promptfoo 0.125.0 → 0.125.1

package/dist/src/fetch-BKlgUg08.cjs

@@ -0,0 +1,1853 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_logger = require("./logger-DXUHJBHJ.cjs");
+const require_invariant = require("./invariant-C2JOzzO2.cjs");
+const require_shared = require("./shared-D9Bf3UgD.cjs");
+const require_time = require("./time-CY7bOv6D.cjs");
+let path = require("path");
+path = require_rolldown_runtime.__toESM(path, 1);
+let node_async_hooks = require("node:async_hooks");
+let fs = require("fs");
+fs = require_rolldown_runtime.__toESM(fs, 1);
+let js_yaml = require("js-yaml");
+js_yaml = require_rolldown_runtime.__toESM(js_yaml, 1);
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
+let proxy_from_env = require("proxy-from-env");
+let undici = require("undici");
+let util = require("util");
+let zlib = require("zlib");
+//#region src/version.ts
+/**
+* Application version from package.json.
+* Injected at build time, or read from npm environment in development.
+*/
+const VERSION = "0.125.1";
+/**
+* PostHog analytics key.
+* Only populated during production builds via PROMPTFOO_POSTHOG_KEY env var.
+* Empty string in development/test.
+*/
+const POSTHOG_KEY = "phc_E5n5uHnDo2eREJL1uqX1cIlbkoRby4yFWt3V94HqRRg";
+function getShareApiBaseUrl() {
+	return require_logger.getEnvString("PROMPTFOO_REMOTE_API_BASE_URL") || "https://api.promptfoo.app";
+}
+function getDefaultShareViewBaseUrl() {
+	return require_logger.getEnvString("PROMPTFOO_SHARING_APP_BASE_URL", `https://promptfoo.app`);
+}
+function getShareViewBaseUrl() {
+	return require_logger.getEnvString("PROMPTFOO_REMOTE_APP_BASE_URL") || getDefaultShareViewBaseUrl();
+}
+const TERMINAL_MAX_WIDTH = process?.stdout?.isTTY && process?.stdout?.columns && process?.stdout?.columns > 10 ? process?.stdout?.columns - 10 : 120;
+const CLOUD_PROVIDER_PREFIX = "promptfoo://provider/";
+const CONSENT_ENDPOINT = "https://api.promptfoo.dev/consent";
+const EVENTS_ENDPOINT = "https://a.promptfoo.app";
+const R_ENDPOINT = "https://r.promptfoo.app/";
+//#endregion
+//#region src/globalConfig/globalConfig.ts
+/**
+* Functions for manipulating the global configuration file, which lives at
+* ~/.promptfoo/promptfoo.yaml by default.
+*/
+function writeGlobalConfig(config) {
+	fs.writeFileSync(path.join(require_logger.getConfigDirectoryPath(true), "promptfoo.yaml"), js_yaml.dump(config));
+}
+function readGlobalConfig() {
+	const configDir = require_logger.getConfigDirectoryPath();
+	const configFilePath = path.join(configDir, "promptfoo.yaml");
+	let globalConfig = { id: crypto.randomUUID() };
+	if (fs.existsSync(configFilePath)) {
+		globalConfig = require_logger.loadYaml(fs.readFileSync(configFilePath, "utf-8")) || {};
+		if (!globalConfig?.id) {
+			globalConfig = {
+				...globalConfig,
+				id: crypto.randomUUID()
+			};
+			writeGlobalConfig(globalConfig);
+		}
+	} else {
+		if (!fs.existsSync(configDir)) fs.mkdirSync(configDir, { recursive: true });
+		fs.writeFileSync(configFilePath, js_yaml.dump(globalConfig));
+	}
+	return globalConfig;
+}
+/**
+* Merges the top-level keys into existing config.
+* @param partialConfig New keys to merge into the existing config.
+*/
+function writeGlobalConfigPartial(partialConfig) {
+	const updatedConfig = { ...readGlobalConfig() };
+	Object.entries(partialConfig).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) updatedConfig[key] = value;
+		else delete updatedConfig[key];
+	});
+	writeGlobalConfig(updatedConfig);
+}
+const CLOUD_HOSTNAMES = /* @__PURE__ */ new Set([
+	new URL("https://api.promptfoo.app").hostname,
+	new URL("https://www.promptfoo.app").hostname,
+	new URL("https://promptfoo.app").hostname
+]);
+const SHARING_CUTOFF_DATE = /* @__PURE__ */ new Date("2026-03-09T00:00:00Z");
+function isPromptfooCloudHost(url) {
+	try {
+		const hostname = new URL(url).hostname.toLowerCase().replace(/\.$/, "");
+		return CLOUD_HOSTNAMES.has(hostname);
+	} catch {
+		return false;
+	}
+}
+let hasWarnedAboutLegacyApiHost = false;
+function warnOnceAboutLegacyApiHost() {
+	if (hasWarnedAboutLegacyApiHost) return;
+	hasWarnedAboutLegacyApiHost = true;
+	require_logger.logger.warn("Ignoring the API_HOST environment variable for Promptfoo Cloud routing. To point at a self-hosted deployment, use PROMPTFOO_CLOUD_API_URL or `promptfoo auth login --host <url>`.");
+}
+var CloudConfig = class {
+	configState = null;
+	constructor(initializeImmediately = true) {
+		if (initializeImmediately) this.config;
+	}
+	get config() {
+		this.configState ??= this.readConfig();
+		return this.configState;
+	}
+	set config(config) {
+		this.configState = config;
+	}
+	readConfig() {
+		const savedConfig = readGlobalConfig()?.cloud || {};
+		return {
+			appUrl: savedConfig.appUrl || "https://www.promptfoo.app",
+			apiHost: savedConfig.apiHost,
+			apiKey: savedConfig.apiKey,
+			authHeaderName: savedConfig.authHeaderName,
+			sharing: savedConfig.sharing,
+			currentOrganizationId: savedConfig.currentOrganizationId,
+			currentTeamId: savedConfig.currentTeamId,
+			teams: savedConfig.teams
+		};
+	}
+	/**
+	* Returns the API key from config file or PROMPTFOO_API_KEY environment variable.
+	* Config file takes precedence over environment variable.
+	*/
+	resolveApiKey() {
+		return this.config.apiKey || process.env.PROMPTFOO_API_KEY;
+	}
+	/**
+	* Returns the API host from config file, PROMPTFOO_CLOUD_API_URL environment variable,
+	* or defaults to the standard cloud API host.
+	* Config file takes precedence over environment variable.
+	*
+	* Trailing slashes are stripped so callers that append a path (e.g.
+	* `${getApiHost()}/api/v1/...`) never produce a double slash. On-prem hosts
+	* entered via `promptfoo auth login --host https://host/` commonly include one.
+	*/
+	resolveApiHost() {
+		const host = this.config.apiHost || process.env.PROMPTFOO_CLOUD_API_URL || "https://api.promptfoo.app";
+		if (!this.config.apiHost && !process.env.PROMPTFOO_CLOUD_API_URL && process.env.API_HOST && this.resolveApiKey()) warnOnceAboutLegacyApiHost();
+		return host.replace(/\/+$/, "");
+	}
+	/**
+	* Returns the header name used to carry the Cloud API credential, from config file,
+	* PROMPTFOO_CLOUD_AUTH_HEADER environment variable, or the default `Authorization`.
+	* Config file takes precedence over environment variable, matching resolveApiHost().
+	*
+	* process.env is read directly (not getEnvString) for the same reason as
+	* PROMPTFOO_CLOUD_API_URL: an eval config's `env` block must never be able to
+	* influence Cloud auth routing.
+	*/
+	resolveAuthHeaderName() {
+		return this.config.authHeaderName || process.env.PROMPTFOO_CLOUD_AUTH_HEADER || "Authorization";
+	}
+	isEnabled() {
+		return !!this.resolveApiKey();
+	}
+	setApiHost(apiHost) {
+		this.config.apiHost = apiHost.replace(/\/+$/, "");
+		this.saveConfig();
+	}
+	setApiKey(apiKey) {
+		this.config.apiKey = apiKey;
+		this.saveConfig();
+	}
+	getApiKey() {
+		return this.resolveApiKey();
+	}
+	getApiHost() {
+		return this.resolveApiHost();
+	}
+	setAuthHeaderName(authHeaderName) {
+		this.config.authHeaderName = authHeaderName;
+		this.saveConfig();
+	}
+	getAuthHeaderName() {
+		return this.resolveAuthHeaderName();
+	}
+	/**
+	* Returns the header(s) to attach to a Cloud API request for the current credential,
+	* or `undefined` when no API key is resolved. Callers should spread the result
+	* conditionally (`...(cloudConfig.getAuthHeaders() ?? {})`) rather than sending a
+	* header with a `Bearer undefined` value.
+	*/
+	getAuthHeaders() {
+		const token = this.getApiKey();
+		if (!token) return;
+		return { [this.getAuthHeaderName()]: `Bearer ${token}` };
+	}
+	setAppUrl(appUrl) {
+		this.config.appUrl = appUrl;
+		this.saveConfig();
+	}
+	getAppUrl() {
+		return this.config.appUrl;
+	}
+	getSharing() {
+		return this.config.sharing;
+	}
+	/**
+	* Sets the sharing preference. Note: this value is only updated at authentication time
+	* (via `validateAndSetApiToken`) and may become stale if the user's license status
+	* changes between re-authentications.
