promptfoo 0.120.27 → 0.121.1

package/dist/src/{types-C5hEkb-x.js → types-CLKiCBW3.js}

@@ -1,7 +1,6 @@
-import { i as isJavascriptFile, t as JAVASCRIPT_EXTENSIONS } from "./fileExtensions-ePDqouxn.js";
+import { i as isJavascriptFile, t as JAVASCRIPT_EXTENSIONS } from "./fileExtensions-DnqA1y9x.js";
 import dedent from "dedent";
 import { z } from "zod";
-
 //#region src/types/env.ts
 const ProviderEnvOverridesSchema = z.object({
 	AI21_API_BASE_URL: z.string().optional(),
@@ -122,7 +121,6 @@ const ProviderEnvOverridesSchema = z.object({
 	AWS_SAGEMAKER_MAX_RETRIES: z.string().optional(),
 	PROMPTFOO_EVAL_TIMEOUT_MS: z.string().optional()
 });
-
 //#endregion
 //#region src/types/shared.ts
 const CompletionTokenDetailsSchema = z.object({
@@ -150,7 +148,6 @@ const BaseTokenUsageSchema = z.object({
 	}).optional()
 });
 const InputsSchema = z.record(z.string().regex(/^[a-zA-Z_][a-zA-Z0-9_]*$/, { error: "Input variable names must be valid identifiers (start with letter or underscore)" }), z.string().min(1, { error: "Input descriptions must be non-empty strings" }));
-
 //#endregion
 //#region src/validators/prompts.ts
 const PromptConfigSchema = z.object({
@@ -170,10 +167,8 @@ function assert$1() {}
 assert$1();
 assert$1();
 assert$1();
-
 //#endregion
 //#region src/redteam/constants/plugins.ts
-const DEFAULT_NUM_TESTS_PER_PLUGIN = 5;
 const MULTI_INPUT_VAR = "__prompt";
 const LLAMA_GUARD_REPLICATE_PROVIDER = "replicate:moderation:meta/llama-guard-4-12b";
 const LLAMA_GUARD_ENABLED_CATEGORIES = [
@@ -370,6 +365,7 @@ const PHARMACY_PLUGINS = [
 ];
 const INSURANCE_PLUGINS = [
 	"insurance:coverage-discrimination",
+	"insurance:data-disclosure",
 	"insurance:network-misinformation",
 	"insurance:phi-disclosure"
 ];
@@ -455,6 +451,7 @@ const ADDITIONAL_PLUGINS = [
 	"ecommerce:price-manipulation",
 	"goal-misalignment",
 	"insurance:coverage-discrimination",
+	"insurance:data-disclosure",
 	"insurance:network-misinformation",
 	"insurance:phi-disclosure",
 	"off-topic",
@@ -532,7 +529,7 @@ const DEFAULT_PLUGINS = new Set([...[
 	...PII_PLUGINS,
 	...BIAS_PLUGINS
 ].sort()]);
-const RAG_PLUGINS = new Set([
+new Set([
 	...DEFAULT_PLUGINS,
 	"bola",
 	"bfla",
@@ -592,12 +589,11 @@ const REMOTE_ONLY_PLUGIN_IDS = [
 	...TELECOM_PLUGINS,
 	...REALESTATE_PLUGINS
 ];
-const UI_DISABLED_WHEN_REMOTE_UNAVAILABLE = [
+[
 	...Object.keys(UNALIGNED_PROVIDER_HARM_PLUGINS),
 	...BIAS_PLUGINS,
 	...REMOTE_ONLY_PLUGIN_IDS
 ];
-
 //#endregion
 //#region src/redteam/constants/frameworks.ts
 const OWASP_LLM_TOP_10_MAPPING = {
@@ -1594,7 +1590,6 @@ const ALIASED_PLUGIN_MAPPINGS = {
 		strategies: []
 	} }
 };
-
 //#endregion
 //#region src/redteam/constants/metadata.ts
 const Severity = {
@@ -1611,20 +1606,8 @@ const SeveritySchema = z.enum([
 	"low",
 	"informational"
 ]);
-const severityDisplayNames = {
-	[Severity.Critical]: "Critical",
-	[Severity.High]: "High",
-	[Severity.Medium]: "Medium",
-	[Severity.Low]: "Low",
-	[Severity.Informational]: "Informational"
-};
-const severityRiskScores = {
-	[Severity.Critical]: 9,
-	[Severity.High]: 7,
-	[Severity.Medium]: 4,
-	[Severity.Low]: 0,
-	[Severity.Informational]: 0
-};
+Severity.Critical, Severity.High, Severity.Medium, Severity.Low, Severity.Informational;
+Severity.Critical, Severity.High, Severity.Medium, Severity.Low, Severity.Informational;
 const riskCategorySeverityMap = {
 	["agentic:memory-poisoning"]: Severity.High,
 	aegis: Severity.Medium,
@@ -1713,6 +1696,7 @@ const riskCategorySeverityMap = {
 	imitation: Severity.Low,
 	"indirect-prompt-injection": Severity.High,
