()).select({
 			id: configsTable.id,
 			name: configsTable.name,
 			createdAt: configsTable.createdAt,
@@ -4753,18 +4914,22 @@ configsRouter.get("/", async (req, res) => {
 		if (type) query.where(eq(configsTable.type, type));
 		const configs = await query;
 		logger_default.info(`Loaded ${configs.length} configs${type ? ` of type ${type}` : ""}`);
-		res.json({ configs });
+		res.json(ConfigSchemas.List.Response.parse({ configs }));
 	} catch (error) {
 		logger_default.error(`Error fetching configs: ${error}`);
 		res.status(500).json({ error: "Failed to fetch configs" });
 	}
 });
 configsRouter.post("/", async (req, res) => {
-	const db = await getDb();
+	const bodyResult = ConfigSchemas.Create.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
 	try {
-		const { name, type, config } = req.body;
+		const { name, type, config } = bodyResult.data;
 		const id = crypto.randomUUID();
-		const [result] = await db.insert(configsTable).values({
+		const [result] = await (await getDb()).insert(configsTable).values({
 			id,
 			name,
 			type,
@@ -4774,41 +4939,48 @@ configsRouter.post("/", async (req, res) => {
 			createdAt: configsTable.createdAt
 		});
 		logger_default.info(`Saved config ${id} of type ${type}`);
-		res.json(result);
+		res.json(ConfigSchemas.Create.Response.parse(result));
 	} catch (error) {
 		logger_default.error(`Error saving config: ${error}`);
 		res.status(500).json({ error: "Failed to save config" });
 	}
 });
 configsRouter.get("/:type", async (req, res) => {
-	const db = await getDb();
-	const type = req.params.type;
+	const paramsResult = ConfigSchemas.ListByType.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const configs = await db.select({
+		const { type } = paramsResult.data;
+		const configs = await (await getDb()).select({
 			id: configsTable.id,
 			name: configsTable.name,
 			createdAt: configsTable.createdAt,
 			updatedAt: configsTable.updatedAt
 		}).from(configsTable).where(eq(configsTable.type, type)).orderBy(configsTable.updatedAt);
 		logger_default.info(`Loaded ${configs.length} configs of type ${type}`);
-		res.json({ configs });
+		res.json(ConfigSchemas.ListByType.Response.parse({ configs }));
 	} catch (error) {
 		logger_default.error(`Error fetching configs: ${error}`);
 		res.status(500).json({ error: "Failed to fetch configs" });
 	}
 });
 configsRouter.get("/:type/:id", async (req, res) => {
-	const db = await getDb();
-	const type = req.params.type;
-	const id = req.params.id;
+	const paramsResult = ConfigSchemas.Get.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const config = await db.select().from(configsTable).where(and(eq(configsTable.type, type), eq(configsTable.id, id))).limit(1);
-		logger_default.info(`Loaded config ${id} of type ${type}`);
-		if (!config.length) {
+		const { type, id } = paramsResult.data;
+		const [config] = await (await getDb()).select().from(configsTable).where(and(eq(configsTable.type, type), eq(configsTable.id, id))).limit(1);
+		if (!config) {
 			res.status(404).json({ error: "Config not found" });
 			return;
 		}
-		res.json(config[0]);
+		logger_default.info(`Loaded config ${id} of type ${type}`);
+		res.json(ConfigSchemas.Get.Response.parse(config));
 	} catch (error) {
 		logger_default.error(`Error fetching config: ${error}`);
 		res.status(500).json({ error: "Failed to fetch config" });
@@ -6352,6 +6524,7 @@ async function synthesize$1({ abortSignal, delay, entities: entitiesOverride, in
 		seen.add(key);
 		return true;
 	});
+	const needsGoalExtraction = strategies.some((s) => Strategies.find((def) => def.id === s.id)?.requiresGoalExtraction);
 	await validateStrategies(strategies);
 	await validateSharpDependency(strategies, plugins);
 	const redteamProvider = await redteamProviderManager.getProvider({ provider });
@@ -6543,13 +6716,15 @@ async function synthesize$1({ abortSignal, delay, entities: entitiesOverride, in
 			if (!Array.isArray(allPluginTests) || allPluginTests.length === 0) logger_default.warn(`Failed to generate tests for ${plugin.id}`);
 			else {
 				const testCasesWithMetadata = allPluginTests;
-				logger_default.debug(`Extracting goal for ${testCasesWithMetadata.length} tests from ${plugin.id}...`);
-				for (const testCase of testCasesWithMetadata) {
-					const promptVar = testCase.vars?.[injectVar];
-					const prompt = Array.isArray(promptVar) ? promptVar[0] : String(promptVar);
-					const policy = getPolicyText(testCase.metadata);
-					const extractedGoal = await extractGoalFromPrompt(prompt, purpose, plugin.id, policy);
-					testCase.metadata.goal = extractedGoal;
+				if (needsGoalExtraction) {
+					logger_default.debug(`Extracting goal for ${testCasesWithMetadata.length} tests from ${plugin.id}...`);
+					for (const testCase of testCasesWithMetadata) {
+						const promptVar = testCase.vars?.[injectVar];
+						const prompt = Array.isArray(promptVar) ? promptVar[0] : String(promptVar);
+						const policy = getPolicyText(testCase.metadata);
+						const extractedGoal = await extractGoalFromPrompt(prompt, purpose, plugin.id, policy);
+						testCase.metadata.goal = extractedGoal;
+					}
 				}
 				testCases.push(...testCasesWithMetadata);
 			}
@@ -6584,13 +6759,15 @@ async function synthesize$1({ abortSignal, delay, entities: entitiesOverride, in
 					...t.metadata || {}
 				}
 			}));
-			logger_default.debug(`Extracting goal for ${testCasesWithMetadata.length} custom tests from ${plugin.id}...`);
-			for (const testCase of testCasesWithMetadata) {
-				const promptVar = testCase.vars?.[injectVar];
-				const prompt = Array.isArray(promptVar) ? promptVar[0] : String(promptVar);
-				const policy = getPolicyText(testCase.metadata);
-				const extractedGoal = await extractGoalFromPrompt(prompt, purpose, plugin.id, policy);
-				testCase.metadata.goal = extractedGoal;
+			if (needsGoalExtraction) {
+				logger_default.debug(`Extracting goal for ${testCasesWithMetadata.length} custom tests from ${plugin.id}...`);
+				for (const testCase of testCasesWithMetadata) {
+					const promptVar = testCase.vars?.[injectVar];
+					const prompt = Array.isArray(promptVar) ? promptVar[0] : String(promptVar);
+					const policy = getPolicyText(testCase.metadata);
+					const extractedGoal = await extractGoalFromPrompt(prompt, purpose, plugin.id, policy);
+					testCase.metadata.goal = extractedGoal;
+				}
 			}
 			testCases.push(...testCasesWithMetadata);
 			logger_default.debug(`Added ${customTests.length} custom test cases from ${plugin.id}`);
@@ -7368,7 +7545,7 @@ async function doRedteamRun(options) {
 		const evalMs = evalResult.evaluationDurationMs ?? 0;
 		logger_default.info(chalk.gray(`Total scan time: ${formatDuration(totalMs / 1e3)} (generation: ${formatDuration(generationDurationMs / 1e3)}, evaluation: ${formatDuration(evalMs / 1e3)})`));
 	}
-	logger_default.info(chalk.green("\nRed team scan complete!"));
+	if (evalResult ? await evalResult.findTargetErrorStatus() != null : false) {} else logger_default.info(chalk.green("\nRed team scan complete!"));
 	if (!evalResult?.shared) if (options.liveRedteamConfig) logger_default.info(chalk.blue(`To view the results, click the ${chalk.bold("View Report")} button or run ${chalk.bold(promptfooCommand("redteam report"))} on the command line.`));
 	else logger_default.info(chalk.blue(`To view the results, run ${chalk.bold(promptfooCommand("redteam report"))}`));
 	setLogCallback(null);
@@ -7477,13 +7654,6 @@ var src_default = {
 	redteam
 };
 
-//#endregion
-//#region src/types/api/common.ts
-/** Standard email validation schema. */
-const EmailSchema = z.string().email();
-/** Response containing a single message field. */
-const MessageResponseSchema = z.object({ message: z.string() });
-
 //#endregion
 //#region src/types/api/eval.ts
 /** Eval ID parameter schema. */
@@ -7515,8 +7685,111 @@ const EvalTableQuerySchema = z.object({
 	filter: z.union([z.string(), z.array(z.string())]).transform((v) => Array.isArray(v) ? v : v ? [v] : []).prefault([]),
 	comparisonEvalIds: z.union([z.string(), z.array(z.string())]).transform((v) => Array.isArray(v) ? v : v ? [v] : []).prefault([])
 });
+/**
+* Schema for creating a new evaluation job.
+* Based on EvaluateTestSuiteWithEvaluateOptions type.
+* Note: prompts must be an array for this endpoint (evaluate() expects array).
