promptfoo 0.125.0 → 0.125.1

package/dist/src/dataUrl-CGsBT7UZ.cjs

@@ -1,3187 +0,0 @@
-const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_logger = require("./logger-DXUHJBHJ.cjs");
-const require_invariant = require("./invariant-C2JOzzO2.cjs");
-const require_fetch = require("./fetch-DYte6oQX.cjs");
-const require_tables = require("./tables-CNr3LyS7.cjs");
-const require_time = require("./time-CY7bOv6D.cjs");
-const require_esm = require("./esm-DITT-qdS.cjs");
-const require_file = require("./file-CPfaem7U.cjs");
-const require_render = require("./render-j-UNQw7s.cjs");
-const require_genaiTracer = require("./genaiTracer-C32xFIB8.cjs");
-const require_createHash = require("./createHash-sm6Q6LWg.cjs");
-require("./blobs-CwaJ7l1g.cjs");
-const require_extractor = require("./extractor-q61MtrkD.cjs");
-const require_packageImportErrors = require("./packageImportErrors-B2JxLURu.cjs");
-const require_tokenUsageUtils = require("./tokenUsageUtils-DMF9uhT9.cjs");
-let fs_promises = require("fs/promises");
-fs_promises = require_rolldown_runtime.__toESM(fs_promises, 1);
-let path = require("path");
-path = require_rolldown_runtime.__toESM(path, 1);
-let fs = require("fs");
-fs = require_rolldown_runtime.__toESM(fs, 1);
-let os = require("os");
-os = require_rolldown_runtime.__toESM(os, 1);
-let js_yaml = require("js-yaml");
-js_yaml = require_rolldown_runtime.__toESM(js_yaml, 1);
-let fast_deep_equal = require("fast-deep-equal");
-fast_deep_equal = require_rolldown_runtime.__toESM(fast_deep_equal, 1);
-let dedent = require("dedent");
-dedent = require_rolldown_runtime.__toESM(dedent, 1);
-let node_util = require("node:util");
-let crypto$1 = require("crypto");
-let drizzle_orm = require("drizzle-orm");
-let fast_xml_parser = require("fast-xml-parser");
-let lru_cache = require("lru-cache");
-let csv_stringify_sync = require("csv-stringify/sync");
-//#region src/providers/constants.ts
-const FILE_METADATA_KEY = "_promptfooFileMetadata";
-/**
-* Identifier for manual user ratings in componentResults.
-* Used to distinguish human ratings from automated assertions.
-*/
-const HUMAN_ASSERTION_TYPE = "human";
-//#endregion
-//#region src/util/providerRef.ts
-const PROVIDER_OPTION_KEYS = /* @__PURE__ */ new Set([
-	"id",
-	"label",
-	"config",
-	"prompts",
-	"transform",
-	"delay",
-	"env",
-	"inputs"
-]);
-/** Returns true if the value is a non-empty string suitable as a provider identifier. */
-function isValidProviderId(id) {
-	return typeof id === "string" && id !== "";
-}
-function getProviderLabel(provider) {
-	if ((typeof provider === "object" || typeof provider === "function") && provider !== null && "label" in provider && typeof provider.label === "string") return provider.label;
-}
-/**
-* Resolves relative file paths in provider IDs to absolute paths for consistent matching.
-* Handles file://, exec:, python:, golang: prefixes and bare .js/.ts/.mjs paths.
-*/
-function canonicalizeProviderId(id) {
-	if (id.startsWith("file://")) {
-		const filePath = id.slice(7);
-		return path.default.isAbsolute(filePath) ? id : `file://${path.default.resolve(filePath)}`;
-	}
-	for (const prefix of [
-		"exec:",
-		"python:",
-		"golang:"
-	]) if (id.startsWith(prefix)) {
-		const filePath = id.slice(prefix.length);
-		if (filePath.includes("/") || filePath.includes("\\")) return `${prefix}${path.default.resolve(filePath)}`;
-		return id;
-	}
-	if ((id.endsWith(".js") || id.endsWith(".ts") || id.endsWith(".mjs")) && (id.includes("/") || id.includes("\\"))) return `file://${path.default.resolve(id)}`;
-	return id;
-}
-/**
-* Returns true for provider refs that should be expanded from YAML/JSON config files.
-*/
-function isProviderConfigFileReference(providerPath) {
-	return providerPath.startsWith("file://") && (providerPath.endsWith(".yaml") || providerPath.endsWith(".yml") || providerPath.endsWith(".json"));
-}
-/**
-* Reads a provider config file and normalizes single-provider and multi-provider files.
-* An explicit base path also scopes nested configuration files; otherwise their
-* caller scope is retained.
-* Returns a `wasArray` flag so callers can detect multi-provider files that require
-* `loadApiProviders` instead of `loadApiProvider`.
-*/
-function readProviderConfigFile(providerPath, basePath) {
-	const relativePath = providerPath.slice(7);
-	const resolvedPath = path.default.isAbsolute(relativePath) ? relativePath : path.default.join(basePath || process.cwd(), relativePath);
-	let rawContent;
-	try {
-		rawContent = require_logger.loadYaml(fs.default.readFileSync(resolvedPath, "utf8"));
-	} catch (err) {
-		throw new Error(`Failed to load provider config ${relativePath}: ${err instanceof Error ? err.message : err}`);
-	}
-	const fileContent = require_file.maybeLoadConfigFromExternalFile(rawContent, void 0, basePath);
-	require_invariant.invariant(fileContent, `Provider config ${relativePath} is undefined`);
-	return {
-		configs: [fileContent].flat(),
-		relativePath,
-		wasArray: Array.isArray(fileContent)
-	};
-}
-/**
-* Loads provider config objects from a file-backed provider reference.
-*/
-function loadProviderConfigsFromFile(providerPath, basePath) {
-	return readProviderConfigFile(providerPath, basePath).configs;
-}
-/**
-* Pure, synchronous classifier that converts every supported provider reference shape
-* into a discriminated descriptor. Does not read files or instantiate providers.
-*/
-function normalizeProviderRef(provider, options = {}) {
-	const { index } = options;
-	if (typeof provider === "string") {
-		if (!isValidProviderId(provider)) return {
-			kind: "unknown",
-			id: index === void 0 ? "unknown" : `unknown-${index}`
-		};
-		if (isProviderConfigFileReference(provider)) return {
-			kind: "file",
-			id: provider,
-			loadProviderPath: provider
-		};
-		return {
-			kind: "named",
-			id: provider,
-			loadProviderPath: provider
-		};
-	}
-	if (typeof provider === "function") {
-		const label = getProviderLabel(provider);
-		return {
-			kind: "function",
-			id: label ?? (index === void 0 ? "custom-function" : `custom-function-${index}`),
-			label
-		};
-	}
-	if (typeof provider === "object" && provider !== null && !Array.isArray(provider)) {
-		const providerId = provider.id;
-		const label = getProviderLabel(provider);
-		if (isValidProviderId(providerId)) return {
-			kind: "options",
-			id: providerId,
-			label,
-			loadOptions: provider,
-			loadProviderPath: providerId
-		};
-		const keys = Object.keys(provider);
-		if (keys.length === 1 && !PROVIDER_OPTION_KEYS.has(keys[0])) {
-			const originalId = keys[0];
-			const providerObject = provider[originalId];
-			if (typeof providerObject === "object" && providerObject !== null && !Array.isArray(providerObject) && isValidProviderId(originalId)) {
-				const id = isValidProviderId(providerObject.id) ? providerObject.id : originalId;
-				return {
-					kind: "map",
-					id,
-					label: getProviderLabel(providerObject),
-					loadOptions: {
-						...providerObject,
-						id
-					},
-					loadProviderPath: originalId
-				};
-			}
-		}
-		if (isValidProviderId(label)) return {
-			kind: "unknown",
-			id: label,
-			label
-		};
-	}
-	return {
-		kind: "unknown",
-		id: index === void 0 ? "unknown" : `unknown-${index}`
-	};
-}
-//#endregion
-//#region src/util/provider.ts
-function providerToIdentifier(provider) {
-	if (!provider) return;
-	if (typeof provider === "string") return canonicalizeProviderId(provider);
-	const { label } = normalizeProviderRef(provider);
-	if (label) return label;
-	if (require_logger.isApiProvider(provider)) return canonicalizeProviderId(provider.id());
-	if (require_logger.isProviderOptions(provider)) {
-		if (provider.id) return canonicalizeProviderId(provider.id);
-		return;
-	}
-	if (typeof provider === "object" && "id" in provider && typeof provider.id === "string") return canonicalizeProviderId(provider.id);
-}
-/**
-* Gets the identifier string for a provider (label or id).
-*/
-function getProviderIdentifier(provider) {
-	return provider.label || provider.id();
-}
-/**
-* Gets a descriptive identifier string for a provider, showing both label and ID when both exist.
-* Useful for error messages to help users debug provider reference issues.
-*/
-function getProviderDescription(provider) {
-	const label = provider.label;
-	const id = provider.id();
-	if (label && label !== id) return `${label} (${id})`;
-	return id;
-}
-function sanitizeProviderIdForLog(providerId) {
-	const descriptionMatch = providerId.match(/^(\S+)(\s+\(.+\))$/);
-	if (descriptionMatch) {
-		const [, id, description] = descriptionMatch;
-		return `${sanitizeProviderIdForLog(id)}${description}`;
-	}
-	return providerId.includes("://") || providerId.startsWith("/") ? require_logger.sanitizeUrl(providerId) : providerId;
-}
-/**
-* Checks if a provider reference matches a given provider.
-* Supports exact matching and wildcard patterns.
-*/
-function doesProviderRefMatch(ref, provider) {
-	const label = provider.label;
-	const id = provider.id();
-	const canonicalRef = canonicalizeProviderId(ref);
-	const canonicalId = canonicalizeProviderId(id);
-	if (label && label === ref) return true;
-	if (id === ref || canonicalId === canonicalRef) return true;
-	if (ref.endsWith("*")) {
-		const prefix = ref.slice(0, -1);
-		if (label?.startsWith(prefix) || id.startsWith(prefix) || canonicalId.startsWith(prefix)) return true;
-	}
-	if (label?.startsWith(`${ref}:`) || id.startsWith(`${ref}:`) || canonicalId.startsWith(`${ref}:`)) return true;
-	return false;
-}
-/**
-* Checks if a provider is allowed based on a list of allowed references.
-*/
-function isProviderAllowed(provider, allowedProviders) {
-	if (!Array.isArray(allowedProviders)) return true;
-	if (allowedProviders.length === 0) return false;
-	return allowedProviders.some((ref) => doesProviderRefMatch(ref, provider));
-}
-/**
-* Detects if a provider uses OpenAI models.
-* This includes direct OpenAI providers and Azure OpenAI.
-*/
-function isOpenAiProvider(providerId) {
-	const lowerProviderId = providerId.toLowerCase();
-	if (lowerProviderId.startsWith("openai:")) return true;
-	if (lowerProviderId.startsWith("azureopenai:")) return true;
-	if (lowerProviderId.startsWith("azure:")) {
-		if ([
-			"gpt",
-			"openai",
-			"davinci",
-			"curie",
-			"babbage",
-			"ada",
-			"text-embedding",
-			"whisper",
-			"dall-e",
-			"tts"
-		].some((indicator) => lowerProviderId.includes(indicator))) return true;
-	}
-	return false;
-}
-/**
-* Detects if a provider uses Anthropic/Claude models.
-* This includes direct Anthropic providers, Bedrock with Claude, and Vertex with Claude.
-*/
-function isAnthropicProvider(providerId) {
-	const lowerProviderId = providerId.toLowerCase();
-	if (lowerProviderId.startsWith("anthropic:")) return true;
-	if (lowerProviderId.startsWith("bedrock:")) {
-		if (lowerProviderId.includes("claude") || lowerProviderId.includes("anthropic")) return true;
-	}
-	if (lowerProviderId.startsWith("vertex:")) {
-		if (lowerProviderId.includes("claude")) return true;
-	}
-	return false;
-}
-const KNOWN_ENV_VARS = {
-	openai: "OPENAI_API_KEY",
-	anthropic: "ANTHROPIC_API_KEY",
-	google: "GOOGLE_API_KEY",
-	mistral: "MISTRAL_API_KEY",
-	cohere: "COHERE_API_KEY",
-	replicate: "REPLICATE_API_TOKEN",
-	voyage: "VOYAGE_API_KEY",
-	ai21: "AI21_API_KEY",
-	xai: "XAI_API_KEY",
-	groq: "GROQ_API_KEY",
-	deepseek: "DEEPSEEK_API_KEY",
-	meta: "MODEL_API_KEY",
-	moonshot: "MOONSHOT_API_KEY",
-	perplexity: "PERPLEXITY_API_KEY",
-	hyperbolic: "HYPERBOLIC_API_KEY",
-	cerebras: "CEREBRAS_API_KEY",
-	togetherai: "TOGETHER_API_KEY",
-	fal: "FAL_KEY",
-	huggingface: "HF_TOKEN",
-	"cloudflare-ai": "CLOUDFLARE_API_KEY"
-};
-function getDefaultEnvVar(providerId) {
-	const prefix = providerId.split(":")[0];
-	return KNOWN_ENV_VARS[prefix] || `${prefix.toUpperCase()}_API_KEY`;
-}
-/**
-* Pre-checks providers for missing API keys before evaluation starts.
-* Assumes getApiKey() is side-effect free (no network calls or token refresh).
-* Returns stable provider IDs by default; descriptions are for user-facing diagnostics only.
-*/
-function checkProviderApiKeys(providers, options = {}) {
-	const missingApiKeys = /* @__PURE__ */ new Map();
-	for (const provider of providers) {
-		const p = provider;
-		if (typeof p.getApiKey !== "function") continue;
-		if (provider.id().startsWith("azure:")) continue;
-		const requiresKey = typeof p.requiresApiKey === "function" ? p.requiresApiKey() : p.config?.apiKeyRequired !== false;
-		let apiKey;
-		try {
-			apiKey = p.getApiKey();
-		} catch {
-			apiKey = void 0;
-		}
-		if (requiresKey && !apiKey) {
-			const envVar = p.config?.apiKeyEnvar || getDefaultEnvVar(provider.id());
-			const providerIdentifier = options.useDescriptions ? getProviderDescription(provider) : provider.id();
-			if (!missingApiKeys.has(envVar)) missingApiKeys.set(envVar, []);
-			missingApiKeys.get(envVar).push(providerIdentifier);
-		}
-	}
-	return missingApiKeys;
-}
-/**
-* Detects if a provider uses Google models.
-* This includes direct Google/Vertex providers with Gemini and other Google models.
-* Note: Vertex with Claude models is NOT counted as Google (it's Anthropic).
-*/
-function isGoogleProvider(providerId) {
-	const lowerProviderId = providerId.toLowerCase();
-	if (lowerProviderId.startsWith("google:")) return true;
-	if (lowerProviderId.startsWith("vertex:")) {
-		if (!lowerProviderId.includes("claude")) return true;
-	}
-	return false;
-}
-//#endregion
-//#region src/util/comparison.ts
-/**
-* Explicit runtime variable names that don't follow the underscore convention.
-* These are added during evaluation but aren't part of the original test definition.
-*
-* - sessionId: Added by multi-turn strategy providers (GOAT, Crescendo)
-*
-* Note: Variables starting with underscore (e.g., _conversation) are automatically
-* treated as runtime variables and filtered out.
-*/
-const EXPLICIT_RUNTIME_VAR_KEYS = ["sessionId"];
-/**
-* Checks if a variable key is a runtime-only variable that should be filtered
-* when comparing test cases.
-*
-* Runtime variables are identified by:
-* 1. Starting with underscore (_) - convention for internal/runtime vars
-* 2. Being in the explicit runtime var list (for legacy vars like sessionId)
-*/
-function isRuntimeVar(key) {
-	return key.startsWith("_") || EXPLICIT_RUNTIME_VAR_KEYS.includes(key);
-}
-/**
-* Filters out runtime-only variables that are added during evaluation
-* but aren't part of the original test definition.
-*
-* This is used when comparing test cases to determine if a result
-* corresponds to a particular test, regardless of runtime state.
-*
-* Runtime variables are identified by:
-* - Starting with underscore (e.g., _conversation, _metadata)
-* - Being in the explicit list (e.g., sessionId for backward compatibility)
-*/
-function filterRuntimeVars(vars) {
-	if (!vars || typeof vars !== "object" || Array.isArray(vars)) return vars;
-	const filtered = {};
-	for (const [key, value] of Object.entries(vars)) if (!isRuntimeVar(key)) filtered[key] = value;
-	return filtered;
-}
-/**
-* Extracts only runtime variables from a vars object.
-* This is the inverse of filterRuntimeVars.
-*
-* Used to restore runtime state when re-running filtered tests.
-*/
-function extractRuntimeVars(vars) {
-	if (!vars || typeof vars !== "object" || Array.isArray(vars)) return;
-	const extracted = {};
-	for (const [key, value] of Object.entries(vars)) if (isRuntimeVar(key)) extracted[key] = value;
-	return Object.keys(extracted).length > 0 ? extracted : void 0;
-}
-function varsMatch(vars1, vars2) {
-	return (0, fast_deep_equal.default)(vars1, vars2);
-}
-/**
-* Generate a unique key for a test case for deduplication purposes.
-* Excludes runtime variables and includes strategyId to distinguish tests
-* with the same prompt but different strategies.
-*
-* @param testCase - The test case to generate a key for
-* @returns A JSON string that uniquely identifies the test case
-*/
-function getTestCaseDeduplicationKey(testCase) {
-	const filteredVars = filterRuntimeVars(testCase.vars);
-	const strategyId = testCase.metadata?.strategyId || "none";
-	return JSON.stringify({
-		vars: filteredVars,
-		strategyId
-	});
-}
-/**
-* Deduplicates an array of test cases based on their vars and strategyId.
