promptfoo 0.125.0 → 0.125.1

package/dist/src/cloud-ramjGURF.js

@@ -0,0 +1,599 @@
+import { o as logger } from "./logger-CNHLbG5Y.js";
+import { t as invariant } from "./invariant-CHP0zrix.js";
+import { Y as normalizeProviderRef } from "./dataUrl-DUSr-ZvI.js";
+import { B as CLOUD_PROVIDER_PREFIX, I as cloudConfig, t as fetchWithProxy } from "./fetch-BG_Jl7ty.js";
+import { $ as isUuid, V as UnifiedConfigSchema, Wt as ProviderOptionsSchema } from "./tables-CpHZEDfI.js";
+import { t as checkServerFeatureSupport } from "./server-C7b8z6aC.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import dedent from "dedent";
+//#region src/util/cloud.ts
+const PERMISSION_CHECK_SERVER_FEATURE_NAME = "config-permission-check-endpoint";
+const PERMISSION_CHECK_SERVER_FEATURE_DATE = "2025-09-03T14:49:11Z";
+const cloudProviderResolver = new AsyncLocalStorage();
+function parseCloudProvider(id, config) {
+	const provider = ProviderOptionsSchema.parse(config);
+	invariant(provider.id, `Provider ${id} has no id`);
+	return {
+		...provider,
+		id: provider.id
+	};
+}
+/**
+* Makes an authenticated HTTP request to the PromptFoo Cloud API.
+* @param path - The API endpoint path (with or without leading slash)
+* @param method - HTTP method (GET, POST, PUT, DELETE, etc.)
+* @param body - Optional request body that will be JSON stringified
+* @returns Promise resolving to the fetch Response object
+* @throws Error if the request fails due to network or other issues
+*/
+async function makeRequest(path, method, body) {
+	const url = `${cloudConfig.getApiHost()}/api/v1/${path.startsWith("/") ? path.slice(1) : path}`;
+	try {
+		return await fetchWithProxy(url, {
+			method,
+			body: JSON.stringify(body),
+			headers: {
+				...cloudConfig.getAuthHeaders() ?? {},
+				"Content-Type": "application/json"
+			}
+		});
+	} catch (e) {
+		logger.error("[Cloud] Failed to make request", { url });
+		throw e;
+	}
+}
+/**
+* Fetches a provider configuration from PromptFoo Cloud by its ID.
+* @param id - The unique identifier of the cloud provider
+* @param localOptions - Per-entry options for a native load; omitted for lookup only
+* @returns Promise resolving to provider options with guaranteed id field
+* @throws Error if cloud is not enabled, provider not found, or request fails
+*/
+async function getProviderFromCloud(id, localOptions) {
+	const resolver = cloudProviderResolver.getStore();
+	if (resolver) {
+		const prepared = await resolver(id, localOptions);
+		return {
+			...parseCloudProvider(id, prepared),
+			...prepared.env && { env: prepared.env }
+		};
+	}
+	if (!cloudConfig.isEnabled()) throw new Error(`Could not fetch Provider ${id} from cloud. Cloud config is not enabled. Please run \`promptfoo auth login\` to login.`);
+	try {
+		const response = await makeRequest(`providers/${id}`, "GET");
+		if (!response.ok) {
+			const errorMessage = await response.text();
+			logger.error(`[Cloud] Failed to fetch provider from cloud: ${errorMessage}. HTTP Status: ${response.status} -- ${response.statusText}.`);
+			throw new Error(`Failed to fetch provider from cloud: ${response.statusText}`);
+		}
+		const body = await response.json();
+		logger.debug(`Provider fetched from cloud: ${id}`);
+		return parseCloudProvider(id, body.config);
+	} catch (e) {
+		logger.error(`Failed to fetch provider from cloud: ${id}.`);
+		logger.error(String(e));
+		throw new Error(`Failed to fetch provider from cloud: ${id}.`);
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function fetchCloudConfig(path) {
+	const response = await makeRequest(path, "GET");
+	if (!response.ok) {
+		const errorMessage = typeof response.text === "function" ? await response.text() : "";
+		logger.error(`[Cloud] Failed to fetch config from cloud: ${errorMessage}. HTTP Status: ${response.status} -- ${response.statusText}.`);
+		throw new Error(`Failed to fetch config from cloud: ${response.statusText}`);
+	}
+	return response.json();
+}
+function looksLikeEvalConfig(config) {
+	return "providers" in config || "providerIds" in config || "prompts" in config || "tests" in config || "testCases" in config;
+}
+function extractEvalConfigPayload(body) {
+	if (!isRecord(body)) throw new Error("Invalid cloud eval config response: expected a JSON object.");
+	const bodyConfig = isRecord(body.config) ? body.config : void 0;
+	if (!bodyConfig) {
+		if (looksLikeEvalConfig(body)) return body;
+		throw new Error("Invalid cloud eval config response: missing \"config\" object.");
+	}
+	const nestedConfig = isRecord(bodyConfig.config) ? bodyConfig.config : void 0;
