promptfoo 0.122.1 → 0.122.2

package/dist/src/codex-security-DqVPI2Th.js

@@ -0,0 +1,382 @@
+import { R as state, o as logger } from "./logger-BKiOczgq.js";
+import { i as resolvePackageEntryPoint, r as importModule, t as getDirectory } from "./esm-RDYwXiu5.js";
+import { t as providerRegistry } from "./providerRegistry-DVHtat9n.js";
+import { o as resolveAgenticWorkingDir } from "./agentic-utils-B94-_ExD.js";
+import { n as renderVarsInObject } from "./render-zarxdXS7.js";
+import "./codex-runtime-DYQUgTW-.js";
+import { z as z$1 } from "zod";
+import fs from "fs/promises";
+import path from "path";
+import dedent from "dedent";
+import semverSatisfies from "semver/functions/satisfies.js";
+//#region src/providers/openai/codex-security.ts
+const CODEX_SECURITY_OPERATIONS = [
+	"security-scan",
+	"deep-security-scan",
+	"security-diff-scan",
+	"validation"
+];
+const MINIMUM_CODEX_SECURITY_SDK_VERSION = "0.1.18";
+const ReasoningEffortSchema = z$1.enum([
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max",
+	"ultra"
+]);
+const CodexSecurityConfigSchema = z$1.object({
+	basePath: z$1.string().optional(),
+	prefix: z$1.string().optional(),
+	suffix: z$1.string().optional(),
+	provider: z$1.unknown().optional(),
+	linkedTargetId: z$1.string().optional(),
+	maxRetries: z$1.number().int().nonnegative().optional(),
+	operation: z$1.enum(CODEX_SECURITY_OPERATIONS).optional(),
+	model: z$1.string().min(1).optional(),
+	model_provider: z$1.string().min(1).optional(),
+	model_reasoning_effort: ReasoningEffortSchema.optional(),
+	reasoning_effort: ReasoningEffortSchema.optional(),
+	repository: z$1.string().min(1).optional(),
+	working_dir: z$1.string().min(1).optional(),
+	paths: z$1.array(z$1.string().min(1)).min(1).optional(),
+	base_ref: z$1.string().min(1).optional(),
+	head_ref: z$1.string().min(1).optional(),
+	working_tree: z$1.boolean().optional(),
+	output_dir: z$1.string().min(1).optional(),
+	archive_existing: z$1.boolean().optional(),
+	knowledge_base_paths: z$1.array(z$1.string().min(1)).optional(),
+	scan_prompt: z$1.string().optional(),
+	validation_prompt: z$1.string().optional(),
+	post_scan_prompt: z$1.string().optional(),
+	expected_plugin_version: z$1.string().optional(),
+	failure_severity: z$1.enum([
+		"low",
+		"medium",
+		"high",
+		"critical"
+	]).optional(),
+	max_cost_usd: z$1.number().positive().optional(),
+	workers: z$1.number().int().positive().optional(),
+	subagents: z$1.number().int().nonnegative().optional(),
+	stop_after_no_new: z$1.number().int().nonnegative().optional(),
+	max_discovery_runs: z$1.number().int().positive().optional(),
+	max_time_hours: z$1.number().positive().optional(),
+	auth: z$1.enum([
+		"auto",
+		"chatgpt",
+		"api-key"
+	]).optional(),
+	plugin_path: z$1.string().min(1).optional(),
+	python_path: z$1.string().min(1).optional(),
+	codex_overrides: z$1.record(z$1.string(), z$1.unknown()).optional(),
+	finding: z$1.union([z$1.string(), z$1.record(z$1.string(), z$1.unknown())]).optional(),
+	finding_file: z$1.string().min(1).optional()
+}).strict().superRefine((config, context) => {
+	if (config.model_reasoning_effort && config.reasoning_effort && config.model_reasoning_effort !== config.reasoning_effort) context.addIssue({
+		code: "custom",
+		path: ["reasoning_effort"],
+		message: "reasoning_effort and model_reasoning_effort must match when both are set"
+	});
+	if (config.working_tree && config.head_ref) context.addIssue({
+		code: "custom",
+		path: ["head_ref"],
+		message: "head_ref cannot be combined with working_tree"
+	});
+	if (config.paths && (config.base_ref || config.head_ref || config.working_tree)) context.addIssue({
+		code: "custom",
+		path: ["paths"],
+		message: "paths cannot be combined with a diff target"
+	});
+});
+const CodexSecurityMergedPromptConfigSchema = CodexSecurityConfigSchema.strip();
+function configError(error) {
+	const details = error.issues.map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`).join("; ");
+	return /* @__PURE__ */ new Error(`Invalid OpenAI Codex Security provider configuration: ${details}`);
+}
+function parseConfig(config = {}, options = {}) {
+	const parsed = (options.stripUnknownKeys ? CodexSecurityMergedPromptConfigSchema : CodexSecurityConfigSchema).safeParse(config);
+	if (!parsed.success) throw configError(parsed.error);
+	return parsed.data;
+}
+async function loadCodexSecurity() {
+	const basePaths = [path.resolve(getDirectory(), ".."), path.resolve(getDirectory(), "../..")];