-* Tests with the same vars but different strategies are considered different.
-* Runtime variables (like _conversation, sessionId) are filtered out before comparison.
-*
-* @param tests - Array of test cases to deduplicate
-* @returns Deduplicated array of test cases
-*/
-function deduplicateTestCases(tests) {
-	const seen = /* @__PURE__ */ new Set();
-	return tests.filter((test) => {
-		const key = getTestCaseDeduplicationKey(test);
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	});
-}
-function resultIsForTestCase(result, testCase) {
-	const testProviderId = testCase.provider ? providerToIdentifier(testCase.provider) : void 0;
-	const resultProviderId = providerToIdentifier(result.provider);
-	const providersMatch = !testProviderId || !resultProviderId || testProviderId === resultProviderId;
-	const resultVars = filterRuntimeVars(result.vars);
-	const testVars = filterRuntimeVars(testCase.vars);
-	const doVarsMatch = varsMatch(testVars, resultVars);
-	const isMatch = doVarsMatch && providersMatch;
-	if (!isMatch) {
-		const varKeys = testVars ? Object.keys(testVars).join(", ") : "none";
-		require_logger.logger.debug(`[resultIsForTestCase] No match: vars=${doVarsMatch}, providers=${providersMatch}`, {
-			testProvider: testProviderId || "none",
-			resultProvider: resultProviderId || "none",
-			testVarKeys: varKeys
-		});
-	}
-	return isMatch;
-}
-//#endregion
-//#region src/util/env.ts
-/**
-* Load environment variables from .env file(s).
-* @param envPath - Single path, array of paths, or undefined for default .env loading.
-*                  When paths are explicitly specified, all files must exist or an error is thrown.
-*                  When multiple files are provided, later files override values from earlier files.
-*/
-function setupEnv(envPath, options = {}) {
-	const paths = (Array.isArray(envPath) ? envPath : [envPath ?? ""]).flatMap((p) => p.split(",").map((s) => s.trim())).filter(Boolean);
-	if (paths.length > 0) {
-		for (const p of paths) if (!fs.existsSync(p)) throw new Error(`Environment file not found: ${p}`);
-		if (paths.length === 1) require_logger.logger.info(`Loading environment variables from ${paths[0]}`);
-		else require_logger.logger.info(`Loading environment variables from: ${paths.join(", ")}`);
-	}
-	const previousEnv = { ...options.processEnv };
-	require_logger.loadEnvFiles(paths.length > 0 ? paths : void 0, {
-		...paths.length > 0 && { override: true },
-		...options.processEnv && { processEnv: options.processEnv }
-	});
-	if (options.processEnv && paths.length === 0) {
-		for (const key of Object.keys(options.processEnv)) if (!Object.prototype.hasOwnProperty.call(previousEnv, key) && process.env[key] !== void 0) delete options.processEnv[key];
-	}
-	if (options.refreshConfigDirectory) require_logger.refreshConfigDirectoryPathFromEnv();
-}
-//#endregion
-//#region src/googleSheets.ts
-var GoogleSheetAuthenticationRequiredError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "GoogleSheetAuthenticationRequiredError";
-	}
-};
-async function loadGoogleSheetsApi() {
-	try {
-		return await import("@googleapis/sheets");
-	} catch (error) {
-		if (require_packageImportErrors.isMissingPackageImportError(error, "@googleapis/sheets")) throw new Error("The @googleapis/sheets package is required for authenticated Google Sheets access. Install it with: npm install @googleapis/sheets");
-		throw error;
-	}
-}
-async function checkGoogleSheetAccess(url) {
-	try {
-		const response = await require_fetch.fetchWithProxy(url);
-		if (response.ok) return {
-			public: true,
-			status: response.status
-		};
-		else return {
-			public: false,
-			status: response.status
-		};
-	} catch (error) {
-		require_logger.logger.error(`Error checking sheet access: ${error}`);
-		return { public: false };
-	}
-}
-function isHtmlExportResponse(response, body) {
-	const contentType = response.headers?.get("content-type")?.toLowerCase() ?? "";
-	if (contentType.includes("text/html")) return true;
-	if (contentType.includes("text/csv") || contentType.includes("application/csv")) return false;
-	const prefix = body.trimStart().slice(0, 32).toLowerCase();
-	return prefix.startsWith("<!doctype html") || prefix.startsWith("<html");
-}
-/**
-* Returns the sheet id (`gid`) a Google Sheets URL selects. The browser keeps it in the fragment
-* (`/edit#gid=123`); newer URLs also repeat it in the query (`/edit?gid=123#gid=123`). It stays a
-* string so that sheet id 0 is still truthy.
-*/
-function getSheetGid(url) {
-	const { searchParams, hash } = new URL(url);
-	return searchParams.get("gid") || new URLSearchParams(hash.slice(1)).get("gid") || void 0;
-}
-async function fetchCsvFromGoogleSheetUnauthenticated(url) {
-	const { parse: parseCsv } = await import("csv-parse/sync");
-	const gid = getSheetGid(url);
-	const csvUrl = `${url.replace(/\/edit.*$/, "/export")}?format=csv${gid ? `&gid=${gid}` : ""}`;
-	const response = await require_fetch.fetchWithProxy(csvUrl);
-	if (response.status !== 200) throw new Error(`Failed to fetch CSV from Google Sheets URL: ${url}`);
-	const csvData = await response.text();
-	if (isHtmlExportResponse(response, csvData)) throw new GoogleSheetAuthenticationRequiredError(`Failed to fetch CSV from Google Sheets URL: ${url}`);
-	return parseCsv(csvData, { columns: true });
-}
-async function fetchCsvFromGoogleSheetAuthenticated(url) {
-	const { sheets: googleSheets, auth: googleAuth } = await loadGoogleSheetsApi();
-	const auth = new googleAuth.GoogleAuth({ scopes: ["https://www.googleapis.com/auth/spreadsheets.readonly"] });
-	const sheets = googleSheets("v4");
-	const match = url.match(/\/d\/([^/]+)/);
-	if (!match) throw new Error(`Invalid Google Sheets URL: ${url}`);
-	const spreadsheetId = match[1];
-	let range;
-	const gid = getSheetGid(url);
-	if (gid) {
-		const sheet = (await sheets.spreadsheets.get({
-			spreadsheetId,
-			auth
-		})).data.sheets?.find((sheet) => sheet.properties?.sheetId === Number(gid));
-		if (!sheet || !sheet.properties?.title) throw new Error(`Sheet not found for gid: ${gid}`);
-		range = sheet.properties.title;
-	} else {
-		const firstSheet = (await sheets.spreadsheets.get({
-			spreadsheetId,
-			auth
-		})).data.sheets?.[0];
-		if (!firstSheet || !firstSheet.properties?.title) throw new Error(`No sheets found in spreadsheet`);
-		range = firstSheet.properties.title;
-	}
-	const rows = (await sheets.spreadsheets.values.get({
-		spreadsheetId,
-		range,
-		auth
-	})).data.values;
-	if (!rows?.length) throw new Error(`No data found in Google Sheets URL: ${url}`);
-	const headers = rows[0];
-	return rows.slice(1).map((row) => {
-		const csvRow = {};
-		headers.forEach((header, index) => {
-			csvRow[header] = row[index] ?? "";
-		});
-		return csvRow;
-	});
-}
-async function fetchCsvFromGoogleSheet(url) {
-	const access = await checkGoogleSheetAccess(url);
-	const { public: isPublic } = access;
-	require_logger.logger.debug(`Google Sheets URL: ${url}, isPublic: ${isPublic}`);
-	if (isPublic) try {
-		return await fetchCsvFromGoogleSheetUnauthenticated(url);
-	} catch (error) {
-		if (error instanceof GoogleSheetAuthenticationRequiredError) return fetchCsvFromGoogleSheetAuthenticated(url);
-		throw error;
-	}
-	if (!("status" in access)) try {
-		return await fetchCsvFromGoogleSheetUnauthenticated(url);
-	} catch {
-		return fetchCsvFromGoogleSheetAuthenticated(url);
-	}
-	return fetchCsvFromGoogleSheetAuthenticated(url);
-}
-async function writeCsvToGoogleSheet(rows, url) {
-	const { sheets: googleSheets, auth: googleAuth } = await loadGoogleSheetsApi();
-	const auth = new googleAuth.GoogleAuth({ scopes: ["https://www.googleapis.com/auth/spreadsheets"] });
-	const sheets = googleSheets("v4");
-	const match = url.match(/\/d\/([^/]+)/);
-	if (!match) throw new Error(`Invalid Google Sheets URL: ${url}`);
-	const spreadsheetId = match[1];
-	const headers = Object.keys(rows[0]);
-	const values = [headers, ...rows.map((row) => headers.map((header) => row[header]))];
-	const getColumnLetter = (col) => {
-		let letter = "";
-		while (col > 0) {
-			col--;
-			letter = String.fromCharCode(65 + col % 26) + letter;
-			col = Math.floor(col / 26);
-		}
-		return letter;
-	};
-	const numRows = values.length;
-	const numCols = headers.length;
-	const endColumn = getColumnLetter(numCols);
-	let range;
-	const gid = getSheetGid(url);
-	if (gid) {
-		const sheet = (await sheets.spreadsheets.get({
-			spreadsheetId,
-			auth
-		})).data.sheets?.find((sheet) => sheet.properties?.sheetId === Number(gid));
-		if (!sheet || !sheet.properties?.title) throw new Error(`Sheet not found for gid: ${gid}`);
-		range = `${sheet.properties.title}!A1:${endColumn}${numRows}`;
-	} else {
-		const newSheetTitle = `Sheet${Date.now()}`;
-		await sheets.spreadsheets.batchUpdate({
-			spreadsheetId,
-			auth,
-			requestBody: { requests: [{ addSheet: { properties: { title: newSheetTitle } } }] }
-		});
-		range = `${newSheetTitle}!A1:${endColumn}${numRows}`;
-	}
-	require_logger.logger.debug(`Writing CSV to Google Sheets URL: ${url} with ${values.length} rows`);
-	await sheets.spreadsheets.values.update({
-		spreadsheetId,
-		range,
-		valueInputOption: "USER_ENTERED",
-		auth,
-		requestBody: { values }
-	});
-}
-//#endregion
-//#region src/models/prompt.ts
-/**
-* Generates a unique identifier for a prompt based on its properties.
-*
-* Priority order:
-* 1. If label is truthy, hash the label
-* 2. If id is truthy, hash the id
-* 3. Otherwise, hash the raw content (stringified if object)
-*
-* @param prompt - The prompt object to generate an ID for
-* @returns A SHA-256 hash string
-*/
-function generateIdFromPrompt(prompt) {
-	if (prompt.label) return require_createHash.sha256(prompt.label);
-	if (prompt.id) return require_createHash.sha256(prompt.id);
-	return require_createHash.sha256(typeof prompt.raw === "object" ? JSON.stringify(prompt.raw) : prompt.raw);
-}
-//#endregion
-//#region src/prompts/constants.ts
-const VALID_FILE_EXTENSIONS = [
-	".cjs",
-	".cts",
-	".j2",
-	".js",
-	".json",
-	".jsonl",
-	".md",
-	".mjs",
-	".mts",
-	".py",
-	".ts",
-	".txt",
-	".yml",
-	".yaml"
-];
-//#endregion
-//#region src/prompts/utils.ts
-/**
-* Determines if a string is a valid file path.
-* @param str - The string to check.
-* @returns True if the string is a valid file path, false otherwise.
-*/
-function maybeFilePath(str) {
-	if (typeof str !== "string") throw new Error(`Invalid input: ${JSON.stringify(str)}`);
-	if ([
-		"\n",
-		"portkey://",
-		"langfuse://",
-		"helicone://"
-	].some((substring) => str.includes(substring))) return false;
-	return str.startsWith("file://") || VALID_FILE_EXTENSIONS.some((ext) => {
-		const tokens = str.split(":");
-		const pathOrFunctionToken = tokens[tokens.length - 1];
-		const pathToken = tokens[tokens.length - 2];
-		return pathOrFunctionToken?.endsWith(ext) || pathToken?.endsWith(ext);
-	}) || str.charAt(str.length - 3) === "." || str.charAt(str.length - 4) === "." || str.includes("*") || str.includes("/") || str.includes("\\");
-}
-/**
-* Normalizes the input prompt to an array of prompts, rejecting invalid and empty inputs.
-* @param promptPathOrGlobs - The input prompt.
-* @returns The normalized prompts.
-* @throws If the input is invalid or empty.
-*/
-function normalizeInput(promptPathOrGlobs) {
-	if (!promptPathOrGlobs || (typeof promptPathOrGlobs === "string" || Array.isArray(promptPathOrGlobs)) && promptPathOrGlobs.length === 0) throw new Error(`Invalid input prompt: ${JSON.stringify(promptPathOrGlobs)}`);
-	if (typeof promptPathOrGlobs === "string") return [{ raw: promptPathOrGlobs }];
-	if (Array.isArray(promptPathOrGlobs)) return promptPathOrGlobs.map((promptPathOrGlob, _index) => {
-		if (typeof promptPathOrGlob === "string") return { raw: promptPathOrGlob };
-		return {
-			raw: promptPathOrGlob.raw || promptPathOrGlob.id,
-			...promptPathOrGlob
-		};
-	});
-	if (typeof promptPathOrGlobs === "object" && Object.keys(promptPathOrGlobs).length) return Object.entries(promptPathOrGlobs).map(([raw, key]) => ({
-		label: key,
-		raw
-	}));
-	throw new Error(`Invalid input prompt: ${JSON.stringify(promptPathOrGlobs)}`);
-}
-/**
-* Generates a hash identifier for a prompt.
-* This is an alias for generateIdFromPrompt for backward compatibility.
-*
-* @param prompt - The prompt to hash
-* @returns A SHA-256 hash string
-*/
-function hashPrompt(prompt) {
-	return generateIdFromPrompt(prompt);
-}
-//#endregion
-//#region src/database/signal.ts
-const SIGNAL_WATCHER_DEBOUNCE_MS = 250;
-/**
-* The legacy `evalId:timestamp` text format can't be told apart from a stray short token, so
-* {@link readLegacySignalEvalId} only recovers eval ids at least this long. Generated ids
-* (`eval-<rand>-<iso>`) always clear it; a short caller-provided id (e.g. an imported `demo`) is
-* written as JSON instead, which stores the id explicitly and survives the round trip.
-*/
-const MIN_LEGACY_EVAL_ID_LENGTH = 9;
-/** Whether {@link readLegacySignalEvalId} can recover this id from the legacy text format. */
-function isLegacyRecoverableEvalId(evalId) {
-	return evalId.length >= MIN_LEGACY_EVAL_ID_LENGTH;
-}
-/** Returns the string entries of an unknown value, or undefined if it is not an array. */
-function toStringEvalIds(value) {
-	return Array.isArray(value) ? value.filter((evalId) => typeof evalId === "string") : void 0;
-}
-function writeSignalFile(content) {
-	const filePath = require_tables.getDbSignalPath();
-	try {
-		fs.default.writeFileSync(filePath, content);
-	} catch (err) {
-		require_logger.logger.warn(`Failed to write database signal file: ${err}`);
-	}
-}
-/**
-* Updates the signal file with the current timestamp and optional eval ID.
-* This is used to notify clients that there are new data available.
-*
-* If another signal is still pending in the watcher's debounce window, this folds it into a
-* combined JSON payload so no refresh is lost — scoped updates, a pending unscoped "refresh
-* latest", and pending deletes all survive coalescing. When nothing is pending it keeps the
-* compact legacy `evalId:timestamp` text.
-* This read-modify-write is best-effort within a single process; concurrent writes from separate
-* processes can still race the unlocked file, in which case a dropped signal self-heals on the
-* next one.
-* @param evalId - Optional eval ID that triggered the update
-*/
-function updateSignalFile(evalId) {
-	const now = Date.now();
-	const nowIso = new Date(now).toISOString();
-	const pending = readPendingSignal(now);
-	const pendingUpdateIds = pending ? updateEvalIds(pending) : [];
-	const pendingHasDelete = pending ? hasDeleteComponent(pending) : false;
-	const pendingHasUnscopedUpdate = pending ? hasUnscopedUpdate(pending) : false;
-	const updatedEvalIds = [.../* @__PURE__ */ new Set([...pendingUpdateIds, ...evalId ? [evalId] : []])];
-	const refreshLatest = evalId === void 0 || pendingHasUnscopedUpdate;
-	const needsCoalesce = pendingHasDelete || pendingUpdateIds.some((id) => id !== evalId) || refreshLatest && updatedEvalIds.length > 0;
-	const evalIdNeedsJson = evalId !== void 0 && !isLegacyRecoverableEvalId(evalId);
-	if (needsCoalesce || evalIdNeedsJson) {
-		writeSignalFile(JSON.stringify({
-			type: "update",
-			evalId,
-			updatedEvalIds: updatedEvalIds.length > 0 ? updatedEvalIds : void 0,
-			deletedEvalIds: pendingHasDelete ? pending?.deletedEvalIds ?? [] : void 0,
-			refreshLatest: refreshLatest ? true : void 0,
-			timestamp: nowIso
-		}));
-		return;
-	}
-	writeSignalFile(evalId ? `${evalId}:${nowIso}` : nowIso);
-}
-/** True when the signal carries an update component (a scoped or unscoped eval refresh). */
-function hasUpdateComponent(signal) {
-	return signal.type === "update" || signal.evalId !== void 0 || (signal.updatedEvalIds?.length ?? 0) > 0 || signal.refreshLatest === true;
-}
-/**
-* True when the signal asks to refresh the latest eval (an unscoped update component): the
-* `refreshLatest` marker, or a bare update with no scoped ids (e.g. a legacy bare timestamp). The
-* watcher emits {@link Eval.latest} for these, so a root `/eval` view follows new evals even when a
-* coalesced signal also carries scoped updates or a delete.