+*/
+const CreateJobRequestSchema = TestSuiteConfigSchema.extend({
+	prompts: z.array(z.union([z.string(), z.record(z.string(), z.unknown())])),
+	evaluateOptions: EvaluateOptionsSchema.optional()
+}).passthrough();
+const CreateJobResponseSchema = z.object({ id: z.string().uuid() });
+const GetJobParamsSchema = z.object({ id: z.string().uuid() });
+const GetJobResponseSchema = z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("in-progress"),
+		progress: z.number(),
+		total: z.number(),
+		logs: z.array(z.string())
+	}),
+	z.object({
+		status: z.literal("complete"),
+		result: z.record(z.string(), z.unknown()).nullable(),
+		evalId: z.string().nullable(),
+		logs: z.array(z.string())
+	}),
+	z.object({
+		status: z.literal("error"),
+		logs: z.array(z.string())
+	})
+]);
+const UpdateEvalParamsSchema = EvalIdParamSchema;
+/** Schema for EvaluateTable - permissive to allow complex nested structures. */
+const EvaluateTableSchema = z.object({
+	head: z.object({
+		prompts: z.array(z.record(z.string(), z.unknown())),
+		vars: z.array(z.string())
+	}),
+	body: z.array(z.record(z.string(), z.unknown()))
+}).passthrough();
+const UpdateEvalRequestSchema = z.object({
+	table: EvaluateTableSchema.optional(),
+	config: z.record(z.string(), z.unknown()).optional()
+});
+const UpdateEvalResponseSchema = MessageResponseSchema;
+const AddResultsParamsSchema = EvalIdParamSchema;
+/** Schema for eval results with minimal required fields.
+* EvaluateResult has many optional fields, but these core fields are required
+* for the result to be usable. Using passthrough to preserve all extra fields.
+*/
+const AddResultsRequestSchema = z.array(z.object({
+	promptIdx: z.number().int().nonnegative(),
+	testIdx: z.number().int().nonnegative(),
+	success: z.boolean(),
+	score: z.number()
+}).passthrough());
+const ReplayRequestSchema = z.object({
+	evaluationId: z.string().min(1),
+	testIndex: z.number().int().nonnegative().optional(),
+	prompt: z.string().min(1),
+	variables: z.record(z.string(), z.unknown()).optional()
+});
+const ReplayResponseSchema = z.object({
+	output: z.string(),
+	error: z.string().nullable().optional(),
+	response: z.record(z.string(), z.unknown()).optional()
+});
+const SubmitRatingParamsSchema = z.object({
+	evalId: z.string().min(1),
+	id: z.string().min(1)
+});
+/** Permissive grading result schema. */
+const SubmitRatingRequestSchema = z.object({
+	pass: z.boolean(),
+	score: z.number()
+}).passthrough();
+const SaveEvalRequestSchema = z.object({
+	data: z.object({
+		results: z.record(z.string(), z.unknown()),
+		config: z.record(z.string(), z.unknown())
+	}).passthrough().optional(),
+	config: z.record(z.string(), z.unknown()).optional(),
+	prompts: z.array(z.record(z.string(), z.unknown())).optional(),
+	results: z.array(z.record(z.string(), z.unknown())).optional(),
+	author: z.string().nullable().optional(),
+	createdAt: z.union([z.string(), z.number()]).optional(),
+	vars: z.array(z.string()).optional()
+}).passthrough();
+const SaveEvalResponseSchema = z.object({ id: z.string() });
+const DeleteEvalParamsSchema = EvalIdParamSchema;
+const DeleteEvalResponseSchema = MessageResponseSchema;
+const BulkDeleteEvalsRequestSchema = z.object({ ids: z.array(z.string().min(1)).min(1) });
 /** Grouped schemas for server-side validation. */
 const EvalSchemas = {
+	CreateJob: {
+		Request: CreateJobRequestSchema,
+		Response: CreateJobResponseSchema
+	},
+	GetJob: {
+		Params: GetJobParamsSchema,
+		Response: GetJobResponseSchema
+	},
+	Update: {
+		Params: UpdateEvalParamsSchema,
+		Request: UpdateEvalRequestSchema,
+		Response: UpdateEvalResponseSchema
+	},
 	UpdateAuthor: {
 		Params: UpdateEvalAuthorParamsSchema,
 		Request: UpdateEvalAuthorRequestSchema,
@@ -7537,7 +7810,31 @@ const EvalSchemas = {
 		Request: CopyEvalRequestSchema,
 		Response: CopyEvalResponseSchema
 	},
-	Table: { Query: EvalTableQuerySchema }
+	Table: {
+		Params: EvalIdParamSchema,
+		Query: EvalTableQuerySchema
+	},
+	AddResults: {
+		Params: AddResultsParamsSchema,
+		Request: AddResultsRequestSchema
+	},
+	Replay: {
+		Request: ReplayRequestSchema,
+		Response: ReplayResponseSchema
+	},
+	SubmitRating: {
+		Params: SubmitRatingParamsSchema,
+		Request: SubmitRatingRequestSchema
+	},
+	Save: {
+		Request: SaveEvalRequestSchema,
+		Response: SaveEvalResponseSchema
+	},
+	Delete: {
+		Params: DeleteEvalParamsSchema,
+		Response: DeleteEvalResponseSchema
+	},
+	BulkDelete: { Request: BulkDeleteEvalsRequestSchema }
 };
 
 //#endregion
@@ -7562,7 +7859,16 @@ function setDownloadHeaders(res, fileName, contentType) {
 const evalRouter = Router();
 const evalJobs = /* @__PURE__ */ new Map();
 evalRouter.post("/job", (req, res) => {
-	const { evaluateOptions, ...testSuite } = req.body;
+	const result = EvalSchemas.CreateJob.Request.safeParse(req.body);
+	if (!result.success) {
+		res.status(400).json({ error: z.prettifyError(result.error) });
+		return;
+	}
+	const { evaluateOptions, providers: _validatedProviders, ...restData } = result.data;
+	const testSuite = {
+		...restData,
+		providers: req.body.providers
+	};
 	const id = crypto.randomUUID();
 	evalJobs.set(id, {
 		evalId: null,
@@ -7584,12 +7890,12 @@ evalRouter.post("/job", (req, res) => {
 			job.total = total;
 			console.log(`[${id}] ${progress}/${total}`);
 		}
-	})).then(async (result) => {
+	})).then(async (evalResult) => {
 		const job = evalJobs.get(id);
 		invariant(job, "Job not found");
 		job.status = "complete";
-		job.result = await result.toEvaluateSummary();
-		job.evalId = result.id;
+		job.result = await evalResult.toEvaluateSummary();
+		job.evalId = evalResult.id;
 		console.log(`[${id}] Complete`);
 	}).catch((error) => {
 		logger_default.error(dedent`Failed to eval tests:
@@ -7602,79 +7908,98 @@ evalRouter.post("/job", (req, res) => {
 		job.evalId = null;
 		job.logs = [String(error)];
 	});
-	res.json({ id });
+	res.json(EvalSchemas.CreateJob.Response.parse({ id }));
 });
 evalRouter.get("/job/:id", (req, res) => {
-	const id = req.params.id;
+	const paramsResult = EvalSchemas.GetJob.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
 	const job = evalJobs.get(id);
 	if (!job) {
 		res.status(404).json({ error: "Job not found" });
 		return;
 	}
-	if (job.status === "complete") res.json({
+	if (job.status === "complete") res.json(EvalSchemas.GetJob.Response.parse({
 		status: "complete",
 		result: job.result,
 		evalId: job.evalId,
 		logs: job.logs
-	});
-	else if (job.status === "error") res.json({
+	}));
+	else if (job.status === "error") res.json(EvalSchemas.GetJob.Response.parse({
 		status: "error",
 		logs: job.logs
-	});
-	else res.json({
+	}));
+	else res.json(EvalSchemas.GetJob.Response.parse({
 		status: "in-progress",
 		progress: job.progress,
 		total: job.total,
 		logs: job.logs
-	});
+	}));
 });
 evalRouter.patch("/:id", async (req, res) => {
-	const id = req.params.id;
-	const { table, config } = req.body;
-	if (!id) {
-		res.status(400).json({ error: "Missing id" });
+	const paramsResult = EvalSchemas.Update.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const bodyResult = EvalSchemas.Update.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
+	const { id } = paramsResult.data;
+	const { table, config } = bodyResult.data;
 	try {
 		await updateResult(id, config, table);
-		res.json({ message: "Eval updated successfully" });
+		res.json(EvalSchemas.Update.Response.parse({ message: "Eval updated successfully" }));
 	} catch {
 		res.status(500).json({ error: "Failed to update eval table" });
 	}
 });
 evalRouter.patch("/:id/author", async (req, res) => {
+	const paramsResult = EvalSchemas.UpdateAuthor.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const bodyResult = EvalSchemas.UpdateAuthor.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
+	const { author } = bodyResult.data;
 	try {
-		const { id } = EvalSchemas.UpdateAuthor.Params.parse(req.params);
-		const { author } = EvalSchemas.UpdateAuthor.Request.parse(req.body);
 		const eval_ = await Eval.findById(id);
 		if (!eval_) {
 			res.status(404).json({ error: "Eval not found" });
 			return;
 		}
-		if (!author) {
-			res.status(400).json({ error: "No author provided" });
-			return;
-		}
 		eval_.author = author;
 		await eval_.save();
 		if (!getUserEmail()) setUserEmail(author);
 		res.json(EvalSchemas.UpdateAuthor.Response.parse({ message: "Author updated successfully" }));
 	} catch (error) {
-		if (error instanceof z.ZodError) res.status(400).json({ error: z.prettifyError(error) });
-		else {
-			logger_default.error(`Failed to update eval author: ${error}`);
-			res.status(500).json({ error: "Failed to update eval author" });
-		}
+		logger_default.error(`Failed to update eval author: ${error}`);
+		res.status(500).json({ error: "Failed to update eval author" });
 	}
 });
 const UNLIMITED_RESULTS = Number.MAX_SAFE_INTEGER;
 evalRouter.get("/:id/table", async (req, res) => {
-	const id = req.params.id;
-	const queryResult = EvalTableQuerySchema.safeParse(req.query);
