promptfoo 0.121.4 → 0.121.5

package/dist/src/{evalResult-KZqXl4XP.cjs → evalResult-Cx-8OWkb.cjs}

@@ -1,9 +1,9 @@
 const require_logger = require("./logger-COuQb2xB.cjs");
-const require_types = require("./types-CeaeaZdP.cjs");
-const require_fetch = require("./fetch-CJU5ELPa.cjs");
-const require_utils = require("./utils-B05gLxER.cjs");
-const require_tables = require("./tables-DUfh1F7Z.cjs");
-const require_extractor = require("./extractor-WVPOrH43.cjs");
+const require_fetch = require("./fetch-NuqXW1Xb.cjs");
+const require_types = require("./types-CgG2rKiW.cjs");
+const require_tables = require("./tables-CXbaZ9y1.cjs");
+const require_extractor = require("./extractor-Dxr2J_wK.cjs");
+const require_utils = require("./utils-DkVeShIB.cjs");
 let drizzle_orm = require("drizzle-orm");
 //#region src/models/evalResult.ts
 function sanitizeProvider(provider) {
@@ -55,6 +55,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return require_logger.sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -71,10 +89,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: require_utils.hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -113,8 +131,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -298,4 +316,4 @@ Object.defineProperty(exports, "sanitizeProvider", {
 	}
 });
 
-//# sourceMappingURL=evalResult-KZqXl4XP.cjs.map
+//# sourceMappingURL=evalResult-Cx-8OWkb.cjs.map

package/dist/src/{evalResult-D3hVYFis.js → evalResult-D6P5I5il.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { T as getEnvBool, s as logger, x as safeJsonStringify } from "./logger-DksKw1Qc.js";
-import { c as getCurrentTimestamp } from "./fetch-BEWnXrrG.js";
-import { f as isResultFailureReason, m as isProviderOptions, p as isApiProvider, s as ResultFailureReason } from "./types-Dm9JM6Vb.js";
-import { t as hashPrompt } from "./utils-BLJKfv0y.js";
-import { a as evalResultsTable, g as getDb } from "./tables-C4CH3zRr.js";
-import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-DNSeBVOJ.js";
+import { T as getEnvBool, m as sanitizeObject, s as logger, x as safeJsonStringify } from "./logger-BbY6ypFL.js";
+import { c as getCurrentTimestamp } from "./fetch-B6ch2nU2.js";
+import { f as isResultFailureReason, m as isProviderOptions, p as isApiProvider, s as ResultFailureReason } from "./types-BVH9hjgW.js";
+import { a as evalResultsTable, g as getDb } from "./tables-NlvH23ky.js";
+import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-DxyiFhPk.js";
+import { t as hashPrompt } from "./utils-kt7lv30R.js";
 import { and, eq, gte, inArray, lt, ne } from "drizzle-orm";
 //#region src/models/evalResult.ts
 function sanitizeProvider(provider) {
@@ -56,6 +56,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -72,10 +90,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -114,8 +132,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -288,4 +306,4 @@ var EvalResult = class EvalResult {
 //#endregion
 export { sanitizeProvider as n, EvalResult as t };
 
-//# sourceMappingURL=evalResult-D3hVYFis.js.map
+//# sourceMappingURL=evalResult-D6P5I5il.js.map

package/dist/src/{evalResult-Bgm9ZH31.js → evalResult-pSvGWFMo.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./chunk-DEq-mXcV.js";
-import { S as getEnvBool, a as logger, y as safeJsonStringify } from "./logger-Ct2S6Yx-.js";
-import { A as isApiProvider, g as ResultFailureReason, j as isProviderOptions, k as isResultFailureReason } from "./types-BGQDAP8i.js";
-import { u as getCurrentTimestamp } from "./fetch-Di00EQrc.js";
-import { t as hashPrompt } from "./utils-hXtCYanr.js";
-import { i as evalResultsTable, p as getDb } from "./tables-DQ4WU5tX.js";
-import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-Dk6bRWkv.js";
+import { S as getEnvBool, a as logger, f as sanitizeObject, y as safeJsonStringify } from "./logger-Ct2S6Yx-.js";
+import { a as getCurrentTimestamp } from "./fetch-D9xxyC1p.js";
+import { A as isApiProvider, g as ResultFailureReason, j as isProviderOptions, k as isResultFailureReason } from "./types-DNRZVOue.js";
+import { i as evalResultsTable, p as getDb } from "./tables-WgdUZ8Ck.js";
+import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-BM3jRERL.js";
+import { t as hashPrompt } from "./utils-o8S5huU2.js";
 import { and, eq, gte, inArray, lt, ne } from "drizzle-orm";
 //#region src/models/evalResult.ts
 var evalResult_exports = /* @__PURE__ */ __exportAll({
@@ -60,6 +60,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -76,10 +94,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -118,8 +136,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -292,4 +310,4 @@ var EvalResult = class EvalResult {
 //#endregion
 export { evalResult_exports as n, EvalResult as t };
 
-//# sourceMappingURL=evalResult-Bgm9ZH31.js.map
+//# sourceMappingURL=evalResult-pSvGWFMo.js.map