+	const visitedEntryPoints = /* @__PURE__ */ new Set();
+	const incompatibleVersions = /* @__PURE__ */ new Set();
+	let importFailed = false;
+	for (const basePath of new Set(basePaths)) {
+		const entryPoint = resolvePackageEntryPoint("@openai/codex-security", basePath);
+		if (!entryPoint || visitedEntryPoints.has(entryPoint)) continue;
+		visitedEntryPoints.add(entryPoint);
+		try {
+			const module = await importModule(entryPoint);
+			const version = typeof module.VERSION === "string" ? module.VERSION : "unknown";
+			if (!semverSatisfies(version, `>=${MINIMUM_CODEX_SECURITY_SDK_VERSION}`)) {
+				incompatibleVersions.add(version);
+				logger.warn(`[CodexSecurity] Ignoring @openai/codex-security ${version}; version ${MINIMUM_CODEX_SECURITY_SDK_VERSION} or newer is required for complete security operations and deep-scan usage accounting.`);
+				continue;
+			}
+			return module;
+		} catch (error) {
+			logger.debug("[CodexSecurity] Failed to load SDK", { error });
+			importFailed = true;
+		}
+	}
+	if (importFailed) throw new Error(dedent`Failed to load @openai/codex-security.
+
+      Promptfoo and the SDK require a supported even-numbered Node.js release: ^22.22.0, ^24.0.0, or ^26.0.0.
+      Reinstall them together with:
+        npm install promptfoo @openai/codex-security
+
+      See https://www.promptfoo.dev/docs/providers/openai-codex-security/`);
+	if (incompatibleVersions.size > 0) throw new Error(dedent`The installed @openai/codex-security package is incompatible (${Array.from(incompatibleVersions).join(", ")}).
+
+      Version ${MINIMUM_CODEX_SECURITY_SDK_VERSION} or newer is required for finding validation and accurate deep-worker cost tracking.
+      Install the compatible SDK alongside Promptfoo with:
+        npm install promptfoo @openai/codex-security@^${MINIMUM_CODEX_SECURITY_SDK_VERSION}
+
+      See https://www.promptfoo.dev/docs/providers/openai-codex-security/`);
+	throw new Error(dedent`The @openai/codex-security package is required but not installed.
+
+    Install it alongside Promptfoo with:
+      npm install promptfoo @openai/codex-security
+
+    Requires Node.js ^22.22.0, ^24.0.0, or ^26.0.0.
+    See https://www.promptfoo.dev/docs/providers/openai-codex-security/`);
+}
+function resolveConfigPath(value, configBasePath) {
+	return resolveAgenticWorkingDir(value, configBasePath ?? state.basePath);
+}
+function getTokenUsage(result, observedCost) {
+	const usage = result.turnResult.usage;
+	const values = usage && typeof usage === "object" ? usage : {};
+	const cost = result.cost ?? observedCost;
+	const inputTokens = cost?.inputTokens ?? (typeof values.input_tokens === "number" ? values.input_tokens : void 0);
+	const outputTokens = cost?.outputTokens ?? (typeof values.output_tokens === "number" ? values.output_tokens : void 0);
+	const cachedTokens = cost?.cachedInputTokens ?? (typeof values.cached_input_tokens === "number" ? values.cached_input_tokens : void 0);
+	const cacheWriteTokens = cost?.cacheWriteInputTokens ?? (typeof values.cache_write_input_tokens === "number" ? values.cache_write_input_tokens : void 0);
+	const reasoningTokens = typeof values.reasoning_output_tokens === "number" ? values.reasoning_output_tokens : void 0;
+	if (inputTokens === void 0 && outputTokens === void 0) return;
+	const completionDetails = {
+		...reasoningTokens === void 0 ? {} : { reasoning: reasoningTokens },
+		...cachedTokens === void 0 ? {} : { cacheReadInputTokens: cachedTokens },
+		...cacheWriteTokens === void 0 ? {} : { cacheCreationInputTokens: cacheWriteTokens }
+	};
+	return {
+		...inputTokens === void 0 ? {} : { prompt: inputTokens },
+		...outputTokens === void 0 ? {} : { completion: outputTokens },
+		...cachedTokens === void 0 ? {} : { cached: cachedTokens },
+		...inputTokens === void 0 || outputTokens === void 0 ? {} : { total: inputTokens + outputTokens },
+		...Object.keys(completionDetails).length > 0 ? { completionDetails } : {}
+	};
+}
+var OpenAICodexSecurityProvider = class {
+	config;
+	env;
+	providerId;
+	activeClients = /* @__PURE__ */ new Set();
+	constructor(options = {}) {
+		this.config = parseConfig(options.config);
+		this.env = options.env;
+		this.providerId = options.id ?? "openai:codex-security";
+		providerRegistry.register(this);
+	}
+	id() {
+		return this.providerId;
+	}
+	requiresApiKey() {
+		return false;
+	}
+	toString() {
+		return "[OpenAI Codex Security Provider]";
+	}
+	async cleanup() {