+	const paramsResult = EvalSchemas.Table.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const queryResult = EvalSchemas.Table.Query.safeParse(req.query);
 	if (!queryResult.success) {
 		res.status(400).json({ error: z.prettifyError(queryResult.error) });
 		return;
 	}
+	const { id } = paramsResult.data;
 	const { format, limit: baseLimit, offset: baseOffset, filterMode, search: searchText, filter: filters, comparisonEvalIds } = queryResult.data;
 	const limit = format ? UNLIMITED_RESULTS : baseLimit;
 	const offset = format ? 0 : baseOffset;
@@ -7785,9 +8110,19 @@ evalRouter.get("/:id/table", async (req, res) => {
 	});
 });
 evalRouter.get("/:id/metadata-keys", async (req, res) => {
+	const paramsResult = EvalSchemas.MetadataKeys.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const queryResult = EvalSchemas.MetadataKeys.Query.safeParse(req.query);
+	if (!queryResult.success) {
+		res.status(400).json({ error: z.prettifyError(queryResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
+	const { comparisonEvalIds = [] } = queryResult.data;
 	try {
-		const { id } = EvalSchemas.MetadataKeys.Params.parse(req.params);
-		const { comparisonEvalIds = [] } = EvalSchemas.MetadataKeys.Query.parse(req.query);
 		if (!await Eval.findById(id)) {
 			res.status(404).json({ error: "Eval not found" });
 			return;
@@ -7804,19 +8139,24 @@ evalRouter.get("/:id/metadata-keys", async (req, res) => {
 		const response = EvalSchemas.MetadataKeys.Response.parse({ keys });
 		res.json(response);
 	} catch (error) {
-		if (error instanceof z.ZodError) {
-			res.status(400).json({ error: z.prettifyError(error) });
-			return;
-		}
-		const { id } = req.params;
 		logger_default.error(`Error fetching metadata keys for eval ${id}: ${error instanceof Error ? error.message : String(error)}`);
 		res.status(500).json({ error: "Failed to fetch metadata keys" });
 	}
 });
 evalRouter.get("/:id/metadata-values", async (req, res) => {
+	const paramsResult = EvalSchemas.MetadataValues.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const queryResult = EvalSchemas.MetadataValues.Query.safeParse(req.query);
+	if (!queryResult.success) {
+		res.status(400).json({ error: z.prettifyError(queryResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
+	const { key } = queryResult.data;
 	try {
-		const { id } = EvalSchemas.MetadataValues.Params.parse(req.params);
-		const { key } = EvalSchemas.MetadataValues.Query.parse(req.query);
 		if (!await Eval.findById(id)) {
 			res.status(404).json({ error: "Eval not found" });
 			return;
@@ -7825,22 +8165,23 @@ evalRouter.get("/:id/metadata-values", async (req, res) => {
 		const response = EvalSchemas.MetadataValues.Response.parse({ values });
 		res.json(response);
 	} catch (error) {
-		if (error instanceof z.ZodError) {
-			res.status(400).json({ error: z.prettifyError(error) });
-			return;
-		}
-		const { id } = req.params;
 		logger_default.error(`Error fetching metadata values for eval ${id}: ${error instanceof Error ? error.message : String(error)}`);
 		res.status(500).json({ error: "Failed to fetch metadata values" });
 	}
 });
 evalRouter.post("/:id/results", async (req, res) => {
-	const id = req.params.id;
-	const results = req.body;
-	if (!Array.isArray(results)) {
-		res.status(400).json({ error: "Results must be an array" });
+	const paramsResult = EvalSchemas.AddResults.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const bodyResult = EvalSchemas.AddResults.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
+	const { id } = paramsResult.data;
+	const results = bodyResult.data;
 	const eval_ = await Eval.findById(id);
 	if (!eval_) {
 		res.status(404).json({ error: "Eval not found" });
@@ -7856,11 +8197,12 @@ evalRouter.post("/:id/results", async (req, res) => {
 	res.status(204).send();
 });
 evalRouter.post("/replay", async (req, res) => {
-	const { evaluationId, testIndex, prompt, variables } = req.body;
-	if (!evaluationId || !prompt) {
-		res.status(400).json({ error: "Missing required parameters" });
+	const bodyResult = EvalSchemas.Replay.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
+	const { evaluationId, testIndex, prompt, variables } = bodyResult.data;
 	try {
 		const eval_ = await Eval.findById(evaluationId);
 		if (!eval_) {
@@ -7878,7 +8220,7 @@ evalRouter.post("/replay", async (req, res) => {
 				res.status(400).json({ error: "No providers found in evaluation" });
 				return;
 			}
-			providerConfig = providers[testIndex % providers.length];
+			providerConfig = providers[(testIndex ?? 0) % providers.length];
 		} else if (typeof providers === "string" || typeof providers === "function") providerConfig = providers;
 		else providerConfig = providers;
 		const firstResult = (await (await src_default.evaluate({
@@ -7895,20 +8237,34 @@ evalRouter.post("/replay", async (req, res) => {
 			cache: false
 		})).toEvaluateSummary()).results[0];
 		let output = firstResult?.response?.output;
-		if (!output && firstResult?.response?.raw) output = firstResult.response.raw;
-		res.json({
-			output: output || "",
+		if (output === void 0 && firstResult?.response?.raw) output = firstResult.response.raw;
+		let serializedOutput;
+		if (output === null || output === void 0) serializedOutput = "";
+		else if (typeof output === "string") serializedOutput = output;
+		else serializedOutput = JSON.stringify(output, null, 2);
+		res.json(EvalSchemas.Replay.Response.parse({
+			output: serializedOutput,
 			error: firstResult?.response?.error,
 			response: firstResult?.response
-		});
+		}));
 	} catch (error) {
 		logger_default.error(`Failed to replay evaluation: ${error}`);
 		res.status(500).json({ error: "Failed to replay evaluation" });
 	}
 });
 evalRouter.post("/:evalId/results/:id/rating", async (req, res) => {
-	const id = req.params.id;
-	const gradingResult = req.body;
+	const paramsResult = EvalSchemas.SubmitRating.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const bodyResult = EvalSchemas.SubmitRating.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
+	const gradingResult = bodyResult.data;
 	const result = await EvalResult.findById(id);
 	invariant(result, "Result not found");
 	const eval_ = await Eval.findById(result.evalId);
@@ -7946,26 +8302,35 @@ evalRouter.post("/:evalId/results/:id/rating", async (req, res) => {
 	res.json(result);
 });
 evalRouter.post("/", async (req, res) => {
-	const body = req.body;
+	const bodyResult = EvalSchemas.Save.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const body = bodyResult.data;
 	try {
 		if (body.data) {
 			logger_default.debug("[POST /api/eval] Saving eval results (v3) to database");
-			const { data: payload } = req.body;
+			const payload = body.data;
 			const id = await writeResultsToDatabase(payload.results, payload.config);
-			res.json({ id });
+			res.json(EvalSchemas.Save.Response.parse({ id }));
 		} else {
+			if (!body.results || !body.config) {
+				res.status(400).json({ error: "Missing required fields: results and config are required for v4 format" });
+				return;
+			}
 			const incEval = body;
 			logger_default.debug("[POST /api/eval] Saving eval results (v4) to database");
 			const eval_ = await Eval.create(incEval.config, incEval.prompts || [], {
 				author: incEval.author,
-				createdAt: new Date(incEval.createdAt),
+				createdAt: incEval.createdAt !== void 0 ? new Date(incEval.createdAt) : void 0,
 				results: incEval.results,
 				vars: incEval.vars
 			});
 			if (incEval.prompts) eval_.addPrompts(incEval.prompts);
 			logger_default.debug(`[POST /api/eval] Eval created with ID: ${eval_.id}`);
 			logger_default.debug(`[POST /api/eval] Saved ${incEval.results.length} results to eval ${eval_.id}`);
-			res.json({ id: eval_.id });
+			res.json(EvalSchemas.Save.Response.parse({ id: eval_.id }));
 		}
 	} catch (error) {
 		logger_default.error(dedent`Failed to write eval to database:
@@ -7975,10 +8340,15 @@ evalRouter.post("/", async (req, res) => {
 	}
 });
 evalRouter.delete("/:id", async (req, res) => {
-	const id = req.params.id;
+	const paramsResult = EvalSchemas.Delete.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
 	try {
 		await deleteEval(id);
-		res.json({ message: "Eval deleted successfully" });
+		res.json(EvalSchemas.Delete.Response.parse({ message: "Eval deleted successfully" }));
 	} catch (error) {
 		logger_default.error("[DELETE /eval/:id] Failed to delete eval", {
 			evalId: id,
@@ -7995,11 +8365,12 @@ evalRouter.delete("/:id", async (req, res) => {
 * Bulk delete evals.
 */
 evalRouter.delete("/", (req, res) => {
-	const ids = req.body.ids;
-	if (!Array.isArray(ids)) {
-		res.status(400).json({ error: "Ids must be an array" });
+	const bodyResult = EvalSchemas.BulkDelete.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
+	const { ids } = bodyResult.data;
 	try {
 		deleteEvals(ids);
 		res.status(204).send();
@@ -8011,9 +8382,19 @@ evalRouter.delete("/", (req, res) => {
 * Copy an eval with all its results and relationships.