+	*/
+	setSharing(sharing) {
+		this.config.sharing = sharing;
+		this.saveConfig();
+	}
+	delete() {
+		writeGlobalConfigPartial({ cloud: {} });
+		this.reload();
+	}
+	saveConfig() {
+		writeGlobalConfigPartial({ cloud: this.config });
+		this.reload();
+	}
+	reload() {
+		this.config = this.readConfig();
+	}
+	saveValidatedApiToken(token, apiHost, user, app, hasActiveLicense, authHeaderName) {
+		this.setApiKey(token);
+		this.setApiHost(apiHost);
+		this.setAppUrl(app.url);
+		if (authHeaderName) this.setAuthHeaderName(authHeaderName);
+		if (!(isPromptfooCloudHost(apiHost) || isPromptfooCloudHost(app.url))) this.setSharing(true);
+		else if (typeof hasActiveLicense === "boolean") {
+			const createdAt = user?.createdAt ? new Date(user.createdAt) : null;
+			const isGrandfathered = createdAt != null && createdAt < SHARING_CUTOFF_DATE;
+			this.setSharing(hasActiveLicense || isGrandfathered);
+		}
+	}
+	async validateApiToken(token, apiHost, authHeaderName) {
+		try {
+			const { fetchWithProxy } = await Promise.resolve().then(() => fetch_exports);
+			const response = await fetchWithProxy(`${apiHost}/api/v1/users/me`, {
+				headers: { [authHeaderName || this.getAuthHeaderName()]: `Bearer ${token}` },
+				skipCloudAuthInjection: true
+			});
+			if (!response.ok) {
+				const errorMessage = await response.text();
+				require_logger.logger.error(`[Cloud] Failed to validate API token: ${errorMessage}. HTTP Status: ${response.status} - ${response.statusText}.`);
+				throw new Error("Failed to validate API token: " + response.statusText);
+			}
+			const { user, organization, app, hasActiveLicense } = await response.json();
+			return {
+				user,
+				organization,
+				app,
+				...typeof hasActiveLicense === "boolean" ? { hasActiveLicense } : {}
+			};
+		} catch (err) {
+			const error = err;
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			require_logger.logger.error(`[Cloud] Failed to validate API token with host ${apiHost}: ${errorMessage}`);
+			if (error.cause) require_logger.logger.error(`Cause: ${error.cause}`);
+			throw error;
+		}
+	}
+	async validateAndSetApiToken(token, apiHost) {
+		const authHeaderName = this.getAuthHeaderName();
+		const { user, organization, app, hasActiveLicense } = await this.validateApiToken(token, apiHost, authHeaderName);
+		this.saveValidatedApiToken(token, apiHost, user, app, hasActiveLicense, authHeaderName);
+		return {
+			user,
+			organization,
+			app,
+			hasActiveLicense: typeof hasActiveLicense === "boolean" ? hasActiveLicense : false
+		};
+	}
+	getCurrentOrganizationId() {
+		return this.config.currentOrganizationId;
+	}
+	setCurrentOrganization(organizationId) {
+		this.config.currentOrganizationId = organizationId;
+		this.saveConfig();
+	}
+	getCurrentTeamId(organizationId) {
+		if (organizationId) return this.config.teams?.[organizationId]?.currentTeamId;
+		return this.config.currentTeamId;
+	}
+	setCurrentTeamId(teamId, organizationId) {
+		if (organizationId) {
+			if (!this.config.teams) this.config.teams = {};
+			if (!this.config.teams[organizationId]) this.config.teams[organizationId] = {};
+			this.config.teams[organizationId].currentTeamId = teamId;
+		} else this.config.currentTeamId = teamId;
+		this.saveConfig();
+	}
+	clearCurrentTeamId(organizationId) {
+		if (organizationId) {
+			if (this.config.teams?.[organizationId]) delete this.config.teams[organizationId].currentTeamId;
+		} else delete this.config.currentTeamId;
+		this.saveConfig();
+	}
+	cacheTeams(teams, organizationId) {
+		if (organizationId) {
+			if (!this.config.teams) this.config.teams = {};
+			if (!this.config.teams[organizationId]) this.config.teams[organizationId] = {};
+			this.config.teams[organizationId].cache = teams.map((t) => ({
+				id: t.id,
+				name: t.name,
+				slug: t.slug,
+				lastFetched: (/* @__PURE__ */ new Date()).toISOString()
+			}));
+		}
+		this.saveConfig();
+	}
+	getCachedTeams(organizationId) {
+		if (organizationId) return this.config.teams?.[organizationId]?.cache;
+	}
+};
+const cloudConfig = new CloudConfig(false);
+//#endregion
+//#region src/scheduler/headerParser.ts
+const OPENAI_HEADERS = {
+	remainingRequests: "x-ratelimit-remaining-requests",
+	remainingTokens: "x-ratelimit-remaining-tokens",
+	limitRequests: "x-ratelimit-limit-requests",
+	limitTokens: "x-ratelimit-limit-tokens",
+	resetRequests: "x-ratelimit-reset-requests",
+	resetTokens: "x-ratelimit-reset-tokens"
+};
+const ANTHROPIC_HEADERS = {
+	remainingRequests: "anthropic-ratelimit-requests-remaining",
+	remainingTokens: "anthropic-ratelimit-tokens-remaining",
+	limitRequests: "anthropic-ratelimit-requests-limit",
+	limitTokens: "anthropic-ratelimit-tokens-limit",
+	resetRequests: "anthropic-ratelimit-requests-reset",
+	resetTokens: "anthropic-ratelimit-tokens-reset"
+};
+const STANDARD_HEADERS = {
+	remaining: "ratelimit-remaining",
+	limit: "ratelimit-limit",
+	reset: "ratelimit-reset",
+	remainingAlt: "x-ratelimit-remaining",
+	limitAlt: "x-ratelimit-limit",
+	resetAlt: "x-ratelimit-reset"
+};
+/**
+* Parse rate limit headers from response.
+*/
+function parseRateLimitHeaders(headers) {
+	const result = {};
+	const h = lowercaseKeys(headers);
+	result.remainingRequests = parseFirstMatch(h, [
+		OPENAI_HEADERS.remainingRequests,
+		ANTHROPIC_HEADERS.remainingRequests,
+		STANDARD_HEADERS.remainingAlt,
+		STANDARD_HEADERS.remaining
+	]);
+	result.remainingTokens = parseFirstMatch(h, [OPENAI_HEADERS.remainingTokens, ANTHROPIC_HEADERS.remainingTokens]);
+	result.limitRequests = parseFirstMatch(h, [
+		OPENAI_HEADERS.limitRequests,
+		ANTHROPIC_HEADERS.limitRequests,
+		STANDARD_HEADERS.limitAlt,
+		STANDARD_HEADERS.limit
+	]);
+	result.limitTokens = parseFirstMatch(h, [OPENAI_HEADERS.limitTokens, ANTHROPIC_HEADERS.limitTokens]);
+	for (const name of [
+		OPENAI_HEADERS.resetRequests,
+		OPENAI_HEADERS.resetTokens,
+		ANTHROPIC_HEADERS.resetRequests,
+		ANTHROPIC_HEADERS.resetTokens,
+		STANDARD_HEADERS.resetAlt,
+		STANDARD_HEADERS.reset
+	]) if (h[name] !== void 0) {
+		const parsed = parseResetTime(h[name]);
+		if (parsed !== null) {
+			result.resetAt = parsed;
+			break;
+		}
+	}
+	if (h["retry-after-ms"] !== void 0) {
+		const ms = Number.parseInt(h["retry-after-ms"], 10);
+		if (Number.isFinite(ms) && ms >= 0) {
+			result.retryAfterMs = ms;
+			if (result.resetAt === void 0) result.resetAt = Date.now() + ms;
+		}
+	}
+	if (result.retryAfterMs === void 0 && h["retry-after"] !== void 0) {
+		const parsed = parseRetryAfter(h["retry-after"]);
+		if (parsed !== null) {
+			result.retryAfterMs = parsed;
+			if (result.resetAt === void 0) result.resetAt = Date.now() + parsed;
+		}
+	}
+	return result;
+}
+/**
+* Parse Retry-After header value.
+* Returns duration in milliseconds.
+* Exported for integration use.
+*/
+function parseRetryAfter(value) {
+	const seconds = Number.parseInt(value, 10);
+	const durationMs = seconds * 1e3;
+	if (Number.isFinite(seconds) && seconds >= 0 && String(seconds) === value.trim() && Number.isFinite(durationMs)) return durationMs;
+	const httpDate = parseHttpDate(value);
+	if (httpDate !== null) return Math.max(0, httpDate - Date.now());
+	return null;
+}
+function parseFirstMatch(headers, names) {
+	for (const name of names) {
+		const value = headers[name];
+		if (value !== void 0) {
+			const num = Number.parseInt(value, 10);
+			if (Number.isFinite(num) && num >= 0) return num;
+		}
+	}
+}
+/**
+* A bare non-negative decimal number and nothing else: "0", "120", "1.5".
+*
+* `Number.parseFloat` stops at the first character it cannot consume, so
+* without this guard it silently reads the leading digits of a timestamp
+* ("2026-08-07T21:00:00Z" -> 2026) and the magnitude heuristic below then
+* treats them as relative seconds. Same intent as the `String(seconds) ===
+* value.trim()` check in `parseRetryAfter`.
+*/
+const BARE_NUMBER_RE = /^\d+(?:\.\d+)?$/;
+/**
+* Parse reset time from various formats.
+* Returns absolute Unix timestamp in milliseconds.
+*/
+function parseResetTime(value) {
+	const durationMs = parseDuration(value);
+	if (durationMs !== null) return Date.now() + durationMs;
+	if (BARE_NUMBER_RE.test(value.trim())) {
+		const num = Number.parseFloat(value);
+		if (Number.isFinite(num) && num >= 0) {
+			if (num < 1e9) return Date.now() + num * 1e3;
+			else if (num < 1e10) return num * 1e3;
+			else return num;
+		}
+	}
+	const httpDate = parseHttpDate(value);
+	if (httpDate !== null) return httpDate;
+	return null;
+}
+/**
+* Parse HTTP-date format (RFC 7231).
+*/
+function parseHttpDate(value) {
+	const timestamp = Date.parse(value);
+	if (Number.isFinite(timestamp)) {
+		const now = Date.now();
+		const oneYearMs = 31536e6;
+		if (timestamp > now - oneYearMs && timestamp < now + oneYearMs) return timestamp;
+	}
+	return null;
+}
+/**
+* Parse duration strings like "1s", "100ms", "1m30s", "1h30s", "2h15m30s".