 	"insurance:coverage-discrimination": Severity.Critical,
+	"insurance:data-disclosure": Severity.Critical,
 	"insurance:network-misinformation": Severity.High,
 	"insurance:phi-disclosure": Severity.Critical,
 	"ecommerce:pci-dss": Severity.Critical,
@@ -1773,7 +1757,7 @@ const riskCategorySeverityMap = {
 	wordplay: Severity.Low,
 	xstest: Severity.Low
 };
-const riskCategories = {
+Object.entries({
 	"Security & Access Control": [
 		"ascii-smuggling",
 		"bfla",
@@ -1796,6 +1780,7 @@ const riskCategories = {
 		"data-exfil",
 		"divergent-repetition",
 		"harmful:privacy",
+		"insurance:data-disclosure",
 		"insurance:phi-disclosure",
 		"pii:api-db",
 		"pii:direct",
@@ -1921,14 +1906,12 @@ const riskCategories = {
 		"vlsu",
 		"xstest"
 	]
-};
-const categoryMapReverse = Object.entries(riskCategories).reduce((acc, [category, harms]) => {
+}).reduce((acc, [category, harms]) => {
 	harms.forEach((harm) => {
 		acc[harm] = category;
 	});
 	return acc;
 }, {});
-const categoryLabels = Object.keys(categoryMapReverse);
 const categoryAliases = {
 	["agentic:memory-poisoning"]: "AgenticMemoryPoisoning",
 	aegis: "Aegis",
@@ -2046,6 +2029,7 @@ const categoryAliases = {
 	imitation: "Imitation",
 	"indirect-prompt-injection": "Indirect Prompt Injection",
 	"insurance:coverage-discrimination": "InsuranceCoverageDiscrimination",
+	"insurance:data-disclosure": "InsuranceDataDisclosure",
 	"insurance:network-misinformation": "InsuranceNetworkMisinformation",
 	"insurance:phi-disclosure": "InsurancePhiDisclosure",
 	intent: "Intent",
@@ -2077,7 +2061,7 @@ const categoryAliases = {
 	wordplay: "Wordplay",
 	xstest: "XSTest"
 };
-const categoryAliasesReverse = Object.entries(categoryAliases).reduce((acc, [key, value]) => {
+Object.entries(categoryAliases).reduce((acc, [key, value]) => {
 	acc[value] = key;
 	return acc;
 }, {});
@@ -2115,7 +2099,7 @@ const pluginDescriptions = {
 	bias: "Unified bias detection across protected characteristics including age, disability, gender, and race",
 	medical: "Comprehensive medical AI safety testing for healthcare-specific vulnerabilities including hallucination, anchoring bias, incorrect knowledge, off-label use, prioritization errors, and sycophancy",
 	pharmacy: "Comprehensive pharmacy AI safety testing for pharmaceutical vulnerabilities including drug interactions, dosage calculations, and controlled substance compliance",
-	insurance: "Comprehensive insurance AI safety testing for healthcare coverage vulnerabilities including coverage discrimination, network misinformation, and PHI disclosure",
+	insurance: "Comprehensive insurance AI safety testing across all insurance types including coverage discrimination, network misinformation, PHI disclosure, and policyholder data disclosure",
 	financial: "Comprehensive financial AI safety testing for financial services vulnerabilities including calculation errors, compliance violations, hallucination, and data leakage",
 	ecommerce: "Comprehensive e-commerce AI safety testing for payment security and transaction integrity vulnerabilities including PCI DSS compliance, fraud detection, and price manipulation",
 	telecom: "Comprehensive telecommunications AI safety testing across CPNI protection, account security, regulatory compliance (FCC, TCPA, CALEA), and telecom-specific fraud prevention",
@@ -2168,8 +2152,9 @@ const pluginDescriptions = {
 	"harmful:weapons:ied": "Tests handling of Improvised Explosive Devices",
 	hijacking: "Assesses protection against unauthorized resource usage and purpose deviation",
