promptfoo 0.121.4 → 0.121.7

package/dist/src/{docker-CQmlA2NU.js → docker-DdJQBxK9.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { O as getEnvString, s as logger } from "./logger-DksKw1Qc.js";
-import { a as fetchWithCache } from "./cache-mb7c8hbp.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-Dr3DUQ0D.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-D3xTseo7.js";
-import { t as OpenAiCompletionProvider } from "./completion-x0a_c2y1.js";
+import { O as getEnvString, s as logger } from "./logger-BbY6ypFL.js";
+import { a as fetchWithCache } from "./cache-DpPWrkTE.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-DqUFcWI0.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding--UZVe4_7.js";
+import { t as OpenAiCompletionProvider } from "./completion-DZNxcyfG.js";
 //#region src/providers/docker.ts
 async function fetchLocalModels(apiBaseUrl) {
 	try {
@@ -79,4 +79,4 @@ var DMREmbeddingProvider = class extends OpenAiEmbeddingProvider {
 //#endregion
 export { createDockerProvider };
 
-//# sourceMappingURL=docker-CQmlA2NU.js.map
+//# sourceMappingURL=docker-DdJQBxK9.js.map

package/dist/src/{embedding-D3xTseo7.js → embedding--UZVe4_7.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { s as logger } from "./logger-DksKw1Qc.js";
-import { m as REQUEST_TIMEOUT_MS } from "./fetch-BEWnXrrG.js";
-import { a as fetchWithCache } from "./cache-mb7c8hbp.js";
-import { t as OpenAiGenericProvider } from "./openai-Qsvz25mV.js";
-import { c as getTokenUsage } from "./util-C9J8ahRn.js";
+import { s as logger } from "./logger-BbY6ypFL.js";
+import { _ as REQUEST_TIMEOUT_MS } from "./fetch-DXUnXkVU.js";
+import { a as fetchWithCache } from "./cache-DpPWrkTE.js";
+import { t as OpenAiGenericProvider } from "./openai-CJrsh9n4.js";
+import { c as getTokenUsage } from "./util-5WnCSb0h.js";
 //#region src/providers/openai/embedding.ts
 var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 	async callEmbeddingApi(text) {
@@ -56,4 +56,4 @@ var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 //#endregion
 export { OpenAiEmbeddingProvider as t };
 
-//# sourceMappingURL=embedding-D3xTseo7.js.map
+//# sourceMappingURL=embedding--UZVe4_7.js.map

package/dist/src/{embedding-I45KG3o7.cjs → embedding-BbrwopfX.cjs}

@@ -1,8 +1,8 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_fetch = require("./fetch-CJU5ELPa.cjs");
-const require_cache = require("./cache-BIyPcp5v.cjs");
-const require_openai = require("./openai-URNyItar.cjs");
-const require_util = require("./util-CN3SrLT4.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_fetch = require("./fetch-Dw4XZHjj.cjs");
+const require_cache = require("./cache-CPGUA4Yl.cjs");
+const require_openai = require("./openai-C3uXv8wS.cjs");
+const require_util = require("./util-BSIuSLVK.cjs");
 //#region src/providers/openai/embedding.ts
 var OpenAiEmbeddingProvider = class extends require_openai.OpenAiGenericProvider {
 	async callEmbeddingApi(text) {
@@ -60,4 +60,4 @@ Object.defineProperty(exports, "OpenAiEmbeddingProvider", {
 	}
 });
 
-//# sourceMappingURL=embedding-I45KG3o7.cjs.map
+//# sourceMappingURL=embedding-BbrwopfX.cjs.map