+	if (!nestedConfig) return mergeEvalConfigEnvelope(bodyConfig, body);
+	return mergeEvalConfigEnvelope(nestedConfig, bodyConfig);
+}
+function mergeEvalConfigEnvelope(config, envelope) {
+	const mergedConfig = {
+		...config,
+		...typeof config.name !== "string" && typeof envelope.name === "string" ? { name: envelope.name } : {}
+	};
+	const envelopeMetadata = {
+		...typeof envelope.teamId === "string" ? { teamId: envelope.teamId } : {},
+		...typeof envelope.id === "string" ? { configId: envelope.id } : {}
+	};
+	if (Object.keys(envelopeMetadata).length > 0 && (mergedConfig.metadata === void 0 || isRecord(mergedConfig.metadata))) mergedConfig.metadata = {
+		...isRecord(mergedConfig.metadata) ? mergedConfig.metadata : {},
+		...envelopeMetadata
+	};
+	return mergedConfig;
+}
+function normalizeCloudEvalProvider(provider) {
+	if (isRecord(provider)) {
+		const descriptor = normalizeProviderRef(provider);
+		if (descriptor.kind === "options" && typeof provider.id === "string") {
+			const id = normalizeCloudEvalProvider(provider.id);
+			return id === provider.id ? provider : {
+				...provider,
+				id
+			};
+		}
+		if (descriptor.kind === "map") {
+			const originalOptions = provider[descriptor.loadProviderPath];
+			const options = isRecord(originalOptions) && typeof originalOptions.id === "string" ? {
+				...originalOptions,
+				id: normalizeCloudEvalProvider(originalOptions.id)
+			} : originalOptions;
+			return { [normalizeCloudEvalProvider(descriptor.loadProviderPath)]: options };
+		}
+		return provider;
+	}
+	if (typeof provider !== "string") return provider;
+	if (provider.startsWith("promptfoo://provider/") || !isUuid(provider)) return provider;
+	return `${CLOUD_PROVIDER_PREFIX}${provider}`;
+}
+function normalizeCloudEvalProviders(providers) {
+	return (Array.isArray(providers) ? providers : [providers]).map(normalizeCloudEvalProvider);
+}
+function normalizeCloudEvalPrompt(prompt) {
+	if (!isRecord(prompt)) return prompt;
+	if (typeof prompt.raw === "string") return typeof prompt.label === "string" ? prompt : {
+		...prompt,
+		label: prompt.raw
+	};
+	if (typeof prompt.content === "string") {
+		const { content, ...rest } = prompt;
+		return {
+			...rest,
+			raw: content,
+			label: typeof prompt.label === "string" ? prompt.label : content
+		};
+	}
+	return prompt;
+}
+function normalizeEvalConfig(config) {
+	const providers = config.providers === void 0 ? config.providerIds === void 0 ? config.targets === void 0 ? [] : void 0 : normalizeCloudEvalProviders(config.providerIds) : normalizeCloudEvalProviders(config.providers);
+	const targets = config.targets === void 0 ? void 0 : normalizeCloudEvalProviders(config.targets);
+	const prompts = config.prompts === void 0 ? [] : Array.isArray(config.prompts) ? config.prompts.map(normalizeCloudEvalPrompt) : config.prompts;
+	const tests = config.tests === void 0 ? config.testCases === void 0 ? [] : config.testCases : config.tests;
+	const legacyCommandLineOptions = {
+		...config.maxConcurrency == null ? {} : { maxConcurrency: config.maxConcurrency },
+		...config.delay == null ? {} : { delay: config.delay },
+		...config.verbose == null ? {} : { verbose: config.verbose }
+	};
+	const commandLineOptions = config.commandLineOptions === void 0 ? Object.keys(legacyCommandLineOptions).length > 0 ? legacyCommandLineOptions : void 0 : isRecord(config.commandLineOptions) ? {
+		...config.commandLineOptions,
+		...legacyCommandLineOptions
+	} : config.commandLineOptions;
+	const normalizedConfig = {
+		...config,
+		...providers === void 0 ? {} : { providers },
+		...targets === void 0 ? {} : { targets },
+		prompts,
+		tests,
+		...commandLineOptions === void 0 ? {} : { commandLineOptions }
+	};
+	if (typeof config.description === "string" && config.description.trim().length > 0) normalizedConfig.description = config.description;
+	else if (typeof config.name === "string" && config.name.trim().length > 0) normalizedConfig.description = config.name;
+	delete normalizedConfig.providerIds;
+	delete normalizedConfig.testCases;
+	delete normalizedConfig.maxConcurrency;
+	delete normalizedConfig.delay;
+	delete normalizedConfig.verbose;
+	delete normalizedConfig.name;
+	UnifiedConfigSchema.parse(normalizedConfig);
+	if (normalizedConfig.targets !== void 0 && normalizedConfig.providers === void 0) {
+		normalizedConfig.providers = normalizedConfig.targets;
+		delete normalizedConfig.targets;
+	}
+	return normalizedConfig;
+}
+/**
+* Fetches an eval configuration from PromptFoo Cloud by ID.