-*/
-function hasUnscopedUpdate(signal) {
-	return signal.refreshLatest === true || hasUpdateComponent(signal) && updateEvalIds(signal).length === 0;
-}
-/** True when the signal carries a delete component (specific ids or "all evals deleted"). */
-function hasDeleteComponent(signal) {
-	return signal.type === "delete" || signal.deletedEvalIds !== void 0;
-}
-/**
-* True when a delete component means "all evals were deleted" rather than a specific id list.
-* "All" is encoded as `undefined` by direct delete callers and as `[]` when a pending delete-all
-* is folded into a JSON update, so both count. Only meaningful for a signal that actually carries
-* a delete component (see {@link hasDeleteComponent}); an update-only signal has no ids either.
-*/
-function isAllEvalsDeleted(deletedEvalIds) {
-	return deletedEvalIds === void 0 || deletedEvalIds.length === 0;
-}
-/**
-* The distinct scoped eval ids an update signal refreshes, newest last. Empty for an unscoped
-* update (which means "refresh to the latest eval"). Prefers the accumulated `updatedEvalIds`
-* set and falls back to the single `evalId` for legacy/simple signals.
-*/
-function updateEvalIds(signal) {
-	if (signal.updatedEvalIds && signal.updatedEvalIds.length > 0) return signal.updatedEvalIds;
-	return signal.evalId ? [signal.evalId] : [];
-}
-/**
-* Parses signal-file content as a combined JSON payload, returning the classified signal and
-* its timestamp (used for the debounce-window check), or null if it is not a JSON signal.
-*/
-function parseSignalJson(content) {
-	try {
-		const parsed = JSON.parse(content);
-		if (parsed !== null && typeof parsed === "object" && "type" in parsed && (parsed.type === "delete" || parsed.type === "update")) {
-			const evalId = "evalId" in parsed && typeof parsed.evalId === "string" ? parsed.evalId : void 0;
-			const updatedEvalIds = "updatedEvalIds" in parsed ? toStringEvalIds(parsed.updatedEvalIds) : void 0;
-			const deletedEvalIds = "deletedEvalIds" in parsed ? toStringEvalIds(parsed.deletedEvalIds) : void 0;
-			const timestamp = "timestamp" in parsed && typeof parsed.timestamp === "string" ? parsed.timestamp : void 0;
-			const refreshLatest = "refreshLatest" in parsed && parsed.refreshLatest === true ? true : void 0;
-			return {
-				signal: {
-					type: parsed.type,
-					evalId,
-					updatedEvalIds,
-					deletedEvalIds,
-					refreshLatest
-				},
-				timestamp
-			};
-		}
-	} catch {}
-	return null;
-}
-/**
-* Reads the signal file only if it was written within the watcher's debounce window, so a
-* writer can fold a not-yet-observed signal into its own write instead of clobbering it.
-* Returns null when the file is stale (outside the window), unreadable, or unparseable.
-*/
-function readPendingSignal(now) {
-	const withinWindow = (timestamp) => {
-		if (timestamp === void 0) return false;
-		const elapsed = now - Date.parse(timestamp);
-		return Number.isFinite(elapsed) && elapsed >= 0 && elapsed <= SIGNAL_WATCHER_DEBOUNCE_MS;
-	};
-	try {
-		const content = fs.default.readFileSync(require_tables.getDbSignalPath(), "utf8").trim();
-		const json = parseSignalJson(content);
-		if (json) return withinWindow(json.timestamp) ? json.signal : null;
-		const legacyTimestamp = content.match(/(\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)$/)?.[1];
-		if (!withinWindow(legacyTimestamp)) return null;
-		return {
-			type: "update",
-			evalId: readLegacySignalEvalId(content)
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* Signals that one or more evals were deleted. Deletions use a JSON payload so the watcher can
-* tell clients exactly which evals to drop (whereas a plain update keeps the legacy
-* `evalId:timestamp` text format unless it has to fold in a pending delete). A delete in the
-* debounce window also carries forward a pending update — scoped ids or an unscoped "refresh
-* latest" — so neither refresh is lost (same-process best-effort, like {@link updateSignalFile};
-* cross-process writes can still race).
-* Pre-PR view servers don't understand this JSON and read it back as "no eval id", falling back
-* to broadcasting the latest eval — a benign degradation, so the view server and CLI should be
-* on matching versions for delete-aware refreshes.
-*/
-function updateSignalFileForDeletedEvals(deletedEvalIds) {
-	const now = Date.now();
-	const pending = readPendingSignal(now);
-	const pendingDelete = pending && hasDeleteComponent(pending) ? pending : null;
-	const mergedDeletedEvalIds = pendingDelete ? isAllEvalsDeleted(pendingDelete.deletedEvalIds) || isAllEvalsDeleted(deletedEvalIds) ? void 0 : [.../* @__PURE__ */ new Set([...pendingDelete.deletedEvalIds ?? [], ...deletedEvalIds ?? []])] : deletedEvalIds;
-	const carriedUpdateIds = pending && hasUpdateComponent(pending) ? updateEvalIds(pending) : [];
-	const carriedRefreshLatest = pending ? hasUnscopedUpdate(pending) : false;
-	writeSignalFile(JSON.stringify({
-		type: "delete",
-		deletedEvalIds: mergedDeletedEvalIds,
-		evalId: carriedUpdateIds[carriedUpdateIds.length - 1],
-		updatedEvalIds: carriedUpdateIds.length > 0 ? carriedUpdateIds : void 0,
-		refreshLatest: carriedRefreshLatest ? true : void 0,
-		timestamp: new Date(now).toISOString()
-	}));
-}
-function readLegacySignalEvalId(content) {
-	if (/^\d{4}-\d{2}-\d{2}T/.test(content)) return;
-	const evalId = content.match(/^(.*):\d{4}-\d{2}-\d{2}T/)?.[1];
-	return evalId && isLegacyRecoverableEvalId(evalId) ? evalId : void 0;
-}
-//#endregion
-//#region src/util/standaloneEvalCache.ts
-const standaloneEvalCache = new lru_cache.LRUCache({
-	ttl: 72e5,
-	max: 2e3
-});
-function clearStandaloneEvalCache() {
-	standaloneEvalCache.clear();
-}
-//#endregion
-//#region src/models/evalPerformance.ts
-const countCache = /* @__PURE__ */ new Map();
-const CACHE_TTL = 3e5;
-async function getResultCount(evalId, distinct) {
-	const cacheKey = `${distinct ? "distinct" : "total"}:${evalId}`;
-	const cached = countCache.get(cacheKey);
-	if (cached && Date.now() - cached.timestamp < CACHE_TTL) {
-		require_logger.logger.debug(`Using cached ${distinct ? "distinct count" : "total row count"} for eval ${evalId}: ${cached.count}`);
-		return cached.count;
-	}
-	const db = await require_tables.getDb();
-	const start = Date.now();
-	const result = await db.select({ count: distinct ? drizzle_orm.sql`COUNT(DISTINCT test_idx)` : drizzle_orm.sql`COUNT(*)` }).from(require_tables.evalResultsTable).where(drizzle_orm.sql`eval_id = ${evalId}`).all();
-	const count = Number(result[0]?.count ?? 0);
-	const duration = Date.now() - start;
-	require_logger.logger.debug(`${distinct ? "Distinct count" : "Total row count"} query for eval ${evalId}: ${count} in ${duration}ms`);
-	countCache.set(cacheKey, {
-		count,
-		timestamp: Date.now()
-	});
-	return count;
-}
-/**
-* Get the count of distinct test indices for an eval.
-* This represents the number of unique test cases (rows in the UI table).
-*
-* Use getTotalResultRowCount() if you need the total number of result rows
-* (which may be higher when there are multiple prompts/providers per test case).
-*/
-function getCachedResultsCount(evalId) {
-	return getResultCount(evalId, true);
-}
-/**
-* Get the total count of all result rows for an eval.
-* This counts every result row in the database, including multiple results
-* per test case (e.g., when using multiple prompts or providers).
-*
-* Use this for progress tracking when iterating over all results (e.g., sharing).
-*/
-function getTotalResultRowCount(evalId) {
-	return getResultCount(evalId, false);
-}
-function clearCountCache(evalId) {
-	if (evalId) {
-		countCache.delete(`distinct:${evalId}`);
-		countCache.delete(`total:${evalId}`);
-	} else countCache.clear();
-}
-async function queryTestIndicesOptimized(evalId, opts) {
-	const db = await require_tables.getDb();
-	const offset = opts.offset ?? 0;
-	const limit = opts.limit ?? 50;
-	const mode = opts.filterMode ?? "all";
-	let baseQuery = drizzle_orm.sql`eval_id = ${evalId}`;
-	if (mode === "errors") baseQuery = drizzle_orm.sql`${baseQuery} AND failure_reason = ${2}`;
-	else if (mode === "failures") baseQuery = drizzle_orm.sql`${baseQuery} AND success = 0 AND failure_reason != ${2}`;
-	else if (mode === "passes") baseQuery = drizzle_orm.sql`${baseQuery} AND success = 1`;
-	else if (mode === "highlights") baseQuery = drizzle_orm.sql`${baseQuery} AND json_extract(grading_result, '$.comment') LIKE '!highlight%'`;
-	else if (mode === "user-rated") baseQuery = drizzle_orm.sql`${baseQuery} AND EXISTS (
-      SELECT 1
-      FROM json_each(grading_result, '$.componentResults')
-      WHERE json_extract(value, '$.assertion.type') = ${HUMAN_ASSERTION_TYPE}
-    )`;
-	let searchCondition = drizzle_orm.sql`1=1`;
-	if (opts.searchQuery && opts.searchQuery.trim() !== "" && !opts.filters?.length) searchCondition = drizzle_orm.sql`response LIKE ${`%${opts.searchQuery}%`}`;
-	const whereClause = drizzle_orm.sql`${baseQuery} AND ${searchCondition}`;
-	const countStart = Date.now();
-	const countQuery = drizzle_orm.sql`
-    SELECT COUNT(DISTINCT test_idx) as count 
-    FROM ${require_tables.evalResultsTable} 
-    WHERE ${whereClause}
-  `;
-	const countResult = await db.all(countQuery);
-	const filteredCount = Number(countResult[0]?.count ?? 0);
-	require_logger.logger.debug(`Optimized count query took ${Date.now() - countStart}ms`);
-	const idxStart = Date.now();
-	const idxQuery = drizzle_orm.sql`
-    SELECT DISTINCT test_idx 
-    FROM ${require_tables.evalResultsTable} 
-    WHERE ${whereClause}
-    ORDER BY test_idx 
-    LIMIT ${limit} 
-    OFFSET ${offset}
-  `;
-	const testIndices = (await db.all(idxQuery)).map((row) => row.test_idx);
-	require_logger.logger.debug(`Optimized index query took ${Date.now() - idxStart}ms`);
-	return {
-		testIndices,
-		filteredCount
-	};
-}
-//#endregion
-//#region src/models/evalMutation.ts
-/**
-* Drops this process's cached eval aggregates so the next read re-queries the DB.
-* Always clears the standalone-eval LRU (keyed by filter combos, no per-eval granularity)
-* and the count cache for `evalId` (or every eval's counts when `evalId` is omitted).
-* Use this for in-process cache coherence only — it does NOT notify the view server.
-*/
-function invalidateEvaluationCache(evalId) {
-	clearStandaloneEvalCache();
-	clearCountCache(evalId);
-}
-/**
-* Like {@link invalidateEvaluationCache} but for several evals at once: clears the standalone-eval
-* LRU once (it has no per-eval granularity, so repeating it per id is wasteful) and the count
-* cache for each id.
-*/
-function invalidateEvaluationCaches(evalIds) {
-	clearStandaloneEvalCache();
-	for (const id of evalIds) clearCountCache(id);
-}
-/**
-* Call after creating or mutating an eval's data (results, prompts, ratings). Invalidates
-* this process's caches and writes a scoped update signal so a running `promptfoo view`
-* server refreshes clients viewing this eval (and the root route, which follows the latest).
-*/
-function notifyEvaluationChanged(evalId) {
-	invalidateEvaluationCache(evalId);
-	updateSignalFile(evalId);
-}
-/**
-* Call after deleting one or more evals. Invalidates this process's caches and writes a
-* delete signal so the view server can navigate clients off the removed evals. Pass no
-* argument (or omit ids) for "all evals deleted".
-*/
-function notifyEvaluationsDeleted(evalIds) {
-	if (evalIds) invalidateEvaluationCaches(evalIds);
-	else invalidateEvaluationCache();
-	updateSignalFileForDeletedEvals(evalIds);
-}
-//#endregion
-//#region src/models/evalResult.ts
-function sanitizeProviderConfig(config) {
-	return require_logger.sanitizeObject(JSON.parse(require_logger.safeJsonStringify(config)), {
-		context: "provider config",
-		sanitizeUrls: true,
-		maxDepth: Number.POSITIVE_INFINITY
-	});
-}
-function stripMediaReferences(value) {
-	if (require_extractor.extractBlobHashesFromValue(value).length > 0 || typeof value === "string" && /^data:[^,]*,/i.test(value)) return "[output stripped]";
-	if (Array.isArray(value)) return value.map(stripMediaReferences);
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, stripMediaReferences(item)]));
-	return value;
-}
-function projectOutputMetadata(metadata, stripOutput, responseMetadata, testMetadata) {
-	if (!stripOutput || !metadata || !responseMetadata || typeof metadata !== "object") return metadata;
-	return Object.fromEntries(Object.entries(metadata).flatMap(([key, value]) => {
-		if (!Object.prototype.hasOwnProperty.call(responseMetadata, key) || testMetadata && (0, node_util.isDeepStrictEqual)(value, testMetadata[key])) return [[key, value]];
-		return key === "audio" || key === "blobUris" ? [] : [[key, stripMediaReferences(sanitizeForDb(value))]];
-	}));
-}
-function projectProviderResponse(response, options) {
-	if (!response) return response;
-	if (!options.stripMetadata && !options.stripOutput) return response;
-	const projectedResponse = options.stripMetadata ? (({ metadata: _metadata, ...rest }) => rest)(response) : { ...response };
-	if (options.stripOutput) {
-		projectedResponse.output = "[output stripped]";
-		delete projectedResponse.raw;
-		delete projectedResponse.providerTransformedOutput;
-		delete projectedResponse.conversationOutput;
-		delete projectedResponse.audio;
-		delete projectedResponse.video;
-		delete projectedResponse.images;
-		if (projectedResponse.metadata) projectedResponse.metadata = projectOutputMetadata(projectedResponse.metadata, true, projectedResponse.metadata);
-	}
-	return projectedResponse;
-}
-function projectPrompt(prompt, stripPromptText) {
-	return stripPromptText ? {
-		...prompt,
-		raw: "[prompt stripped]",
-		template: void 0,
-		...prompt.config?.provider && { config: {
-			...prompt.config,
-			provider: require_logger.stripProviderPromptSelectors(prompt.config.provider)
-		} }
-	} : prompt;
-}
-function projectTracesForOutput(traces, { shouldStripMetadata, shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars }) {
-	if (!shouldStripMetadata && !shouldStripPromptText && !shouldStripResponseOutput && !shouldStripTestVars) return traces;
-	return traces.map((trace) => {
-		let projectedTrace = trace;
-		if (shouldStripMetadata) {
-			const { metadata: _metadata, ...traceWithoutMetadata } = trace;
-			projectedTrace = traceWithoutMetadata;
-		} else if (shouldStripTestVars && trace.metadata && "vars" in trace.metadata) {
-			const { metadata: traceMetadata, ...traceWithoutMetadata } = trace;
-			const { vars: _vars, ...metadata } = traceMetadata;
-			projectedTrace = {
-				...traceWithoutMetadata,
-				...Object.keys(metadata).length > 0 && { metadata }
-			};
-		}
-		if (!shouldStripPromptText && !shouldStripResponseOutput) return projectedTrace;
-		return {
-			...projectedTrace,
-			spans: projectedTrace.spans.map((span) => {
-				if (!span.attributes) return span;
-				const projectedAttributes = { ...span.attributes };
-				if (shouldStripPromptText) delete projectedAttributes[require_genaiTracer.PromptfooAttributes.REQUEST_BODY];
-				if (shouldStripResponseOutput) delete projectedAttributes[require_genaiTracer.PromptfooAttributes.RESPONSE_BODY];
-				const { attributes: _attributes, ...projectedSpan } = span;
-				return {
-					...projectedSpan,
-					...Object.keys(projectedAttributes).length > 0 && { attributes: projectedAttributes }
-				};
-			})
-		};
-	});
-}
-function projectTestCase(testCase, options) {
-	if (!options.stripMetadata && !options.stripVars && !options.stripOutput && !options.stripPromptText) return testCase;
-	const projectedTestCase = options.stripMetadata ? (({ metadata: _metadata, ...rest }) => rest)(testCase) : { ...testCase };
-	if (options.stripVars) projectedTestCase.vars = void 0;
-	if (options.stripOutput) delete projectedTestCase.providerOutput;
-	if (options.stripMetadata && testCase.metadata?.__promptfoo?.remote === true) projectedTestCase.metadata = { __promptfoo: { remote: true } };
-	return options.stripPromptText ? require_logger.stripTestProviderPromptSelectors(projectedTestCase) : projectedTestCase;
-}
-/** Map only grading assertion providers and component results. */
-function mapGradingResultProviderRefs(gradingResult, mapProvider) {
-	const visited = /* @__PURE__ */ new WeakMap();
-	const project = (value) => {
-		const result = asRecord(value);
-		if (!result) return value;
-		const previous = visited.get(result);
-		if (previous) return previous;
-		const projected = { ...result };
-		visited.set(result, projected);
-		if (result.assertion) projected.assertion = require_logger.mapTestProviderRefs(result.assertion, mapProvider);
-		if (Array.isArray(result.componentResults)) projected.componentResults = result.componentResults.map(project);
-		return projected;
-	};
-	return project(gradingResult);
-}
-/** Project assertion providers only, preserving grading details and unrelated metadata. */
-function projectGradingResult(gradingResult, stripPromptText) {
-	return stripPromptText ? mapGradingResultProviderRefs(gradingResult, require_logger.stripProviderPromptSelectors) : gradingResult;
-}
-function sanitizeProvider(provider) {
-	try {
-		if (require_logger.isApiProvider(provider)) return {
-			id: provider.id(),
-			label: provider.label,
-			...provider.config && { config: sanitizeProviderConfig(provider.config) }
-		};
-		if (require_logger.isProviderOptions(provider)) return {
-			id: provider.id,
-			label: provider.label,
-			...provider.config && { config: sanitizeProviderConfig(provider.config) }
-		};
-		if (typeof provider === "object" && provider) {
-			const providerObj = provider;
-			return {
-				id: typeof providerObj.id === "function" ? providerObj.id() : providerObj.id,
-				label: providerObj.label,
-				...providerObj.config && { config: sanitizeProviderConfig(providerObj.config) }
-			};
-		}
-	} catch {}
-	return JSON.parse(require_logger.safeJsonStringify(provider));
-}
-/** Snapshot live provider references for replay without retaining runtime client state. */
-function toSerializableProviderRef(provider) {
-	if (require_logger.isApiProvider(provider)) return {
-		...sanitizeProvider(provider),
-		...require_logger.sanitizeObject({
-			transform: typeof provider.transform === "string" ? provider.transform : void 0,
-			delay: provider.delay,
-			inputs: provider.inputs
-		}, {
-			context: "provider options",
-			sanitizeUrls: true,
-			maxDepth: Number.POSITIVE_INFINITY
-		}),
-		...provider.prompts && { prompts: [...provider.prompts] }
-	};
-	if (Array.isArray(provider)) return provider.map(toSerializableProviderRef);
-	if (require_logger.isProviderTypeMap(provider)) {
-		let serialized;
-		for (const type of require_logger.GRADING_PROVIDER_TYPE_KEYS) if (require_logger.isApiProvider(provider[type])) {
-			serialized ??= { ...provider };
-			serialized[type] = toSerializableProviderRef(provider[type]);
-		}
-		return serialized ?? provider;
-	}
-	return provider;
-}
-/** Snapshot live grading references before generic result serialization invokes provider toJSON. */
-function serializeResultProviderRefs(result) {
-	const record = result;
-	const serializeProvider = (provider) => {
-		if (!require_logger.isApiProvider(provider) && !require_logger.isProviderTypeMap(provider)) return provider;
-		return require_logger.sanitizeObject(toSerializableProviderRef(provider), {
-			context: "grading provider",
-			sanitizeUrls: true,
-			maxDepth: Number.POSITIVE_INFINITY,
-			throwOnError: true
-		});
-	};
-	const projected = { ...record };
-	if (record.testCase) projected.testCase = require_logger.mapTestProviderRefs(record.testCase, serializeProvider);
-	const prompt = asRecord(record.prompt);
-	const config = asRecord(prompt?.config);
-	if (config?.provider !== void 0) projected.prompt = {
-		...prompt,
-		config: {
-			...config,
-			provider: serializeProvider(config.provider)
-		}
-	};
-	if (record.gradingResult) projected.gradingResult = mapGradingResultProviderRefs(record.gradingResult, serializeProvider);
-	return projected;
-}
-/**
-* Sanitize an object for database storage by removing circular references
-* and non-serializable values (functions, Timeout objects, etc.).