 	imitation: "Tests safeguards against unauthorized entity impersonation attempts",
-	"insurance:coverage-discrimination": "Tests for discriminatory coverage or benefit determinations based on protected characteristics (age, disability, race, genetic information, sex) in violation of federal civil rights laws including ADA, Section 1557, GINA, and age discrimination statutes",
-	"insurance:network-misinformation": "Tests for inaccurate provider network information including wrong network status, terminated contracts, ghost networks, and outdated provider data that could expose members to surprise medical bills and balance billing",
+	"insurance:coverage-discrimination": "Tests for discriminatory coverage, underwriting, or claims determinations based on protected characteristics (age, disability, race, genetic information, sex) in violation of federal civil rights laws including ADA, Section 1557, GINA, Fair Housing Act, ECOA, and state unfair trade practices acts",
+	"insurance:data-disclosure": "Tests for unauthorized disclosure of protected policyholder data including claims history, property details, driving records, beneficiary information, and business data in violation of GLBA, FCRA, DPPA, and state insurance privacy laws",
+	"insurance:network-misinformation": "Tests for inaccurate provider or vendor network information including wrong network status, terminated contracts, ghost networks, and outdated provider data that could expose policyholders to unexpected costs, voided warranties, or inadequate service",
 	"insurance:phi-disclosure": "Tests for unauthorized disclosure of Protected Health Information in violation of HIPAA privacy regulations including cross-member PHI leakage, inadequate authentication, and disclosure to unauthorized third parties",
 	"ecommerce:pci-dss": "Tests for exposure of payment card data including credit card numbers, CVVs, expiration dates, cardholder names, bank account details, and payment tokens in violation of PCI DSS requirements for secure payment processing",
 	"ecommerce:compliance-bypass": "Tests for attempts to bypass security rules, terms of service, age restrictions, geographic limitations, or compliance policies in e-commerce systems",
@@ -2229,7 +2214,6 @@ const pluginDescriptions = {
 	xstest: "Tests how models handle ambiguous terms related to potentially harmful topics like violence and drugs",
 	"guardrails-eval": "Evaluate guardrail effectiveness against common risks"
 };
-
 //#endregion
 //#region src/redteam/constants/strategies.ts
 const FRAMEWORK_COMPLIANCE_IDS = [
@@ -2248,7 +2232,6 @@ const DEFAULT_STRATEGIES = [
 	"jailbreak:meta",
 	"jailbreak:composite"
 ];
-const DEFAULT_STRATEGIES_SET = new Set(DEFAULT_STRATEGIES);
 const MULTI_TURN_STRATEGIES = [
 	"crescendo",
 	"goat",
@@ -2256,16 +2239,9 @@ const MULTI_TURN_STRATEGIES = [
 	"custom",
 	"mischievous-user"
 ];
-const MULTI_TURN_STRATEGY_SET = new Set(MULTI_TURN_STRATEGIES);
 const isCustomStrategy = (strategyId) => {
 	return strategyId === "custom" || strategyId.startsWith("custom:");
 };
-const MULTI_MODAL_STRATEGIES = [
-	"audio",
-	"image",
-	"video"
-];
-const MULTI_MODAL_STRATEGIES_SET = new Set(MULTI_MODAL_STRATEGIES);
 const AGENTIC_STRATEGIES = [
 	"crescendo",
 	"goat",
@@ -2277,7 +2253,6 @@ const AGENTIC_STRATEGIES = [
 	"jailbreak:tree",
 	"mischievous-user"
 ];
-const AGENTIC_STRATEGIES_SET = new Set(AGENTIC_STRATEGIES);
 const DATASET_PLUGINS = [
 	"beavertails",
 	"cyberseceval",
@@ -2339,22 +2314,6 @@ const _ALL_STRATEGIES = [
 	...AGENTIC_STRATEGIES
 ];