+*
+* Supported formats:
+* - Xms (milliseconds)
+* - Xs or X.Xs (seconds)
+* - Xm or XmYs (minutes with optional seconds)
+* - Xh or XhYm or XhYs or XhYmZs (hours with optional minutes/seconds)
+*/
+function parseDuration(value) {
+	const match = value.match(/^(?:(\d+)h)?(?:(\d+)m(?!s))?(?:(\d+(?:\.\d+)?)(ms|s))?$/);
+	if (!match) return null;
+	const [, hours, minutes, secondsValue, secondsUnit] = match;
+	if (!hours && !minutes && !secondsValue) return null;
+	let ms = 0;
+	if (hours) ms += Number.parseInt(hours, 10) * 36e5;
+	if (minutes) ms += Number.parseInt(minutes, 10) * 6e4;
+	if (secondsValue) {
+		const num = Number.parseFloat(secondsValue);
+		ms += secondsUnit === "ms" ? num : num * 1e3;
+	}
+	return Number.isFinite(ms) ? ms : null;
+}
+function lowercaseKeys(obj) {
+	const result = {};
+	for (const [key, value] of Object.entries(obj)) result[key.toLowerCase()] = value;
+	return result;
+}
+//#endregion
+//#region src/util/fetch/cloudAuthRedirects.ts
+var CloudAuthRedirectError = class extends Error {
+	constructor() {
+		super("Cloud authentication cannot follow a redirect to a different origin. Use the final API URL with promptfoo auth login --host.");
+		this.name = "CloudAuthRedirectError";
+	}
+};
+function unwrapCloudAuthRedirectError(error) {
+	return error instanceof Error && "cause" in error && error.cause instanceof CloudAuthRedirectError ? error.cause : error;
+}
+/** Keep native fetch's redirect handling, but bind this authenticated request to its initial origin. */
+function restrictCloudAuthRedirects(url, dispatcher = (0, undici.getGlobalDispatcher)()) {
+	const origin = new URL(url).origin;
+	const dispatch = (options, handler) => {
+		if (!options.origin || new URL(options.origin.toString()).origin !== origin) throw new CloudAuthRedirectError();
+		return dispatcher.dispatch(options, handler);
+	};
+	return new Proxy({ dispatch }, { get(target, property) {
+		return property === "dispatch" ? target.dispatch : Reflect.get(dispatcher, property, dispatcher);
+	} });
+}
+//#endregion
+//#region src/util/fetch/decompress.ts
+/** Create the required decoder without exposing undici's internal API notice to CLI users. */
+function createDecompressionInterceptor() {
+	const originalEmitWarning = process.emitWarning;
+	const wrappedEmitWarning = ((warning, ...args) => {
+		if (warning === "DecompressInterceptor is experimental and subject to change" && args[0] === "ExperimentalWarning") return;
+		Reflect.apply(originalEmitWarning, process, [warning, ...args]);
+	});
+	process.emitWarning = wrappedEmitWarning;
+	try {
+		return undici.interceptors.decompress({
+			skipErrorResponses: false,
+			maxSize: 67108864
+		});
+	} finally {
+		if (process.emitWarning === wrappedEmitWarning) process.emitWarning = originalEmitWarning;
+	}
+}
+function hasContentEncoding(headers) {
+	if ("content-encoding" in headers) return true;
+	return Object.keys(headers).some((key) => key.toLowerCase() === "content-encoding");
+}
+var StripEncodingHandler = class {
+	#handler;
+	constructor(handler) {
+		this.#handler = handler;
+	}
+	onRequestStart(controller, context) {
+		return this.#handler.onRequestStart?.(controller, context);
+	}
+	onRequestUpgrade(controller, statusCode, headers, socket) {
+		return this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket);
+	}
+	onResponseStart(controller, statusCode, headers, statusMessage) {
+		const ctrl = controller;
+		if (Array.isArray(ctrl.rawHeaders) && !hasContentEncoding(headers)) {
+			const filtered = [];
+			let rawHadContentEncoding = false;
+			const pairCount = ctrl.rawHeaders.length - ctrl.rawHeaders.length % 2;
+			for (let i = 0; i < pairCount; i += 2) {
+				const name = ctrl.rawHeaders[i].toString().toLowerCase();
+				if (name === "content-encoding") rawHadContentEncoding = true;
+				else if (name !== "content-length") filtered.push(ctrl.rawHeaders[i], ctrl.rawHeaders[i + 1]);
+			}
+			if (rawHadContentEncoding) {
+				if (ctrl.rawHeaders.length % 2 === 1) filtered.push(ctrl.rawHeaders[ctrl.rawHeaders.length - 1]);
+				ctrl.rawHeaders = filtered;
+			}
+		}
+		return this.#handler.onResponseStart?.(controller, statusCode, headers, statusMessage);
+	}
+	onResponseStarted() {
+		return this.#handler.onResponseStarted?.();
+	}
+	onResponseData(controller, chunk) {
+		return this.#handler.onResponseData?.(controller, chunk);
+	}
+	onResponseEnd(controller, trailers) {
+		return this.#handler.onResponseEnd?.(controller, trailers);
+	}
+	onResponseError(controller, err) {
+		return this.#handler.onResponseError?.(controller, err);
+	}
+};
+function stripDecompressionHeaders() {
+	return (dispatch) => (opts, handler) => dispatch(opts, new StripEncodingHandler(handler));
+}
+//#endregion
+//#region src/util/fetch/errors.ts
+/**
+* Body-level error codes that indicate a hard quota/billing failure rather than
+* a transient per-window rate limit. Retrying these will not succeed and just
+* amplifies load and cost; callers should fail fast.
+*
+* References:
+* - OpenAI: https://platform.openai.com/docs/guides/error-codes/api-errors
+* - Azure OpenAI: https://learn.microsoft.com/en-us/azure/ai-services/openai/reference
+* - Anthropic: https://platform.claude.com/docs/en/api/errors
+*
+* Note: Azure OpenAI is known to return `insufficient_quota` for both billing
+* exhaustion AND per-minute deployment quota saturation. The
+* {@link HttpRateLimitError} constructor downgrades such an ambiguous quota
+* code to `rate_limit` when the server also hints at a near-term recovery
+* (`Retry-After` / reset header) — a billing server has no reason to hint at
+* recovery time. The codes in {@link DEFINITIVE_BILLING_ERROR_CODES} name a
+* billing state explicitly and are never downgraded.
+*/
+const HARD_QUOTA_ERROR_CODES = /* @__PURE__ */ new Set([
+	"insufficient_quota",
+	"billing_hard_limit_reached",
+	"billing_not_active",
+	"access_terminated",
+	"quota_exceeded",
+	"credit_balance_exhausted"
+]);
+/**
+* Subset of {@link HARD_QUOTA_ERROR_CODES} that unambiguously describes the
+* account's billing state (no credits, hard limit reached, billing inactive,
+* access terminated). Unlike `insufficient_quota` / `quota_exceeded`, these
+* are not reused for per-window throttling, so a `Retry-After` next to them
+* (some gateways attach one to every 429) must not turn them retryable.
+*/
+const DEFINITIVE_BILLING_ERROR_CODES = /* @__PURE__ */ new Set([
+	"credit_balance_exhausted",
+	"billing_hard_limit_reached",
+	"billing_not_active",
+	"access_terminated"
+]);
+/**
+* Body codes that name a per-window throttle outright (OpenAI / Azure OpenAI
+* `rate_limit_exceeded`, Anthropic `rate_limit_error` / `overloaded_error`,
+* per-minute token / request buckets). An AMBIGUOUS hard-quota `type`
+* (`insufficient_quota`, `quota_exceeded`) is only a fallback for an
+* unrecognized `code`; next to one of these it never promotes the error to
+* `quota`, whether or not the server sent a `Retry-After` / reset header. A
+* {@link DEFINITIVE_BILLING_ERROR_CODES} type still does, because it names the
+* account's billing state rather than guessing at it.
+*/
+const TRANSIENT_RATE_LIMIT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"rate_limit_exceeded",
+	"rate_limit_error",
+	"rate_limit",
+	"rate_limited",
+	"overloaded_error",
+	"too_many_requests",
+	"tokens",
+	"requests",
+	"tokens_per_min",
+	"requests_per_min",
+	"tokens_per_day",
+	"requests_per_day"
+]);
+/**
+* Upper bound for the "server hinted a recovery time, so this isn't billing"
+* heuristic. A server that says "retry in &lt;= 1 hour" (via `Retry-After`
+* or a reset timestamp) is signalling a per-window throttle, not a billing
+* exhaustion. Above 1h we treat the hint as ambiguous and let the body code
+* decide.
+*/
+const RATE_LIMIT_QUOTA_DOWNGRADE_THRESHOLD_MS = 36e5;
+/**
+* Normalize a caller-supplied millisecond duration / timestamp: a finite,
+* non-negative number passes through; anything else maps to `undefined`.
+*/
+function normalizeNonNegativeMs(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+/**
+* Structured error representing a final HTTP rate limit (status 429 or an
+* equivalent header signal) — i.e. retries are exhausted, or the response
+* code indicates a hard quota that should not be retried.
+*
+* Distinguishes:
+* - `kind: 'quota'`     — daily / billing / contractual exhaustion. Don't retry.
+* - `kind: 'rate_limit'` — per-window throttling. Retry honoring `retryAfterMs`.
+*
+* The rendered `message` always contains the kind prefix (`"Rate limit
+* exceeded"` or `"Quota exceeded"`) plus the literal status code. When the
+* status is 429 (the typical construction path) the message also contains
+* `"429"` and the default `"Too Many Requests"` statusText, which is what
+* legacy substring classifiers downstream rely on.
+*
+* The `Http` prefix on the name scopes this to the network transport
+* boundary, distinguishing it from rate-limit-shaped errors in other
+* layers (e.g. an in-process scheduler queue exhausting its budget).