package/dist/src/{embedding-nFbumxcv.js → embedding-Bi3rxrZF.js}

@@ -1,8 +1,8 @@
 import { a as logger } from "./logger-Ct2S6Yx-.js";
-import { h as REQUEST_TIMEOUT_MS } from "./fetch-Di00EQrc.js";
-import { r as fetchWithCache } from "./cache-D5NZmMiT.js";
-import { t as OpenAiGenericProvider } from "./openai-iYtrXzOX.js";
-import { c as getTokenUsage } from "./util-D9TisOyk.js";
+import { p as REQUEST_TIMEOUT_MS } from "./fetch-It34O8Ur.js";
+import { r as fetchWithCache } from "./cache-DIXbtkNO.js";
+import { t as OpenAiGenericProvider } from "./openai-zgwBb4Ff.js";
+import { c as getTokenUsage } from "./util-LKTmNsMQ.js";
 //#region src/providers/openai/embedding.ts
 var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 	async callEmbeddingApi(text) {
@@ -55,4 +55,4 @@ var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 //#endregion
 export { OpenAiEmbeddingProvider as t };
 
-//# sourceMappingURL=embedding-nFbumxcv.js.map
+//# sourceMappingURL=embedding-Bi3rxrZF.js.map

package/dist/src/{embedding-DD9wa3ae.js → embedding-C251p1-8.js}

@@ -1,8 +1,8 @@
-import { a as logger } from "./logger-B88EkIn6.js";
-import { h as REQUEST_TIMEOUT_MS } from "./fetch-B0Z3Oe4k.js";
-import { r as fetchWithCache } from "./cache-C4Xb-hNb.js";
-import { t as OpenAiGenericProvider } from "./openai-DhVEmgeZ.js";
-import { c as getTokenUsage } from "./util-D3q0WQ-0.js";
+import { a as logger } from "./logger-KD8JjCRJ.js";
+import { v as REQUEST_TIMEOUT_MS } from "./fetch-BufrQtvR.js";
+import { r as fetchWithCache } from "./cache-roFAE0cI.js";
+import { t as OpenAiGenericProvider } from "./openai-BMHD2Huo.js";
+import { c as getTokenUsage } from "./util-efByNxcr.js";
 //#region src/providers/openai/embedding.ts
 var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 	async callEmbeddingApi(text) {
@@ -55,4 +55,4 @@ var OpenAiEmbeddingProvider = class extends OpenAiGenericProvider {
 //#endregion
 export { OpenAiEmbeddingProvider as t };
 
-//# sourceMappingURL=embedding-DD9wa3ae.js.map
+//# sourceMappingURL=embedding-C251p1-8.js.map

package/dist/src/{errors-Cw810C93.js → errors-9PcUL8BC.js}

@@ -33,4 +33,4 @@ function isTransientConnectionError(error) {
 //#endregion
 export { isNonTransientHttpStatus as n, isTransientConnectionError as r, NON_TRANSIENT_HTTP_STATUSES as t };
 
-//# sourceMappingURL=errors-Cw810C93.js.map
+//# sourceMappingURL=errors-9PcUL8BC.js.map

package/dist/src/{esm-Dh4dOLlt.js → esm-B6whoAcf.js}

@@ -1,4 +1,4 @@
-import { a as logger } from "./logger-B88EkIn6.js";
+import { a as logger } from "./logger-KD8JjCRJ.js";
 import { createRequire } from "node:module";
 import path from "path";
 import path$1 from "node:path";
@@ -385,4 +385,4 @@ function loadCjsModule(modulePath) {
 //#endregion
 export { safeJoin as a, resolvePackageEntryPoint as i, getWrapperDir as n, safeResolve as o, importModule as r, getDirectory as t };
 
-//# sourceMappingURL=esm-Dh4dOLlt.js.map
+//# sourceMappingURL=esm-B6whoAcf.js.map

package/dist/src/{esm-CtEPLdAj.cjs → esm-BIKakvNa.cjs}

@@ -1,16 +1,17 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
 let path = require("path");
-path = require_logger.__toESM(path);
+path = require_rolldown_runtime.__toESM(path, 1);
 let node_fs = require("node:fs");
-node_fs = require_logger.__toESM(node_fs);
+node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
 let node_fs_promises = require("node:fs/promises");
-node_fs_promises = require_logger.__toESM(node_fs_promises);
+node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
 let node_module = require("node:module");
 let node_path = require("node:path");
-node_path = require_logger.__toESM(node_path);
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_url = require("node:url");
 let node_vm = require("node:vm");
-node_vm = require_logger.__toESM(node_vm);
+node_vm = require_rolldown_runtime.__toESM(node_vm, 1);
 let exsolve = require("exsolve");
 //#region src/util/pathUtils.ts
 /**
@@ -415,4 +416,4 @@ Object.defineProperty(exports, "safeResolve", {
 	}
 });
 