-* Uses safeJsonStringify which handles circular references gracefully.
-*
-* This prevents "Converting circular structure to JSON" errors that can occur
-* when Node.js Timeout objects or other non-serializable data leaks into results.
-* See: https://github.com/promptfoo/promptfoo/issues/7266
-*/
-function sanitizeForDb(obj) {
-	if (obj === null || obj === void 0) return obj;
-	try {
-		const serialized = require_logger.safeJsonStringify(obj);
-		if (serialized === void 0) {
-			require_logger.logger.debug("sanitizeForDb: Failed to serialize object, using fallback", {
-				valueType: typeof obj,
-				isArray: Array.isArray(obj)
-			});
-			return Array.isArray(obj) ? [] : null;
-		}
-		return JSON.parse(serialized);
-	} catch (error) {
-		require_logger.logger.debug("sanitizeForDb: Parse error, using fallback", { error });
-		return Array.isArray(obj) ? [] : null;
-	}
-}
-/**
-* Sanitize a per-test-case field for persistence: strips circular refs,
-* collapses class instances (e.g. live SDK clients that leaked in via
-* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
-* `token`, etc.) at any depth. Use this for any slot that can carry a provider
-* config — notably `testCase.options.provider` and `prompt.config.provider`,
-* where the resolved runtime provider (with its Anthropic / Bedrock SDK
-* client) flows in from the evaluator. Without this, credentials configured on
-* the judge provider end up in the Eval results both in the DB and in the
-* polling response served by `/api/eval/job/:id`.
-*/
-function sanitizeForDbWithSecrets(obj) {
-	if (obj === null || obj === void 0) return obj;
-	return require_logger.sanitizeObject(obj, {
-		context: "evalResult field",
-		maxDepth: Number.POSITIVE_INFINITY
-	});
-}
-const SENSITIVE_RESPONSE_HEADER_NAMES = /* @__PURE__ */ new Set([
-	"authorization",
-	"proxy-authorization",
-	"cookie",
-	"set-cookie",
-	"openai-organization",
-	"openai-project",
-	"openai-version",
-	"x-request-id",
-	"x-amzn-requestid",
-	"x-amzn-trace-id",
-	"x-amz-security-token",
-	"x-amz-cf-id",
-	"x-azure-ref",
-	"x-correlation-id",
-	"x-trace-id",
-	"cf-ray",
-	"cf-cache-status",
-	"x-openai-proxy-wasm",
-	"via"
-]);
-const SENSITIVE_RESPONSE_HEADER_PREFIXES = ["x-ratelimit-"];
-function isSensitiveResponseHeader(headerName) {
-	const normalized = headerName.toLowerCase();
-	if (SENSITIVE_RESPONSE_HEADER_NAMES.has(normalized)) return true;
-	return SENSITIVE_RESPONSE_HEADER_PREFIXES.some((prefix) => normalized.startsWith(prefix));
-}
-function isSensitiveRequestHeader(headerName) {
-	return isSensitiveResponseHeader(headerName) || require_logger.isSecretField(headerName);
-}
-function redactSensitiveHeaders(headers, sourceHeaders = headers, isSensitiveHeader = isSensitiveResponseHeader) {
-	let mutated = false;
-	const next = {};
-	for (const [key, value] of Object.entries(headers)) if (Object.prototype.hasOwnProperty.call(sourceHeaders, key) && (0, node_util.isDeepStrictEqual)(sourceHeaders[key], value) && isSensitiveHeader(key)) {
-		next[key] = require_logger.REDACTED;
-		mutated = true;
-	} else next[key] = value;
-	return mutated ? next : null;
-}
-function redactHttpHeadersOnMetadata(metadata, options) {
-	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return metadata;
-	const m = metadata;
-	let nextMetadata;
-	const legacyHeaders = m.headers;
-	const legacyHeadersSource = options?.redactLegacyHeaders ? legacyHeaders : (options?.legacyHeadersSource)?.headers;
-	if (legacyHeaders && typeof legacyHeaders === "object" && !Array.isArray(legacyHeaders) && legacyHeadersSource && typeof legacyHeadersSource === "object" && !Array.isArray(legacyHeadersSource)) {
-		const redacted = redactSensitiveHeaders(legacyHeaders, legacyHeadersSource, isSensitiveRequestHeader);
-		if (redacted) nextMetadata = {
-			...m,
-			headers: redacted
-		};
-	}
-	const http = m.http;
-	if (!http || typeof http !== "object" || Array.isArray(http)) return nextMetadata ?? metadata;
-	const httpRecord = http;
-	let nextHttp;
-	for (const slot of ["headers", "requestHeaders"]) {
-		const slotValue = httpRecord[slot];
-		if (slotValue && typeof slotValue === "object" && !Array.isArray(slotValue)) {
-			const redacted = slot === "requestHeaders" ? redactSensitiveHeaders(slotValue, slotValue, isSensitiveRequestHeader) : redactSensitiveHeaders(slotValue);
-			if (redacted) {
-				nextHttp ??= { ...httpRecord };
-				nextHttp[slot] = redacted;
-			}
-		}
-	}
-	if (!nextHttp) return nextMetadata ?? metadata;
-	nextMetadata ??= { ...m };
-	nextMetadata.http = nextHttp;
-	return nextMetadata;
-}
-function redactHttpHeadersOnGradingResult(gradingResult) {
-	if (!gradingResult || typeof gradingResult !== "object" || Array.isArray(gradingResult)) return gradingResult;
-	const gr = gradingResult;
-	let mutated = false;
-	const next = { ...gr };
-	if (gr.metadata !== void 0) {
-		const redacted = redactHttpHeadersOnMetadata(gr.metadata);
-		if (redacted !== gr.metadata) {
-			next.metadata = redacted;
-			mutated = true;
-		}
-	}
-	if (Array.isArray(gr.componentResults)) {
-		let componentMutated = false;
-		const nextComponents = gr.componentResults.map((component) => {
-			const redacted = redactHttpHeadersOnGradingResult(component);
-			if (redacted !== component) componentMutated = true;
-			return redacted;
-		});
-		if (componentMutated) {
-			next.componentResults = nextComponents;
-			mutated = true;
-		}
-	}
-	return mutated ? next : gradingResult;
-}
-function sanitizeResponseForDb(response) {
-	if (!response) return response;
-	const redactedMetadata = redactHttpHeadersOnMetadata(response.metadata, { redactLegacyHeaders: true });
-	if (redactedMetadata === response.metadata) return response;
-	return {
-		...response,
-		metadata: redactedMetadata
-	};
-}
-function sanitizeMetadataForDb(metadata, responseMetadata) {
-	return redactHttpHeadersOnMetadata(metadata, { legacyHeadersSource: sanitizeForDb(responseMetadata) });
-}
-function sanitizeGradingResultAssertions(gradingResult) {
-	if (!gradingResult || typeof gradingResult !== "object" || Array.isArray(gradingResult)) return gradingResult;
-	const gr = gradingResult;
-	const assertion = asRecord(gr.assertion);
-	const sanitizedAssertion = assertion && { ...assertion };
-	if (sanitizedAssertion) {
-		for (const field of ["provider", "config"]) if (Object.prototype.hasOwnProperty.call(sanitizedAssertion, field)) sanitizedAssertion[field] = require_logger.sanitizeObject(sanitizedAssertion[field], {
-			context: "grading assertion",
-			maxDepth: Number.POSITIVE_INFINITY,
-			sanitizeUrls: true,
-			throwOnError: true
-		});
-	}
-	return {
-		...gr,
-		...sanitizedAssertion && { assertion: sanitizedAssertion },
-		...Array.isArray(gr.componentResults) && { componentResults: gr.componentResults.map(sanitizeGradingResultAssertions) }
-	};
-}
-function sanitizeGradingResultForDb(gradingResult) {
-	return redactHttpHeadersOnGradingResult(sanitizeGradingResultAssertions(gradingResult));
-}
-const PROMPTFOO_METADATA_KEY = "__promptfoo";
-const TRACE_LINKAGE_KEY = "traceLinkage";
-const REPEAT_LINKAGE_KEY = "repeatLinkage";
-function asRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function persistTraceMetadata(metadata, traceId, evaluationId) {
-	if (!traceId && !evaluationId) return stripTraceLinkageFromMetadata(metadata);
-	const metadataRecord = metadata ?? {};
-	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
-	if (metadataRecord["__promptfoo"] !== void 0 && promptfooMetadata === void 0) require_logger.logger.warn(`[EvalResult] Overwriting non-object metadata.${PROMPTFOO_METADATA_KEY} with internal trace linkage; the key is reserved for promptfoo internals.`);
-	if (promptfooMetadata && TRACE_LINKAGE_KEY in promptfooMetadata) require_logger.logger.warn(`[EvalResult] Overwriting metadata.${PROMPTFOO_METADATA_KEY}.${TRACE_LINKAGE_KEY} with internal trace linkage; the path is reserved for promptfoo internals.`);
-	return {
-		...metadataRecord,
-		[PROMPTFOO_METADATA_KEY]: {
-			...promptfooMetadata ?? {},
-			[TRACE_LINKAGE_KEY]: {
-				traceId,
-				evaluationId
-			}
-		}
-	};
-}
-function stripTraceLinkageFromMetadata(metadata) {
-	const metadataRecord = asRecord(metadata);
-	const promptfooMetadata = asRecord(metadataRecord?.[PROMPTFOO_METADATA_KEY]);
-	if (!metadataRecord || !promptfooMetadata || !(TRACE_LINKAGE_KEY in promptfooMetadata)) return metadata;
-	const { [TRACE_LINKAGE_KEY]: _traceLinkage, ...remainingPromptfooMetadata } = promptfooMetadata;
-	const strippedMetadata = { ...metadataRecord };
-	delete strippedMetadata[PROMPTFOO_METADATA_KEY];
-	if (Object.keys(remainingPromptfooMetadata).length > 0) strippedMetadata[PROMPTFOO_METADATA_KEY] = remainingPromptfooMetadata;
-	return strippedMetadata;
-}
-function persistRepeatMetadata(metadata, repeatIndex, repeatGroupId) {
-	if (repeatIndex === void 0 || !repeatGroupId) return stripRepeatLinkageFromMetadata(metadata);
-	const metadataRecord = metadata ?? {};
-	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
-	if (metadataRecord["__promptfoo"] !== void 0 && promptfooMetadata === void 0) require_logger.logger.warn(`[EvalResult] Overwriting non-object metadata.${PROMPTFOO_METADATA_KEY} with internal repeat linkage; the key is reserved for promptfoo internals.`);
-	if (promptfooMetadata && REPEAT_LINKAGE_KEY in promptfooMetadata) require_logger.logger.warn(`[EvalResult] Overwriting metadata.${PROMPTFOO_METADATA_KEY}.${REPEAT_LINKAGE_KEY} with internal repeat linkage; the path is reserved for promptfoo internals.`);
-	return {
-		...metadataRecord,
-		[PROMPTFOO_METADATA_KEY]: {
-			...promptfooMetadata ?? {},
-			[REPEAT_LINKAGE_KEY]: {
-				repeatIndex,
-				repeatGroupId
-			}
-		}
-	};
-}
-function stripRepeatLinkageFromMetadata(metadata) {
-	const metadataRecord = asRecord(metadata);
-	const promptfooMetadata = asRecord(metadataRecord?.[PROMPTFOO_METADATA_KEY]);
-	if (!metadataRecord || !promptfooMetadata || !(REPEAT_LINKAGE_KEY in promptfooMetadata)) return metadata;
-	const { [REPEAT_LINKAGE_KEY]: _repeatLinkage, ...remainingPromptfooMetadata } = promptfooMetadata;
-	const strippedMetadata = { ...metadataRecord };
-	delete strippedMetadata[PROMPTFOO_METADATA_KEY];
-	if (Object.keys(remainingPromptfooMetadata).length > 0) strippedMetadata[PROMPTFOO_METADATA_KEY] = remainingPromptfooMetadata;
-	return strippedMetadata;
-}
-function surfaceRepeatMetadata(metadata) {
-	const metadataRecord = metadata ?? {};
-	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
-	const repeatLinkage = asRecord(promptfooMetadata?.[REPEAT_LINKAGE_KEY]);
-	return {
-		repeatIndex: typeof repeatLinkage?.repeatIndex === "number" && Number.isInteger(repeatLinkage.repeatIndex) && repeatLinkage.repeatIndex >= 0 ? repeatLinkage.repeatIndex : void 0,
-		repeatGroupId: typeof repeatLinkage?.repeatGroupId === "string" && repeatLinkage.repeatGroupId.length > 0 ? repeatLinkage.repeatGroupId : void 0,
-		metadata: promptfooMetadata != null && REPEAT_LINKAGE_KEY in promptfooMetadata ? stripRepeatLinkageFromMetadata(metadataRecord) : metadataRecord
-	};
-}
-function surfaceTraceMetadata(metadata) {
-	const metadataRecord = metadata ?? {};
-	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
-	const traceLinkage = asRecord(promptfooMetadata?.[TRACE_LINKAGE_KEY]);
-	const traceId = typeof traceLinkage?.traceId === "string" ? traceLinkage.traceId : void 0;
-	const evaluationId = typeof traceLinkage?.evaluationId === "string" ? traceLinkage.evaluationId : void 0;
-	if (!(promptfooMetadata != null && TRACE_LINKAGE_KEY in promptfooMetadata)) return {
-		traceId,
-		evaluationId,
-		metadata: metadataRecord
-	};
-	return {
-		traceId,
-		evaluationId,
-		metadata: stripTraceLinkageFromMetadata(metadataRecord)
-	};
-}
-function redactSensitiveResultFieldsForDb(fields) {
-	return {
-		response: sanitizeResponseForDb(fields.response),
-		gradingResult: sanitizeGradingResultForDb(fields.gradingResult),
-		metadata: sanitizeMetadataForDb(fields.metadata, fields.response?.metadata)
-	};
-}
-function getStripFlags(env) {
-	const getFlag = (key) => {
-		const value = env?.[key];
-		return value === void 0 ? require_logger.getEnvBool(key, false) : require_logger.parseEnvBool(String(value), false);
-	};
-	return {
-		shouldStripPromptText: getFlag("PROMPTFOO_STRIP_PROMPT_TEXT"),
-		shouldStripResponseOutput: getFlag("PROMPTFOO_STRIP_RESPONSE_OUTPUT"),
-		shouldStripTestVars: getFlag("PROMPTFOO_STRIP_TEST_VARS"),
-		shouldStripGradingResult: getFlag("PROMPTFOO_STRIP_GRADING_RESULT"),
-		shouldStripMetadata: getFlag("PROMPTFOO_STRIP_METADATA")
-	};
-}
-/**
-* Sanitize a result before it is serialized into a JSONL output artifact. This is the
-* JSONL-boundary equivalent of the database-persistence sanitization and must stay in sync
-* with it: it redacts credential-bearing HTTP headers from the response / grading / metadata
-* and applies the `PROMPTFOO_STRIP_*` projections (prompt text, response output, test vars,
-* grading result, metadata). In-memory rows keep their real values for hooks; only the
-* on-disk copy is sanitized.