 const ALL_STRATEGIES = Array.from(new Set(_ALL_STRATEGIES)).sort();
-const CONFIGURABLE_STRATEGIES = [
-	"layer",
-	"best-of-n",
-	"goat",
-	"crescendo",
-	"indirect-web-pwn",
-	"jailbreak",
-	"jailbreak:hydra",
-	"jailbreak:meta",
-	"jailbreak:tree",
-	"gcg",
-	"citation",
-	"custom",
-	"mischievous-user"
-];
-const CONFIGURABLE_STRATEGIES_SET = new Set(CONFIGURABLE_STRATEGIES);
 /**
 * Default 'n' fan out for strategies that can add additional test cases during generation
 */
@@ -2369,19 +2328,6 @@ function getDefaultNFanout(strategyId) {
 function isFanoutStrategy(strategyId) {
 	return strategyId in DEFAULT_N_FAN_OUT_BY_STRATEGY;
 }
-const STRATEGIES_REQUIRING_REMOTE = [
-	"audio",
-	"citation",
-	"gcg",
-	"goat",
-	"indirect-web-pwn",
-	"jailbreak:composite",
-	"jailbreak:hydra",
-	"jailbreak:likert",
-	"jailbreak:meta"
-];
-const STRATEGIES_REQUIRING_REMOTE_SET = new Set(STRATEGIES_REQUIRING_REMOTE);
-
 //#endregion
 //#region src/util/uuid.ts
 /**
@@ -2398,7 +2344,6 @@ const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-
 function isUuid(value) {
 	return UUID_REGEX.test(value);
 }
-
 //#endregion
 //#region src/redteam/plugins/policy/validators.ts
 /**
@@ -2434,7 +2379,6 @@ function isValidInlinePolicyId(id) {
 function isValidPolicyId(id) {
 	return isValidReusablePolicyId(id) || isValidInlinePolicyId(id);
 }
-
 //#endregion
 //#region src/redteam/types.ts
 const PolicyObjectSchema = z.object({
@@ -2501,7 +2445,6 @@ var PartialGenerationError = class extends Error {
 		this.failedPlugins = failedPlugins;
 	}
 };
-
 //#endregion
 //#region src/validators/providers.ts
 const ProviderOptionsSchema = z.object({
@@ -2526,7 +2469,7 @@ const ApiProviderSchema = z.object({
 	config: z.any().optional(),
 	inputs: InputsSchema.optional()
 });
-const ProviderResponseSchema = z.object({
+z.object({
 	cached: z.boolean().optional(),
 	cost: z.number().optional(),
 	error: z.string().optional(),
@@ -2535,17 +2478,17 @@ const ProviderResponseSchema = z.object({
 	output: z.union([z.string(), z.any()]).optional(),
 	tokenUsage: BaseTokenUsageSchema.optional()
 });
-const ProviderEmbeddingResponseSchema = z.object({
+z.object({
 	error: z.string().optional(),
 	embedding: z.array(z.number()).optional(),
 	tokenUsage: BaseTokenUsageSchema.partial().optional()
 });
-const ProviderSimilarityResponseSchema = z.object({
+z.object({
 	error: z.string().optional(),
 	similarity: z.number().optional(),
 	tokenUsage: BaseTokenUsageSchema.partial().optional()
 });
-const ProviderClassificationResponseSchema = z.object({
+z.object({
 	error: z.string().optional(),
 	classification: z.record(z.string(), z.number()).optional()
 });
@@ -2564,7 +2507,6 @@ const ProviderSchema = z.union([
 	ApiProviderSchema,
 	ProviderOptionsSchema
 ]);
-
 //#endregion
 //#region src/validators/redteam.ts
 const TracingConfigSchema = z.lazy(() => z.object({
@@ -2609,7 +2551,7 @@ const RedteamPluginObjectSchema = z.object({
 			message: `Invalid plugin id "${val}". Custom plugins must start with file:// or use a built-in plugin. See https://www.promptfoo.dev/docs/red-team/plugins for available plugins.`
 		});
 	})]).describe("Name of the plugin"),
-	numTests: z.int().positive().prefault(DEFAULT_NUM_TESTS_PER_PLUGIN).describe("Number of tests to generate for this plugin"),
+	numTests: z.int().positive().prefault(5).describe("Number of tests to generate for this plugin"),
 	config: z.record(z.string(), z.unknown()).optional().describe("Plugin-specific configuration"),
 	severity: SeveritySchema.optional().describe("Severity level for this plugin")
 });