+		const clients = Array.from(this.activeClients);
+		this.activeClients.clear();
+		const results = await Promise.allSettled(clients.map((client) => client.close()));
+		for (const result of results) if (result.status === "rejected") logger.warn("[CodexSecurity] Error while closing SDK client", { error: result.reason });
+	}
+	async shutdown() {
+		try {
+			await this.cleanup();
+		} finally {
+			providerRegistry.unregister(this);
+		}
+	}
+	async callApi(prompt, context, callOptions) {
+		try {
+			const mergedConfig = {
+				...this.config,
+				...context?.prompt?.config
+			};
+			delete mergedConfig.provider;
+			const config = parseConfig(renderVarsInObject(mergedConfig, context?.vars), { stripUnknownKeys: true });
+			const operation = config.operation ?? "security-scan";
+			const repositoryVariable = context?.vars?.repository;
+			const repository = resolveConfigPath(config.repository ?? config.working_dir ?? (typeof repositoryVariable === "string" ? repositoryVariable : void 0), config.basePath) ?? process.cwd();
+			if (callOptions?.abortSignal?.aborted) return { error: "Codex Security operation was aborted before it started." };
+			for (const key of ["OPENAI_API_KEY", "CODEX_API_KEY"]) if (this.env?.[key] && this.env[key] !== process.env[key]) return { error: `Codex Security does not support provider-scoped ${key}. Set ${key} in the Promptfoo process environment before running the evaluation.` };
+			const module = await loadCodexSecurity();
+			const effort = config.model_reasoning_effort ?? config.reasoning_effort;
+			const codexOverrides = {
+				...config.codex_overrides,
+				...config.model ? { model: config.model } : {},
+				...config.model_provider ? { model_provider: config.model_provider } : {},
+				...effort ? { model_reasoning_effort: effort } : {}
+			};
+			const client = new module.CodexSecurity({
+				...config.plugin_path ? { pluginPath: resolveConfigPath(config.plugin_path, config.basePath) } : {},
+				...config.python_path ? { pythonPath: resolveConfigPath(config.python_path, config.basePath) } : {},
+				...Object.keys(codexOverrides).length > 0 ? { codexOverrides } : {}
+			});
+			this.activeClients.add(client);
+			try {
+				if (operation === "validation") return await this.runValidation(client, prompt, repository, config, context, callOptions);
+				return await this.runScan(client, module, prompt, repository, operation, config, callOptions);
+			} finally {
+				this.activeClients.delete(client);
+				try {
+					await client.close();
+				} catch (error) {
+					logger.warn("[CodexSecurity] Error while closing SDK client", { error });
+				}
+			}
+		} catch (error) {
+			return { error: `Codex Security operation failed: ${error instanceof Error ? error.message : String(error)}` };
+		}
+	}
+	async runScan(client, module, prompt, repository, operation, config, callOptions) {
+		const mode = operation === "deep-security-scan" ? "deep" : "standard";
+		const targetResult = this.getScanTarget(module, operation, config);
+		if ("error" in targetResult) return targetResult;
+		const observers = { warnings: [] };
+		const options = this.buildScanOptions(prompt, mode, targetResult.target, config, observers, callOptions);
+		const result = await client.run(repository, options);
+		return this.buildScanResponse(result, module, repository, operation, mode, config, observers);
+	}
+	getScanTarget(module, operation, config) {
+		if (operation === "security-diff-scan") {
+			if (config.working_tree) return { target: module.DiffTarget.workingTree(config.base_ref ? { base: config.base_ref } : void 0) };
+			if (config.base_ref) return { target: module.DiffTarget.refs({
+				base: config.base_ref,
+				...config.head_ref ? { head: config.head_ref } : {}
+			}) };
+			return { error: "Codex Security security-diff-scan requires base_ref or working_tree: true." };
+		}
+		if (config.base_ref || config.head_ref || config.working_tree) return { error: "Git diff target options require operation: security-diff-scan." };
+		return { target: config.paths ?? "repository" };
+	}
+	buildScanOptions(prompt, mode, target, config, observers, callOptions) {
+		const scanPrompt = [config.scan_prompt, prompt].filter(Boolean).join("\n\n");
+		return {
+			mode,
+			target,
+			...scanPrompt ? { scanPrompt } : {},
+			...config.auth ? { auth: config.auth } : {},
+			...config.output_dir ? { outputDir: resolveConfigPath(config.output_dir, config.basePath) } : {},