 */
 evalRouter.post("/:id/copy", async (req, res) => {
+	const paramsResult = EvalSchemas.Copy.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
+	const bodyResult = EvalSchemas.Copy.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { id } = paramsResult.data;
+	const { description } = bodyResult.data;
 	try {
-		const { id } = EvalSchemas.Copy.Params.parse(req.params);
-		const { description } = EvalSchemas.Copy.Request.parse(req.body);
 		const sourceEval = await Eval.findById(id);
 		if (!sourceEval) {
 			res.status(404).json({ error: "Eval not found" });
@@ -8032,18 +8413,27 @@ evalRouter.post("/:id/copy", async (req, res) => {
 		});
 		res.status(201).json(response);
 	} catch (error) {
-		if (error instanceof z.ZodError) {
-			res.status(400).json({ error: z.prettifyError(error) });
-			return;
-		}
 		logger_default.error("Failed to copy eval", {
 			error,
-			evalId: req.params.id
+			evalId: id
 		});
 		res.status(500).json({ error: "Failed to copy evaluation" });
 	}
 });
 
+//#endregion
+//#region src/types/api/media.ts
+const MediaParamsSchema = z.object({
+	type: z.enum([
+		"audio",
+		"image",
+		"video"
+	]),
+	filename: z.string().regex(/^[a-f0-9]{12}\.[a-z0-9]+$/i, "Invalid media filename")
+});
+/** Grouped schemas for server-side validation. */
+const MediaSchemas = { Params: MediaParamsSchema };
+
 //#endregion
 //#region src/server/routes/media.ts
 /**
@@ -8052,15 +8442,6 @@ evalRouter.post("/:id/copy", async (req, res) => {
 * Serves media files stored in the local filesystem storage.
 */
 const mediaRouter = express.Router();
-const ALLOWED_MEDIA_TYPES = new Set([
-	"audio",
-	"image",
-	"video"
-]);
-const MEDIA_FILENAME_REGEX = /^[a-f0-9]{12}\.[a-z0-9]+$/i;
-function isValidMediaKey(type, filename) {
-	return ALLOWED_MEDIA_TYPES.has(type) && MEDIA_FILENAME_REGEX.test(filename);
-}
 /**
 * Get storage stats
 * Must be defined BEFORE wildcard routes
@@ -8091,13 +8472,13 @@ mediaRouter.get("/stats", async (_req, res) => {
 * Path format: /info/audio/abc123.mp3
 */
 mediaRouter.get("/info/:type/:filename", async (req, res) => {
+	const paramsResult = MediaSchemas.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const type = req.params.type;
-		const filename = req.params.filename;
-		if (!isValidMediaKey(type, filename)) {
-			res.status(400).json({ error: "Invalid media key" });
-			return;
-		}
+		const { type, filename } = paramsResult.data;
 		const key = `${type}/${filename}`;
 		if (!await mediaExists(key)) {
 			res.status(404).json({ error: "Media not found" });
@@ -8125,13 +8506,13 @@ mediaRouter.get("/info/:type/:filename", async (req, res) => {
 * The key is constructed from type + filename, e.g., "audio/abc123.mp3"
 */
 mediaRouter.get("/:type/:filename", async (req, res) => {
+	const paramsResult = MediaSchemas.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const type = req.params.type;
-		const filename = req.params.filename;
-		if (!isValidMediaKey(type, filename)) {
-			res.status(400).json({ error: "Invalid media key" });
-			return;
-		}
+		const { type, filename } = paramsResult.data;
 		const key = `${type}/${filename}`;
 		logger_default.debug(`[Media API] Serving media: ${key}`);
 		if (!await mediaExists(key)) {
@@ -8986,61 +9367,183 @@ function modelScanCommand(program) {
 	});
 }
 
+//#endregion
+//#region src/types/api/modelAudit.ts
+const CheckInstalledResponseSchema = z.object({
+	installed: z.boolean(),
+	version: z.string().nullable(),
+	cwd: z.string()
+});
+const CheckPathRequestSchema = z.object({ path: z.string().trim().min(1, "No path provided") });
+const CheckPathResponseSchema = z.union([z.object({
+	exists: z.literal(false),
+	type: z.null()
+}), z.object({
+	exists: z.literal(true),
+	type: z.enum(["directory", "file"]),
+	absolutePath: z.string(),
+	name: z.string()
+})]);
+const ScanRequestSchema = z.object({
+	paths: z.array(z.string()).min(1, "No paths provided").refine((arr) => arr.some((p) => p.trim() !== ""), { message: "No valid paths to scan" }),
+	options: z.object({
+		blacklist: z.array(z.string()).optional(),
+		timeout: z.number().positive().optional(),
+		maxFileSize: z.string().optional(),
+		maxTotalSize: z.string().optional(),
+		verbose: z.boolean().optional(),
+		format: z.enum([
+			"text",
+			"json",
+			"sarif"
+		]).optional(),
+		strict: z.boolean().optional(),
+		dryRun: z.boolean().optional(),
+		cache: z.boolean().optional(),
+		quiet: z.boolean().optional(),
+		progress: z.boolean().optional(),
+		sbom: z.string().optional(),
+		output: z.string().optional(),
+		maxSize: z.string().optional(),
+		persist: z.boolean().optional(),
+		name: z.string().optional(),
+		author: z.string().optional()
+	}).optional().default({})
+});
+const ListScansQuerySchema = z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional().default(100),
+	offset: z.coerce.number().int().min(0).optional().default(0),
+	sort: z.enum([
+		"createdAt",
+		"name",
+		"modelPath"
+	]).optional().default("createdAt"),
+	order: z.enum(["asc", "desc"]).optional().default("desc"),
+	search: z.string().optional()
+});
+/** Shape returned by ModelAudit.toJSON(). */
+const ModelAuditRecordSchema = z.object({
+	id: z.string(),
+	createdAt: TimestampSchema,
+	updatedAt: TimestampSchema,
+	name: z.string().nullable().optional(),
+	author: z.string().nullable().optional(),
+	modelPath: z.string(),
+	modelType: z.string().nullable().optional(),
+	results: z.unknown(),
+	checks: z.unknown().nullable().optional(),
+	issues: z.unknown().nullable().optional(),
+	hasErrors: z.boolean(),
+	totalChecks: z.number().nullable().optional(),
+	passedChecks: z.number().nullable().optional(),
+	failedChecks: z.number().nullable().optional(),
+	metadata: z.unknown().nullable().optional()
+}).passthrough();
+const ListScansResponseSchema = z.object({
+	scans: z.array(ModelAuditRecordSchema),
+	total: z.number(),
+	limit: z.number(),
+	offset: z.number()
+});
+const GetLatestScanResponseSchema = ModelAuditRecordSchema;
+const GetScanParamsSchema = z.object({ id: z.string().min(1) });
+const GetScanResponseSchema = ModelAuditRecordSchema;
+const DeleteScanParamsSchema = z.object({ id: z.string().min(1) });
+const DeleteScanResponseSchema = z.object({
+	success: z.literal(true),
+	message: z.string()
+});
+const ModelAuditSchemas = {
+	CheckInstalled: { Response: CheckInstalledResponseSchema },
+	CheckPath: {
+		Request: CheckPathRequestSchema,
+		Response: CheckPathResponseSchema
+	},
+	Scan: { Request: ScanRequestSchema },
+	ListScans: {
+		Query: ListScansQuerySchema,
+		Response: ListScansResponseSchema
+	},
+	GetLatestScan: { Response: GetLatestScanResponseSchema },
+	GetScan: {
+		Params: GetScanParamsSchema,
+		Response: GetScanResponseSchema
+	},
+	DeleteScan: {
+		Params: DeleteScanParamsSchema,
+		Response: DeleteScanResponseSchema
+	}
+};
+
+//#endregion
+//#region src/server/utils/errors.ts
+/**
+* Send a standardized error response.
+*
+* All error responses use the shape `{ error: string }`.
+* Internal details are logged but never exposed to the client.