+*/
+var HttpRateLimitError = class extends Error {
+	status;
+	statusText;
+	retryAfterMs;
+	resetAt;
+	code;
+	type;
+	kind;
+	headers;
+	body;
+	constructor(init) {
+		const status = init.status;
+		const statusText = init.statusText || "Too Many Requests";
+		const retryAfterMs = normalizeNonNegativeMs(init.retryAfterMs);
+		const resetAt = normalizeNonNegativeMs(init.resetAt);
+		const typeImpliesQuota = isHardQuotaCode(init.type) && (isDefinitiveBillingCode(init.type) || !isTransientRateLimitCode(init.code));
+		let kind = isHardQuotaCode(init.code) || typeImpliesQuota ? "quota" : "rate_limit";
+		if (kind === "quota" && !isDefinitiveBillingCode(init.code) && !isDefinitiveBillingCode(init.type) && hasNearTermRecoveryHint(retryAfterMs, resetAt)) kind = "rate_limit";
+		const prefix = kind === "quota" ? "Quota exceeded" : "Rate limit exceeded";
+		const codeSuffix = init.code ? ` (code: ${init.code})` : "";
+		super(`${prefix}: HTTP ${status} ${statusText}${codeSuffix}`);
+		this.name = "HttpRateLimitError";
+		this.status = status;
+		this.statusText = statusText;
+		this.retryAfterMs = retryAfterMs;
+		this.resetAt = resetAt;
+		this.code = init.code;
+		this.type = init.type;
+		this.kind = kind;
+		this.headers = init.headers ? { ...init.headers } : void 0;
+		this.body = init.body;
+	}
+};
+function isHardQuotaCode(code) {
+	return code !== void 0 && HARD_QUOTA_ERROR_CODES.has(code);
+}
+function isDefinitiveBillingCode(code) {
+	return code !== void 0 && DEFINITIVE_BILLING_ERROR_CODES.has(code);
+}
+function isTransientRateLimitCode(code) {
+	return code !== void 0 && TRANSIENT_RATE_LIMIT_ERROR_CODES.has(code);
+}
+/**
+* Whether the server advertised a recovery within
+* {@link RATE_LIMIT_QUOTA_DOWNGRADE_THRESHOLD_MS}: an explicit `Retry-After`,
+* or a reset timestamp whose remaining wait (from now) is within the bound.
+* A reset timestamp in the past counts as "recovers now".
+*/
+function hasNearTermRecoveryHint(retryAfterMs, resetAt) {
+	if (retryAfterMs !== void 0) return retryAfterMs <= RATE_LIMIT_QUOTA_DOWNGRADE_THRESHOLD_MS;
+	if (resetAt !== void 0) return resetAt - Date.now() <= RATE_LIMIT_QUOTA_DOWNGRADE_THRESHOLD_MS;
+	return false;
+}
+/**
+* Render the per-window retry-after / reset detail for a structured
+* rate-limit error. Returns empty string when:
+* - No retry metadata is available, OR
+* - The error is a hard quota (`kind === 'quota'`) — retries won't help,
+*   so showing a "retry after Xs" hint would contradict the quota message.
+*/
+function formatRateLimitDetail(err) {
+	if (err.kind === "quota") return "";
+	const parts = [];
+	if (typeof err.retryAfterMs === "number") parts.push(`retry after ${Math.round(err.retryAfterMs / 1e3)}s`);
+	else if (typeof err.resetAt === "number") {
+		const remainingMs = Math.max(err.resetAt - Date.now(), 0);
+		if (remainingMs > 0) parts.push(`resets in ${Math.round(remainingMs / 1e3)}s`);
+	}
+	return parts.length > 0 ? ` [${parts.join(", ")}]` : "";
+}
+/**
+* Render the user-facing error string for a structured rate-limit / quota
+* failure. Single-prefix format (no provider-specific wrapper duplication):
+*
+*   "Rate limit exceeded: HTTP 429 Too Many Requests (code: rate_limit_exceeded) [retry after 7s]"
+*   "Quota exceeded: HTTP 429 Too Many Requests (code: insufficient_quota). Retries will not help — check your billing or daily quota."
+*
+* `details` (optional) is appended verbatim before the kind-specific
+* trailer. Use it to surface upstream-provided context (e.g. an SDK
+* error's full message that names the deployment / token count) that the
+* structured error itself doesn't carry.
+*/
+function formatRateLimitErrorMessage(err, details) {
+	const codePart = err.code ? ` (code: ${err.code})` : "";
+	const trailingDetails = details ? ` ${details}` : "";
+	if (err.kind === "quota") return `Quota exceeded: HTTP ${err.status} ${err.statusText}${codePart}${trailingDetails}. Retries will not help — check your billing or daily quota.`;
+	const detail = formatRateLimitDetail(err);
+	return `Rate limit exceeded: HTTP ${err.status} ${err.statusText}${codePart}${trailingDetails}${detail}`;
+}
+function isHttpRateLimitError(err) {
+	return err instanceof HttpRateLimitError;
+}
+/**
+* Best-effort extraction of an error code from a parsed response body across
+* provider variants (OpenAI / Azure / Anthropic / generic JSON-RPC style).
+*/
+function extractRateLimitErrorCode(body) {
+	if (typeof body !== "object" || body === null) return;
+	const root = body;
+	if (typeof root.error === "object" && root.error !== null) {
+		const err = root.error;
+		const metadata = err.metadata;
+		const providerCode = typeof metadata === "object" && metadata !== null ? metadata.provider_code : void 0;
+		if (typeof providerCode === "string" && isDefinitiveBillingCode(providerCode.toLowerCase())) return providerCode.toLowerCase();
+		if (typeof err.code === "string" && err.code.length > 0) return err.code;
+	}
+	if (typeof root.code === "string" && root.code.length > 0) return root.code;
+	return extractRateLimitErrorType(body);
+}
+/**
+* Best-effort extraction of the broad error class (`error.type` / top-level
+* `type`) from a parsed response body. OpenAI pairs `type: "insufficient_quota"`
+* with billing-specific codes such as `credit_balance_exhausted`, so the type
+* still carries the quota classification when the code is not recognized.
+* Returns `undefined` when the body has no separate `type` field.
+*/
+function extractRateLimitErrorType(body) {
+	if (typeof body !== "object" || body === null) return;
+	const root = body;
+	const nested = typeof root.error === "object" && root.error !== null ? root.error.type : void 0;
+	if (typeof nested === "string" && nested.length > 0) return nested;
+	return typeof root.type === "string" && root.type.length > 0 ? root.type : void 0;
+}
+/**
+* Non-transient HTTP status codes that indicate the target is unavailable or misconfigured.
+* These errors will not resolve on retry and should abort the scan immediately.
+*
+* - 401: Unauthorized - authentication required or invalid credentials
+* - 403: Forbidden - valid credentials but access denied
+* - 404: Not Found - target endpoint doesn't exist
+* - 501: Not Implemented - server doesn't support the request method
+*
+* Excluded: 500 (often transient — server crashes, DB timeouts, deployment rollouts,
+* or input-dependent bugs where one prompt triggers it but the next doesn't),
+* 502/503/504 (typically transient gateway issues).
+*/
+const NON_TRANSIENT_HTTP_STATUSES = [
+	401,
+	403,
+	404,
+	501
+];
+function isNonTransientHttpStatus(status) {
+	return NON_TRANSIENT_HTTP_STATUSES.includes(status);
+}
+function isTransientConnectionError(error) {
+	if (!error) return false;
+	const code = error.code;
+	if (code === "ECONNRESET" || code === "EPIPE") return true;
+	const message = (error.message ?? "").toLowerCase();
+	if (message.includes("eproto") && (message.includes("wrong version number") || message.includes("self signed") || message.includes("unable to verify") || message.includes("unknown ca") || message.includes("cert"))) return false;
+	return message.includes("bad record mac") || message.includes("eproto") || message.includes("econnreset") || message.includes("socket hang up");
+}
+/**
+* True when an error represents an aborted/cancelled operation (an AbortController
+* signal firing). Callers use this to suppress expected cancellation rather than
+* treating it as a real failure, so the abort's `.name` must be preserved upstream.
+*/
+function isAbortError(error) {
+	return error instanceof Error && (error.name === "AbortError" || error.name === "AbortException");
+}
+function getAbortError(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error && reason.name === "AbortError") return reason;
+	const error = new Error(reason instanceof Error ? reason.message : "Request was aborted");
+	error.name = "AbortError";
+	return error;
+}
+//#endregion
+//#region src/util/fetch/monkeyPatchFetch.ts
+const gzipAsync = (0, util.promisify)(zlib.gzip);
+const PROMPTFOO_TEAM_ID_HEADER = "x-promptfoo-team-id";
+function isConnectionError(error) {
+	return error instanceof TypeError && error.message === "fetch failed" && error.cause?.stack?.includes("internalConnectMultiple");
+}
+/** Extracts the request URL as a string. A `Request`'s `toString()` is "[object Request]", so read `.url`. */
+function getRequestUrlString(url) {
+	return url instanceof Request ? url.url : url.toString();
+}
+function matchesNoLogUrl(url, noLogUrl) {
+	try {
+		const target = new URL(url);
+		const excluded = new URL(noLogUrl);
+		if (target.origin !== excluded.origin) return false;
+		const excludedPath = excluded.pathname.replace(/\/+$/, "");
+		return excludedPath === "" || target.pathname === excludedPath || target.pathname.startsWith(`${excludedPath}/`);
+	} catch {
+		return false;
+	}
+}
+function getSafeUrlForConnectionLog(url) {
+	return require_logger.sanitizeUrl(getRequestUrlString(url));
+}
+function getSafeProxyForConnectionLog() {
+	const proxyUrl = process.env.HTTP_PROXY || process.env.HTTPS_PROXY;
+	return proxyUrl ? `or Proxy: ${require_logger.sanitizeUrl(proxyUrl)}` : "";
+}
+/**
+* Returns true when `url` targets the configured Promptfoo Cloud origin: the public
+* cloud host by default, or the on-prem host when one is configured via
+* `cloudConfig.getApiHost()`. Matching is scheme+host+port exact (`URL.origin`), so
+* look-alike hosts, HTTP downgrades, and different ports never match. Matching is
+* origin-wide — every path on the configured cloud origin is treated as cloud, so the
+* saved token may also reach sibling services hosted on that same origin. Fails closed
+* (returns false) when either URL is unparseable, so a misconfigured host never leaks
+* the token.