-//# sourceMappingURL=esm-CtEPLdAj.cjs.map
+//# sourceMappingURL=esm-BIKakvNa.cjs.map

package/dist/src/{esm-C7PnfdF8.js → esm-BTK1W7lG.js}

@@ -385,4 +385,4 @@ function loadCjsModule(modulePath) {
 //#endregion
 export { safeJoin as a, resolvePackageEntryPoint as i, getWrapperDir as n, safeResolve as o, importModule as r, getDirectory as t };
 
-//# sourceMappingURL=esm-C7PnfdF8.js.map
+//# sourceMappingURL=esm-BTK1W7lG.js.map

package/dist/src/{esm-tVgYPY-f.js → esm-Bexx2PFc.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { s as logger } from "./logger-DksKw1Qc.js";
+import { s as logger } from "./logger-BbY6ypFL.js";
 import { createRequire } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import path from "path";
@@ -386,4 +386,4 @@ function loadCjsModule(modulePath) {
 //#endregion
 export { safeJoin as a, resolvePackageEntryPoint as i, getWrapperDir as n, safeResolve as o, importModule as r, getDirectory as t };
 
-//# sourceMappingURL=esm-tVgYPY-f.js.map
+//# sourceMappingURL=esm-Bexx2PFc.js.map

package/dist/src/{eval-u4UVafl6.js → eval-0VRANImH.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { T as getEnvBool, s as logger } from "./logger-DksKw1Qc.js";
-import { L as HUMAN_ASSERTION_TYPE, c as getCurrentTimestamp } from "./fetch-BEWnXrrG.js";
-import { t as invariant } from "./invariant-BtWWVVhl.js";
-import { o as getUserEmail } from "./accounts-F9d_5sMC.js";
-import { H as riskCategorySeverityMap, ct as PLUGIN_CATEGORIES, s as ResultFailureReason } from "./types-Dm9JM6Vb.js";
-import { n as isNonTransientHttpStatus, t as NON_TRANSIENT_HTTP_STATUSES } from "./errors-Cw810C93.js";
-import { t as hashPrompt } from "./utils-BLJKfv0y.js";
-import { n as sha256, t as randomSequence } from "./createHash-ChI45QR1.js";
-import { a as createEmptyTokenUsage, r as accumulateTokenUsage } from "./tokenUsageUtils-CXrvO-wA.js";
-import { a as evalResultsTable, c as evalsToPromptsTable, d as promptsTable, g as getDb, i as datasetsTable, l as evalsToTagsTable, o as evalsTable, p as tagsTable, s as evalsToDatasetsTable } from "./tables-C4CH3zRr.js";
-import { n as getTraceStore } from "./store-CYEy5J2D.js";
-import { i as getActualPrompt, r as updateSignalFile } from "./signal-CE5G3a7x.js";
-import { t as EvalResult } from "./evalResult-D3hVYFis.js";
+import { T as getEnvBool, s as logger } from "./logger-BbY6ypFL.js";
+import { R as HUMAN_ASSERTION_TYPE, d as getCurrentTimestamp } from "./fetch-DXUnXkVU.js";
+import { t as invariant } from "./invariant-B2Rf6avk.js";
+import { a as getAuthor } from "./accounts-CjFnOPmb.js";
+import { H as riskCategorySeverityMap, ct as PLUGIN_CATEGORIES, s as ResultFailureReason } from "./types-BFevViUY.js";
+import { n as sha256, t as randomSequence } from "./createHash-CgRvs4Fn.js";
+import { n as isNonTransientHttpStatus, t as NON_TRANSIENT_HTTP_STATUSES } from "./errors-9PcUL8BC.js";
+import { a as createEmptyTokenUsage, r as accumulateTokenUsage } from "./tokenUsageUtils-CDet74yk.js";
+import { a as evalResultsTable, c as evalsToPromptsTable, d as promptsTable, g as getDb, i as datasetsTable, l as evalsToTagsTable, o as evalsTable, p as tagsTable, s as evalsToDatasetsTable } from "./tables-DafUHOeh.js";