+*/
+function sendError(res, status, publicMessage, internalError) {
+	if (internalError) logger_default.error(publicMessage, { error: internalError });
+	res.status(status).json({ error: publicMessage });
+}
+
 //#endregion
 //#region src/server/routes/modelAudit.ts
 const modelAuditRouter = Router();
 modelAuditRouter.get("/check-installed", async (_req, res) => {
 	try {
 		const { installed, version } = await checkModelAuditInstalled();
-		res.json({
+		res.json(ModelAuditSchemas.CheckInstalled.Response.parse({
 			installed,
 			version,
 			cwd: process.cwd()
-		});
+		}));
 	} catch {
-		res.json({
+		res.json(ModelAuditSchemas.CheckInstalled.Response.parse({
 			installed: false,
 			version: null,
 			cwd: process.cwd()
-		});
+		}));
 	}
 });
 modelAuditRouter.post("/check-path", async (req, res) => {
+	const bodyResult = ModelAuditSchemas.CheckPath.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
 	try {
-		const { path: inputPath } = req.body;
-		if (!inputPath) {
-			res.status(400).json({ error: "No path provided" });
-			return;
-		}
+		const { path: inputPath } = bodyResult.data;
 		let expandedPath = inputPath;
 		if (expandedPath.startsWith("~/")) expandedPath = path$1.join(os.homedir(), expandedPath.slice(2));
 		const absolutePath = path$1.isAbsolute(expandedPath) ? expandedPath : path$1.resolve(process.cwd(), expandedPath);
 		if (!fs$1.existsSync(absolutePath)) {
-			res.json({
+			res.json(ModelAuditSchemas.CheckPath.Response.parse({
 				exists: false,
 				type: null
-			});
+			}));
 			return;
 		}
 		const type = fs$1.statSync(absolutePath).isDirectory() ? "directory" : "file";
-		res.json({
+		res.json(ModelAuditSchemas.CheckPath.Response.parse({
 			exists: true,
 			type,
 			absolutePath,
 			name: path$1.basename(absolutePath)
-		});
+		}));
 	} catch (error) {
-		logger_default.error(`Error checking path: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to check path", error);
 	}
 });
 modelAuditRouter.post("/scan", async (req, res) => {
+	const bodyResult = ModelAuditSchemas.Scan.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
 	try {
-		const { paths, options = {} } = req.body;
-		if (!paths || !Array.isArray(paths) || paths.length === 0) {
-			res.status(400).json({ error: "No paths provided" });
-			return;
-		}
+		const { paths, options } = bodyResult.data;
 		const { installed } = await checkModelAuditInstalled();
 		if (!installed) {
 			res.status(400).json({ error: "ModelAudit is not installed. Please install it using: pip install modelaudit" });
@@ -9073,9 +9576,9 @@ modelAuditRouter.post("/scan", async (req, res) => {
 		telemetry_default.record("webui_api", {
 			event: "model_scan",
 			pathCount: paths.length,
-			hasBlacklist: options.blacklist?.length > 0,
-			timeout: options.timeout,
-			verbose: options.verbose,
+			hasBlacklist: (options.blacklist?.length ?? 0) > 0,
+			timeout: options.timeout ?? 0,
+			verbose: options.verbose ?? false,
 			persist
 		});
 		const modelAudit = spawn("modelaudit", args);
@@ -9113,16 +9616,15 @@ modelAuditRouter.post("/scan", async (req, res) => {
 				errorMessage = "Permission denied when trying to execute modelaudit";
 				suggestion = "Check that modelaudit is executable and you have the necessary permissions";
 			}
+			logger_default.error("Failed to start modelaudit", {
+				error: error.message,
+				command: "modelaudit",
+				args,
+				paths: resolvedPaths
+			});
 			safeRespond(500, {
 				error: errorMessage,
-				originalError: error.message,
-				suggestion,
-				debug: {
-					command: "modelaudit",
-					args,
-					paths: resolvedPaths,
-					cwd: process.cwd()
-				}
+				suggestion
 			});
 		});
 		modelAudit.on("close", async (code) => {
@@ -9201,35 +9703,32 @@ modelAuditRouter.post("/scan", async (req, res) => {
 						};
 					}
 				}
-				safeRespond(500, {
-					error: errorMessage,
+				logger_default.error("Model scan failed", {
 					exitCode: code,
 					stderr: stderr || void 0,
-					stdout: stdout || void 0,
-					...errorDetails,
-					debug: {
-						command: "modelaudit",
-						args,
-						paths: resolvedPaths,
-						cwd: process.cwd()
-					}
+					command: "modelaudit",
+					args,
+					paths: resolvedPaths
+				});
+				safeRespond(500, {
+					error: errorMessage,
+					...errorDetails
 				});
 				return;
 			}
 			try {
 				const jsonOutput = stdout.trim();
 				if (!jsonOutput) {
+					logger_default.error("No output from model scan", {
+						stderr: stderr || void 0,
+						command: "modelaudit",
+						args,
+						paths: resolvedPaths,
+						exitCode: code
+					});
 					safeRespond(500, {
 						error: "No output received from model scan",
-						stderr: stderr || void 0,
-						suggestion: "The scan may have failed silently. Check that the model files are valid and accessible.",
-						debug: {
-							command: "modelaudit",
-							args,
-							paths: resolvedPaths,
-							cwd: process.cwd(),
-							exitCode: code
-						}
+						suggestion: "The scan may have failed silently. Check that the model files are valid and accessible."
 					});
 					return;
 				}
@@ -9237,20 +9736,18 @@ modelAuditRouter.post("/scan", async (req, res) => {
 				try {
 					scanResults = JSON.parse(jsonOutput);
 				} catch (parseError) {
-					logger_default.error(`Failed to parse model scan output: ${parseError}`);
-					safeRespond(500, {
-						error: "Failed to parse scan results - invalid JSON output",
-						parseError: String(parseError),
+					logger_default.error("Failed to parse model scan output", {
+						parseError,
 						output: jsonOutput.substring(0, 1e3),
 						stderr: stderr || void 0,
-						suggestion: "The model scan may have produced invalid output. Check the raw output for error messages.",
-						debug: {
-							command: "modelaudit",
-							args,
-							paths: resolvedPaths,
-							cwd: process.cwd(),
-							exitCode: code
-						}
+						command: "modelaudit",
+						args,
+						paths: resolvedPaths,
+						exitCode: code
+					});
+					safeRespond(500, {
+						error: "Failed to parse scan results - invalid JSON output",
+						suggestion: "The model scan may have produced invalid output. Check the raw output for error messages."
 					});
 					return;
 				}
@@ -9258,7 +9755,7 @@ modelAuditRouter.post("/scan", async (req, res) => {
 				if (persist) try {
 					auditId = (await ModelAudit.create({
 						name: options.name || `API scan ${(/* @__PURE__ */ new Date()).toISOString()}`,
-						author: options.author || null,
+						author: options.author ?? void 0,
 						modelPath: resolvedPaths.join(", "),
 						results: {
 							...scanResults,
@@ -9287,44 +9784,32 @@ modelAuditRouter.post("/scan", async (req, res) => {
 					persisted: persist && !!auditId
 				});
 			} catch (error) {
-				logger_default.error(`Error processing model scan results: ${error}`);
-				safeRespond(500, {
-					error: "Error processing scan results",
-					details: String(error)
-				});
+				logger_default.error("Error processing model scan results", { error });
+				safeRespond(500, { error: "Error processing scan results" });
 			}
 		});
 	} catch (error) {
-		logger_default.error(`Error in model scan endpoint: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to start model scan", error);
 	}
 });
-const VALID_SORT_FIELDS = [
-	"createdAt",
-	"name",
-	"modelPath"
-];
-const VALID_SORT_ORDERS = ["asc", "desc"];
 modelAuditRouter.get("/scans", async (req, res) => {
+	const queryResult = ModelAuditSchemas.ListScans.Query.safeParse(req.query);
+	if (!queryResult.success) {
+		res.status(400).json({ error: z.prettifyError(queryResult.error) });
+		return;
+	}
 	try {
-		const limit = Math.min(Math.max(1, parseInt(req.query.limit) || 100), 100);
-		const offset = Math.max(0, parseInt(req.query.offset) || 0);
-		const sortParam = req.query.sort || "createdAt";
-		const orderParam = req.query.order || "desc";
-		const search = req.query.search;
-		const sort = VALID_SORT_FIELDS.includes(sortParam) ? sortParam : "createdAt";
-		const order = VALID_SORT_ORDERS.includes(orderParam) ? orderParam : "desc";
+		const { limit, offset, sort, order, search } = queryResult.data;
 		const audits = await ModelAudit.getMany(limit, offset, sort, order, search);
 		const total = await ModelAudit.count(search);
-		res.json({
+		res.json(ModelAuditSchemas.ListScans.Response.parse({
 			scans: audits.map((audit) => audit.toJSON()),
 			total,
 			limit,
 			offset
-		});
+		}));
 	} catch (error) {
-		logger_default.error(`Error fetching model audits: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to fetch model scans", error);
 	}
 });
 modelAuditRouter.get("/scans/latest", async (_req, res) => {
@@ -9334,40 +9819,47 @@ modelAuditRouter.get("/scans/latest", async (_req, res) => {
 			res.status(404).json({ error: "No scans found" });
 			return;
 		}
-		res.json(audits[0].toJSON());