+*/
+function isPromptfooCloudApiHost(url) {
+	try {
+		const targetUrl = url instanceof Request ? url.url : url.toString();
+		return new URL(targetUrl).origin === new URL(cloudConfig.getApiHost()).origin;
+	} catch {
+		return false;
+	}
+}
+/**
+* Resolves the header name used to carry the Cloud API credential (defaults to
+* `Authorization`, but may be configured to a different name via
+* `promptfoo auth login --auth-header-name` or `PROMPTFOO_CLOUD_AUTH_HEADER`).
+*/
+function getCloudAuthHeaderName() {
+	return cloudConfig.getAuthHeaderName();
+}
+/**
+* Resolves the auth header value for a request to the configured Promptfoo
+* Cloud origin, or `undefined` when the request is not cloud-bound or no API key is
+* saved. Centralizing this keeps the live request (`monkeyPatchFetch`) and the cache
+* key (`getHeadersForCacheKey` in cache.ts) in lockstep.
+*/
+function getCloudBearerToken(url) {
+	if (!isPromptfooCloudApiHost(url)) return;
+	const token = cloudConfig.getApiKey();
+	return token ? `Bearer ${token}` : void 0;
+}
+function isPromptfooCloudTaskUrl(url) {
+	if (!isPromptfooCloudApiHost(url)) return false;
+	try {
+		const pathname = new URL(getRequestUrlString(url)).pathname.replace(/\/+$/, "");
+		return pathname.endsWith("/api/v1/task") || pathname.endsWith("/api/v1/task/harmful");
+	} catch {
+		return false;
+	}
+}
+/** Returns the persisted CLI team for authenticated Cloud task requests. */
+function getCloudTaskTeamId(url) {
+	if (!isPromptfooCloudTaskUrl(url)) return;
+	if (!getCloudBearerToken(url)) return;
+	const organizationId = cloudConfig.getCurrentOrganizationId();
+	return cloudConfig.getCurrentTeamId(organizationId);
+}
+/**
+* Resolves the caller-supplied headers for a request: the explicit `options.headers` when
+* present, otherwise the headers carried by a `Request` URL.
+*
+* `monkeyPatchFetch`'s only in-repo caller (`fetchWithProxy`) always normalizes headers to
+* a plain object, but the function is exported and typed to accept any `HeadersInit` /
+* `Request`, so the helpers here preserve every shape rather than assuming a `Record`.
+*/
+function getEffectiveHeaders(url, headers) {
+	return headers ?? (url instanceof Request ? url.headers : void 0);
+}
+function hasHeader(headers, name) {
+	return new Headers(headers).has(name);
+}
+/**
+* Returns `headers` with `name: value` set. Plain objects retain their shape, while a
+* `Headers` instance or `[name, value][]` array is normalized through `Headers` so existing
+* entries are never dropped (a naive object spread would discard them).
+*/
+function setHeader(headers, name, value) {
+	if (headers instanceof Headers || Array.isArray(headers)) {
+		const merged = new Headers(headers);
+		merged.set(name, value);
+		return merged;
+	}
+	return {
+		...headers ?? {},
+		[name]: value
+	};
+}
+function usesCustomCloudAuth(url, headers, explicitCloudAuth = false) {
+	const effectiveHeaders = new Headers(headers);
+	if (explicitCloudAuth) return Array.from(effectiveHeaders).some(([name, value]) => name !== "authorization" && /^Bearer\s/i.test(value));
+	const headerName = getCloudAuthHeaderName().toLowerCase();
+	if (headerName === "authorization") return false;
+	for (const [name, value] of effectiveHeaders) if (name === headerName) return /^Bearer\s/i.test(value) && (isPromptfooCloudApiHost(url) || value.replace(/^Bearer\s+/i, "") === cloudConfig.getApiKey());
+	return Boolean(getCloudBearerToken(url));
+}
+/** Capture the Cloud redirect policy before any asynchronous work or retry. */
+function preserveCloudAuthRedirects(url, options = {}) {
+	if (options.restrictCloudAuthRedirects || !usesCustomCloudAuth(url, getEffectiveHeaders(url, options.headers), options.skipCloudAuthInjection)) return options;
+	return {
+		...options,
+		restrictCloudAuthRedirects: true
+	};
+}
+/**
+* Enhanced fetch wrapper that adds logging, authentication, error handling, and optional compression
+*/
+async function monkeyPatchFetch(url, options) {
+	const NO_LOG_URLS = [
+		R_ENDPOINT,
+		CONSENT_ENDPOINT,
+		EVENTS_ENDPOINT
+	];
+	const urlString = getRequestUrlString(url);
+	const callerHeaders = getEffectiveHeaders(url, options?.headers);
+	const isSilent = new Headers(callerHeaders).get("x-promptfoo-silent") === "true";
+	const logEnabled = !NO_LOG_URLS.some((logUrl) => matchesNoLogUrl(urlString, logUrl)) && !isSilent;
+	const { restrictCloudAuthRedirects: restrictRedirects, ...opts } = preserveCloudAuthRedirects(url, options);
+	const originalBody = opts.body;
+	if (options?.compress && opts.body && typeof opts.body === "string") try {
+		opts.body = await gzipAsync(opts.body);
+		opts.headers = setHeader(getEffectiveHeaders(url, opts.headers), "Content-Encoding", "gzip");
+	} catch (e) {
+		require_logger.logger.warn(`Failed to compress request body: ${e}`);
+	}
+	if (!options?.skipCloudAuthInjection) {
+		const cloudAuth = getCloudBearerToken(url);
+		if (cloudAuth) {
+			const cloudAuthHeaderName = getCloudAuthHeaderName();
+			const effectiveHeaders = getEffectiveHeaders(url, opts.headers);
+			if (!hasHeader(effectiveHeaders, cloudAuthHeaderName)) opts.headers = setHeader(effectiveHeaders, cloudAuthHeaderName, cloudAuth);
+		}
+		const cloudTaskTeamId = getCloudTaskTeamId(url);
+		const headersWithAuth = getEffectiveHeaders(url, opts.headers);
+		if (cloudTaskTeamId && !hasHeader(headersWithAuth, "x-promptfoo-team-id")) opts.headers = setHeader(headersWithAuth, PROMPTFOO_TEAM_ID_HEADER, cloudTaskTeamId);
+	}
+	if (restrictRedirects || usesCustomCloudAuth(url, getEffectiveHeaders(url, opts.headers), options?.skipCloudAuthInjection)) opts.dispatcher = restrictCloudAuthRedirects(urlString, opts.dispatcher);
+	try {
+		const response = await fetch(url, opts);
+		if (logEnabled) require_logger.logRequestResponse({
+			url: urlString,
+			requestBody: originalBody,
+			requestMethod: opts.method || "GET",
+			response
+		});
+		return response;
+	} catch (e) {
+		if (logEnabled) {
+			require_logger.logRequestResponse({
+				url: urlString,
+				requestBody: opts.body,
+				requestMethod: opts.method || "GET",
+				response: null
+			});
+			if (isConnectionError(e)) {
+				require_logger.logger.debug(`Connection error, please check your network connectivity to the host: ${getSafeUrlForConnectionLog(url)} ${getSafeProxyForConnectionLog()}`);
+				throw e;
+			}
+			const safeUrl = require_logger.sanitizeUrlForLogging(urlString);
+			const safeError = `${JSON.stringify(e, Object.getOwnPropertyNames(e), 2)} ${e instanceof Error ? e.stack : ""}`.split(urlString).join(safeUrl);
+			require_logger.logger.debug(`Error in fetch: ${safeError}`);
+		}
+		throw unwrapCloudAuthRedirectError(e);
+	}
+}
+//#endregion
+//#region src/util/fetch/retryContext.ts
+const fetchRetryContext = new node_async_hooks.AsyncLocalStorage();
+/**
+* Run `fn` with a fetch retry context so nested `fetchWithRetries` /
+* `fetchWithProxy` calls inherit the provider's configured `maxRetries`.
+*
+* When `maxRetries` is `undefined`, the new scope deliberately shadows any
+* outer provider context so providers without an override fall back to defaults.
+*/
+function withFetchRetryContext(maxRetries, fn) {
+	return fetchRetryContext.run({ maxRetries }, fn);
+}
+/**
+* Read the active context's `maxRetries`, or `undefined` when none is set.
+*/
+function getFetchRetryContextMaxRetries() {
+	return fetchRetryContext.getStore()?.maxRetries;
+}
+//#endregion
+//#region src/util/fetch/index.ts
+var fetch_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	computeRateLimitWaitMs: () => computeRateLimitWaitMs,
+	fetchWithProxy: () => fetchWithProxy,
+	fetchWithRetries: () => fetchWithRetries,
+	fetchWithTimeout: () => fetchWithTimeout,
+	getFetchWithProxyHeaders: () => getFetchWithProxyHeaders,
+	handleRateLimit: () => handleRateLimit,
+	isRateLimited: () => isRateLimited,
+	isTransientError: () => isTransientError,
+	rateLimitTimingFromHeaders: () => rateLimitTimingFromHeaders,
+	readBoundedText: () => readBoundedText
+});
+var RequestAuthenticationError = class extends Error {};
+async function resolveAuthenticationHeaders(getAuthHeaders, explicitHeaders, signal) {
+	signal?.throwIfAborted();
+	let headers;
+	try {
+		headers = new Headers(await getAuthHeaders(signal ?? void 0));
+	} catch (error) {
+		signal?.throwIfAborted();
+		throw Object.assign(new RequestAuthenticationError(error instanceof Error ? error.message : "Request authentication failed"), { cause: error });
+	}
+	signal?.throwIfAborted();
+	new Headers(explicitHeaders).forEach((value, name) => headers.set(name, value));
+	return Object.fromEntries(headers);
+}
+const cachedAgents = /* @__PURE__ */ new Map();
+const cachedProxyAgents = /* @__PURE__ */ new Map();
+/**
+* Get the connection pool size for HTTP agents.