+import { t as hashPrompt } from "./utils-BFOh20Gb.js";
+import { n as getTraceStore } from "./store-DKd5592Q.js";
+import { i as getActualPrompt, r as updateSignalFile } from "./signal-CSurUUyV.js";
+import { t as EvalResult } from "./evalResult-eUkJv9Ko.js";
 import { and, desc, eq, sql } from "drizzle-orm";
 //#region src/redteam/metrics.ts
 /**
@@ -831,7 +831,7 @@ var Eval = class Eval {
 		const evalInstance = new Eval(eval_.config, {
 			id: eval_.id,
 			createdAt: new Date(eval_.createdAt),
-			author: eval_.author || void 0,
+			author: eval_.author,
 			description: eval_.description || void 0,
 			prompts: eval_.prompts || [],
 			datasetId,
@@ -854,7 +854,7 @@ var Eval = class Eval {
 		return (await getDb().select().from(evalsTable).limit(limit).orderBy(desc(evalsTable.createdAt)).all()).map((e) => new Eval(e.config, {
 			id: e.id,
 			createdAt: new Date(e.createdAt),
-			author: e.author || void 0,
+			author: e.author,
 			description: e.description || void 0,
 			prompts: e.prompts || [],
 			persisted: true
@@ -869,7 +869,7 @@ var Eval = class Eval {
 		return (await getDb().select().from(evalsTable).orderBy(desc(evalsTable.createdAt)).limit(limit).offset(offset).all()).map((e) => new Eval(e.config, {
 			id: e.id,
 			createdAt: new Date(e.createdAt),
-			author: e.author || void 0,
+			author: e.author,
 			description: e.description || void 0,
 			prompts: e.prompts || [],
 			persisted: true
@@ -884,7 +884,7 @@ var Eval = class Eval {
 	static async create(config, renderedPrompts, opts) {
 		const createdAt = opts?.createdAt || /* @__PURE__ */ new Date();
 		const evalId = opts?.id || createEvalId(createdAt);
-		const author = opts?.author || getUserEmail();
+		const author = opts && "author" in opts ? opts.author ?? null : getAuthor();
 		const db = getDb();
 		const datasetId = sha256(JSON.stringify(config.tests || []));
 		db.transaction(() => {
@@ -946,7 +946,7 @@ var Eval = class Eval {
 		});
 		return new Eval(config, {
 			id: evalId,
-			author: opts?.author,
+			author,
 			createdAt,
 			persisted: true,
 			runtimeOptions: sanitizeRuntimeOptions(opts?.runtimeOptions)
@@ -956,7 +956,7 @@ var Eval = class Eval {
 		const createdAt = opts?.createdAt || /* @__PURE__ */ new Date();
 		this.createdAt = createdAt.getTime();
 		this.id = opts?.id || createEvalId(createdAt);
-		this.author = opts?.author;
+		this.author = opts?.author ?? null;
 		this.config = config;
 		this.results = [];
 		this.prompts = opts?.prompts || [];
@@ -1486,7 +1486,7 @@ var Eval = class Eval {
 		newConfig.description = copyDescription;
 		const newPrompts = structuredClone(this.prompts);
 		const newVars = this.vars ? structuredClone(this.vars) : [];
-		const author = getUserEmail();
+		const author = getAuthor();
 		const db = getDb();
 		let copiedCount = 0;
 		db.transaction(() => {
@@ -1649,4 +1649,4 @@ async function getEvalSummaries(datasetId, type, includeProviders = false) {
 //#endregion
 export { createEvalId as a, combineFilterConditions as i, EvalQueries as n, escapeJsonPathKey as o, buildSafeJsonPath as r, getEvalSummaries as s, Eval as t };
 