+* The response may contain legacy eval fields, which are normalized into UnifiedConfig.
+* @param id - The unique identifier of the cloud eval configuration
+* @returns Promise resolving to a normalized unified configuration object
+* @throws Error if cloud is not enabled, config not found, or response shape is invalid
+*/
+async function getEvalConfigFromCloud(id) {
+	if (!cloudConfig.isEnabled()) throw new Error(`Could not fetch Config ${id} from cloud. Cloud config is not enabled. Please run \`promptfoo auth login\` to login.`);
+	try {
+		const config = normalizeEvalConfig(extractEvalConfigPayload(await fetchCloudConfig(`eval/configs/${id}`)));
+		logger.info(`Eval config fetched from cloud: ${id}`);
+		return config;
+	} catch (e) {
+		logger.debug("[Cloud] Failed to fetch eval config", {
+			id,
+			error: e
+		});
+		if (e instanceof Error) throw e;
+		throw new Error(String(e));
+	}
+}
+/**
+* Checks if a provider path represents a cloud-based provider.
+* @param providerPath - The provider path to check
+* @returns True if the path starts with the cloud provider prefix, false otherwise
+*/
+function isCloudProvider(providerPath) {
+	return providerPath.startsWith(CLOUD_PROVIDER_PREFIX);
+}
+/**
+* Extracts the database ID from a cloud provider path.
+* @param providerPath - The cloud provider path
+* @returns The database ID portion of the path
+* @throws Error if the path is not a valid cloud provider path
+*/
+function getCloudDatabaseId(providerPath) {
+	if (!isCloudProvider(providerPath)) throw new Error(`Provider path ${providerPath} is not a cloud provider.`);
+	return providerPath.slice(CLOUD_PROVIDER_PREFIX.length);
+}
+/**
+* Get the plugin severity overrides for a cloud provider.
+* @param cloudProviderId - The cloud provider ID.
+* @returns The plugin severity overrides.
+*/
+async function getPluginSeverityOverridesFromCloud(cloudProviderId) {
+	if (!cloudConfig.isEnabled()) throw new Error(`Could not fetch plugin severity overrides from cloud. Cloud config is not enabled. Please run \`promptfoo auth login\` to login.`);
+	try {
+		const response = await makeRequest(`/providers/${cloudProviderId}`, "GET");
+		if (!response.ok) {
+			const formattedErrorMessage = `Failed to provider from cloud: ${await response.text()}. HTTP Status: ${response.status} -- ${response.statusText}.`;
+			logger.error(`[Cloud] ${formattedErrorMessage}`);
+			throw new Error(formattedErrorMessage);
+		}
+		const body = await response.json();
+		if (body.pluginSeverityOverrideId) {
+			const overrideRes = await makeRequest(`/redteam/plugins/severity-overrides/${body.pluginSeverityOverrideId}`, "GET");
+			if (!overrideRes.ok) {
+				const formattedErrorMessage = `Failed to fetch plugin severity override from cloud: ${await overrideRes.text()}. HTTP Status: ${overrideRes.status} -- ${overrideRes.statusText}.`;
+				logger.error(`[Cloud] ${formattedErrorMessage}`);
+				throw new Error(formattedErrorMessage);
+			}
+			const pluginSeverityOverride = await overrideRes.json();
+			return {
+				id: pluginSeverityOverride.id,
+				severities: pluginSeverityOverride.members.reduce((acc, member) => ({
+					...acc,
+					[member.pluginId]: member.severity
+				}), {})
+			};
+		} else {
+			logger.debug(`No plugin severity overrides found for cloud provider ${cloudProviderId}`);
+			return null;
+		}
+	} catch (e) {
+		logger.error(`Failed to fetch plugin severity overrides from cloud.`);
+		logger.error(String(e));
+		throw new Error(`Failed to fetch plugin severity overrides from cloud.`);
+	}
+}
+/**
+* Retrieves all teams for the current user from Promptfoo Cloud.