+* Priority: PROMPTFOO_FETCH_CONNECTIONS env var > CLI -j flag > DEFAULT_MAX_CONCURRENCY (4).
+* Set PROMPTFOO_FETCH_CONNECTIONS to override independently of eval concurrency
+* (e.g., server deployments that need more connections than the default 4).
+*/
+function getConnectionPoolSize() {
+	const envConnections = require_logger.getEnvString("PROMPTFOO_FETCH_CONNECTIONS");
+	if (envConnections != null) {
+		const normalized = envConnections.trim();
+		const parsed = Number(normalized);
+		if (/^\d+$/.test(normalized) && Number.isSafeInteger(parsed) && parsed > 0) return parsed;
+	}
+	return require_logger.state.maxConcurrency || 4;
+}
+function getOrCreateAgent(tlsOptions) {
+	const concurrency = getConnectionPoolSize();
+	const existing = cachedAgents.get(concurrency);
+	if (existing) return existing;
+	const agent = new undici.Agent({
+		headersTimeout: require_shared.getRequestTimeoutMs(),
+		keepAliveTimeout: 3e4,
+		keepAliveMaxTimeout: 6e4,
+		connections: concurrency,
+		connect: tlsOptions
+	}).compose(createDecompressionInterceptor()).compose(stripDecompressionHeaders());
+	cachedAgents.set(concurrency, agent);
+	return agent;
+}
+function getProxyAgentCacheKey(proxyUrl, concurrency) {
+	return `${proxyUrl}::${concurrency}`;
+}
+function getOrCreateProxyAgent(proxyUrl, tlsOptions) {
+	const concurrency = getConnectionPoolSize();
+	const cacheKey = getProxyAgentCacheKey(proxyUrl, concurrency);
+	const existing = cachedProxyAgents.get(cacheKey);
+	if (existing) return existing;
+	const agent = new undici.ProxyAgent({
+		uri: proxyUrl,
+		proxyTls: tlsOptions,
+		requestTls: tlsOptions,
+		headersTimeout: require_shared.getRequestTimeoutMs(),
+		keepAliveTimeout: 3e4,
+		keepAliveMaxTimeout: 6e4,
+		connections: concurrency
+	}).compose(createDecompressionInterceptor()).compose(stripDecompressionHeaders());
+	cachedProxyAgents.set(cacheKey, agent);
+	return agent;
+}
+/**
+* Resolve whether to disable transient-error retries. An explicit caller flag
+* always wins (a caller may opt back in even when the provider set
+* `maxRetries: 0`); otherwise we disable only when the retry context carries
+* `maxRetries === 0`.
+*/
+function resolveTransientRetryDisabled(explicit) {
+	if (explicit !== void 0) return explicit;
+	return getFetchRetryContextMaxRetries() === 0;
+}
+function headersInitToRecord(headers) {
+	if (!headers) return {};
+	if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+	if (Array.isArray(headers)) return Object.fromEntries(new Headers(headers).entries());
+	return { ...headers };
+}
+function getFetchWithProxyHeaders(url, options) {
+	const requestHeaders = url instanceof Request && options.headers === void 0 ? headersInitToRecord(url.headers) : {};
+	const optionHeaders = headersInitToRecord(options.headers);
+	return {
+		...requestHeaders,
+		...optionHeaders,
+		"x-promptfoo-version": VERSION
+	};
+}
+function getFetchUrlString(url) {
+	if (typeof url === "string") return url;
+	if (url instanceof URL) return url.toString();
+	if (url instanceof Request) return url.url;
+}
+async function fetchWithProxy(url, options = {}, abortSignal) {
+	options = preserveCloudAuthRedirects(url, options);
+	let finalUrl = url;
+	let finalUrlString = getFetchUrlString(url);
+	if (!finalUrlString) throw new Error("Invalid URL");
+	const combinedSignal = abortSignal ? options.signal ? AbortSignal.any([options.signal, abortSignal]) : abortSignal : options.signal;
+	const { getAuthHeaders, ...requestOptions } = options;
+	const finalOptions = {
+		...requestOptions,
+		headers: getFetchWithProxyHeaders(url, options),
+		signal: combinedSignal
+	};
+	const logEnabled = new Headers(finalOptions.headers).get("x-promptfoo-silent") !== "true";
+	if (typeof url === "string") try {
+		const parsedUrl = new URL(url);
+		if (parsedUrl.username || parsedUrl.password) {
+			const headers = finalOptions.headers ?? {};
+			if (Object.keys(headers).some((name) => name.toLowerCase() === "authorization")) {
+				if (logEnabled) require_logger.logger.warn("Both URL credentials and Authorization header present - URL credentials will be ignored");
+			} else {
+				const credentials = [parsedUrl.username, parsedUrl.password].map((part) => {
+					try {
+						return decodeURIComponent(part);
+					} catch {
+						return part;
+					}
+				}).join(":");
+				finalOptions.headers = {
+					...headers,
+					Authorization: `Basic ${Buffer.from(credentials).toString("base64")}`
+				};
+			}
+			parsedUrl.username = "";
+			parsedUrl.password = "";
+			finalUrl = parsedUrl.toString();
+			finalUrlString = finalUrl;
+		}
+	} catch (e) {
+		if (logEnabled) require_logger.logger.debug(`URL parsing failed in fetchWithProxy: ${e}`);
+	}
+	const tlsOptions = { rejectUnauthorized: !require_logger.getEnvBool("PROMPTFOO_INSECURE_SSL", true) };
+	const caCertPath = require_logger.getEnvString("PROMPTFOO_CA_CERT_PATH");
+	if (caCertPath) try {
+		const resolvedPath = path.default.resolve(require_logger.state.basePath || "", caCertPath);
+		tlsOptions.ca = await node_fs_promises.readFile(resolvedPath, "utf8");
+		if (logEnabled) require_logger.logger.debug(`Using custom CA certificate from ${resolvedPath}`);
+	} catch (e) {
+		if (logEnabled) require_logger.logger.warn(`Failed to read CA certificate from ${caCertPath}: ${e}`);
+	}
+	const proxyUrl = finalUrlString ? (0, proxy_from_env.getProxyForUrl)(finalUrlString) : "";
+	if (!finalOptions.dispatcher) {
+		if (proxyUrl) {
+			if (logEnabled) require_logger.logger.debug(`Using proxy: ${require_logger.sanitizeUrl(proxyUrl)}`);
+			finalOptions.dispatcher = getOrCreateProxyAgent(proxyUrl, tlsOptions);
+		} else finalOptions.dispatcher = getOrCreateAgent(tlsOptions);
+	}
+	const disableTransientRetries = resolveTransientRetryDisabled(options.disableTransientRetries);
+	const maxTransientRetries = disableTransientRetries ? 0 : 3;
+	for (let attempt = 0; attempt <= maxTransientRetries; attempt++) {
+		let attemptOptions = finalOptions;
+		if (getAuthHeaders) attemptOptions = {
+			...finalOptions,
+			headers: await resolveAuthenticationHeaders(getAuthHeaders, finalOptions.headers, combinedSignal)
+		};
+		const response = await monkeyPatchFetch(finalUrl, attemptOptions);
+		if (!disableTransientRetries && isTransientError(response) && attempt < maxTransientRetries) {
+			const backoffMs = Math.pow(2, attempt) * 1e3;
+			if (logEnabled) require_logger.logger.debug(`Transient error (${response.status} ${response.statusText}), retry ${attempt + 1}/${maxTransientRetries} after ${backoffMs}ms`);
+			await require_time.sleep(backoffMs);
+			continue;
+		}
+		return response;
+	}
+	throw new Error("Unexpected end of transient retry loop");
+}
+function fetchWithTimeout(url, options = {}, timeout) {
+	return new Promise((resolve, reject) => {
+		const timeoutController = new AbortController();
+		const signal = options.signal ? AbortSignal.any([options.signal, timeoutController.signal]) : timeoutController.signal;
+		const timeoutId = setTimeout(() => {
+			timeoutController.abort();
+			reject(/* @__PURE__ */ new Error(`Request timed out after ${timeout} ms`));
+		}, timeout);
+		fetchWithProxy(url, {
+			...options,
+			signal
+		}).then((response) => {
+			clearTimeout(timeoutId);
+			resolve(response);
+		}).catch((error) => {
+			clearTimeout(timeoutId);
+			reject(error);
+		});
+	});
+}
+/**
+* Check if a response indicates rate limiting
+*/
+function isRateLimited(response) {
+	require_invariant.invariant(response.headers, "Response headers are missing");
+	require_invariant.invariant(response.status, "Response status is missing");
+	return response.headers.get("X-RateLimit-Remaining") === "0" || response.status === 429 || response.headers.get("x-ratelimit-remaining-requests") === "0" || response.headers.get("x-ratelimit-remaining-tokens") === "0";
+}
+/**
+* Compute how long to wait after a rate-limited response.
+* Reads `retry-after-ms`, `Retry-After`, `X-RateLimit-Reset`, and OpenAI-style reset headers.
+* Default: 60s.
+*/
+function computeRateLimitWaitMs(response) {
+	const parsedHeaders = parseRateLimitHeaders(Object.fromEntries(response.headers.entries()));
+	const rateLimitReset = response.headers.get("X-RateLimit-Reset");
+	if (response.headers.get("x-ratelimit-reset-requests") || response.headers.get("x-ratelimit-reset-tokens")) {
+		if (parsedHeaders.resetAt !== void 0) return Math.max(parsedHeaders.resetAt - Date.now(), 0);
+	}
+	if (rateLimitReset) {
+		const resetAt = Number.parseInt(rateLimitReset, 10) * 1e3;
+		if (Number.isFinite(resetAt) && resetAt >= 0) return Math.max(resetAt - Date.now() + 1e3, 0);
+	}
+	return parsedHeaders.retryAfterMs ?? 6e4;
+}
+/**
+* Maximum jitter (in ms) added to rate-limit waits. Spreads concurrent
+* waiters so they don't all retry in the same instant after Retry-After.