-*/
-function sanitizeResultForJsonlArtifact(result, stripFlags = getStripFlags()) {
-	const { shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars, shouldStripGradingResult, shouldStripMetadata } = stripFlags;
-	const artifactResult = serializeResultProviderRefs(result);
-	const redacted = redactSensitiveResultFieldsForDb({
-		response: sanitizeForDb(artifactResult.response),
-		gradingResult: sanitizeForDb(artifactResult.gradingResult),
-		metadata: sanitizeForDb(artifactResult.metadata)
-	});
-	const response = projectProviderResponse(redacted.response ?? void 0, {
-		stripMetadata: shouldStripMetadata,
-		stripOutput: shouldStripResponseOutput
-	});
-	return {
-		...result,
-		...artifactResult.testCase ? { testCase: projectTestCase(sanitizeForDbWithSecrets(artifactResult.testCase), {
-			stripMetadata: shouldStripMetadata,
-			stripVars: shouldStripTestVars,
-			stripOutput: shouldStripResponseOutput,
-			stripPromptText: shouldStripPromptText
-		}) } : {},
-		...artifactResult.vars === void 0 ? {} : { vars: shouldStripTestVars ? {} : sanitizeForDbWithSecrets(artifactResult.vars) },
-		...artifactResult.prompt ? { prompt: projectPrompt(sanitizeForDbWithSecrets(artifactResult.prompt), shouldStripPromptText) } : {},
-		...artifactResult.provider ? { provider: sanitizeProvider(artifactResult.provider) } : {},
-		response,
-		gradingResult: shouldStripGradingResult ? null : projectGradingResult(redacted.gradingResult, shouldStripPromptText),
-		namedScores: sanitizeForDb(artifactResult.namedScores),
-		metadata: shouldStripMetadata ? {} : projectOutputMetadata(redacted.metadata, shouldStripResponseOutput, redacted.response?.metadata, artifactResult.testCase?.metadata)
-	};
-}
-var EvalResult = class EvalResult {
-	static async createFromEvaluateResult(evalId, result, opts) {
-		const persist = opts?.persist == null ? true : opts.persist;
-		const { prompt, error, score, latencyMs, success, provider, gradingResult, namedScores, cost, metadata, failureReason, testCase, traceId, evaluationId, repeatIndex, repeatGroupId } = serializeResultProviderRefs(result);
-		const persistedMetadata = persistTraceMetadata(persistRepeatMetadata(metadata, repeatIndex, repeatGroupId), traceId, evaluationId);
-		const processedResponse = await require_extractor.extractAndStoreBinaryData(result.response, {
-			evalId,
-			testIdx: result.testIdx,
-			promptIdx: result.promptIdx
-		});
-		const args = {
-			id: crypto.randomUUID(),
-			evalId,
-			testCase: sanitizeForDbWithSecrets(testCase),
-			promptIdx: result.promptIdx,
-			testIdx: result.testIdx,
-			prompt: sanitizeForDbWithSecrets(prompt),
-			promptId: hashPrompt(prompt),
-			error: error?.toString(),
-			success,
-			score: score == null ? 0 : score,
-			response: sanitizeForDb(processedResponse || null),
-			gradingResult: sanitizeForDb(gradingResult || null),
-			namedScores: sanitizeForDb(namedScores),
-			provider: sanitizeProvider(provider),
-			latencyMs,
-			cost,
-			metadata: sanitizeForDb(persistedMetadata),
-			failureReason
-		};
-		if (persist) {
-			const db = await require_tables.getDb();
-			const redacted = redactSensitiveResultFieldsForDb({
-				response: args.response,
-				gradingResult: args.gradingResult,
-				metadata: args.metadata
-			});
-			args.response = redacted.response;
-			args.gradingResult = redacted.gradingResult;
-			args.metadata = redacted.metadata;
-			const dbResult = await db.insert(require_tables.evalResultsTable).values(args).returning();
-			clearCountCache(evalId);
-			return new EvalResult({
-				...dbResult[0],
-				persisted: true
-			});
-		}
-		return new EvalResult(args);
-	}
-	static async createManyFromEvaluateResult(results, evalId) {
-		const db = await require_tables.getDb();
-		const returnResults = [];
-		const processedResults = [];
-		for (const result of results) {
-			const processedResponse = require_extractor.isBlobStorageEnabled() ? await require_extractor.extractAndStoreBinaryData(result.response, {
-				evalId,
-				testIdx: result.testIdx,
-				promptIdx: result.promptIdx
-			}) : result.response;
-			processedResults.push({
-				...serializeResultProviderRefs(result),
-				response: processedResponse ?? void 0
-			});
-		}
-		await db.transaction(async (tx) => {
-			for (const result of processedResults) {
-				const { traceId: _traceId, evaluationId: _evaluationId, repeatIndex: _repeatIndex, repeatGroupId: _repeatGroupId, ...rest } = result;
-				const sanitizedResult = {
-					...rest,
-					testCase: sanitizeForDbWithSecrets(result.testCase),
-					prompt: sanitizeForDbWithSecrets(result.prompt),
-					...redactSensitiveResultFieldsForDb({
-						response: sanitizeForDb(result.response),
-						gradingResult: sanitizeForDb(result.gradingResult),
-						metadata: sanitizeForDb(persistTraceMetadata(persistRepeatMetadata(result.metadata, result.repeatIndex, result.repeatGroupId), result.traceId, result.evaluationId))
-					}),
-					namedScores: sanitizeForDb(result.namedScores),
-					provider: result.provider ? sanitizeProvider(result.provider) : result.provider
-				};
-				const dbResult = await tx.insert(require_tables.evalResultsTable).values({
-					...sanitizedResult,
-					evalId,
-					id: crypto.randomUUID()
-				}).returning().get();
-				returnResults.push(new EvalResult({
-					...dbResult,
-					persisted: true
-				}));
-			}
-		});
-		clearCountCache(evalId);
-		return returnResults;
-	}
-	static async findById(id) {
-		const result = await (await require_tables.getDb()).select().from(require_tables.evalResultsTable).where((0, drizzle_orm.eq)(require_tables.evalResultsTable.id, id));
-		return result.length > 0 ? new EvalResult({
-			...result[0],
-			persisted: true
-		}) : null;
-	}
-	static async findManyByEvalId(evalId, opts) {
-		return (await (await require_tables.getDb()).select().from(require_tables.evalResultsTable).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId), opts?.testIdx == null ? void 0 : (0, drizzle_orm.eq)(require_tables.evalResultsTable.testIdx, opts.testIdx)))).map((result) => new EvalResult({
-			...result,
-			persisted: true
-		}));
-	}
-	static async findManyByEvalIdAndTestIndices(evalId, testIndices) {
-		if (!testIndices.length) return [];
-		return (await (await require_tables.getDb()).select().from(require_tables.evalResultsTable).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId), testIndices.length === 1 ? (0, drizzle_orm.eq)(require_tables.evalResultsTable.testIdx, testIndices[0]) : (0, drizzle_orm.inArray)(require_tables.evalResultsTable.testIdx, testIndices)))).map((result) => new EvalResult({
-			...result,
-			persisted: true
-		}));
-	}
-	/**
-	* Returns a set of completed (testIdx,promptIdx) pairs for a given eval.
-	* Key format: `${testIdx}:${promptIdx}`
-	*
-	* @param evalId - The evaluation ID to query
-	* @param opts.excludeErrors - If true, excludes results with ERROR failureReason (used in retry mode)
-	*/
-	static async getCompletedIndexPairs(evalId, opts) {
-		const db = await require_tables.getDb();
-		const whereClause = opts?.excludeErrors ? (0, drizzle_orm.and)((0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId), (0, drizzle_orm.ne)(require_tables.evalResultsTable.failureReason, require_tables.ResultFailureReason.ERROR)) : (0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId);
-		const rows = await db.select({
-			testIdx: require_tables.evalResultsTable.testIdx,
-			promptIdx: require_tables.evalResultsTable.promptIdx
-		}).from(require_tables.evalResultsTable).where(whereClause);
-		const ret = /* @__PURE__ */ new Set();
-		for (const r of rows) ret.add(`${r.testIdx}:${r.promptIdx}`);
-		return ret;
-	}
-	static async *findManyByEvalIdBatched(evalId, opts) {
-		const db = await require_tables.getDb();
-		const batchSize = opts?.batchSize || 100;
-		let offset = 0;
-		while (true) {
-			const nextResult = await db.select({ testIdx: require_tables.evalResultsTable.testIdx }).from(require_tables.evalResultsTable).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId), (0, drizzle_orm.gte)(require_tables.evalResultsTable.testIdx, offset))).orderBy(require_tables.evalResultsTable.testIdx).limit(1).get();
-			if (!nextResult) break;
-			offset = nextResult.testIdx;
-			yield (await db.select().from(require_tables.evalResultsTable).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(require_tables.evalResultsTable.evalId, evalId), (0, drizzle_orm.gte)(require_tables.evalResultsTable.testIdx, offset), (0, drizzle_orm.lt)(require_tables.evalResultsTable.testIdx, offset + batchSize))).all()).map((result) => new EvalResult({
-				...result,
-				persisted: true
-			}));
-			offset += batchSize;
-		}
-	}
-	id;
-	evalId;
-	description;
-	promptIdx;
-	testIdx;
-	testCase;
-	prompt;
-	promptId;
-	error;
-	success;
-	score;
-	response;
-	gradingResult;
-	namedScores;
-	provider;
-	latencyMs;
-	cost;
-	metadata;
-	traceId;
-	evaluationId;
-	repeatIndex;
-	repeatGroupId;
-	failureReason;
-	persisted;
-	pluginId;
-	constructor(opts) {
-		this.id = opts.id;
-		this.evalId = opts.evalId;
-		this.promptIdx = opts.promptIdx;
-		this.testIdx = opts.testIdx;
-		this.testCase = opts.testCase;
-		this.prompt = opts.prompt;
-		this.promptId = opts.promptId || hashPrompt(opts.prompt);
-		this.error = opts.error;
-		this.score = opts.score;
-		this.success = opts.success;
-		this.response = opts.response || void 0;
-		this.gradingResult = opts.gradingResult;
-		this.namedScores = opts.namedScores || {};
-		this.provider = opts.provider;
-		this.latencyMs = opts.latencyMs || 0;
-		this.cost = opts.cost || 0;
-		const surfacedTrace = surfaceTraceMetadata(opts.metadata);
-		const surfacedRepeat = surfaceRepeatMetadata(surfacedTrace.metadata);
-		this.metadata = surfacedRepeat.metadata;
-		this.traceId = surfacedTrace.traceId;
-		this.evaluationId = surfacedTrace.evaluationId;
-		this.repeatIndex = surfacedRepeat.repeatIndex;
-		this.repeatGroupId = surfacedRepeat.repeatGroupId;
-		this.failureReason = require_tables.isResultFailureReason(opts.failureReason) ? opts.failureReason : require_tables.ResultFailureReason.NONE;
-		this.persisted = opts.persisted || false;
-		this.pluginId = opts.testCase.metadata?.pluginId;
-	}
-	async save() {
-		const db = await require_tables.getDb();
-		const { traceId: _traceId, evaluationId: _evaluationId, repeatIndex: _repeatIndex, repeatGroupId: _repeatGroupId, pluginId: _pluginId, ...rest } = serializeResultProviderRefs(this);
-		const persistedValues = {
-			...rest,
-			error: this.error ?? null,
-			gradingResult: sanitizeGradingResultForDb(rest.gradingResult),
-			metadata: persistTraceMetadata(persistRepeatMetadata(this.metadata, this.repeatIndex, this.repeatGroupId), this.traceId, this.evaluationId)
-		};
-		if (this.persisted) await db.update(require_tables.evalResultsTable).set({
-			...persistedValues,
-			updatedAt: require_time.getCurrentTimestamp()
-		}).where((0, drizzle_orm.eq)(require_tables.evalResultsTable.id, this.id)).run();
-		else {
-			const result = await db.insert(require_tables.evalResultsTable).values(persistedValues).returning();
-			this.id = result[0].id;
-			this.persisted = true;
-		}
-		invalidateEvaluationCache(this.evalId);
-	}
-	toEvaluateResult(stripFlags = getStripFlags()) {
-		const { shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars, shouldStripGradingResult, shouldStripMetadata } = stripFlags;
-		const response = projectProviderResponse(this.response, {
-			stripMetadata: shouldStripMetadata,
-			stripOutput: shouldStripResponseOutput
-		});
-		const prompt = projectPrompt(this.prompt, shouldStripPromptText);
-		const testCase = projectTestCase(this.testCase, {
-			stripMetadata: shouldStripMetadata,
-			stripVars: shouldStripTestVars,
-			stripOutput: shouldStripResponseOutput,
-			stripPromptText: shouldStripPromptText
-		});
-		const tokenUsage = require_tokenUsageUtils.createEmptyTokenUsage();
-		if (this.response) require_tokenUsageUtils.accumulateResponseTokenUsage(tokenUsage, this.response);
-		if (this.gradingResult) require_tokenUsageUtils.accumulateGradingTokenUsage(tokenUsage, this.gradingResult.tokensUsed, { cached: this.gradingResult.metadata?.cachedResponse });
-		return {
-			cost: this.cost,
-			...this.response?.incurredCost !== void 0 && { incurredCost: this.response.incurredCost },
-			description: this.description || void 0,
-			error: this.error || void 0,
-			gradingResult: shouldStripGradingResult ? null : projectGradingResult(this.gradingResult, shouldStripPromptText),
-			id: this.id,
-			latencyMs: this.latencyMs,
-			namedScores: this.namedScores,
-			prompt,
-			promptId: this.promptId,
-			promptIdx: this.promptIdx,
-			...this.traceId ? { traceId: this.traceId } : {},
-			...this.evaluationId ? { evaluationId: this.evaluationId } : {},
-			...this.repeatGroupId !== void 0 && {
-				repeatGroupId: this.repeatGroupId,
-				repeatIndex: this.repeatIndex
-			},
-			provider: {
-				id: this.provider.id,
-				label: this.provider.label
-			},
-			response,
-			score: this.score,
-			success: this.success,
-			testCase,
-			testIdx: this.testIdx,
-			tokenUsage,
-			vars: shouldStripTestVars ? {} : this.testCase.vars || {},
-			metadata: shouldStripMetadata ? {} : projectOutputMetadata(this.metadata, shouldStripResponseOutput, this.response?.metadata, this.testCase.metadata),
-			failureReason: this.failureReason
-		};
-	}
-};
-/** Normalize an `EvalResult` model instance or a plain `EvaluateResult` to `EvaluateResult`. */
-function asEvaluateResult(result, stripFlags = getStripFlags()) {
-	return "toEvaluateResult" in result ? result.toEvaluateResult(stripFlags) : result;
-}
-/** Canonical `testIdx:promptIdx` key used to dedupe/look up a result across the streaming,
-* recovery, and comparison paths. */
-function getResultIndexKey(result) {
-	return `${result.testIdx}:${result.promptIdx}`;
-}
-//#endregion
-//#region src/util/eval/evalTableUtils.ts
-/**
-* Keep this in its current order, as it is used to map the columns in the CSV, so it needs to be static.
-*
-* The keys are the names of the columns in the metadata object, and the values are the names of the columns in the CSV.
-*
-* This is imported by enterprise so it doesn't need to be copied.
-*/
-const REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES = {
-	messages: "Messages",
-	redteamHistory: "RedteamHistory",
-	redteamTreeHistory: "RedteamTreeHistory",
-	pluginId: "pluginId",
-	strategyId: "strategyId",
-	sessionId: "sessionId",
-	sessionIds: "sessionIds"
-};
-const REDTEAM_METADATA_COLUMNS = Object.values(REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES);
-/**
-* Get the status string for an output
-*/
-function getOutputStatus(output) {
-	if (output.pass) return "PASS";
-	return output.failureReason === require_tables.ResultFailureReason.ASSERT ? "FAIL" : "ERROR";
-}
-/**
-* Format named scores for CSV output.
-* Returns empty string if no named scores, otherwise JSON string.
-*/
-function formatNamedScores(namedScores) {
-	if (!namedScores || Object.keys(namedScores).length === 0) return "";
-	const rounded = {};
-	for (const [key, value] of Object.entries(namedScores)) if (typeof value === "number" && !Number.isNaN(value)) rounded[key] = Number(value.toFixed(2));
-	if (Object.keys(rounded).length === 0) return "";
-	return JSON.stringify(rounded);
-}
-function formatNamedScoreValue(value) {
-	return typeof value === "number" && !Number.isNaN(value) ? value.toFixed(2) : "";
-}
-/**
-* Build a per-prompt list of `Metric: <name>` column names, deduplicated and
-* sorted with `localeCompare`. Shared shell for both the row-scanning helper
-* (WebUI path) and the aggregate-reading helper (streaming CLI path); see the
-* two call sites below.
-*/
-function collectMetricNamesByPrompt(items, namesFor) {
-	return items.map((item, index) => [...new Set(namesFor(item, index))].sort((a, b) => a.localeCompare(b)));
-}
-/**
-* Collect per-row named metric names from prompt-level aggregate metrics, for
-* use by the streaming CSV path which cannot scan rows up front.