+* @returns Promise resolving to an array of team objects
+* @throws Error if the request fails
+*/
+async function getUserTeams(apiHost, apiKey, authHeaderName) {
+	const response = apiHost && apiKey ? await fetchWithProxy(`${apiHost}/api/v1/users/me/teams`, {
+		headers: { [authHeaderName || cloudConfig.getAuthHeaderName()]: `Bearer ${apiKey}` },
+		skipCloudAuthInjection: true
+	}) : await makeRequest(`/users/me/teams`, "GET");
+	if (!response.ok) throw new Error(`Failed to get user teams: ${response.statusText}`);
+	return await response.json();
+}
+/** Returns the oldest team by creation date, which matches the enterprise app's default team. */
+function getOldestTeam(teams) {
+	return [...teams].sort((teamA, teamB) => new Date(teamA.createdAt).getTime() - new Date(teamB.createdAt).getTime())[0];
+}
+/** Finds an exact team ID first; otherwise prefers names and slugs in the selected organization. */
+function findTeam(teams, identifier, preferredOrganizationId) {
+	const name = identifier.toLowerCase();
+	const findByNameOrSlug = (candidates) => candidates.find((team) => team.name.toLowerCase() === name) ?? candidates.find((team) => team.slug === identifier);
+	return teams.find((team) => team.id === identifier) ?? (preferredOrganizationId ? findByNameOrSlug(teams.filter((team) => team.organizationId === preferredOrganizationId)) : void 0) ?? findByNameOrSlug(teams);
+}
+/**
+* Retrieves a team by its ID.
+* @param teamId - The team ID to look up
+* @returns Promise resolving to an object with team id, name, organizationId, and createdAt
+* @throws Error if the team is not found or not accessible
+*/
+async function getTeamById(teamId) {
+	const team = (await getUserTeams()).find((t) => t.id === teamId);
+	if (!team) throw new Error(`Team with ID '${teamId}' not found or not accessible`);
+	return {
+		id: team.id,
+		name: team.name,
+		organizationId: team.organizationId,
+		createdAt: team.createdAt
+	};
+}
+/**
+* Resolves a team identifier (name, slug, or ID) to a team object. When several
+* organizations share a team name or slug, the current organization's team wins.
+* @param identifier - The team name, slug, or ID
+* @returns Promise resolving to an object with team id, name, organizationId, and createdAt
+* @throws Error if the team is not found
+*/
+async function resolveTeamFromIdentifier(identifier) {
+	const teams = await getUserTeams();
+	const team = findTeam(teams, identifier, cloudConfig.getCurrentOrganizationId());
+	if (!team) {
+		const availableTeams = teams.map((t) => t.name).join(", ");
+		throw new Error(`Team '${identifier}' not found. Available teams: ${availableTeams}`);
+	}
+	return {
+		id: team.id,
+		name: team.name,
+		organizationId: team.organizationId,
+		createdAt: team.createdAt
+	};
+}
+/**
+* Resolves the current team context, checking stored preferences first. Never changes the
+* current organization: the fallback is the oldest team in that organization.