+			...config.archive_existing === void 0 ? {} : { archiveExisting: config.archive_existing },
+			...config.knowledge_base_paths ? { knowledgeBasePaths: config.knowledge_base_paths.map((knowledgePath) => resolveConfigPath(knowledgePath, config.basePath)) } : {},
+			...config.validation_prompt ? { validationPrompt: config.validation_prompt } : {},
+			...config.post_scan_prompt ? { postScanPrompt: config.post_scan_prompt } : {},
+			...config.expected_plugin_version ? { expectedPluginVersion: config.expected_plugin_version } : {},
+			...config.failure_severity ? { failureSeverity: config.failure_severity } : {},
+			...config.max_cost_usd === void 0 ? {} : { maxCostUsd: config.max_cost_usd },
+			...this.buildDeepScanOptions(mode, config),
+			...callOptions?.abortSignal ? { signal: callOptions.abortSignal } : {},
+			onCost: (cost) => {
+				observers.cost = { ...cost };
+			},
+			onProgress: (progress) => {
+				observers.progress = progress;
+			},
+			onWarning: (warning) => {
+				observers.warnings.push(warning);
+			}
+		};
+	}
+	buildDeepScanOptions(mode, config) {
+		if (mode !== "deep") return {};
+		return {
+			...config.workers === void 0 ? {} : { workers: config.workers },
+			...config.subagents === void 0 ? {} : { subagents: config.subagents },
+			...config.stop_after_no_new === void 0 ? {} : { stopAfterNoNew: config.stop_after_no_new },
+			...config.max_discovery_runs === void 0 ? {} : { maxDiscoveryRuns: config.max_discovery_runs },
+			...config.max_time_hours === void 0 ? {} : { maxTimeHours: config.max_time_hours }
+		};
+	}
+	buildScanResponse(result, module, repository, operation, mode, config, observers) {
+		const cost = result.cost ?? observers.cost;
+		const tokenUsage = getTokenUsage(result, observers.cost);
+		const findings = Array.isArray(result.findings?.findings) ? result.findings.findings : [];
+		const model = result.turnResult.model ?? cost?.model ?? config.model;
+		return {
+			output: JSON.stringify(result.toJSON()),
+			format: "json",
+			raw: result.toJSON(),
+			cached: false,
+			sessionId: result.threadId,
+			...cost ? { cost: cost.estimatedUsd } : {},
+			...tokenUsage ? { tokenUsage } : {},
+			metadata: {
+				operation,
+				mode,
+				repository,
+				...model ? { model } : {},
+				...config.model_reasoning_effort || config.reasoning_effort ? { reasoningEffort: config.model_reasoning_effort ?? config.reasoning_effort } : {},
+				findingsCount: findings.length,
+				coverage: result.coverage,
+				scanDir: result.scanDir,
+				reportPath: result.reportPath,
+				findingsPath: result.findingsPath,
+				coveragePath: result.coveragePath,
+				...result.sarifPath ? { sarifPath: result.sarifPath } : {},
+				pluginVersion: result.pluginVersion,
+				sdkVersion: module.VERSION,
+				...observers.progress ? { progress: observers.progress } : {},
+				...observers.warnings.length > 0 ? { warnings: observers.warnings } : {},
+				skillCalls: [{ name: operation }]
+			}
+		};
+	}
+	async runValidation(client, prompt, repository, config, context, callOptions) {
+		const findingVariable = context?.vars?.finding;
+		const contextualFinding = typeof findingVariable === "string" || findingVariable !== null && typeof findingVariable === "object" && !Array.isArray(findingVariable) ? findingVariable : void 0;
+		let finding = config.finding ?? contextualFinding ?? prompt;
+		if (config.finding_file) {
+			const findingContents = await fs.readFile(resolveConfigPath(config.finding_file, config.basePath), "utf8");
+			try {
+				finding = JSON.parse(findingContents);
+			} catch {
+				finding = findingContents;
+			}
+		}
+		const options = {
+			repositoryPath: repository,
+			finding,
+			...config.auth ? { auth: config.auth } : {},
+			...config.output_dir ? { outputDir: resolveConfigPath(config.output_dir, config.basePath) } : {},
+			...callOptions?.abortSignal ? { signal: callOptions.abortSignal } : {}
+		};
+		const result = await client.validate(options);
+		return {
+			output: JSON.stringify(result),
+			format: "json",
+			raw: result,
+			cached: false,
+			...result.threadId ? { sessionId: result.threadId } : {},
+			metadata: {
+				operation: "validation",
+				repository,
+				disposition: result.disposition,
+				outputDir: result.outputDir,
+				...config.model ? { model: config.model } : {},
+				skillCalls: [{ name: "validation" }]
+			}
+		};
+	}
+};
+//#endregion
+export { OpenAICodexSecurityProvider };
+
+//# sourceMappingURL=codex-security-DqVPI2Th.js.map