-//# sourceMappingURL=eval-u4UVafl6.js.map
+//# sourceMappingURL=eval-0VRANImH.js.map

package/dist/src/{eval-CzJFfFO9.js → eval-DscR5iOM.js}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { t as Eval } from "./eval-u4UVafl6.js";
+import { t as Eval } from "./eval-0VRANImH.js";
 export { Eval as default };

package/dist/src/{evalResult-Bgm9ZH31.js → evalResult-2RRJvFyB.js}

@@ -1,34 +1,40 @@
 import { t as __exportAll } from "./chunk-DEq-mXcV.js";
-import { S as getEnvBool, a as logger, y as safeJsonStringify } from "./logger-Ct2S6Yx-.js";
-import { A as isApiProvider, g as ResultFailureReason, j as isProviderOptions, k as isResultFailureReason } from "./types-BGQDAP8i.js";
-import { u as getCurrentTimestamp } from "./fetch-Di00EQrc.js";
-import { t as hashPrompt } from "./utils-hXtCYanr.js";
-import { i as evalResultsTable, p as getDb } from "./tables-DQ4WU5tX.js";
-import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-Dk6bRWkv.js";
+import { S as getEnvBool, a as logger, f as sanitizeObject, y as safeJsonStringify } from "./logger-Ct2S6Yx-.js";
+import { Gt as isProviderOptions, Wt as isApiProvider, g as ResultFailureReason, k as isResultFailureReason } from "./types-D6glLbdF.js";
+import { c as getCurrentTimestamp } from "./fetch-It34O8Ur.js";
+import { i as evalResultsTable, p as getDb } from "./tables-CRSXQ2Ke.js";
+import { t as hashPrompt } from "./utils-BGY69tk_.js";
+import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-CxRtnaHl.js";
 import { and, eq, gte, inArray, lt, ne } from "drizzle-orm";
 //#region src/models/evalResult.ts
 var evalResult_exports = /* @__PURE__ */ __exportAll({
 	default: () => EvalResult,
 	sanitizeProvider: () => sanitizeProvider
 });
+function sanitizeProviderConfig(config) {
+	return sanitizeObject(JSON.parse(safeJsonStringify(config)), {
+		context: "provider config",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 function sanitizeProvider(provider) {
 	try {
 		if (isApiProvider(provider)) return {
 			id: provider.id(),
 			label: provider.label,
-			...provider.config && { config: JSON.parse(safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (isProviderOptions(provider)) return {
 			id: provider.id,
 			label: provider.label,
-			...provider.config && { config: JSON.parse(safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (typeof provider === "object" && provider) {
 			const providerObj = provider;
 			return {
 				id: typeof providerObj.id === "function" ? providerObj.id() : providerObj.id,
 				label: providerObj.label,
-				...providerObj.config && { config: JSON.parse(safeJsonStringify(providerObj.config)) }
+				...providerObj.config && { config: sanitizeProviderConfig(providerObj.config) }
 			};
 		}
 	} catch {}
@@ -60,6 +66,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -76,10 +100,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -118,8 +142,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -241,7 +265,8 @@ var EvalResult = class EvalResult {
 			updatedAt: getCurrentTimestamp()
 		}).where(eq(evalResultsTable.id, this.id));
 		else {
-			this.id = (await db.insert(evalResultsTable).values(this).returning())[0].id;
+			const result = await db.insert(evalResultsTable).values(this).returning();
+			this.id = result[0].id;
 			this.persisted = true;
 		}
 	}
@@ -290,6 +315,6 @@ var EvalResult = class EvalResult {
 	}
 };
 //#endregion
-export { evalResult_exports as n, EvalResult as t };
+export { evalResult_exports as n, sanitizeProvider as r, EvalResult as t };
 