+		res.json(ModelAuditSchemas.GetLatestScan.Response.parse(audits[0].toJSON()));
 	} catch (error) {
-		logger_default.error(`Error fetching latest model audit: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to fetch latest model scan", error);
 	}
 });
 modelAuditRouter.get("/scans/:id", async (req, res) => {
+	const paramsResult = ModelAuditSchemas.GetScan.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const audit = await ModelAudit.findById(req.params.id);
+		const audit = await ModelAudit.findById(paramsResult.data.id);
 		if (!audit) {
 			res.status(404).json({ error: "Model scan not found" });
 			return;
 		}
-		res.json(audit.toJSON());
+		res.json(ModelAuditSchemas.GetScan.Response.parse(audit.toJSON()));
 	} catch (error) {
-		logger_default.error(`Error fetching model audit: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to fetch model scan", error);
 	}
 });
 modelAuditRouter.delete("/scans/:id", async (req, res) => {
+	const paramsResult = ModelAuditSchemas.DeleteScan.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const audit = await ModelAudit.findById(req.params.id);
+		const audit = await ModelAudit.findById(paramsResult.data.id);
 		if (!audit) {
 			res.status(404).json({ error: "Model scan not found" });
 			return;
 		}
 		await audit.delete();
-		res.json({
+		res.json(ModelAuditSchemas.DeleteScan.Response.parse({
 			success: true,
 			message: "Model scan deleted successfully"
-		});
+		}));
 	} catch (error) {
-		logger_default.error(`Error deleting model audit: ${error}`);
-		res.status(500).json({ error: String(error) });
+		sendError(res, 500, "Failed to delete model scan", error);
 	}
 });
 
@@ -9761,6 +10253,16 @@ const defaultProviders = [].concat([
 		}
 	}
 ]).concat([
+	{
+		id: "vertex:gemini-3.1-pro-preview",
+		label: "Vertex: Gemini 3.1 Pro",
+		config: { generationConfig: {
+			temperature: .5,
+			maxOutputTokens: 1024,
+			topP: .95,
+			topK: 40
+		} }
+	},
 	{
 		id: "vertex:gemini-2.5-pro",
 		label: "Vertex: Gemini 2.5 Pro",
@@ -10242,10 +10744,11 @@ function discoverCommand(program, defaultConfig, defaultConfigPath) {
 
 //#endregion
 //#region src/types/api/providers.ts
+const ProviderOptionsWithIdSchema = ProviderOptionsSchema.extend({ id: z.string().min(1, "Provider ID is required") });
 /** Request body for testing provider connectivity. */
 const TestProviderRequestSchema = z.object({
 	prompt: z.string().optional(),
-	providerOptions: ProviderOptionsSchema
+	providerOptions: ProviderOptionsWithIdSchema
 });
 /** Request body for testing request transforms. */
 const TestRequestTransformSchema = z.object({
@@ -10257,11 +10760,28 @@ const TestResponseTransformSchema = z.object({
 	transformCode: z.string().optional(),
 	response: z.string()
 });
+/** Request body for generating HTTP provider config from example request/response. */
+const HttpGeneratorRequestSchema = z.object({
+	requestExample: z.string().min(1),
+	responseExample: z.string().optional()
+});
+/** Request body for testing multi-turn session functionality. */
+const TestSessionRequestSchema = z.object({
+	provider: ProviderOptionsWithIdSchema,
+	sessionConfig: z.object({
+		sessionSource: z.string().optional(),
+		sessionParser: z.string().optional()
+	}).optional(),
+	mainInputVariable: z.string().optional()
+});
 /** Grouped schemas for server-side validation. */
 const ProviderSchemas = {
 	Test: { Request: TestProviderRequestSchema },
+	Discover: { Request: ProviderOptionsWithIdSchema },
+	HttpGenerator: { Request: HttpGeneratorRequestSchema },
 	TestRequestTransform: { Request: TestRequestTransformSchema },
-	TestResponseTransform: { Request: TestResponseTransformSchema }
+	TestResponseTransform: { Request: TestResponseTransformSchema },
+	TestSession: { Request: TestSessionRequestSchema }
 };
 
 //#endregion
@@ -10963,15 +11483,12 @@ providersRouter.get("/config-status", (_req, res) => {
 	}
 });
 providersRouter.post("/test", async (req, res) => {
-	let payload;
-	try {
-		payload = ProviderSchemas.Test.Request.parse(req.body);
-	} catch (e) {
-		res.status(400).json({ error: z.prettifyError(e) });
+	const bodyResult = ProviderSchemas.Test.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
-	const providerOptions = payload.providerOptions;
-	invariant(payload.providerOptions.id, "id is required");
+	const { providerOptions } = bodyResult.data;
 	const result = await testProviderConnectivity({
 		provider: await loadApiProvider(providerOptions.id, { options: {
 			...providerOptions,
@@ -10980,7 +11497,7 @@ providersRouter.post("/test", async (req, res) => {
 				maxRetries: 1
 			}
 		} }),
-		prompt: payload.prompt,
+		prompt: bodyResult.data.prompt,
 		inputs: providerOptions.inputs || providerOptions.config?.inputs
 	});
 	res.status(200).json({
@@ -10997,15 +11514,12 @@ providersRouter.post("/test", async (req, res) => {
 	});
 });
 providersRouter.post("/discover", async (req, res) => {
-	const body = req.body;
-	let providerOptions;
-	try {
-		providerOptions = ProviderOptionsSchema.parse(body);
-	} catch (e) {
-		res.status(400).json({ error: z.prettifyError(e) });
+	const bodyResult = ProviderSchemas.Discover.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
-	invariant(providerOptions.id, "Provider ID (`id`) is required");
+	const providerOptions = bodyResult.data;
 	if (neverGenerateRemote()) {
 		res.status(400).json({ error: "Requires remote generation be enabled." });
 		return;
@@ -11015,21 +11529,21 @@ providersRouter.post("/discover", async (req, res) => {
 		if (result) res.json(result);
 		else res.status(500).json({ error: "Discovery failed to discover the target's purpose." });
 	} catch (e) {
-		const errorMessage = e instanceof Error ? e.message : String(e);
 		logger_default.error("Error calling target purpose discovery", {
 			error: e,
 			providerOptions
 		});
-		res.status(500).json({ error: `Discovery failed: ${errorMessage}` });
+		sendError(res, 500, "Discovery failed to discover the target's purpose");
 		return;
 	}
 });
 providersRouter.post("/http-generator", async (req, res) => {
-	const { requestExample, responseExample } = req.body;
-	if (!requestExample) {
-		res.status(400).json({ error: "Request example is required" });
+	const bodyResult = ProviderSchemas.HttpGenerator.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
 		return;
 	}
+	const { requestExample, responseExample } = bodyResult.data;
 	const HOST = getEnvString("PROMPTFOO_CLOUD_API_URL", "https://api.promptfoo.app");
 	try {
 		logger_default.debug("[POST /providers/http-generator] Calling HTTP provider generator API", {
@@ -11050,27 +11564,28 @@ providersRouter.post("/http-generator", async (req, res) => {
 				status: response.status,
 				errorText
 			});
-			res.status(response.status).json({
-				error: `HTTP error! status: ${response.status}`,
-				details: errorText
-			});
+			res.status(response.status).json({ error: `HTTP error! status: ${response.status}` });
 			return;
 		}
 		const data = await response.json();
 		logger_default.debug("[POST /providers/http-generator] Successfully generated config");
 		res.status(200).json(data);
 	} catch (error) {
-		const errorMessage = error instanceof Error ? error.message : String(error);
 		logger_default.error("[POST /providers/http-generator] Error calling HTTP provider generator", { error });
-		res.status(500).json({
-			error: "Failed to generate HTTP configuration",
-			details: errorMessage
-		});
+		sendError(res, 500, "Failed to generate HTTP configuration");
 	}
 });
 providersRouter.post("/test-request-transform", async (req, res) => {
+	const bodyResult = ProviderSchemas.TestRequestTransform.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({
+			success: false,
+			error: z.prettifyError(bodyResult.error)
+		});
+		return;
+	}
+	const { transformCode, prompt } = bodyResult.data;
 	try {
-		const { transformCode, prompt } = ProviderSchemas.TestRequestTransform.Request.parse(req.body);
 		const result = await (await createTransformRequest(transformCode && transformCode.trim() ? transformCode : void 0))(prompt, {}, {
 			prompt: {
 				raw: prompt,
@@ -11090,13 +11605,6 @@ providersRouter.post("/test-request-transform", async (req, res) => {
 			result
 		});
 	} catch (error) {
-		if (error instanceof z.ZodError) {
-			res.status(400).json({
-				success: false,
-				error: z.prettifyError(error)
-			});
-			return;
-		}
 		const errorMessage = error instanceof Error ? error.message : String(error);
 		logger_default.error("[POST /providers/test-request-transform] Error", { error });
 		res.status(200).json({
@@ -11106,8 +11614,16 @@ providersRouter.post("/test-request-transform", async (req, res) => {
 	}
 });
 providersRouter.post("/test-response-transform", async (req, res) => {
+	const bodyResult = ProviderSchemas.TestResponseTransform.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({
+			success: false,
+			error: z.prettifyError(bodyResult.error)
+		});