package/dist/src/{cometapi-CFOBA79U.js → cometapi-BdmjhPSR.js}

@@ -1,10 +1,10 @@
 import { I as getEnvString } from "./logger-D4ion89i.js";
-import "./fetch-BdWQKDMj.js";
-import "./cache-C41JuZ74.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-D6SUUPHc.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-Kx2Jhb7b.js";
-import { t as OpenAiCompletionProvider } from "./completion-CcbYZDub.js";
-import { t as OpenAiImageProvider } from "./image-B-BLrwzM.js";
+import "./fetch-DnDg-Ics.js";
+import "./cache-ePPAC5hy.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-CQkXljIT.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding-qvISOYlD.js";
+import { t as OpenAiCompletionProvider } from "./completion-D90cHpyH.js";
+import { t as OpenAiImageProvider } from "./image-CeAMtI2v.js";
 //#region src/providers/cometapi.ts
 /**
 * CometAPI Image Provider - extends OpenAI Image Provider for CometAPI's image generation models
@@ -53,4 +53,4 @@ function createCometApiProvider(providerPath, options = {}) {
 //#endregion
 export { createCometApiProvider };
 
-//# sourceMappingURL=cometapi-CFOBA79U.js.map
+//# sourceMappingURL=cometapi-BdmjhPSR.js.map

package/dist/src/{cometapi-Dq70nB-i.js → cometapi-Bst9fl8W.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { R as getEnvString } from "./logger-YzVIwMVq.js";
-import "./fetch-Bnj1JCJi.js";
-import "./cache-NhFSRGTI.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-ByXWx4Jn.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-DWeAJwIi.js";
-import { t as OpenAiCompletionProvider } from "./completion-wKp5JlDu.js";
-import { t as OpenAiImageProvider } from "./image-Dll064X0.js";
+import "./fetch-KD8O9oZZ.js";
+import "./cache-xL5UULpy.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-WpIdBaCf.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding-DgjYhcCm.js";
+import { t as OpenAiCompletionProvider } from "./completion-DSVbiAms.js";
+import { t as OpenAiImageProvider } from "./image-G65m_Tkp.js";
 //#region src/providers/cometapi.ts
 /**
 * CometAPI Image Provider - extends OpenAI Image Provider for CometAPI's image generation models
@@ -54,4 +54,4 @@ function createCometApiProvider(providerPath, options = {}) {
 //#endregion
 export { createCometApiProvider };
 
-//# sourceMappingURL=cometapi-Dq70nB-i.js.map
+//# sourceMappingURL=cometapi-Bst9fl8W.js.map

package/dist/src/{cometapi-DEVvRD5z.cjs → cometapi-CPjQpopA.cjs}

@@ -1,10 +1,10 @@
 const require_logger = require("./logger-BN3n9c1R.cjs");
-require("./fetch-DTnUr1aF.cjs");
-require("./cache-DU82DyKI.cjs");
-const require_chat = require("./chat-g28uolEO.cjs");
-const require_embedding = require("./embedding-cJ7sWqTp.cjs");
-const require_completion = require("./completion-Ch4qZHiN.cjs");
-const require_image = require("./image-DD9l6-Hi.cjs");
+require("./fetch-D54lzFcD.cjs");
+require("./cache-g3VTrtsd.cjs");
+const require_chat = require("./chat-BuHuQ8dN.cjs");
+const require_embedding = require("./embedding-C2BHs7bs.cjs");
+const require_completion = require("./completion-fjqwBQIQ.cjs");
+const require_image = require("./image-ChCkFmER.cjs");
 //#region src/providers/cometapi.ts
 /**
 * CometAPI Image Provider - extends OpenAI Image Provider for CometAPI's image generation models
@@ -53,4 +53,4 @@ function createCometApiProvider(providerPath, options = {}) {
 //#endregion
 exports.createCometApiProvider = createCometApiProvider;
 