-*
-* Uses `namedScoresCount` because it is incremented only when a per-row
-* result contributes a metric (`src/util/namedMetrics.ts`). Derived metrics
-* write to `namedScores` but not `namedScoresCount` (`src/evaluator.ts`
-* `updateDerivedMetrics`), so this keeps the streaming column set aligned
-* with what `collectNamedScoreNamesByPrompt` would produce from row outputs.
-*
-* Returns an empty list both for prompts with no per-row contributions
-* (`namedScoresCount: {}` — modern eval with no named metrics configured)
-* and for prompts whose count map is missing entirely (legacy/imported
-* evals). Use `promptNeedsDiscoveryFallback` to distinguish the two: only
-* the latter requires a row-scan pre-pass.
-*/
-function collectNamedScoreNamesByPromptFromAggregate(prompts) {
-	return collectMetricNamesByPrompt(prompts, (prompt) => {
-		const counts = prompt.metrics?.namedScoresCount;
-		if (!counts) return [];
-		return Object.keys(counts).filter((name) => (counts[name] ?? 0) > 0);
-	});
-}
-/**
-* True when a prompt's aggregate `metrics.namedScoresCount` is missing/absent,
-* not merely empty. Legacy evals persisted before count tracking shipped, and
-* external imports via `POST /api/eval` that don't backfill the count, both
-* land here. Modern evals always have an object (possibly empty) and skip the
-* discovery pass.
-*/
-function promptNeedsDiscoveryFallback(prompt) {
-	const metrics = prompt.metrics;
-	return !metrics || !metrics.namedScoresCount;
-}
-/**
-* Scan one batch of `EvalResult` rows for the metric names that will need
-* dedicated `Metric: <name>` columns. Only inspects the prompts in
-* `fallbackPromptIndices` (those whose aggregate `namedScoresCount` is
-* missing/empty), and only touches `namedScores` + `testCase.description` —
-* not the full row shape — so the discovery pass stays allocation-light even
-* for very large legacy evals.
-*
-* Mirrors the row-output filter in `collectNamedScoreNamesByPrompt` so the
-* streaming CSV column set matches the WebUI CSV column set.
-*/
-function scanBatchForDiscovery(batchResults, acc, fallbackPromptIndices) {
-	for (const result of batchResults) {
-		if (!acc.hasDescriptions && result.testCase?.description) acc.hasDescriptions = true;
-		if (!fallbackPromptIndices.has(result.promptIdx)) continue;
-		const namedScores = result.namedScores;
-		if (!namedScores) continue;
-		let names = acc.metricNamesByPrompt.get(result.promptIdx);
-		if (!names) {
-			names = /* @__PURE__ */ new Set();
-			acc.metricNamesByPrompt.set(result.promptIdx, names);
-		}
-		for (const [name, value] of Object.entries(namedScores)) if (typeof value === "number" && !Number.isNaN(value)) names.add(name);
-	}
-}
-/**
-* Convert a batch of `EvalResult` rows (grouped by testIdx) into the table-row
-* shape that `tableRowToCsvValues` accepts. Used by `streamEvalCsv` to keep its
-* per-batch processing tight; the outputs array is pre-sized so columns line up
-* with prompts even when results arrive out of promptIdx order.
-*/
-function batchToStreamRows(batchResults, varNames, numPrompts) {
-	const rowsByTestIdx = /* @__PURE__ */ new Map();
-	for (const result of batchResults) {
-		let row = rowsByTestIdx.get(result.testIdx);
-		if (!row) {
-			row = {
-				vars: varNames.map((varName) => {
-					const value = result.testCase?.vars?.[varName];
-					return value === void 0 ? "" : String(value);
-				}),
-				outputs: new Array(numPrompts).fill(null),
-				test: { description: result.testCase?.description }
-			};
-			rowsByTestIdx.set(result.testIdx, row);
-		}
-		row.outputs[result.promptIdx] = {
-			text: result.response?.output ?? "",
-			pass: result.success,
-			score: result.score,
-			namedScores: result.namedScores,
-			failureReason: result.failureReason,
-			gradingResult: result.gradingResult,
-			metadata: result.metadata
-		};
-	}
-	return Array.from(rowsByTestIdx.values());
-}
-/**
-* Build CSV headers for an evaluation table.
-*
-* @param vars - Variable names from the table head
-* @param prompts - Prompt definitions from the table head
-* @param options - Export options
-* @param options.namedScoreNamesByPrompt - Named metric names that should get
-*   dedicated `Metric: <name>` columns, one sorted list per prompt (aligned
-*   with `prompts`). Must match the value passed to `tableRowToCsvValues` so
-*   header and row column counts stay in sync.
-* @returns Array of header strings
-*/
-function buildCsvHeaders(vars, prompts, options = {}) {
-	const headers = [
-		...options.hasDescriptions ? ["Description"] : [],
-		...vars,
-		...prompts.flatMap((prompt, promptIndex) => {
-			const provider = prompt.provider || "";
-			return [
-				provider ? `[${provider}] ${prompt.label}` : prompt.label,
-				"Status",
-				"Score",
-				"Named Scores",
-				...(options.namedScoreNamesByPrompt?.[promptIndex] || []).map((name) => `Metric: ${name}`),
-				"Grader Reason",
-				"Comment"
-			];
-		})
-	];
-	if (options.isRedteam) headers.push(...REDTEAM_METADATA_COLUMNS);
-	return headers;
-}
-/**
-* Convert a single table row to CSV row values.
-*
-* @param row - The table row to convert
-* @param options - Export options (`namedScoreNamesByPrompt` must match the
-*   array passed to `buildCsvHeaders`)
-* @returns Array of values for the CSV row
-*/
-function tableRowToCsvValues(row, options = {}) {
-	const rowValues = [
-		...options.hasDescriptions ? [row.test.description || ""] : [],
-		...row.vars,
-		...row.outputs.flatMap((output, outputIndex) => {
-			const namedScoreNames = options.namedScoreNamesByPrompt?.[outputIndex] || [];
-			if (!output) return [
-				"",
-				"",
-				"",
-				"",
-				...namedScoreNames.map(() => ""),
-				"",
-				""
-			];
-			const status = getOutputStatus(output);
-			const score = output.score?.toFixed(2) ?? "";
-			const namedScores = formatNamedScores(output.namedScores);
-			const namedScoreValues = namedScoreNames.map((name) => formatNamedScoreValue(output.namedScores?.[name]));
-			return [
-				output.text || "",
-				status,
-				score,
-				namedScores,
-				...namedScoreValues,
-				output.gradingResult?.reason || "",
-				output.gradingResult?.comment || ""
-			];
-		})
-	];
-	if (options.isRedteam) {
-		const redteamKeys = Object.keys(REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES);
-		const firstOutputMetadata = row.outputs[0]?.metadata;
-		for (const key of redteamKeys) {
-			let value = firstOutputMetadata?.[key];
-			if (key === "strategyId" && (value === null || value === void 0)) value = "basic";
-			if (value === null || value === void 0) rowValues.push("");
-			else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") rowValues.push(value.toString());
-			else rowValues.push(JSON.stringify(value));
-		}
-	}
-	return rowValues;
-}
-/**
-* Escape every cell of a CSV row matrix (headers + body) against spreadsheet
-* formula injection (CWE-1236), unless disabled via
-* `PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING`. Numbers and booleans pass through
-* untouched; only string cells are inspected. Applied at the `csvStringify`
-* boundary so `buildCsvHeaders`/`tableRowToCsvValues` stay pure and re-importable
-* CSVs are never produced from un-escaped data.
-*/
-function escapeCsvRowsForFormulaInjection(rows, env) {
-	const configuredValue = env?.PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING ?? process.env.PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING;
-	if ([
-		"1",
-		"true",
-		"yes",
-		"yup",
-		"yeppers"
-	].includes(configuredValue?.toLowerCase() ?? "")) return rows;
-	return rows.map((row) => row.map((cell) => typeof cell === "string" ? escapeCsvFormula(cell) : cell));
-}
-function isNumericCell(value) {
-	return value.trim() !== "" && Number.isFinite(Number(value));
-}
-/**
-* Neutralize spreadsheet formula (CSV) injection at eval export time (CWE-1236).
-*
-* Spreadsheet applications execute cells beginning with `=`, `+`, `-`, or `@`
-* as formulas. Exported eval data can contain attacker-controlled model output,
-* variables, and grader comments, and CSV quoting alone does not neutralize
-* those formulas. Prefix dangerous values with the spreadsheet-native text
-* marker while preserving finite signed numbers.
-*
-* Leading whitespace and zero-width characters are ignored when identifying a
-* trigger because spreadsheet applications can strip them before evaluation.
-*/
-function escapeCsvFormula(value) {
-	if (value.length === 0) return value;
-	const unpadded = value.replace(/^[\s\u200B\u200C\u200D]+/, "");
-	const firstChar = unpadded[0];
-	if (firstChar === void 0) return value;
-	return firstChar === "=" || firstChar === "@" || (firstChar === "-" || firstChar === "+") && !isNumericCell(unpadded) ? `'${value}` : value;
-}
-/**
-* Stream CSV data from an evaluation in batches.
-*
-* This is more memory-efficient for large evaluations as it processes
-* results in batches rather than loading everything into memory.
-*
-* Used by the CLI export (`promptfoo eval -o output.csv`) to maintain
-* consistent CSV format with WebUI exports while handling large datasets.
-*
-* @param eval_ - The evaluation to export
-* @param options - Streaming options including the write callback
-*/
-async function streamEvalCsv(eval_, options) {
-	const { isRedteam = false, write } = options;
-	const env = eval_.config?.env;
-	const varNames = eval_.vars;
-	const prompts = eval_.prompts;
-	const numPrompts = prompts.length;
-	const namedScoreNamesByPrompt = collectNamedScoreNamesByPromptFromAggregate(prompts);
-	const fallbackPromptIndices = prompts.flatMap((prompt, promptIndex) => promptNeedsDiscoveryFallback(prompt) ? [promptIndex] : []);
-	const fallbackPromptIndexSet = new Set(fallbackPromptIndices);
-	const accumulator = {
-		metricNamesByPrompt: /* @__PURE__ */ new Map(),
-		hasDescriptions: false
-	};
-	for await (const batchResults of eval_.fetchResultsBatched()) scanBatchForDiscovery(batchResults, accumulator, fallbackPromptIndexSet);
-	const hasDescriptions = accumulator.hasDescriptions;
-	for (const promptIndex of fallbackPromptIndices) {
-		const names = accumulator.metricNamesByPrompt.get(promptIndex);
-		namedScoreNamesByPrompt[promptIndex] = names ? [...names].sort((a, b) => a.localeCompare(b)) : [];
-	}
-	const headers = buildCsvHeaders(varNames, prompts, {
-		hasDescriptions,
-		isRedteam,
-		namedScoreNamesByPrompt
-	});
-	await write((0, csv_stringify_sync.stringify)(escapeCsvRowsForFormulaInjection([headers], env)));
-	for await (const batchResults of eval_.fetchResultsBatched()) {
-		const csvRows = batchToStreamRows(batchResults, varNames, numPrompts).map((row) => tableRowToCsvValues(row, {
-			hasDescriptions,
-			isRedteam,
-			namedScoreNamesByPrompt
-		}));
-		if (csvRows.length > 0) await write((0, csv_stringify_sync.stringify)(escapeCsvRowsForFormulaInjection(csvRows, env)));
-	}
-}
-//#endregion
-//#region src/util/junit.ts
-const MAX_JUNIT_NAME_LENGTH = 512;
-const MAX_JUNIT_DETAIL_LENGTH = 8192;
-const JUNIT_ASSERTION_FAILURE_MESSAGE = "Assertion failed";
-const JUNIT_EVALUATION_ERROR_MESSAGE = "Evaluation error";
-const INVALID_XML_CHARACTERS = /[^\t\n\r\u0020-\ud7ff\ue000-\ufffd\u{10000}-\u{10ffff}]/gu;
-function truncateText(value, maxLength) {
-	if (value.length <= maxLength) return value;
-	const cutoff = maxLength - 3;
-	const end = (value.codePointAt(cutoff - 1) ?? 0) > 65535 ? cutoff + 1 : cutoff;
-	return `${value.slice(0, end)}...`;
-}
-function normalizeInlineText(value, fallback, maxLength = MAX_JUNIT_NAME_LENGTH) {
-	return truncateText((value ?? "").replace(/\s+/g, " ").replace(INVALID_XML_CHARACTERS, "").replace(/\s+/g, " ").trim() || fallback, maxLength);
-}
-function formatDurationSeconds(durationMs) {
-	return Number(((typeof durationMs === "number" && Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0) / 1e3).toFixed(3)).toString();
-}
-function getEvaluationTimestamp(evalRecord) {
-	const date = new Date(evalRecord.createdAt);
-	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
-}
-function getTestCaseName(result) {
-	const prefix = `test ${result.testIdx + 1}`;
-	const description = normalizeInlineText(result.description || result.testCase.description, "");
-	return description ? `${prefix}: ${description}` : prefix;
-}
-function getFailedComponentResults(gradingResult) {
-	return gradingResult?.componentResults?.filter((component) => !component.pass) ?? [];
-}
-function getAssertionLabel(gradingResult) {
-	return gradingResult.assertion?.type ?? "assertion";
-}
-function getFailedAssertionLabels(gradingResult) {
-	const failedComponents = getFailedComponentResults(gradingResult);
-	if (failedComponents.length > 0) return failedComponents.map(getAssertionLabel);
-	return gradingResult ? [getAssertionLabel(gradingResult)] : [];
-}
-function getFailureDetails(result) {
-	const lines = [`Score: ${result.score}`, `Reason: ${JUNIT_ASSERTION_FAILURE_MESSAGE}`];
-	const failedAssertionLabels = getFailedAssertionLabels(result.gradingResult);
-	if (failedAssertionLabels.length > 0) {
-		lines.push("Failed assertions:");
-		for (const label of failedAssertionLabels) lines.push(`- ${label}`);
-	}
-	return truncateText(lines.join("\n").replace(INVALID_XML_CHARACTERS, ""), MAX_JUNIT_DETAIL_LENGTH);
-}
-function projectEvalResult(result) {
-	const projected = "toEvaluateResult" in result ? result.toEvaluateResult() : result;
-	return {
-		description: projected.description,
-		error: projected.error,
-		failureReason: projected.failureReason,
-		gradingResult: projected.gradingResult,
-		latencyMs: projected.latencyMs,
-		prompt: projected.prompt,
-		promptId: projected.promptId,
-		promptIdx: projected.promptIdx,
-		provider: projected.provider,
-		score: projected.score,
-		success: projected.success,
-		testCase: projected.testCase,
-		testIdx: projected.testIdx
-	};
-}
-async function* iterateJunitProjectedResults(evalRecord) {
-	if (evalRecord.useOldResults()) {
-		const results = await evalRecord.getResults();
-		for (const result of results) yield projectEvalResult(result);
-		return;
-	}
-	if (!evalRecord.persisted) {
-		for (const result of evalRecord.results) yield projectEvalResult(result);
-		return;
-	}
-	for await (const batchResults of evalRecord.fetchResultsBatched()) for (const result of batchResults) yield projectEvalResult(result);
-}
-async function buildJunitSuites(evalRecord) {
-	const suites = /* @__PURE__ */ new Map();
-	const providersByDisplayName = /* @__PURE__ */ new Map();
-	for await (const result of iterateJunitProjectedResults(evalRecord)) {
-		const { provider } = result;
-		const providerKey = JSON.stringify([provider.id ?? "", provider.label ?? ""]);
-		const promptKey = result.promptId || `prompt-index:${result.promptIdx}`;
-		const key = JSON.stringify([providerKey, promptKey]);
-		let suite = suites.get(key);
-		if (!suite) {
-			const rawName = provider.label || provider.id || "";
-			const displayName = normalizeInlineText(rawName, "unknown provider");
-			const providers = providersByDisplayName.get(displayName) ?? /* @__PURE__ */ new Set();
-			providers.add(providerKey);
-			providersByDisplayName.set(displayName, providers);
-			suite = {
-				providerKey,
-				rawName,
-				promptKey,
-				promptIdx: result.promptIdx,
-				displayName: "",
-				errors: 0,
-				failures: 0,
-				testcases: [],
-				timeMs: 0
-			};
-			suites.set(key, suite);
-		}
-		suite.promptIdx = Math.min(suite.promptIdx, result.promptIdx);