-//# sourceMappingURL=evalResult-Bgm9ZH31.js.map
+//# sourceMappingURL=evalResult-2RRJvFyB.js.map

package/dist/src/{evalResult-KZqXl4XP.cjs → evalResult-CvtS8h8u.cjs}

@@ -1,29 +1,40 @@
-const require_logger = require("./logger-COuQb2xB.cjs");
-const require_types = require("./types-CeaeaZdP.cjs");
-const require_fetch = require("./fetch-CJU5ELPa.cjs");
-const require_utils = require("./utils-B05gLxER.cjs");
-const require_tables = require("./tables-DUfh1F7Z.cjs");
-const require_extractor = require("./extractor-WVPOrH43.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-D_mwlA32.cjs");
+const require_logger = require("./logger-cfNpzI4o.cjs");
+const require_types = require("./types-CxJvaY2S.cjs");
+const require_fetch = require("./fetch-Dw4XZHjj.cjs");
+const require_tables = require("./tables-DBIJU0WE.cjs");
+const require_utils = require("./utils-Ve6kuJsa.cjs");
+const require_extractor = require("./extractor-BdxEtt3J.cjs");
 let drizzle_orm = require("drizzle-orm");
 //#region src/models/evalResult.ts
+var evalResult_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	default: () => EvalResult,
+	sanitizeProvider: () => sanitizeProvider
+});
+function sanitizeProviderConfig(config) {
+	return require_logger.sanitizeObject(JSON.parse(require_logger.safeJsonStringify(config)), {
+		context: "provider config",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 function sanitizeProvider(provider) {
 	try {
 		if (require_types.isApiProvider(provider)) return {
 			id: provider.id(),
 			label: provider.label,
-			...provider.config && { config: JSON.parse(require_logger.safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (require_types.isProviderOptions(provider)) return {
 			id: provider.id,
 			label: provider.label,
-			...provider.config && { config: JSON.parse(require_logger.safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (typeof provider === "object" && provider) {
 			const providerObj = provider;
 			return {
 				id: typeof providerObj.id === "function" ? providerObj.id() : providerObj.id,
 				label: providerObj.label,
-				...providerObj.config && { config: JSON.parse(require_logger.safeJsonStringify(providerObj.config)) }
+				...providerObj.config && { config: sanitizeProviderConfig(providerObj.config) }
 			};
 		}
 	} catch {}
@@ -55,6 +66,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return require_logger.sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -71,10 +100,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: require_utils.hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -113,8 +142,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -236,7 +265,8 @@ var EvalResult = class EvalResult {
 			updatedAt: require_fetch.getCurrentTimestamp()
 		}).where((0, drizzle_orm.eq)(require_tables.evalResultsTable.id, this.id));
 		else {
-			this.id = (await db.insert(require_tables.evalResultsTable).values(this).returning())[0].id;
+			const result = await db.insert(require_tables.evalResultsTable).values(this).returning();
+			this.id = result[0].id;
 			this.persisted = true;
 		}
 	}
@@ -291,6 +321,12 @@ Object.defineProperty(exports, "EvalResult", {
 		return EvalResult;
 	}
 });
+Object.defineProperty(exports, "evalResult_exports", {
+	enumerable: true,
+	get: function() {
+		return evalResult_exports;
+	}
+});
 Object.defineProperty(exports, "sanitizeProvider", {
 	enumerable: true,
 	get: function() {
@@ -298,4 +334,4 @@ Object.defineProperty(exports, "sanitizeProvider", {
 	}
 });
 
-//# sourceMappingURL=evalResult-KZqXl4XP.cjs.map
+//# sourceMappingURL=evalResult-CvtS8h8u.cjs.map

package/dist/src/evalResult-DqzsS6_W.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { t as EvalResult } from "./evalResult-eUkJv9Ko.js";
+export { EvalResult as default };