+		return;
+	}
+	const { transformCode, response: responseText } = bodyResult.data;
 	try {
-		const { transformCode, response: responseText } = ProviderSchemas.TestResponseTransform.Request.parse(req.body);
 		const normalizedTransformCode = transformCode && transformCode.trim() ? transformCode : void 0;
 		let jsonData;
 		try {
@@ -11130,13 +11646,6 @@ providersRouter.post("/test-response-transform", async (req, res) => {
 			result: output
 		});
 	} catch (error) {
-		if (error instanceof z.ZodError) {
-			res.status(400).json({
-				success: false,
-				error: z.prettifyError(error)
-			});
-			return;
-		}
 		const errorMessage = error instanceof Error ? error.message : String(error);
 		logger_default.error("[POST /providers/test-response-transform] Error", { error });
 		res.status(200).json({
@@ -11146,10 +11655,13 @@ providersRouter.post("/test-response-transform", async (req, res) => {
 	}
 });
 providersRouter.post("/test-session", async (req, res) => {
-	const { provider: providerOptions, sessionConfig, mainInputVariable } = req.body;
+	const bodyResult = ProviderSchemas.TestSession.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { provider: validatedProvider, sessionConfig, mainInputVariable } = bodyResult.data;
 	try {
-		const validatedProvider = ProviderOptionsSchema.parse(providerOptions);
-		invariant(validatedProvider.id, "Provider ID is required");
 		const result = await testProviderSession({
 			provider: await loadApiProvider(validatedProvider.id, { options: {
 				...validatedProvider,
@@ -11166,15 +11678,53 @@ providersRouter.post("/test-session", async (req, res) => {
 		});
 		res.json(result);
 	} catch (error) {
-		const errorMessage = error instanceof Error ? error.message : String(error);
+		logger_default.error("[POST /providers/test-session] Error testing session", { error });
 		res.status(500).json({
 			success: false,
-			message: `Failed to test session: ${errorMessage}`,
-			error: errorMessage
+			message: "Failed to test session",
+			error: "Failed to test session"
 		});
 	}
 });
 
+//#endregion
+//#region src/types/api/redteam.ts
+const TestCaseGenerationSchema = z.object({
+	plugin: z.object({
+		id: z.string().refine((val) => ALL_PLUGINS.includes(val), { message: `Invalid plugin ID. Must be one of: ${ALL_PLUGINS.join(", ")}` }),
+		config: PluginConfigSchema.optional().prefault({})
+	}),
+	strategy: z.object({
+		id: z.string().refine((val) => ALL_STRATEGIES.includes(val), { message: `Invalid strategy ID. Must be one of: ${ALL_STRATEGIES.join(", ")}` }),
+		config: StrategyConfigSchema.optional().prefault({})
+	}),
+	config: z.object({ applicationDefinition: z.object({ purpose: z.string().nullable() }) }),
+	turn: z.int().min(0).optional().prefault(0),
+	maxTurns: z.int().min(1).optional(),
+	history: z.array(ConversationMessageSchema).optional().prefault([]),
+	goal: z.string().optional(),
+	stateful: z.boolean().optional(),
+	count: z.int().min(1).max(10).optional().prefault(1)
+});
+const RedteamRunRequestSchema = z.object({
+	config: z.record(z.string(), z.unknown()),
+	force: z.boolean().optional(),
+	verbose: z.boolean().optional(),
+	delay: z.coerce.number().min(0).optional(),
+	maxConcurrency: z.coerce.number().int().min(1).optional()
+});
+const RedteamTaskParamsSchema = z.object({ taskId: z.string().min(1).max(128) });
+const RedteamTaskRequestSchema = z.record(z.string(), z.unknown());
+/** Grouped schemas for server-side validation. */
+const RedteamSchemas = {
+	GenerateTest: { Request: TestCaseGenerationSchema },
+	Run: { Request: RedteamRunRequestSchema },
+	Task: {
+		Params: RedteamTaskParamsSchema,
+		Request: RedteamTaskRequestSchema
+	}
+};
+
 //#endregion
 //#region src/server/services/redteamTestCaseGenerationService.ts
 const MULTI_TURN_EMAIL = "anonymous@promptfoo.dev";
@@ -11471,34 +12021,14 @@ async function handleCrescendoLikeStrategy(ctx) {
 //#endregion
 //#region src/server/routes/redteam.ts
 const redteamRouter = Router();
-const TestCaseGenerationSchema = z.object({
-	plugin: z.object({
-		id: z.string().refine((val) => ALL_PLUGINS.includes(val), { message: `Invalid plugin ID. Must be one of: ${ALL_PLUGINS.join(", ")}` }),
-		config: PluginConfigSchema.optional().prefault({})
-	}),
-	strategy: z.object({
-		id: z.string().refine((val) => ALL_STRATEGIES.includes(val), { message: `Invalid strategy ID. Must be one of: ${ALL_STRATEGIES.join(", ")}` }),
-		config: StrategyConfigSchema.optional().prefault({})
-	}),
-	config: z.object({ applicationDefinition: z.object({ purpose: z.string().nullable() }) }),
-	turn: z.int().min(0).optional().prefault(0),
-	maxTurns: z.int().min(1).optional(),
-	history: z.array(ConversationMessageSchema).optional().prefault([]),
-	goal: z.string().optional(),
-	stateful: z.boolean().optional(),
-	count: z.int().min(1).max(10).optional().prefault(1)
-});
 /**
 * Generates a test case for a given plugin/strategy combination.
 */
 redteamRouter.post("/generate-test", async (req, res) => {
 	try {
-		const parsedBody = TestCaseGenerationSchema.safeParse(req.body);
+		const parsedBody = RedteamSchemas.GenerateTest.Request.safeParse(req.body);
 		if (!parsedBody.success) {
-			res.status(400).json({
-				error: "Invalid request body",
-				details: parsedBody.error.message
-			});
+			res.status(400).json({ error: z.prettifyError(parsedBody.error) });
 			return;
 		}
 		const { plugin, strategy, config, turn, maxTurns, history, goal: goalOverride, stateful, count } = parsedBody.data;
@@ -11547,11 +12077,8 @@ redteamRouter.post("/generate-test", async (req, res) => {
 			const strategyTestCases = await Strategies.find((s) => s.id === strategy.id).action(testCases, injectVar, strategy.config || {}, strategy.id);
 			if (strategyTestCases && strategyTestCases.length > 0) finalTestCases = strategyTestCases;
 		} catch (error) {
-			logger_default.error(`Error applying strategy ${strategy.id}: ${error}`);
-			res.status(500).json({
-				error: `Failed to apply strategy ${strategy.id}`,
-				details: error instanceof Error ? error.message : String(error)
-			});
+			logger_default.error(`Error applying strategy ${strategy.id}`, { error });
+			res.status(500).json({ error: `Failed to apply strategy ${strategy.id}` });
 			return;
 		}
 		const context = `This test case targets the ${plugin.id} plugin with strategy ${strategy.id} and was generated based on your application context. If the test case is not relevant to your application, you can modify the application definition to improve relevance.`;
@@ -11592,10 +12119,7 @@ redteamRouter.post("/generate-test", async (req, res) => {
 					message: error instanceof Error ? error.message : String(error),
 					strategy: strategy.id
 				});
-				res.status(500).json({
-					error: "Failed to generate multi-turn prompt",
-					details: error instanceof Error ? error.message : String(error)
-				});
+				res.status(500).json({ error: "Failed to generate multi-turn prompt" });
 				return;
 			}
 		}
@@ -11622,16 +12146,21 @@ redteamRouter.post("/generate-test", async (req, res) => {
 			metadata: baseMetadata
 		});
 	} catch (error) {
-		logger_default.error(`Error generating test case: ${error}`);
-		res.status(500).json({
-			error: "Failed to generate test case",
-			details: error instanceof Error ? error.message : String(error)
-		});
+		logger_default.error("Error generating test case", { error });
+		res.status(500).json({ error: "Failed to generate test case" });
 	}
 });
 let currentJobId = null;
 let currentAbortController = null;
 redteamRouter.post("/run", async (req, res) => {
+	const bodyResult = RedteamSchemas.Run.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({
+			success: false,
+			error: z.prettifyError(bodyResult.error)
+		});
+		return;
+	}
 	if (currentJobId) {
 		if (currentAbortController) currentAbortController.abort();
 		const existingJob = evalJobs.get(currentJobId);
@@ -11640,7 +12169,7 @@ redteamRouter.post("/run", async (req, res) => {
 			existingJob.logs.push("Job cancelled - new job started");
 		}
 	}
-	const { config, force, verbose, delay, maxConcurrency } = req.body;
+	const { config, force, verbose, delay, maxConcurrency } = bodyResult.data;
 	const id = crypto.randomUUID();
 	currentJobId = id;
 	currentAbortController = new AbortController();
@@ -11653,13 +12182,12 @@ redteamRouter.post("/run", async (req, res) => {
 		logs: []
 	});
 	cliState_default.webUI = true;
-	const normalizedMaxConcurrency = Math.max(1, Number(maxConcurrency || "1"));
 	doRedteamRun({
 		liveRedteamConfig: config,
 		force,
 		verbose,
-		delay: Number(delay || "0"),
-		maxConcurrency: normalizedMaxConcurrency,
+		delay: delay ?? 0,
+		maxConcurrency: maxConcurrency ?? 1,
 		logCallback: (message) => {
 			if (currentJobId === id) {
 				const job = evalJobs.get(id);
@@ -11725,7 +12253,23 @@ redteamRouter.post("/cancel", async (_req, res) => {
 * Cloud's task registry (See server/src/routes/task.ts).