+*/
+const RATE_LIMIT_JITTER_MS = 1e3;
+async function sleepWithAbort(waitTime, signal) {
+	if (!signal) {
+		await require_time.sleep(waitTime);
+		return;
+	}
+	if (signal.aborted) throw getAbortError(signal);
+	await new Promise((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, waitTime);
+		const onAbort = () => {
+			clearTimeout(timeout);
+			signal.removeEventListener("abort", onAbort);
+			reject(getAbortError(signal));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
+* Handle rate limiting by waiting the appropriate amount of time, plus a
+* uniform random jitter to avoid synchronized retry storms when many
+* concurrent requests hit the same rate limit.
+*/
+async function handleRateLimit(response, signal, onRateLimitBackoff) {
+	const waitTime = computeRateLimitWaitMs(response);
+	if (!signal?.aborted) onRateLimitBackoff?.(Object.freeze({
+		headers: Object.freeze(Object.fromEntries(response.headers.entries())),
+		status: response.status,
+		resetAt: Date.now() + waitTime
+	}));
+	const jitter = Math.floor(Math.random() * RATE_LIMIT_JITTER_MS);
+	const totalWait = waitTime + jitter;
+	require_logger.logger.debug(`Rate limited, waiting ${totalWait}ms (base ${waitTime}ms + ${jitter}ms jitter) before retry`);
+	await sleepWithAbort(totalWait, signal);
+}
+/**
+* Hard cap on bytes read from a 429 response body during classification.
+* A hostile or buggy upstream could otherwise stream a multi-MB body on
+* every 429, amplifying memory pressure under concurrent eval load. 64 KB
+* is well above any well-formed provider error envelope (typical OpenAI
+* / Anthropic JSON errors are <1 KB).
+*/
+const RATE_LIMIT_BODY_PEEK_BYTES = 65536;
+/**
+* Read the body of a rate-limited response without consuming the original
+* stream. Returns the parsed body (JSON if parseable, else raw text) and
+* any extracted error code (e.g. `insufficient_quota`).
+*
+* Why clone: `Response.text()` consumes the underlying stream. The original
+* response may still be observed by upstream wrappers (logging middleware,
+* monkey-patched fetch); cloning preserves their ability to read the body.
+*
+* Clone/read failures degrade to `{ body: undefined, code: undefined }`
+* unless the caller cancelled the unfinished peek. Losing the body code only
+* widens classification from `quota` to `rate_limit`, which is the safer
+* (retryable) side of the misclassification.
+*/
+async function peekRateLimitBody(response, logEnabled, signal) {
+	let cloned;
+	try {
+		cloned = response.clone();
+	} catch (err) {
+		if (signal?.aborted) throw getAbortError(signal);
+		if (logEnabled) require_logger.logger.debug(`[fetch] peekRateLimitBody: clone failed, skipping body code lookup: ${err}`);
+		return {
+			body: void 0,
+			code: void 0,
+			type: void 0
+		};
+	}
+	let text;
+	try {
+		text = await readBoundedText(cloned, RATE_LIMIT_BODY_PEEK_BYTES, { requireStream: true });
+	} catch (err) {
+		if (signal?.aborted) throw getAbortError(signal);
+		if (logEnabled) require_logger.logger.debug(`[fetch] peekRateLimitBody: body read failed: ${err}`);
+		return {
+			body: void 0,
+			code: void 0,
+			type: void 0
+		};
+	}
+	if (!text) return {
+		body: void 0,
+		code: void 0,
+		type: void 0
+	};
+	try {
+		const json = JSON.parse(text);
+		return {
+			body: json,
+			code: extractRateLimitErrorCode(json),
+			type: extractRateLimitErrorType(json)
+		};
+	} catch {
+		if (logEnabled) require_logger.logger.debug("[fetch] peekRateLimitBody: response body was not JSON");
+		return {
+			body: text,
+			code: void 0,
+			type: void 0
+		};
+	}
+}
+/**
+* Drain a Response's body into a string, but stop reading once `maxBytes`
+* have been collected. Each streamed chunk is bounded to the remaining
+* budget *before* it enters the in-memory buffer, so a single oversized
+* chunk cannot exceed `maxBytes` of retained memory. `requireStream` skips
+* streamless polyfills to guarantee bounded buffering for rate-limit peeking.
+* Other callers retain the legacy text fallback, which buffers before truncation.
+*/
+async function readBoundedText(response, maxBytes, options = {}) {
+	if (!response.body) {
+		const contentLength = Number.parseInt(response.headers?.get?.("content-length") ?? "", 10);
+		if (options.requireStream || Number.isFinite(contentLength) && contentLength > maxBytes) return "";
+		const text = await response.text();
+		return text.length > maxBytes ? text.slice(0, maxBytes) : text;
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (total < maxBytes) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			const room = maxBytes - total;
+			const bounded = value.byteLength <= room ? value : value.slice(0, room);
+			chunks.push(bounded);
+			total += bounded.byteLength;
+		}
+	} finally {
+		try {
+			await reader.cancel();
+		} catch {}
+	}
+	const merged = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(merged);
+}
+/**
+* Retry-After / reset timing from a rate-limit response's headers, for callers
+* that build an {@link HttpRateLimitError} from an SDK error rather than a
+* `Response`. Keeps the header parsing in one place.
+*/
+function rateLimitTimingFromHeaders(headers) {
+	const parsed = parseRateLimitHeaders(headers);
+	return {
+		retryAfterMs: parsed.retryAfterMs,
+		resetAt: parsed.resetAt
+	};
+}
+function buildHttpRateLimitError(response, body, code, type) {
+	const headers = Object.fromEntries(response.headers.entries());
+	const parsed = parseRateLimitHeaders(headers);
+	return new HttpRateLimitError({
+		status: response.status,
+		statusText: response.statusText,
+		retryAfterMs: parsed.retryAfterMs,
+		resetAt: parsed.resetAt,
+		code,
+		type,
+		headers,
+		body
+	});
+}
+/**
+* Check if a response indicates a transient server error that should be retried.
+* Matches specific status codes with their expected status text to avoid
+* retrying permanent failures (e.g., some APIs return 502 for auth errors).
+*/
+function isTransientError(response) {
+	if (!response?.statusText) return false;
+	const statusText = response.statusText.toLowerCase();
+	switch (response.status) {
+		case 502: return statusText.includes("bad gateway");
+		case 503: return statusText.includes("service unavailable");
+		case 504: return statusText.includes("gateway timeout");
+		case 524: return statusText.includes("timeout");
+		default: return false;
+	}
+}
+/**
+* Decide what to do with a rate-limited response inside `fetchWithRetries`.
+*
+* Throws on hard-quota fail-fast or retry exhaustion (with a structured
+* {@link HttpRateLimitError} for status 429, or a plain `Error` for the soft
+* `X-RateLimit-Remaining=0` 200 case). Otherwise sleeps via
+* {@link handleRateLimit} and returns so the caller can `continue` the loop.
+*/
+/**
+* Returns a string form of a {@link RequestInfo} suitable for log output.
+* Strips basic-auth credentials and known sensitive query parameters (api_key,
+* token, password, signature, …) via {@link sanitizeUrl} so providers that
+* embed credentials in the URL (e.g. n8n webhooks, HTTP providers with
+* `?api_key=…`) do not leak them into retry diagnostics.