@@ -2650,10 +2592,7 @@ const RedteamStrategySchema = z.union([strategyIdSchema, z.object({
 	id: strategyIdSchema,
 	config: z.record(z.string(), z.unknown()).optional().describe("Strategy-specific configuration")
 })]);
-/**
-* Schema for `promptfoo redteam generate` command options
-*/
-const RedteamGenerateOptionsSchema = z.object({
+z.object({
 	addPlugins: z.array(z.enum(ADDITIONAL_PLUGINS)).optional().describe("Additional plugins to include"),
 	addStrategies: z.array(z.enum(ADDITIONAL_STRATEGIES)).optional().describe("Additional strategies to include"),
 	cache: z.boolean().describe("Whether to use caching"),
@@ -2831,11 +2770,9 @@ const RedteamConfigSchema = z.object({
 });
 function assert() {}
 assert();
-
 //#endregion
 //#region src/validators/shared.ts
 const NunjucksFilterMapSchema = z.record(z.string(), z.custom((v) => typeof v === "function"));
-
 //#endregion
 //#region src/types/providers.ts
 function isApiProvider(provider) {
@@ -2844,7 +2781,6 @@ function isApiProvider(provider) {
 function isProviderOptions(provider) {
 	return typeof provider === "object" && provider != null && "id" in provider && typeof provider.id === "string";
 }
-
 //#endregion
 //#region src/types/index.ts
 const CommandLineOptionsSchema = z.object({
@@ -3313,7 +3249,7 @@ const EvalResultsFilterMode = z.enum([
 	"passes",
 	"user-rated"
 ]);
-
 //#endregion
 export { pluginDescriptions as $, isApiProvider as A, isValidReusablePolicyId as B, TestGeneratorConfigSchema as C, BaseTokenUsageSchema as Ct, VarsSchema as D, UnifiedConfigSchema as E, ConversationMessageSchema as F, MULTI_TURN_STRATEGIES as G, AGENTIC_STRATEGIES as H, PartialGenerationError as I, getDefaultNFanout as J, STRATEGY_COLLECTIONS as K, PluginConfigSchema as L, RedteamConfigSchema as M, ProviderOptionsSchema as N, isGradingResult as O, ProvidersSchema as P, categoryAliases as Q, PolicyObjectSchema as R, TestCasesWithMetadataSchema as S, PromptSchema as St, TestSuiteSchema as T, InputsSchema as Tt, DATASET_PLUGINS as U, isUuid as V, DEFAULT_STRATEGIES as W, isFanoutStrategy as X, isCustomStrategy as Y, Severity as Z, ScenarioSchema as _, REDTEAM_PROVIDER_HARM_PLUGINS as _t, AtomicTestCaseSchema as a, FINANCIAL_PLUGINS as at, TestCaseWithVarsFileSchema as b, TELECOM_PLUGINS as bt, CompletedPromptSchema as c, INSURANCE_PLUGINS as ct, EvaluateOptionsSchema as d, MEDICAL_PLUGINS as dt, riskCategorySeverityMap as et, GradingConfigSchema as f, MULTI_INPUT_EXCLUDED_PLUGINS as ft, ResultFailureReason as g, PLUGIN_CATEGORIES as gt, OutputFileExtension as h, PII_PLUGINS as ht, AssertionTypeSchema as i, DEFAULT_PLUGINS as it, isProviderOptions as j, isResultFailureReason as k, DerivedMetricSchema as l, LLAMA_GUARD_ENABLED_CATEGORIES as lt, OutputConfigSchema as m, PHARMACY_PLUGINS as mt, AssertionSchema as n, BIAS_PLUGINS as nt, BaseAssertionTypesSchema as o, FOUNDATION_PLUGINS as ot, NotPrefixedAssertionTypesSchema as p, MULTI_INPUT_VAR as pt, STRATEGY_COLLECTION_MAPPINGS as q, AssertionSetSchema as r, DATASET_EXEMPT_PLUGINS as rt, CommandLineOptionsSchema as s, HARM_PLUGINS as st, AssertionOrSetSchema as t, ALIASED_PLUGIN_MAPPINGS as tt, EvalResultsFilterMode as u, LLAMA_GUARD_REPLICATE_PROVIDER as ut, SpecialAssertionTypesSchema as v, REMOTE_ONLY_PLUGIN_IDS as vt, TestSuiteConfigSchema as w, CompletionTokenDetailsSchema as wt, TestCasesWithMetadataPromptSchema as x, UNALIGNED_PROVIDER_HARM_PLUGINS as xt, TestCaseSchema as y, STRATEGY_EXEMPT_PLUGINS as yt, StrategyConfigSchema as z };
-//# sourceMappingURL=types-C5hEkb-x.js.map
+
+//# sourceMappingURL=types-CLKiCBW3.js.map