-		suite.testcases.push({
-			testcase: buildJunitTestCase(result),
-			testIdx: result.testIdx
-		});
-		suite.timeMs += result.latencyMs;
-		if (!result.success) {
-			if (result.failureReason === require_tables.ResultFailureReason.ASSERT) suite.failures += 1;
-			else suite.errors += 1;
-		}
-	}
-	const promptCountsByProvider = /* @__PURE__ */ new Map();
-	const orderedSuites = [...suites.values()].sort((a, b) => a.promptIdx - b.promptIdx || a.promptKey.localeCompare(b.promptKey));
-	for (const suite of orderedSuites) {
-		const baseName = normalizeInlineText(suite.rawName, "unknown provider");
-		const suffix = (providersByDisplayName.get(baseName)?.size ?? 0) > 1 || suite.rawName.search(INVALID_XML_CHARACTERS) !== -1 ? ` (${require_createHash.sha256(suite.providerKey).slice(0, 16)})` : "";
-		const providerName = normalizeInlineText(suite.rawName, "unknown provider", MAX_JUNIT_NAME_LENGTH - suffix.length);
-		const ordinal = (promptCountsByProvider.get(suite.providerKey) ?? 0) + 1;
-		promptCountsByProvider.set(suite.providerKey, ordinal);
-		suite.displayName = `[${providerName}] prompt ${ordinal}${suffix}`;
-		for (const { testcase } of suite.testcases) testcase["@_classname"] = suite.displayName;
-	}
-	return [...suites.values()];
-}
-function buildJunitTestCase(result) {
-	const testcase = {
-		"@_name": getTestCaseName(result),
-		"@_time": formatDurationSeconds(result.latencyMs)
-	};
-	if (!result.success) {
-		if (result.failureReason === require_tables.ResultFailureReason.ASSERT) testcase.failure = {
-			"#text": getFailureDetails(result),
-			"@_message": JUNIT_ASSERTION_FAILURE_MESSAGE,
-			"@_type": "assertion"
-		};
-		else testcase.error = {
-			"#text": `Reason: ${JUNIT_EVALUATION_ERROR_MESSAGE}`,
-			"@_message": JUNIT_EVALUATION_ERROR_MESSAGE,
-			"@_type": "error"
-		};
-	}
-	return testcase;
-}
-async function createJunitXml(evalRecord) {
-	const suites = await buildJunitSuites(evalRecord);
-	const tests = suites.reduce((sum, suite) => sum + suite.testcases.length, 0);
-	const failures = suites.reduce((sum, suite) => sum + suite.failures, 0);
-	const errors = suites.reduce((sum, suite) => sum + suite.errors, 0);
-	const totalTimeMs = suites.reduce((sum, suite) => sum + suite.timeMs, 0);
-	const timestamp = getEvaluationTimestamp(evalRecord);
-	return new fast_xml_parser.XMLBuilder({
-		format: true,
-		ignoreAttributes: false,
-		indentBy: "  "
-	}).build({
-		"?xml": {
-			"@_version": "1.0",
-			"@_encoding": "UTF-8"
-		},
-		testsuites: {
-			"@_errors": errors,
-			"@_failures": failures,
-			"@_name": "promptfoo",
-			"@_skipped": 0,
-			"@_tests": tests,
-			"@_time": formatDurationSeconds(totalTimeMs),
-			testsuite: suites.map((suite) => ({
-				"@_errors": suite.errors,
-				"@_failures": suite.failures,
-				"@_name": suite.displayName,
-				"@_skipped": 0,
-				"@_tests": suite.testcases.length,
-				"@_time": formatDurationSeconds(suite.timeMs),
-				...timestamp ? { "@_timestamp": timestamp } : {},
-				testcase: suite.testcases.sort((a, b) => a.testIdx - b.testIdx).map(({ testcase }) => testcase)
-			}))
-		}
-	}).replace(INVALID_XML_CHARACTERS, "");
-}
-async function writeJunitXmlOutput(outputPath, evalRecord) {
-	await fs_promises.writeFile(outputPath, await createJunitXml(evalRecord));
-}
-const SUPPORTED_OUTPUT_FILE_FORMATS = [...require_tables.OutputFileExtension.options, "junit.xml"];
-function getOutputFileFormat(outputPath) {
-	if (outputPath.toLowerCase().endsWith(".junit.xml")) return "junit.xml";
-	return require_tables.OutputFileExtension.safeParse(path.extname(outputPath).slice(1).toLowerCase()).data;
-}
-//#endregion
-//#region src/util/output.ts
-function warnOnDegradedJsonlRecovery(evalRecord, outputPaths) {
-	if (!evalRecord.resultPersistenceFailed) return;
-	if (outputPaths.some((outputPath) => getOutputFileFormat(outputPath) === "jsonl")) require_logger.logger.warn("[Output] Reconciling JSONL from streamed rows and the eval record because one or more rows failed to persist");
-}
-function isFileNotFoundError(error) {
-	return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
-}
-function isPermissionDeniedError(error) {
-	return error !== null && typeof error === "object" && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
-}
-async function resolveJsonlOutputPath(outputPath) {
-	try {
-		if (!(await fs_promises.lstat(outputPath)).isSymbolicLink()) return outputPath;
-		try {
-			return await fs_promises.realpath(outputPath);
-		} catch (error) {
-			if (isFileNotFoundError(error)) return path.resolve(path.dirname(outputPath), await fs_promises.readlink(outputPath));
-			throw error;
-		}
-	} catch (error) {
-		if (isFileNotFoundError(error)) return outputPath;
-		throw error;
-	}
-}
-async function appendJsonlResultBatch(outputPath, results, stripFlags) {
-	if (results.length === 0) return;
-	const text = results.map((result) => JSON.stringify(sanitizeResultForJsonlArtifact(result, stripFlags))).join(os.EOL) + os.EOL;
-	await fs_promises.appendFile(outputPath, text);
-}
-async function readStreamedJsonlResults(outputPath) {
-	let contents;
-	try {
-		contents = await fs_promises.readFile(outputPath, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	}
-	const results = [];
-	const lines = contents.split(/\r?\n/).filter(Boolean);
-	for (const [index, line] of lines.entries()) try {
-		results.push(JSON.parse(line));
-	} catch (error) {
-		require_logger.logger.warn(`[Output] Skipping malformed streamed JSONL row at ${outputPath}:${index + 1} during recovery: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	return results;
-}
-async function collectJsonlResultsAfterPersistenceFailure(outputPath, evalRecord) {
-	const stripFlags = getStripFlags(evalRecord.config.env);
-	const finalResults = /* @__PURE__ */ new Map();
-	const put = (result) => finalResults.set(getResultIndexKey(result), result);
-	for (const result of await readStreamedJsonlResults(outputPath)) put(result);
-	for await (const batchResults of evalRecord.fetchResultsBatched()) for (const result of batchResults) {
-		const evaluateResult = asEvaluateResult(result, stripFlags);
-		if (!evalRecord.hasResultPersistenceFailure(evaluateResult)) put(evaluateResult);
-	}
-	for (const result of evalRecord.getFinalJsonlResults()) put(result);
-	return Array.from(finalResults.values());
-}
-async function getExistingFileMode(outputPath) {
-	try {
-		return (await fs_promises.stat(outputPath)).mode & 4095;
-	} catch (error) {
-		if (isFileNotFoundError(error)) return;
-		throw error;
-	}
-}
-async function appendJsonlResults(outputPath, evalRecord, recoveredResults) {
-	const stripFlags = getStripFlags(evalRecord.config.env);
-	if (recoveredResults) {
-		await appendJsonlResultBatch(outputPath, recoveredResults, stripFlags);
-		return;
-	}
-	for await (const batchResults of evalRecord.fetchResultsBatched()) await appendJsonlResultBatch(outputPath, batchResults.map((result) => asEvaluateResult(result, stripFlags)), stripFlags);
-}
-async function rewriteJsonlWithExternalBackup(outputPath, outputMode, evalRecord, preparedReplacementPath, recoveredResults) {
-	const tempDirectory = await fs_promises.mkdtemp(path.join(os.tmpdir(), "promptfoo-jsonl-"));
-	const backupPath = path.join(tempDirectory, "backup.jsonl");
-	const replacementPath = path.join(tempDirectory, "replacement.jsonl");
-	let overwriteAttempted = false;
-	let preserveTempDirectory = false;
-	let hasBackup = false;
-	try {
-		try {
-			await fs_promises.copyFile(outputPath, backupPath);
-			hasBackup = true;
-		} catch (error) {
-			if (!isFileNotFoundError(error)) throw error;
-		}
-		if (preparedReplacementPath) await fs_promises.copyFile(preparedReplacementPath, replacementPath);
-		else {
-			if (outputMode === void 0) await fs_promises.writeFile(replacementPath, "");
-			else await fs_promises.writeFile(replacementPath, "", { mode: outputMode });
-			await appendJsonlResults(replacementPath, evalRecord, recoveredResults);
-		}
-		overwriteAttempted = true;
-		await fs_promises.copyFile(replacementPath, outputPath);
-		if (outputMode !== void 0) await fs_promises.chmod(outputPath, outputMode);
-	} catch (error) {
-		if (overwriteAttempted && hasBackup) try {
-			await fs_promises.copyFile(backupPath, outputPath);
-		} catch (restoreError) {
-			preserveTempDirectory = true;
-			require_logger.logger.error("[Output] Failed to restore JSONL output after rewrite failure", {
-				backupPath,
-				error: restoreError
-			});
-			throw new Error(`Failed to rewrite JSONL output (${error instanceof Error ? error.message : String(error)}) and restore backup (${restoreError instanceof Error ? restoreError.message : String(restoreError)}). Backup retained at ${backupPath}`);
-		}
-		throw error;
-	} finally {
-		if (!preserveTempDirectory) await fs_promises.rm(tempDirectory, {
-			recursive: true,
-			force: true
-		}).catch((error) => {
-			require_logger.logger.warn("[Output] Failed to remove temporary JSONL backup directory", {
-				error,
-				tempDirectory
-			});
-		});
-	}
-}
-async function removeTemporaryJsonlOutput(tempOutputPath) {
-	await fs_promises.rm(tempOutputPath, { force: true }).catch((error) => {
-		require_logger.logger.warn("[Output] Failed to remove temporary JSONL output", {
-			error,
-			tempOutputPath
-		});
-	});
-}
-const outputToSimpleString = (output) => {
-	const passFailText = output.pass ? "[PASS]" : output.failureReason === require_tables.ResultFailureReason.ASSERT ? "[FAIL]" : "[ERROR]";
-	const namedScoresText = Object.entries(output.namedScores).map(([name, value]) => `${name}: ${value?.toFixed(2)}`).join(", ");
-	const scoreText = namedScoresText.length > 0 ? `(${output.score?.toFixed(2)}, ${namedScoresText})` : `(${output.score?.toFixed(2)})`;
-	const gradingResultText = output.gradingResult ? `${output.pass ? "Pass" : "Fail"} Reason: ${output.gradingResult.reason}` : "";
-	return dedent.default`
-      ${passFailText} ${scoreText}
-
-      ${output.text}
-
-      ${gradingResultText}
-    `.trim();
-};
-const outputToHtmlReportCell = (output) => {
-	const status = output.pass ? "pass" : output.failureReason === require_tables.ResultFailureReason.ERROR ? "error" : "fail";
-	const namedScores = Object.entries(output.namedScores).map(([name, value]) => ({
-		name,
-		value: value?.toFixed(2)
-	}));
-	return {
-		status,
-		statusLabel: status.toUpperCase(),
-		score: output.score?.toFixed(2),
-		namedScores,
-		text: output.text,
-		reason: output.gradingResult?.reason || "",
-		prompt: output.prompt,
-		provider: output.provider || "",
-		error: output.error || "",
-		failureReason: output.failureReason,
-		latencyDisplay: Number.isFinite(output.latencyMs) ? `${output.latencyMs.toFixed(0)} ms` : "",
-		costDisplay: Number.isFinite(output.cost) && output.cost > 0 ? `$${output.cost.toFixed(6)}` : "",
-		totalTokensDisplay: typeof output.tokenUsage?.total === "number" ? output.tokenUsage.total.toLocaleString("en-US") : "",
-		promptTokensDisplay: typeof output.tokenUsage?.prompt === "number" ? output.tokenUsage.prompt.toLocaleString("en-US") : "",
-		completionTokensDisplay: typeof output.tokenUsage?.completion === "number" ? output.tokenUsage.completion.toLocaleString("en-US") : ""
-	};
-};
-async function createOutputSummary(evalRecord, stripFlags) {
-	const summary = await evalRecord.toEvaluateSummary();
-	const prompts = ("prompts" in summary ? summary.prompts : summary.table.head.prompts).map((prompt) => prompt.config ? {
-		...prompt,
-		config: require_logger.sanitizeConfigForOutput(prompt.config, stripFlags)
-	} : prompt);
-	return "prompts" in summary ? {
-		...summary,
-		prompts
-	} : {
-		...summary,
-		table: {
-			...summary.table,
-			head: {
-				...summary.table.head,
-				prompts
-			}
-		}
-	};
-}
-function resultsForMediaExportScan(results, shouldStripResponseOutput) {
-	if (!shouldStripResponseOutput) return results;
-	return {
-		...results,
-		results: results.results.map((result) => {
-			const response = result.response;
-			if (!response?.metadata || !("blobUris" in response.metadata)) return result;
-			const { metadata: responseMetadata, ...projectedResponse } = response;
-			const { blobUris: _blobUris, ...metadata } = responseMetadata;
-			return {
-				...result,
-				response: {
-					...projectedResponse,
-					...Object.keys(metadata).length > 0 && { metadata }
-				}
-			};
-		})
-	};
-}
-function createOutputMetadata(evalRecord) {
-	let evaluationCreatedAt;
-	if (evalRecord.createdAt) try {
-		const date = new Date(evalRecord.createdAt);
-		evaluationCreatedAt = Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
-	} catch {
-		evaluationCreatedAt = void 0;
-	}
-	return {
-		promptfooVersion: require_fetch.VERSION,
-		nodeVersion: process.version,
-		platform: os.platform(),
-		arch: os.arch(),
-		exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		evaluationCreatedAt,
-		author: evalRecord.author ?? void 0
-	};
-}
-async function createOutputData(evalRecord, shareableUrl, options = {}) {
-	const stripFlags = getStripFlags(evalRecord.config.env);
-	const summary = await createOutputSummary(evalRecord, stripFlags);
-	const redactedConfig = require_logger.sanitizeConfigForOutput(evalRecord.config, stripFlags);
-	let traces;
-	try {
-		const { getTraceStore } = await Promise.resolve().then(() => require("./store-D8Q5EmyP.cjs")).then((n) => n.store_exports);
-		traces = await getTraceStore().getTracesByEvaluation(evalRecord.id);
-	} catch (error) {
-		require_logger.logger.warn(`Failed to fetch traces for output ${evalRecord.id}; traces omitted from export: ${error}`);
-	}
-	const output = {
-		evalId: evalRecord.id,
-		results: summary,
-		config: redactedConfig,
-		shareableUrl,
-		metadata: createOutputMetadata(evalRecord),
-		...evalRecord.vars?.length > 0 && { vars: [...evalRecord.vars] },
-		...evalRecord.runtimeOptions && { runtimeOptions: require_logger.sanitizeRuntimeOptions(evalRecord.runtimeOptions) },
-		...traces && traces.length > 0 && { traces: projectTracesForOutput(traces, stripFlags) }
-	};
-	if (options.includeMedia) {
-		const blobAssets = await exportBlobAssets(evalRecord.id, summary, stripFlags.shouldStripResponseOutput, output.traces);
-		if (blobAssets.length > 0) output.blobAssets = blobAssets;
-	}
-	return output;
-}
-async function exportBlobAssets(evalId, results, shouldStripResponseOutput, traces) {
-	const { getShareAuthorizedBlob } = await Promise.resolve().then(() => require("./blobs-CwaJ7l1g.cjs")).then((n) => n.blobs_exports);
-	const assets = [];
-	for (const hash of require_extractor.collectBlobHashes({
-		results: resultsForMediaExportScan(results, shouldStripResponseOutput),
-		traces
-	})) try {
-		const blob = await getShareAuthorizedBlob(hash, evalId);
-		if (!blob) continue;
-		if (blob.data.length > 52428800) {
-			require_logger.logger.warn("[Output] Skipping oversized blob in eval export", {
-				hash,
-				sizeBytes: blob.data.length
-			});
-			continue;
-		}
-		assets.push({
-			hash,
-			mimeType: blob.metadata.mimeType,
-			sizeBytes: blob.data.length,
-			data: blob.data.toString("base64")
-		});
-	} catch (error) {
-		require_logger.logger.warn("[Output] Skipping missing blob in eval export", {
-			error,
-			hash
-		});
-	}
-	return assets;
-}
-/**
-* JSON writer with improved error handling for large datasets.
-* Provides helpful error messages when memory limits are exceeded.