-//# sourceMappingURL=cometapi-DEVvRD5z.cjs.map
+//# sourceMappingURL=cometapi-CPjQpopA.cjs.map

package/dist/src/{cometapi-C3SQRHPF.js → cometapi-Duei84Pe.js}

@@ -1,10 +1,10 @@
 import { P as getEnvString } from "./logger-BKiOczgq.js";
-import "./fetch-BjXG13jC.js";
-import "./cache-Bwj_lNIo.js";
-import { t as OpenAiChatCompletionProvider } from "./chat-DYIP7MZz.js";
-import { t as OpenAiEmbeddingProvider } from "./embedding-DMnl5l3W.js";
-import { t as OpenAiCompletionProvider } from "./completion-Ci8l1pSN.js";
-import { t as OpenAiImageProvider } from "./image-D_yzoOlU.js";
+import "./fetch-tOnj-VPG.js";
+import "./cache-DTOVFNqA.js";
+import { t as OpenAiChatCompletionProvider } from "./chat-DqUm2XRG.js";
+import { t as OpenAiEmbeddingProvider } from "./embedding-B3RQXlr7.js";
+import { t as OpenAiCompletionProvider } from "./completion-BwID-cTv.js";
+import { t as OpenAiImageProvider } from "./image-BqF4qDz6.js";
 //#region src/providers/cometapi.ts
 /**
 * CometAPI Image Provider - extends OpenAI Image Provider for CometAPI's image generation models
@@ -53,4 +53,4 @@ function createCometApiProvider(providerPath, options = {}) {
 //#endregion
 export { createCometApiProvider };
 
-//# sourceMappingURL=cometapi-C3SQRHPF.js.map
+//# sourceMappingURL=cometapi-Duei84Pe.js.map

package/dist/src/{completion-Ci8l1pSN.js → completion-BwID-cTv.js}

@@ -1,9 +1,9 @@
 import { M as getEnvFloat, N as getEnvInt, P as getEnvString, o as logger } from "./logger-BKiOczgq.js";
-import { T as getRequestTimeoutMs } from "./fetch-BjXG13jC.js";
+import { E as getRequestTimeoutMs } from "./fetch-tOnj-VPG.js";
 import { f as withGenAISpan, s as extractProviderResponseAttributes } from "./genaiTracer-Ch7k9W3C.js";
-import { i as fetchWithCache } from "./cache-Bwj_lNIo.js";
-import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-CVbeMrg1.js";
-import { n as calculateOpenAIUsageCost } from "./billing-CXk1T-EF.js";
+import { i as fetchWithCache } from "./cache-DTOVFNqA.js";
+import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-DHtnWbEL.js";
+import { n as calculateOpenAIUsageCost } from "./billing-BhTrP4CT.js";
 import { n as OpenAiGenericProvider } from "./openai-D05D9Qqa.js";
 //#region src/providers/openai/completion.ts
 var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGenericProvider {
@@ -94,4 +94,4 @@ var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGene
 //#endregion
 export { OpenAiCompletionProvider as t };
 
-//# sourceMappingURL=completion-Ci8l1pSN.js.map
+//# sourceMappingURL=completion-BwID-cTv.js.map

package/dist/src/{completion-CcbYZDub.js → completion-D90cHpyH.js}

@@ -1,9 +1,9 @@
 import { F as getEnvInt, I as getEnvString, P as getEnvFloat, o as logger } from "./logger-D4ion89i.js";
-import { A as getRequestTimeoutMs } from "./fetch-BdWQKDMj.js";
+import { j as getRequestTimeoutMs } from "./fetch-DnDg-Ics.js";
 import { f as withGenAISpan, s as extractProviderResponseAttributes } from "./genaiTracer-Cp9O3qLz.js";
-import { i as fetchWithCache } from "./cache-C41JuZ74.js";
-import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-CZ9shpIL.js";
-import { n as calculateOpenAIUsageCost } from "./billing-nlGj2fi4.js";
+import { i as fetchWithCache } from "./cache-ePPAC5hy.js";
+import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-CJi6Bgno.js";
+import { n as calculateOpenAIUsageCost } from "./billing-eFe0xWZw.js";
 import { n as OpenAiGenericProvider } from "./openai-lWgF8NfI.js";
 //#region src/providers/openai/completion.ts
 var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGenericProvider {
@@ -94,4 +94,4 @@ var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGene
 //#endregion
 export { OpenAiCompletionProvider as t };
 