 */
 redteamRouter.post("/:taskId", async (req, res) => {
-	const { taskId } = req.params;
+	const paramsResult = RedteamSchemas.Task.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({
+			success: false,
+			error: z.prettifyError(paramsResult.error)
+		});
+		return;
+	}
+	const bodyResult = RedteamSchemas.Task.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({
+			success: false,
+			error: z.prettifyError(bodyResult.error)
+		});
+		return;
+	}
+	const { taskId } = paramsResult.data;
 	const cloudFunctionUrl = getRemoteGenerationUrl();
 	logger_default.debug(`Received ${taskId} task request: ${JSON.stringify({
 		method: req.method,
@@ -11738,8 +12282,8 @@ redteamRouter.post("/:taskId", async (req, res) => {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: JSON.stringify({
-				task: taskId,
-				...req.body
+				...bodyResult.data,
+				task: taskId
 			})
 		});
 		if (!response.ok) {
@@ -11761,12 +12305,27 @@ redteamRouter.get("/status", async (_req, res) => {
 	});
 });
 
+//#endregion
+//#region src/types/api/traces.ts
+const GetTracesByEvalParamsSchema = z.object({ evaluationId: z.string().min(1) });
+const GetTraceParamsSchema = z.object({ traceId: z.string().min(1) });
+/** Grouped schemas for server-side validation. */
+const TracesSchemas = {
+	GetByEval: { Params: GetTracesByEvalParamsSchema },
+	Get: { Params: GetTraceParamsSchema }
+};
+
 //#endregion
 //#region src/server/routes/traces.ts
 const tracesRouter = Router();
 tracesRouter.get("/evaluation/:evaluationId", async (req, res) => {
+	const paramsResult = TracesSchemas.GetByEval.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const evaluationId = req.params.evaluationId;
+		const { evaluationId } = paramsResult.data;
 		logger_default.debug(`[TracesRoute] Fetching traces for evaluation ${evaluationId}`);
 		const traces = await getTraceStore().getTracesByEvaluation(evaluationId);
 		logger_default.debug(`[TracesRoute] Found ${traces.length} traces for evaluation ${evaluationId}`);
@@ -11777,8 +12336,13 @@ tracesRouter.get("/evaluation/:evaluationId", async (req, res) => {
 	}
 });
 tracesRouter.get("/:traceId", async (req, res) => {
+	const paramsResult = TracesSchemas.Get.Params.safeParse(req.params);
+	if (!paramsResult.success) {
+		res.status(400).json({ error: z.prettifyError(paramsResult.error) });
+		return;
+	}
 	try {
-		const traceId = req.params.traceId;
+		const { traceId } = paramsResult.data;
 		logger_default.debug(`[TracesRoute] Fetching trace ${traceId}`);
 		const trace = await getTraceStore().getTrace(traceId);
 		if (!trace) {
@@ -11811,6 +12375,7 @@ const UpdateUserResponseSchema = z.object({
 	success: z.boolean(),
 	message: z.string()
 });
+const GetEmailStatusQuerySchema = z.object({ validate: z.unknown().optional().transform((v) => v === "true") });
 const GetEmailStatusResponseSchema = z.object({
 	hasEmail: z.boolean(),
 	email: EmailSchema.optional(),
@@ -11854,7 +12419,10 @@ const UserSchemas = {
 		Request: UpdateUserRequestSchema,
 		Response: UpdateUserResponseSchema
 	},
-	EmailStatus: { Response: GetEmailStatusResponseSchema },
+	EmailStatus: {
+		Query: GetEmailStatusQuerySchema,
+		Response: GetEmailStatusResponseSchema
+	},
 	Login: {
 		Request: LoginRequestSchema,
 		Response: LoginResponseSchema
@@ -11887,8 +12455,13 @@ userRouter.get("/id", async (_req, res) => {
 	}
 });
 userRouter.post("/email", async (req, res) => {
+	const bodyResult = UserSchemas.Update.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { email } = bodyResult.data;
 	try {
-		const { email } = UserSchemas.Update.Request.parse(req.body);
 		setUserEmail(email);
 		res.json(UserSchemas.Update.Response.parse({
 			success: true,
@@ -11902,8 +12475,7 @@ userRouter.post("/email", async (req, res) => {
 		await telemetry_default.saveConsent(email, { source: "webui_redteam" });
 	} catch (error) {
 		logger_default.error(`Error setting email: ${error}`);
-		if (error instanceof z.ZodError) res.status(400).json({ error: z.prettifyError(error) });
-		else res.status(500).json({ error: String(error) });
+		res.status(500).json({ error: "Failed to update email" });
 	}
 });
 userRouter.put("/email/clear", async (_req, res) => {
@@ -11920,7 +12492,8 @@ userRouter.put("/email/clear", async (_req, res) => {
 });
 userRouter.get("/email/status", async (req, res) => {
 	try {
-		const result = await checkEmailStatus({ validate: req.query.validate === "true" });
+		const { validate } = UserSchemas.EmailStatus.Query.parse(req.query);
+		const result = await checkEmailStatus({ validate });
 		res.json(UserSchemas.EmailStatus.Response.parse({
 			hasEmail: result.hasEmail,
 			email: result.email,
@@ -11929,13 +12502,17 @@ userRouter.get("/email/status", async (req, res) => {
 		}));
 	} catch (error) {
 		logger_default.error(`Error checking email status: ${error}`);
-		if (error instanceof z.ZodError) res.status(400).json({ error: z.prettifyError(error) });
-		else res.status(500).json({ error: "Failed to check email status" });
+		res.status(500).json({ error: "Failed to check email status" });
 	}
 });
 userRouter.post("/login", async (req, res) => {
+	const bodyResult = UserSchemas.Login.Request.safeParse(req.body);
+	if (!bodyResult.success) {
+		res.status(400).json({ error: z.prettifyError(bodyResult.error) });
+		return;
+	}
+	const { apiKey, apiHost } = bodyResult.data;
 	try {
-		const { apiKey, apiHost } = UserSchemas.Login.Request.parse(req.body);
 		const host = apiHost || cloudConfig.getApiHost();
 		const { user, organization, app } = await cloudConfig.validateAndSetApiToken(apiKey, host);
 		const existingEmail = getUserEmail();
@@ -11962,8 +12539,7 @@ userRouter.post("/login", async (req, res) => {
 		}));
 	} catch (error) {
 		logger_default.error(`Error during API key login: ${error instanceof Error ? error.message : "Unknown error"}`);
-		if (error instanceof z.ZodError) res.status(400).json({ error: z.prettifyError(error) });
-		else res.status(401).json({ error: "Invalid API key or authentication failed" });
+		res.status(401).json({ error: "Invalid API key or authentication failed" });
 	}
 });
 userRouter.post("/logout", async (_req, res) => {
@@ -11995,6 +12571,32 @@ userRouter.get("/cloud-config", async (_req, res) => {
 	}
 });
 
+//#endregion
+//#region src/types/api/version.ts
+const VersionResponseSchema = z.object({
+	currentVersion: z.string(),
+	latestVersion: z.string(),
+	updateAvailable: z.boolean(),
+	selfHosted: z.boolean(),
+	isNpx: z.boolean(),
+	updateCommands: z.object({
+		primary: z.string(),
+		alternative: z.string().nullable(),
+		commandType: z.enum([
+			"docker",
+			"npx",
+			"npm"
+		])
+	}),
+	commandType: z.enum([
+		"docker",
+		"npx",
+		"npm"
+	])
+});
+/** Grouped schemas for server-side validation. */
+const VersionSchemas = { Response: VersionResponseSchema };
+
 //#endregion
 //#region src/updates/updateCommands.ts
 function getUpdateCommands(options) {
@@ -12073,7 +12675,7 @@ router.get("/", async (_req, res) => {
 			updateCommands,
 			commandType: updateCommands.commandType
 		};
-		res.json(response);
+		res.json(VersionSchemas.Response.parse(response));
 	} catch (error) {
 		logger_default.error(`Error in version check endpoint: ${error}`);
 		const selfHosted = getEnvBool("PROMPTFOO_SELF_HOSTED");
@@ -12147,6 +12749,7 @@ function createApp() {
 	const app = express();
 	const staticDir = findStaticDir();
 	app.use(cors());
+	app.use(csrfProtection);
 	app.use(compression());
 	app.use(express.json({ limit: REQUEST_SIZE_LIMIT }));
 	app.use(express.urlencoded({
@@ -14250,8 +14853,8 @@ async function createDummyFiles(directory, interactive = true) {
 					]
 				},
 				{
-					name: "[Google] Gemini 2.5 Pro, ...",
-					value: ["vertex:gemini-2.5-pro"]
+					name: "[Google] Gemini 3.1 Pro, ...",
+					value: ["vertex:gemini-3.1-pro-preview", "vertex:gemini-2.5-pro"]
 				},
 				{
 					name: "[HuggingFace] Llama, Phi, Gemma, ...",
@@ -14583,8 +15186,8 @@ function shouldUseInkList() {
 async function runInkList(options) {
 	const [React, { renderInteractive }, { ListApp }] = await Promise.all([
 		import("react"),
-		import("./render-kFatbqG6.js"),
-		import("./ListApp-CYTAaS6A.js")
+		import("./render-CAZvKKkB.js"),
+		import("./ListApp-D3DG0F8h.js")
 	]);
 	let result = { cancelled: false };
 	let resolveResult;
@@ -16903,8 +17506,8 @@ function registerRunEvaluationTool(server) {
 					}
 					filteredTestSuite.tests = filteredTests;
 				}
-				const { evaluate } = await import("./evaluator-B4qKt437.js");
-				const evalRecord = await (await import("./eval-DgiEH2xe.js")).default.create(config, filteredTestSuite.prompts, { id: `mcp-eval-${Date.now()}` });
+				const { evaluate } = await import("./evaluator-0PvfeBYh.js");
+				const evalRecord = await (await import("./eval-CKHWqG9f.js")).default.create(config, filteredTestSuite.prompts, { id: `mcp-eval-${Date.now()}` });
 				logger_default.debug(`Running filtered eval with ${filteredTestSuite.tests?.length || 0} test cases, ${filteredTestSuite.prompts.length} prompts, ${filteredTestSuite.providers.length} providers`);
 				const startTime = Date.now();
 				const result = await evaluate(filteredTestSuite, evalRecord, {
@@ -17666,6 +18269,7 @@ async function handleEval(id) {
 	const eval_ = await Eval.findById(id);
 	if (!eval_) {
 		logger_default.error(`No evaluation found with ID ${id}`);
+		logger_default.info(`Run ${chalk.green("promptfoo list evals")} to see available evaluation IDs.`);
 		process.exitCode = 1;
 		return;
 	}
@@ -17722,6 +18326,7 @@ async function showCommand(program) {
 			const latestEval = await Eval.latest();
 			if (latestEval) return handleEval(latestEval.id);
 			logger_default.error("No eval found");
+			logger_default.info(`Run ${chalk.green("promptfoo eval")} to create one.`);
 			process.exitCode = 1;
 			return;
 		}
@@ -17729,6 +18334,7 @@ async function showCommand(program) {
 		if (await getPromptFromHash(id)) return handlePrompt(id);
 		if (await getDatasetFromHash(id)) return handleDataset(id);
 		logger_default.error(`No resource found with ID ${id}`);
+		logger_default.info(`Run ${chalk.green("promptfoo list evals")}, ${chalk.green("promptfoo list prompts")}, or ${chalk.green("promptfoo list datasets")} to see available IDs.`);
 		process.exitCode = 1;
 	});
 	showCommand.command("eval [id]").description("Show details of a specific evaluation (defaults to most recent)").action(async (id) => {
@@ -17736,6 +18342,7 @@ async function showCommand(program) {
 			const latestEval = await Eval.latest();
 			if (latestEval) return handleEval(latestEval.id);
 			logger_default.error("No eval found");
+			logger_default.info(`Run ${chalk.green("promptfoo eval")} to create one.`);
 			process.exitCode = 1;
 			return;
 		}