-*/
-async function writeJsonOutputSafely(outputPath, evalRecord, shareableUrl, options) {
-	try {
-		const outputData = await createOutputData(evalRecord, shareableUrl, options);
-		const jsonString = JSON.stringify(outputData, null, 2);
-		await fs_promises.writeFile(outputPath, jsonString);
-	} catch (error) {
-		const msg = error?.message ?? "";
-		const isStringLen = error instanceof RangeError && msg.includes("Invalid string length");
-		const isHeapOOM = /heap out of memory|Array buffer allocation failed|ERR_STRING_TOO_LONG/i.test(msg);
-		if (isStringLen || isHeapOOM) {
-			const resultCount = await evalRecord.getResultsCount();
-			require_logger.logger.error(`Dataset too large for JSON export (${resultCount} results).`);
-			throw new Error(`Dataset too large for JSON export. The evaluation has ${resultCount} results which exceeds memory limits. Consider using JSONL format instead: --output output.jsonl`);
-		} else throw error;
-	}
-}
-async function writeOutput(outputPath, evalRecord, shareableUrl, options = {}) {
-	if (outputPath.match(/^https:\/\/docs\.google\.com\/spreadsheets\//)) {
-		const table = await evalRecord.getTable();
-		const rows = table.body.map((row) => {
-			const csvRow = {};
-			table.head.vars.forEach((varName, index) => {
-				csvRow[varName] = row.vars[index];
-			});
-			table.head.prompts.forEach((prompt, index) => {
-				csvRow[`[${prompt.provider}] ${prompt.label}`] = outputToSimpleString(row.outputs[index]);
-			});
-			return csvRow;
-		});
-		require_logger.logger.info(`Writing ${rows.length} rows to Google Sheets...`);
-		await writeCsvToGoogleSheet(rows, outputPath);
-		return;
-	}
-	const outputExtension = getOutputFileFormat(outputPath);
-	require_invariant.invariant(outputExtension, `Unsupported output file format ${path.extname(outputPath).slice(1).toLowerCase()}. Please use one of: ${SUPPORTED_OUTPUT_FILE_FORMATS.join(", ")}.`);
-	const outputDir = path.dirname(outputPath);
-	await fs_promises.mkdir(outputDir, { recursive: true });
-	if (outputExtension === "junit.xml") await writeJunitXmlOutput(outputPath, evalRecord);
-	else if (outputExtension === "csv") {
-		const fileHandle = await fs_promises.open(outputPath, "w");
-		try {
-			await streamEvalCsv(evalRecord, {
-				isRedteam: Boolean(evalRecord.config.redteam),
-				write: async (data) => {
-					await fileHandle.write(data);
-				}
-			});
-		} finally {
-			await fileHandle.close();
-		}
-	} else if (outputExtension === "json") await writeJsonOutputSafely(outputPath, evalRecord, shareableUrl, options);
-	else if (outputExtension === "yaml" || outputExtension === "yml" || outputExtension === "txt") await fs_promises.writeFile(outputPath, js_yaml.dump(await createOutputData(evalRecord, shareableUrl, options)));
-	else if (outputExtension === "html") {
-		const table = await evalRecord.getTable();
-		const stripFlags = getStripFlags(evalRecord.config.env);
-		const summary = await createOutputSummary(evalRecord, stripFlags);
-		const redactedConfig = require_logger.sanitizeConfigForOutput(evalRecord.config, stripFlags);
-		const metadata = createOutputMetadata(evalRecord);
-		const template = await fs_promises.readFile(path.join(require_esm.getDirectory(), "tableOutput.html"), "utf-8");
-		const htmlTable = [[...table.head.vars, ...table.head.prompts.map((prompt) => `[${prompt.provider}] ${prompt.label}`)], ...table.body.map((row, rowIndex) => [...row.vars.map((value, variableIndex) => ({
-			kind: "variable",
-			name: table.head.vars[variableIndex],
-			text: value
-		})), ...row.outputs.map((output, outputIndex) => ({
-			kind: "output",
-			detailId: `result-detail-${rowIndex}-${outputIndex}`,
-			detailTitle: `Result detail - row ${rowIndex + 1}, prompt ${outputIndex + 1}`,
-			description: row.description || row.test?.description || "",
-			...outputToHtmlReportCell(output)
-		}))])];
-		const reportOutputs = table.body.flatMap((row) => row.outputs);
-		const totalResults = reportOutputs.length;
-		const successes = reportOutputs.filter((output) => output.pass).length;
-		const errors = reportOutputs.filter((output) => !output.pass && output.failureReason === require_tables.ResultFailureReason.ERROR).length;
-		const failures = totalResults - successes - errors;
-		const passRate = totalResults > 0 ? successes / totalResults * 100 : 0;
-		const htmlOutput = require_render.getNunjucksEngine().renderString(template, {
-			config: redactedConfig,
-			table: htmlTable,
-			results: summary,
-			metadata,
-			report: {
-				totalResults,
-				totalRows: table.body.length,
-				promptCount: table.head.prompts.length,
-				variableCount: table.head.vars.length,
-				successes,
-				failures,
-				errors,
-				passRateDisplay: `${passRate.toFixed(1)}%`
-			}
-		});
-		await fs_promises.writeFile(outputPath, htmlOutput);
-	} else if (outputExtension === "jsonl") {
-		const jsonlOutputPath = await resolveJsonlOutputPath(outputPath);
-		if (jsonlOutputPath !== outputPath) await fs_promises.mkdir(path.dirname(jsonlOutputPath), { recursive: true });
-		const outputMode = await getExistingFileMode(jsonlOutputPath);
-		const recoveredResults = evalRecord.resultPersistenceFailed ? await collectJsonlResultsAfterPersistenceFailure(jsonlOutputPath, evalRecord) : void 0;
-		const tempOutputPath = path.join(path.dirname(jsonlOutputPath), `.promptfoo-${(0, crypto$1.randomUUID)()}.tmp`);
-		try {
-			try {
-				await fs_promises.writeFile(tempOutputPath, "");
-			} catch (error) {
-				if (isPermissionDeniedError(error)) {
-					require_logger.logger.warn("[Output] Falling back to JSONL rewrite with external backup because the output directory is not writable");
-					await rewriteJsonlWithExternalBackup(jsonlOutputPath, outputMode, evalRecord, void 0, recoveredResults);
-					return;
-				}
-				throw error;
-			}
-			await appendJsonlResults(tempOutputPath, evalRecord, recoveredResults);
-			if (outputMode !== void 0) await fs_promises.chmod(tempOutputPath, outputMode);
-			try {
-				await fs_promises.rename(tempOutputPath, jsonlOutputPath);
-			} catch (error) {
-				if (isPermissionDeniedError(error)) {
-					require_logger.logger.warn("[Output] Falling back to JSONL rewrite with external backup because replacing the output file is not permitted");
-					await rewriteJsonlWithExternalBackup(jsonlOutputPath, outputMode, evalRecord, tempOutputPath);
-					await removeTemporaryJsonlOutput(tempOutputPath);
-					return;
-				}
-				throw error;
-			}
-		} catch (error) {
-			await removeTemporaryJsonlOutput(tempOutputPath);
-			throw error;
-		}
-	} else if (outputExtension === "xml") {
-		const stripFlags = getStripFlags(evalRecord.config.env);
-		const summary = await createOutputSummary(evalRecord, stripFlags);
-		const redactedConfig = require_logger.sanitizeConfigForOutput(evalRecord.config, stripFlags);
-		const sanitizeForXml = (obj) => {
-			if (obj === null || obj === void 0) return "";
-			if (Array.isArray(obj)) return obj.map(sanitizeForXml);
-			if (typeof obj === "object") {
-				const sanitized = {};
-				for (const [key, value] of Object.entries(obj)) sanitized[key] = sanitizeForXml(value);
-				return sanitized;
-			}
-			return String(obj);
-		};
-		const xmlData = new fast_xml_parser.XMLBuilder({
-			ignoreAttributes: false,
-			format: true,
-			indentBy: "  "
-		}).build({ promptfoo: {
-			evalId: evalRecord.id,
-			results: sanitizeForXml(summary),
-			config: sanitizeForXml(redactedConfig),
-			shareableUrl: shareableUrl || ""
-		} });
-		await fs_promises.writeFile(outputPath, xmlData);
-	}
-}
-async function writeMultipleOutputs(outputPaths, evalRecord, shareableUrl) {
-	const errors = (await Promise.allSettled(outputPaths.map((outputPath) => writeOutput(outputPath, evalRecord, shareableUrl)))).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
-	if (errors.length > 0) throw Object.assign(/* @__PURE__ */ new Error("One or more output writes failed"), { errors });
-}
-//#endregion
-//#region src/util/runtime.ts
-function printBorder() {
-	const border = "=".repeat(require_fetch.TERMINAL_MAX_WIDTH);
-	require_logger.logger.info(border);
-}
-//#endregion
-//#region src/util/dataUrl.ts
-/**
-* Check if a string is a data URL
-* @param value String to check
-* @returns true if value is a data URL (starts with "data:")
-*
-* @example
-* isDataUrl("data:image/jpeg;base64,/9j/...") // true
-* isDataUrl("/9j/4AAQSkZJRg...") // false
-* isDataUrl("https://example.com/image.jpg") // false
-*/
-function isDataUrl(value) {
-	return typeof value === "string" && value.startsWith("data:") && value.length > 5;
-}
-/**
-* Parse a data URL into its components
-*
-* Handles data URLs with optional parameters (e.g., charset, name):
-* - `data:image/jpeg;base64,<data>` - Standard format
-* - `data:image/jpeg;charset=utf-8;base64,<data>` - With charset
-* - `data:image/jpeg;name=photo.jpg;base64,<data>` - With filename
-*
-* @param dataUrl Data URL string
-* @returns Parsed components (mimeType and base64Data) or null if invalid
-*
-* @example
-* parseDataUrl("data:image/jpeg;base64,/9j/...")
-* // { mimeType: "image/jpeg", base64Data: "/9j/..." }
-*
-* parseDataUrl("data:image/jpeg;charset=utf-8;base64,/9j/...")
-* // { mimeType: "image/jpeg", base64Data: "/9j/..." }
-*
-* parseDataUrl("invalid") // null
-*/
-function parseDataUrl(dataUrl) {
-	if (!isDataUrl(dataUrl)) return null;
-	const match = dataUrl.match(/^data:([^;,]+)(?:;[^,]*)?;base64,(.+)$/);
-	if (!match) return null;
-	return {
-		mimeType: match[1].trim(),
-		base64Data: match[2].trim()
-	};
-}
-/**
-* Extract base64 data from a data URL or return original if not a data URL
-* Useful for providers that expect raw base64 (Anthropic, Google)
-*
-* @param value Data URL or raw base64 string
-* @returns Raw base64 string (data URL prefix stripped if present)
-*
-* @example
-* extractBase64FromDataUrl("data:image/jpeg;base64,/9j/...")
-* // "/9j/..."
-*
-* extractBase64FromDataUrl("/9j/...") // "/9j/..." (unchanged)
-*/
-function extractBase64FromDataUrl(value) {
-	const parsed = parseDataUrl(value);
-	return parsed ? parsed.base64Data : value;
-}
-/**
-* Build a data URI from a MIME type and base64 data.
-*
-* @param mimeType MIME type (e.g. "image/png")
-* @param base64Data Raw base64-encoded data
-* @returns Data URI string
-*
-* @example
-* toDataUri("image/png", "iVBORw0KGgo...")
-* // "data:image/png;base64,iVBORw0KGgo..."
-*/
-function toDataUri(mimeType, base64Data) {
-	return `data:${mimeType};base64,${base64Data}`;
-}
-//#endregion
-Object.defineProperty(exports, "EvalResult", {
-	enumerable: true,
-	get: function() {
-		return EvalResult;
-	}
-});
-Object.defineProperty(exports, "FILE_METADATA_KEY", {
-	enumerable: true,
-	get: function() {
-		return FILE_METADATA_KEY;
-	}
-});
-Object.defineProperty(exports, "HUMAN_ASSERTION_TYPE", {
-	enumerable: true,
-	get: function() {
-		return HUMAN_ASSERTION_TYPE;
-	}
-});
-Object.defineProperty(exports, "PROMPTFOO_METADATA_KEY", {
-	enumerable: true,
-	get: function() {
-		return PROMPTFOO_METADATA_KEY;
-	}
-});
-Object.defineProperty(exports, "asEvaluateResult", {
-	enumerable: true,
-	get: function() {
-		return asEvaluateResult;
-	}
-});
-Object.defineProperty(exports, "checkProviderApiKeys", {
-	enumerable: true,
-	get: function() {
-		return checkProviderApiKeys;
-	}
-});
-Object.defineProperty(exports, "deduplicateTestCases", {
-	enumerable: true,
-	get: function() {
-		return deduplicateTestCases;
-	}
-});
-Object.defineProperty(exports, "doesProviderRefMatch", {
-	enumerable: true,
-	get: function() {
-		return doesProviderRefMatch;
-	}
-});
-Object.defineProperty(exports, "extractBase64FromDataUrl", {
-	enumerable: true,
-	get: function() {
-		return extractBase64FromDataUrl;
-	}
-});
-Object.defineProperty(exports, "extractRuntimeVars", {
-	enumerable: true,
-	get: function() {
-		return extractRuntimeVars;
-	}
-});
-Object.defineProperty(exports, "fetchCsvFromGoogleSheet", {
-	enumerable: true,
-	get: function() {
-		return fetchCsvFromGoogleSheet;
-	}
-});
-Object.defineProperty(exports, "filterRuntimeVars", {
-	enumerable: true,
-	get: function() {
-		return filterRuntimeVars;
-	}
-});
-Object.defineProperty(exports, "generateIdFromPrompt", {
-	enumerable: true,
-	get: function() {
-		return generateIdFromPrompt;
-	}
-});
-Object.defineProperty(exports, "getCachedResultsCount", {
-	enumerable: true,
-	get: function() {
-		return getCachedResultsCount;
-	}
-});
-Object.defineProperty(exports, "getOutputFileFormat", {
-	enumerable: true,
-	get: function() {
-		return getOutputFileFormat;
-	}
-});
-Object.defineProperty(exports, "getProviderDescription", {
-	enumerable: true,
-	get: function() {
-		return getProviderDescription;
-	}
-});
-Object.defineProperty(exports, "getProviderIdentifier", {
-	enumerable: true,
-	get: function() {
-		return getProviderIdentifier;
-	}
-});
-Object.defineProperty(exports, "getResultIndexKey", {
-	enumerable: true,
-	get: function() {
-		return getResultIndexKey;
-	}
-});
-Object.defineProperty(exports, "getStripFlags", {
-	enumerable: true,
-	get: function() {
-		return getStripFlags;
-	}
-});
-Object.defineProperty(exports, "getTotalResultRowCount", {
-	enumerable: true,
-	get: function() {
-		return getTotalResultRowCount;
-	}
-});
-Object.defineProperty(exports, "hashPrompt", {
-	enumerable: true,
-	get: function() {
-		return hashPrompt;
-	}
-});
-Object.defineProperty(exports, "invalidateEvaluationCache", {
-	enumerable: true,
-	get: function() {
-		return invalidateEvaluationCache;
-	}
-});
-Object.defineProperty(exports, "isAnthropicProvider", {
-	enumerable: true,
-	get: function() {
-		return isAnthropicProvider;
-	}
-});
-Object.defineProperty(exports, "isDataUrl", {
-	enumerable: true,
-	get: function() {
-		return isDataUrl;
-	}
-});
-Object.defineProperty(exports, "isGoogleProvider", {
-	enumerable: true,
-	get: function() {
-		return isGoogleProvider;
-	}
-});
-Object.defineProperty(exports, "isOpenAiProvider", {
-	enumerable: true,
-	get: function() {
-		return isOpenAiProvider;
-	}
-});
-Object.defineProperty(exports, "isProviderAllowed", {
-	enumerable: true,
-	get: function() {
-		return isProviderAllowed;
-	}
-});
-Object.defineProperty(exports, "isProviderConfigFileReference", {
-	enumerable: true,
-	get: function() {
-		return isProviderConfigFileReference;
-	}
-});
-Object.defineProperty(exports, "loadProviderConfigsFromFile", {
-	enumerable: true,
-	get: function() {
-		return loadProviderConfigsFromFile;
-	}
-});
-Object.defineProperty(exports, "maybeFilePath", {
-	enumerable: true,
-	get: function() {
-		return maybeFilePath;
-	}
-});
-Object.defineProperty(exports, "normalizeInput", {
-	enumerable: true,
-	get: function() {
-		return normalizeInput;
-	}
-});
-Object.defineProperty(exports, "normalizeProviderRef", {
-	enumerable: true,
-	get: function() {
-		return normalizeProviderRef;
-	}
-});
-Object.defineProperty(exports, "notifyEvaluationChanged", {
-	enumerable: true,
-	get: function() {
-		return notifyEvaluationChanged;
-	}
-});
-Object.defineProperty(exports, "notifyEvaluationsDeleted", {
-	enumerable: true,
-	get: function() {
-		return notifyEvaluationsDeleted;
-	}
-});
-Object.defineProperty(exports, "parseDataUrl", {
-	enumerable: true,
-	get: function() {
-		return parseDataUrl;
-	}
-});
-Object.defineProperty(exports, "persistRepeatMetadata", {
-	enumerable: true,
-	get: function() {
-		return persistRepeatMetadata;
-	}
-});
-Object.defineProperty(exports, "persistTraceMetadata", {
-	enumerable: true,
-	get: function() {
-		return persistTraceMetadata;
-	}
-});
-Object.defineProperty(exports, "printBorder", {
-	enumerable: true,
-	get: function() {
-		return printBorder;
-	}
-});
-Object.defineProperty(exports, "projectPrompt", {
-	enumerable: true,
-	get: function() {
-		return projectPrompt;
-	}
-});
-Object.defineProperty(exports, "projectTracesForOutput", {
-	enumerable: true,
-	get: function() {
-		return projectTracesForOutput;
-	}
-});
-Object.defineProperty(exports, "providerToIdentifier", {
-	enumerable: true,
-	get: function() {
-		return providerToIdentifier;
-	}
-});
-Object.defineProperty(exports, "queryTestIndicesOptimized", {
-	enumerable: true,
-	get: function() {
-		return queryTestIndicesOptimized;
-	}
-});
-Object.defineProperty(exports, "readProviderConfigFile", {
-	enumerable: true,
-	get: function() {
-		return readProviderConfigFile;
-	}
-});
-Object.defineProperty(exports, "resultIsForTestCase", {
-	enumerable: true,
-	get: function() {
-		return resultIsForTestCase;
-	}
-});
-Object.defineProperty(exports, "sanitizeProviderIdForLog", {
-	enumerable: true,
-	get: function() {
-		return sanitizeProviderIdForLog;
-	}
-});
-Object.defineProperty(exports, "sanitizeResultForJsonlArtifact", {
-	enumerable: true,
-	get: function() {
-		return sanitizeResultForJsonlArtifact;
-	}
-});
-Object.defineProperty(exports, "setupEnv", {
-	enumerable: true,
-	get: function() {
-		return setupEnv;
-	}
-});
-Object.defineProperty(exports, "stripTraceLinkageFromMetadata", {
-	enumerable: true,
-	get: function() {
-		return stripTraceLinkageFromMetadata;
-	}
-});
-Object.defineProperty(exports, "toDataUri", {
-	enumerable: true,
-	get: function() {
-		return toDataUri;
-	}
-});
-Object.defineProperty(exports, "toSerializableProviderRef", {
-	enumerable: true,
-	get: function() {
-		return toSerializableProviderRef;
-	}
-});
-Object.defineProperty(exports, "warnOnDegradedJsonlRecovery", {
-	enumerable: true,
-	get: function() {
-		return warnOnDegradedJsonlRecovery;
-	}
-});
-Object.defineProperty(exports, "writeMultipleOutputs", {
-	enumerable: true,
-	get: function() {
-		return writeMultipleOutputs;
-	}
-});
-
-//# sourceMappingURL=dataUrl-CGsBT7UZ.cjs.map