package/dist/src/{evalResult-D3hVYFis.js → evalResult-eUkJv9Ko.js}

@@ -1,30 +1,36 @@
 #!/usr/bin/env node
-import { T as getEnvBool, s as logger, x as safeJsonStringify } from "./logger-DksKw1Qc.js";
-import { c as getCurrentTimestamp } from "./fetch-BEWnXrrG.js";
-import { f as isResultFailureReason, m as isProviderOptions, p as isApiProvider, s as ResultFailureReason } from "./types-Dm9JM6Vb.js";
-import { t as hashPrompt } from "./utils-BLJKfv0y.js";
-import { a as evalResultsTable, g as getDb } from "./tables-C4CH3zRr.js";
-import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-DNSeBVOJ.js";
+import { T as getEnvBool, m as sanitizeObject, s as logger, x as safeJsonStringify } from "./logger-BbY6ypFL.js";
+import { d as getCurrentTimestamp } from "./fetch-DXUnXkVU.js";
+import { f as isResultFailureReason, m as isProviderOptions, p as isApiProvider, s as ResultFailureReason } from "./types-BFevViUY.js";
+import { a as evalResultsTable, g as getDb } from "./tables-DafUHOeh.js";
+import { t as hashPrompt } from "./utils-BFOh20Gb.js";
+import { n as isBlobStorageEnabled, t as extractAndStoreBinaryData } from "./extractor-CIW3iN-b.js";
 import { and, eq, gte, inArray, lt, ne } from "drizzle-orm";
 //#region src/models/evalResult.ts
+function sanitizeProviderConfig(config) {
+	return sanitizeObject(JSON.parse(safeJsonStringify(config)), {
+		context: "provider config",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 function sanitizeProvider(provider) {
 	try {
 		if (isApiProvider(provider)) return {
 			id: provider.id(),
 			label: provider.label,
-			...provider.config && { config: JSON.parse(safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (isProviderOptions(provider)) return {
 			id: provider.id,
 			label: provider.label,
-			...provider.config && { config: JSON.parse(safeJsonStringify(provider.config)) }
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
 		};
 		if (typeof provider === "object" && provider) {
 			const providerObj = provider;
 			return {
 				id: typeof providerObj.id === "function" ? providerObj.id() : providerObj.id,
 				label: providerObj.label,
-				...providerObj.config && { config: JSON.parse(safeJsonStringify(providerObj.config)) }
+				...providerObj.config && { config: sanitizeProviderConfig(providerObj.config) }
 			};
 		}
 	} catch {}
@@ -56,6 +62,24 @@ function sanitizeForDb(obj) {
 		return Array.isArray(obj) ? [] : null;
 	}
 }
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
 var EvalResult = class EvalResult {
 	static async createFromEvaluateResult(evalId, result, opts) {
 		const persist = opts?.persist == null ? true : opts.persist;
@@ -72,10 +96,10 @@ var EvalResult = class EvalResult {
 		const args = {
 			id: crypto.randomUUID(),
 			evalId,
-			testCase: sanitizeForDb(preSanitizeTestCase),
+			testCase: sanitizeForDbWithSecrets(preSanitizeTestCase),
 			promptIdx: result.promptIdx,
 			testIdx: result.testIdx,
-			prompt: sanitizeForDb(prompt),
+			prompt: sanitizeForDbWithSecrets(prompt),
 			promptId: hashPrompt(prompt),
 			error: error?.toString(),
 			success,
@@ -114,8 +138,8 @@ var EvalResult = class EvalResult {
 			for (const result of processedResults) {
 				const sanitizedResult = {
 					...result,
-					testCase: sanitizeForDb(result.testCase),
-					prompt: sanitizeForDb(result.prompt),
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
 					response: sanitizeForDb(result.response),
 					gradingResult: sanitizeForDb(result.gradingResult),
 					namedScores: sanitizeForDb(result.namedScores),
@@ -237,7 +261,8 @@ var EvalResult = class EvalResult {
 			updatedAt: getCurrentTimestamp()
 		}).where(eq(evalResultsTable.id, this.id));
 		else {
-			this.id = (await db.insert(evalResultsTable).values(this).returning())[0].id;
+			const result = await db.insert(evalResultsTable).values(this).returning();
+			this.id = result[0].id;
 			this.persisted = true;
 		}
 	}
@@ -288,4 +313,4 @@ var EvalResult = class EvalResult {
 //#endregion
 export { sanitizeProvider as n, EvalResult as t };
 
-//# sourceMappingURL=evalResult-D3hVYFis.js.map
+//# sourceMappingURL=evalResult-eUkJv9Ko.js.map

package/dist/src/evaluator-DNdJF1Gv.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { n as evaluate } from "./evaluator-DRoiYB2q.js";
+export { evaluate };