-//# sourceMappingURL=completion-CcbYZDub.js.map
+//# sourceMappingURL=completion-D90cHpyH.js.map

package/dist/src/{completion-wKp5JlDu.js → completion-DSVbiAms.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { I as getEnvFloat, L as getEnvInt, R as getEnvString, c as logger } from "./logger-YzVIwMVq.js";
-import { k as getRequestTimeoutMs } from "./fetch-Bnj1JCJi.js";
+import { A as getRequestTimeoutMs } from "./fetch-KD8O9oZZ.js";
 import { f as withGenAISpan, s as extractProviderResponseAttributes } from "./genaiTracer-BRW5P2xD.js";
-import { i as fetchWithCache } from "./cache-NhFSRGTI.js";
-import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-DtOvD10k.js";
-import { n as calculateOpenAIUsageCost } from "./billing-_izMSTD8.js";
+import { i as fetchWithCache } from "./cache-xL5UULpy.js";
+import { c as appendOpenAiApiPath, f as formatOpenAiError, h as getTokenUsage, i as OPENAI_COMPLETION_MODELS, l as assertOpenAiApiModel } from "./util-DlT2H1W5.js";
+import { n as calculateOpenAIUsageCost } from "./billing-D0eg28TA.js";
 import { n as OpenAiGenericProvider } from "./openai-2MxDZEzF.js";
 //#region src/providers/openai/completion.ts
 var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGenericProvider {
@@ -95,4 +95,4 @@ var OpenAiCompletionProvider = class OpenAiCompletionProvider extends OpenAiGene
 //#endregion
 export { OpenAiCompletionProvider as t };
 
-//# sourceMappingURL=completion-wKp5JlDu.js.map
+//# sourceMappingURL=completion-DSVbiAms.js.map

package/dist/src/{completion-Ch4qZHiN.cjs → completion-fjqwBQIQ.cjs}

@@ -1,9 +1,9 @@
 const require_logger = require("./logger-BN3n9c1R.cjs");
-const require_fetch = require("./fetch-DTnUr1aF.cjs");
+const require_fetch = require("./fetch-D54lzFcD.cjs");
 const require_genaiTracer = require("./genaiTracer-D_3mCxrD.cjs");
-const require_cache = require("./cache-DU82DyKI.cjs");
-const require_util = require("./util-CeP1x2P-.cjs");
-const require_billing = require("./billing-K5i9I9vT.cjs");
+const require_cache = require("./cache-g3VTrtsd.cjs");
+const require_util = require("./util-Cadd9fGT.cjs");
+const require_billing = require("./billing-Q1c9C5Or.cjs");
 const require_openai = require("./openai-D6d29SL8.cjs");
 //#region src/providers/openai/completion.ts
 var OpenAiCompletionProvider = class OpenAiCompletionProvider extends require_openai.OpenAiGenericProvider {
@@ -99,4 +99,4 @@ Object.defineProperty(exports, "OpenAiCompletionProvider", {
 	}
 });
 
-//# sourceMappingURL=completion-Ch4qZHiN.cjs.map
+//# sourceMappingURL=completion-fjqwBQIQ.cjs.map