+*/
+function urlForLog(url) {
+	const raw = typeof url === "string" ? url : url.url;
+	return require_logger.sanitizeUrlForLogging(raw);
+}
+async function handleRateLimitedResponse(response, url, attempt, maxRetries, logEnabled, signal, onRateLimitBackoff) {
+	const isHardRateLimit = response.status === 429;
+	const safeUrl = urlForLog(url);
+	let rateLimitError;
+	if (isHardRateLimit) {
+		const { body, code, type } = await peekRateLimitBody(response, logEnabled, signal);
+		rateLimitError = buildHttpRateLimitError(response, body, code, type);
+	}
+	if (rateLimitError?.kind === "quota") {
+		if (logEnabled) require_logger.logger.debug(`Quota exhausted on URL ${safeUrl}: HTTP ${response.status} (code: ${rateLimitError.code}), failing fast.`);
+		throw rateLimitError;
+	}
+	if (attempt >= maxRetries) {
+		if (rateLimitError) {
+			if (logEnabled) require_logger.logger.debug(`Rate limited on URL ${safeUrl}: HTTP ${response.status} ${response.statusText}, attempt ${attempt + 1}/${maxRetries + 1}, no retries remain.`);
+			throw rateLimitError;
+		}
+		throw new Error(`Rate limited: ${response.status} ${response.statusText} after ${maxRetries + 1} attempts`);
+	}
+	if (logEnabled) require_logger.logger.debug(`Rate limited on URL ${safeUrl}: HTTP ${response.status} ${response.statusText}, attempt ${attempt + 1}/${maxRetries + 1}, waiting before retry...`);
+	await handleRateLimit(response, signal, onRateLimitBackoff);
+}
+function formatFetchErrorMessage(error, url) {
+	if (!(error instanceof Error)) return String(error);
+	const typedError = error;
+	const rawUrl = typeof url === "string" ? url : url.url;
+	const redactUrl = (value) => value.split(rawUrl).join(urlForLog(url));
+	let message = `${typedError.name}: ${redactUrl(typedError.message)}`;
+	if (typedError.cause) message += ` (Cause: ${redactUrl(String(typedError.cause))})`;
+	if (typedError.code) message += ` (Code: ${typedError.code})`;
+	return message;
+}
+async function fetchWithRetries(url, options = {}, timeout, maxRetries, onRateLimitBackoff) {
+	options = preserveCloudAuthRedirects(url, options);
+	const contextMaxRetries = getFetchRetryContextMaxRetries();
+	maxRetries = Math.max(0, maxRetries ?? contextMaxRetries ?? 4);
+	let lastErrorMessage;
+	const backoff = require_logger.getEnvInt("PROMPTFOO_REQUEST_BACKOFF_MS", 5e3);
+	const signal = require_shared.getEffectiveRequestSignal(url, options);
+	const logEnabled = new Headers(getFetchWithProxyHeaders(url, options)).get("x-promptfoo-silent") !== "true";
+	for (let i = 0; i <= maxRetries; i++) {
+		let response;
+		try {
+			response = await fetchWithTimeout(url, {
+				...options,
+				disableTransientRetries: true
+			}, timeout);
+			if (require_logger.getEnvBool("PROMPTFOO_RETRY_5XX") && response.status >= 500 && response.status < 600) throw new Error(`Internal Server Error: ${response.status} ${response.statusText}`);
+			if (response && isRateLimited(response)) {
+				await handleRateLimitedResponse(response, url, i, maxRetries, logEnabled, signal, onRateLimitBackoff);
+				continue;
+			}
+			return response;
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError") throw error;
+			if (error instanceof CloudAuthRedirectError || error instanceof HttpRateLimitError || error instanceof RequestAuthenticationError) throw error;
+			if (signal?.aborted) throw getAbortError(signal);
+			const errorMessage = formatFetchErrorMessage(error, url);
+			if (logEnabled) require_logger.logger.debug(`Request to ${urlForLog(url)} failed (attempt #${i + 1}), retrying: ${errorMessage}`);
+			if (i < maxRetries) await sleepWithAbort(Math.pow(2, i) * (backoff + 1e3 * Math.random()), signal);
+			lastErrorMessage = errorMessage;
+		}
+	}
+	throw new Error(`Request failed after ${maxRetries} retries: ${lastErrorMessage}`);
+}
+//#endregion
+Object.defineProperty(exports, "CLOUD_PROVIDER_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return CLOUD_PROVIDER_PREFIX;
+	}
+});
+Object.defineProperty(exports, "CONSENT_ENDPOINT", {
+	enumerable: true,
+	get: function() {
+		return CONSENT_ENDPOINT;
+	}
+});
+Object.defineProperty(exports, "CloudConfig", {
+	enumerable: true,
+	get: function() {
+		return CloudConfig;
+	}
+});
+Object.defineProperty(exports, "DEFINITIVE_BILLING_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return DEFINITIVE_BILLING_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "EVENTS_ENDPOINT", {
+	enumerable: true,
+	get: function() {
+		return EVENTS_ENDPOINT;
+	}
+});
+Object.defineProperty(exports, "HARD_QUOTA_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return HARD_QUOTA_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "HttpRateLimitError", {
+	enumerable: true,
+	get: function() {
+		return HttpRateLimitError;
+	}
+});
+Object.defineProperty(exports, "NON_TRANSIENT_HTTP_STATUSES", {
+	enumerable: true,
+	get: function() {
+		return NON_TRANSIENT_HTTP_STATUSES;
+	}
+});
+Object.defineProperty(exports, "POSTHOG_KEY", {
+	enumerable: true,
+	get: function() {
+		return POSTHOG_KEY;
+	}
+});
+Object.defineProperty(exports, "PROMPTFOO_TEAM_ID_HEADER", {
+	enumerable: true,
+	get: function() {
+		return PROMPTFOO_TEAM_ID_HEADER;
+	}
+});
+Object.defineProperty(exports, "R_ENDPOINT", {
+	enumerable: true,
+	get: function() {
+		return R_ENDPOINT;
+	}
+});
+Object.defineProperty(exports, "TERMINAL_MAX_WIDTH", {
+	enumerable: true,
+	get: function() {
+		return TERMINAL_MAX_WIDTH;
+	}
+});
+Object.defineProperty(exports, "VERSION", {
+	enumerable: true,
+	get: function() {
+		return VERSION;
+	}
+});
+Object.defineProperty(exports, "cloudConfig", {
+	enumerable: true,
+	get: function() {
+		return cloudConfig;
+	}
+});
+Object.defineProperty(exports, "createDecompressionInterceptor", {
+	enumerable: true,
+	get: function() {
+		return createDecompressionInterceptor;
+	}
+});
+Object.defineProperty(exports, "extractRateLimitErrorCode", {
+	enumerable: true,
+	get: function() {
+		return extractRateLimitErrorCode;
+	}
+});
+Object.defineProperty(exports, "extractRateLimitErrorType", {
+	enumerable: true,
+	get: function() {
+		return extractRateLimitErrorType;
+	}
+});
+Object.defineProperty(exports, "fetchWithProxy", {
+	enumerable: true,
+	get: function() {
+		return fetchWithProxy;
+	}
+});
+Object.defineProperty(exports, "fetchWithRetries", {
+	enumerable: true,
+	get: function() {
+		return fetchWithRetries;
+	}
+});
+Object.defineProperty(exports, "fetchWithTimeout", {
+	enumerable: true,
+	get: function() {
+		return fetchWithTimeout;
+	}
+});
+Object.defineProperty(exports, "fetch_exports", {
+	enumerable: true,
+	get: function() {
+		return fetch_exports;
+	}
+});
+Object.defineProperty(exports, "formatRateLimitErrorMessage", {
+	enumerable: true,
+	get: function() {
+		return formatRateLimitErrorMessage;
+	}
+});
+Object.defineProperty(exports, "getAbortError", {
+	enumerable: true,
+	get: function() {
+		return getAbortError;
+	}
+});
+Object.defineProperty(exports, "getCloudAuthHeaderName", {
+	enumerable: true,
+	get: function() {
+		return getCloudAuthHeaderName;
+	}
+});
+Object.defineProperty(exports, "getCloudBearerToken", {
+	enumerable: true,
+	get: function() {
+		return getCloudBearerToken;
+	}
+});
+Object.defineProperty(exports, "getCloudTaskTeamId", {
+	enumerable: true,
+	get: function() {
+		return getCloudTaskTeamId;
+	}
+});
+Object.defineProperty(exports, "getDefaultShareViewBaseUrl", {
+	enumerable: true,
+	get: function() {
+		return getDefaultShareViewBaseUrl;
+	}
+});
+Object.defineProperty(exports, "getFetchRetryContextMaxRetries", {
+	enumerable: true,
+	get: function() {
+		return getFetchRetryContextMaxRetries;
+	}
+});
+Object.defineProperty(exports, "getFetchWithProxyHeaders", {
+	enumerable: true,
+	get: function() {
+		return getFetchWithProxyHeaders;
+	}
+});
+Object.defineProperty(exports, "getRequestUrlString", {
+	enumerable: true,
+	get: function() {
+		return getRequestUrlString;
+	}
+});
+Object.defineProperty(exports, "getShareApiBaseUrl", {
+	enumerable: true,
+	get: function() {
+		return getShareApiBaseUrl;
+	}
+});
+Object.defineProperty(exports, "getShareViewBaseUrl", {
+	enumerable: true,
+	get: function() {
+		return getShareViewBaseUrl;
+	}
+});
+Object.defineProperty(exports, "isAbortError", {
+	enumerable: true,
+	get: function() {
+		return isAbortError;
+	}
+});
+Object.defineProperty(exports, "isDefinitiveBillingCode", {
+	enumerable: true,
+	get: function() {
+		return isDefinitiveBillingCode;
+	}
+});
+Object.defineProperty(exports, "isHardQuotaCode", {
+	enumerable: true,
+	get: function() {
+		return isHardQuotaCode;
+	}
+});
+Object.defineProperty(exports, "isHttpRateLimitError", {
+	enumerable: true,
+	get: function() {
+		return isHttpRateLimitError;
+	}
+});
+Object.defineProperty(exports, "isNonTransientHttpStatus", {
+	enumerable: true,
+	get: function() {
+		return isNonTransientHttpStatus;
+	}
+});
+Object.defineProperty(exports, "isPromptfooCloudApiHost", {
+	enumerable: true,
+	get: function() {
+		return isPromptfooCloudApiHost;
+	}
+});
+Object.defineProperty(exports, "isTransientConnectionError", {
+	enumerable: true,
+	get: function() {
+		return isTransientConnectionError;
+	}
+});
+Object.defineProperty(exports, "parseRateLimitHeaders", {
+	enumerable: true,
+	get: function() {
+		return parseRateLimitHeaders;
+	}
+});
+Object.defineProperty(exports, "parseRetryAfter", {
+	enumerable: true,
+	get: function() {
+		return parseRetryAfter;
+	}
+});
+Object.defineProperty(exports, "preserveCloudAuthRedirects", {
+	enumerable: true,
+	get: function() {
+		return preserveCloudAuthRedirects;
+	}
+});
+Object.defineProperty(exports, "rateLimitTimingFromHeaders", {
+	enumerable: true,
+	get: function() {
+		return rateLimitTimingFromHeaders;
+	}
+});
+Object.defineProperty(exports, "readBoundedText", {
+	enumerable: true,
+	get: function() {
+		return readBoundedText;
+	}
+});
+Object.defineProperty(exports, "readGlobalConfig", {
+	enumerable: true,
+	get: function() {
+		return readGlobalConfig;
+	}
+});
+Object.defineProperty(exports, "stripDecompressionHeaders", {
+	enumerable: true,
+	get: function() {
+		return stripDecompressionHeaders;
+	}
+});
+Object.defineProperty(exports, "withFetchRetryContext", {
+	enumerable: true,
+	get: function() {
+		return withFetchRetryContext;
+	}
+});
+Object.defineProperty(exports, "writeGlobalConfig", {
+	enumerable: true,
+	get: function() {
+		return writeGlobalConfig;
+	}
+});
+Object.defineProperty(exports, "writeGlobalConfigPartial", {
+	enumerable: true,
+	get: function() {
+		return writeGlobalConfigPartial;
+	}
+});
+
+//# sourceMappingURL=fetch-BKlgUg08.cjs.map