package/dist/src/{crescendo-QA8kgoFA.cjs → crescendo-Cism3YAo.cjs}

@@ -1,19 +1,19 @@
 const require_logger = require("./logger-BN3n9c1R.cjs");
 const require_invariant = require("./invariant-C2JOzzO2.cjs");
-const require_util = require("./util-L5T81aJ0.cjs");
 const require_time = require("./time-B7AqDy5g.cjs");
-const require_accounts = require("./accounts-CZFxG3Og.cjs");
+const require_accounts = require("./accounts-DosZWKJy.cjs");
+const require_render = require("./render-C1VJjFT2.cjs");
 const require_tokenUsageUtils = require("./tokenUsageUtils-BbqyaBi4.cjs");
-const require_remoteGeneration = require("./remoteGeneration-PxK1EefI.cjs");
-const require_util$1 = require("./util-COyt9Xaf.cjs");
+const require_remoteGeneration = require("./remoteGeneration-C0Ev99MO.cjs");
+const require_util = require("./util-BuKoPAn3.cjs");
 const require_inputVariables = require("./inputVariables-CQ7Ian4x.cjs");
-const require_promptfoo = require("./promptfoo-BzTq3CZR.cjs");
-const require_shared = require("./shared-IP25vMkJ.cjs");
-const require_indirectWebPwn = require("./indirectWebPwn-Ch0EQWKt.cjs");
-const require_evaluatorHelpers = require("./evaluatorHelpers-D2ObFR8i.cjs");
-const require_traceContext = require("./traceContext-BuXw2Yxu.cjs");
-const require_strategies = require("./strategies-Bn1z2exW.cjs");
-const require_runtimeTransform = require("./runtimeTransform-BiANYoNE.cjs");
+const require_promptfoo = require("./promptfoo-B3EDkr9n.cjs");
+const require_shared = require("./shared-Bl84k1Oo.cjs");
+const require_indirectWebPwn = require("./indirectWebPwn-CwSQCQGM.cjs");
+const require_evaluatorHelpers = require("./evaluatorHelpers-B2c1yYV4.cjs");
+const require_traceContext = require("./traceContext-achbslCl.cjs");
+const require_strategies = require("./strategies-DJfqHuoT.cjs");
+const require_runtimeTransform = require("./runtimeTransform-6aaLbaUN.cjs");
 const require_prompts = require("./prompts-jhd7Iq7v.cjs");
 const require_tracingOptions = require("./tracingOptions-C3Hcrnui.cjs");
 const require_prompts$1 = require("./prompts-OxoNLgR5.cjs");
@@ -59,7 +59,7 @@ var CrescendoProvider = class {
 		this.maxTurns = config.maxTurns ?? config.maxRounds ?? DEFAULT_MAX_TURNS;
 		this.maxBacktracks = config.maxBacktracks ?? DEFAULT_MAX_BACKTRACKS;
 		if (!require_accounts.isLoggedIntoCloud()) this.maxTurns = Math.min(this.maxTurns, 10);
-		this.nunjucks = require_util.getNunjucksEngine();
+		this.nunjucks = require_render.getNunjucksEngine();
 		this.memory = new MemorySystem();
 		this.targetConversationId = crypto.randomUUID();
 		this.redTeamingChatConversationId = crypto.randomUUID();
@@ -153,7 +153,7 @@ var CrescendoProvider = class {
 		});
 		let assertToUse = test?.assert?.find((a) => a.type && a.type.includes(test.metadata?.pluginId));
 		if (!assertToUse) assertToUse = test?.assert?.find((a) => a.type);
-		const { getGraderById } = await Promise.resolve().then(() => require("./graders-D7xtBg2s.cjs")).then((n) => n.graders_exports);
+		const { getGraderById } = await Promise.resolve().then(() => require("./graders-DpPGnz8u.cjs")).then((n) => n.graders_exports);
 		let graderPassed;
 		const additionalRubric = require_prompts.getGoalRubric(this.userGoal);
 		while (roundNum < this.maxTurns) try {
@@ -386,7 +386,7 @@ var CrescendoProvider = class {
 			...lastResponse.error ? { error: lastResponse.error } : {},
 			prompt: finalPrompt,
 			metadata: {
-				sessionId: require_util$1.getSessionId(lastResponse, context),
+				sessionId: require_util.getSessionId(lastResponse, context),
 				redteamFinalPrompt: lastFinalAttackPrompt || finalPrompt,
 				messages,
 				crescendoRoundsCompleted: roundNum,
@@ -500,10 +500,10 @@ ${traceSummary}\n\n`;
 	}
 	async sendPrompt(attackPrompt, originalPrompt, vars, filters, provider, _roundNum, context, options, tracingOptions, shouldFetchTrace, traceSnapshots, remoteMaterialization) {
 		let processedPrompt = attackPrompt;
-		const extractedPrompt = require_util$1.extractPromptFromTags(attackPrompt);
+		const extractedPrompt = require_util.extractPromptFromTags(attackPrompt);
 		if (extractedPrompt) processedPrompt = extractedPrompt;
 		if (this.config.inputs && require_remoteGeneration.shouldGenerateRemote()) require_promptfoo.assertRemoteMaterializationHandled(remoteMaterialization, "Crescendo multi-input generation");
-		const currentInputVars = require_util$1.extractInputVarsFromPrompt(processedPrompt, this.config.inputs);
+		const currentInputVars = require_util.extractInputVarsFromPrompt(processedPrompt, this.config.inputs);
 		let materializedInputVars;
 		if (this.config.inputs && require_remoteGeneration.shouldGenerateRemote() && !currentInputVars && !remoteMaterialization?.materializedVars) throw new Error("Crescendo remote multi-input generation returned an invalid prompt format");
 		if ((currentInputVars || remoteMaterialization?.materializedVars) && this.config.inputs) if (require_remoteGeneration.shouldGenerateRemote()) materializedInputVars = require_promptfoo.buildRemoteMaterializedInputVariables(remoteMaterialization ?? {}, currentInputVars ?? {}, this.config.inputs);
@@ -655,7 +655,7 @@ ${traceSummary}\n\n`;
 	}
 	async getRefusalScore(attackPrompt, lastResponse, tokenUsage, options) {
 		require_logger.logger.debug(`[Crescendo] Getting refusal score for prompt: ${attackPrompt}`);
-		if (require_util$1.isBasicRefusal(lastResponse)) {
+		if (require_util.isBasicRefusal(lastResponse)) {
 			require_logger.logger.debug("[Crescendo] Response contains a standard refusal prefix. Short-circuiting refusal grading.");
 			return [true, "The output contains a standard refusal."];
 		}
@@ -752,4 +752,4 @@ ${traceSummary}\n\n`;
 //#endregion
 exports.CrescendoProvider = CrescendoProvider;
 
-//# sourceMappingURL=crescendo-QA8kgoFA.cjs.map
+//# sourceMappingURL=crescendo-Cism3YAo.cjs.map