+* @param teamIdentifier - Optional explicit team identifier to use
+* @param fallbackToDefault - Whether to fall back to server default team
+* @returns Promise resolving to an object with team id and name
+* @throws Error if no team can be resolved
+*/
+async function resolveTeamId(teamIdentifier, fallbackToDefault = true) {
+	if (teamIdentifier) {
+		logger.debug(`[Team Resolution] Using explicit team identifier: ${teamIdentifier}`);
+		return await resolveTeamFromIdentifier(teamIdentifier);
+	}
+	const configuredOrganizationId = cloudConfig.getCurrentOrganizationId();
+	let currentOrganizationId = configuredOrganizationId;
+	const currentTeamId = cloudConfig.getCurrentTeamId(currentOrganizationId);
+	if (!currentTeamId && !fallbackToDefault) throw new Error("No team specified and no default available");
+	if (!currentOrganizationId) {
+		const response = await makeRequest("/users/me", "GET");
+		const organizationId = response.ok ? (await response.json())?.organization?.id : void 0;
+		if (typeof organizationId !== "string" || !organizationId) throw new Error("Could not determine the current organization. Run 'promptfoo auth login' to select it.");
+		currentOrganizationId = organizationId;
+	}
+	const teams = (await getUserTeams()).filter((team) => team.organizationId === currentOrganizationId);
+	const storedTeam = teams.find((team) => team.id === currentTeamId);
+	if (storedTeam) {
+		if (!configuredOrganizationId) {
+			cloudConfig.setCurrentOrganization(currentOrganizationId);
+			cloudConfig.setCurrentTeamId(storedTeam.id, currentOrganizationId);
+		}
+		logger.debug(`[Team Resolution] Using stored team ID: ${currentTeamId}`);
+		return storedTeam;
+	}
+	if (currentTeamId) logger.warn(`[Team Resolution] Stored team ${currentTeamId} no longer accessible, falling back`);
+	if (!fallbackToDefault) throw new Error("No team specified and no default available");
+	if (teams.length === 0) throw new Error(`No accessible teams in organization '${currentOrganizationId}'. Log in with an API key for the organization you want to use: 'promptfoo auth login --api-key <apiKey>'.`);
+	const defaultTeam = getOldestTeam(teams);
+	if (!configuredOrganizationId) cloudConfig.setCurrentOrganization(currentOrganizationId);
+	cloudConfig.setCurrentTeamId(defaultTeam.id, currentOrganizationId);
+	logger.info(`Using team: ${defaultTeam.name} (use 'promptfoo auth teams set <name>' to change)`);
+	return defaultTeam;
+}
+/**
+* Custom error class for configuration permission-related failures.
+* Thrown when users lack necessary permissions to use certain cloud features.
+*/
+var ConfigPermissionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ConfigPermissionError";
+	}
+};
+/**
+* Converts an array of structured error objects into a human-readable message.
+* @param errors - Array of error objects with type, id, and message fields
+* @returns A comma-separated string of formatted error messages
+*/
+function convertErrorsToReadableMessage(errors) {
+	return errors.map((error) => `${error.type} ${error.id}: ${error.message}`).join(", ");
+}
+/**
+* Validates that the current user has necessary permissions for the given configuration.
+* Checks with PromptFoo Cloud to ensure providers and other resources can be accessed.
+* Gracefully degrades if cloud is disabled or server doesn't support permission checking.
+* @param config - The configuration to validate permissions for
+* @throws ConfigPermissionError if permissions are insufficient (403 responses)
+* @throws Error for other critical permission check failures
+*/
+async function checkCloudPermissions(config) {
+	if (!cloudConfig.isEnabled()) return;
+	if (!config.providers) {
+		logger.warn("No providers specified. Skipping permission check.");
+		return;
+	}
+	try {
+		if (!await checkServerFeatureSupport(PERMISSION_CHECK_SERVER_FEATURE_NAME, PERMISSION_CHECK_SERVER_FEATURE_DATE)) {
+			logger.debug(`[Config Permission Check] Server feature ${PERMISSION_CHECK_SERVER_FEATURE_NAME} is not supported. Skipping permission check.`);
+			return;
+		}
+		const { tests, scenarios, defaultTest, evaluateOptions, ...minimalConfig } = config;
+		if (minimalConfig.redteam) minimalConfig.redteam = {};
+		const response = await makeRequest("permissions/check", "POST", { config: minimalConfig });
+		if (!response.ok) {
+			const body = await response.json().catch(() => null);
+			const errorData = isRecord(body) ? body : { errors: ["Unknown error"] };
+			const errors = Array.isArray(errorData.errors) && errorData.errors.length > 0 ? errorData.errors.map((error) => {
+				if (typeof error === "string") return {
+					type: "config",
+					id: "unknown",
+					message: error
+				};
+				if (isRecord(error) && typeof error.type === "string" && typeof error.id === "string" && typeof error.message === "string") return {
+					type: error.type,
+					id: error.id,
+					message: error.message
+				};
+				return {
+					type: "config",
+					id: "unknown",
+					message: "Unknown error"
+				};
+			}) : [{
+				type: "config",
+				id: "unknown",
+				message: typeof errorData.error === "string" && errorData.error ? errorData.error : "Permission check failed"
+			}];
+			if (response.status === 403) throw new ConfigPermissionError(`Permission denied: ${convertErrorsToReadableMessage(errors)}`);
+			logger.warn(`Error checking permissions: ${convertErrorsToReadableMessage(errors)}. Continuing anyway.`);
+			return;
+		}
+		const result = await response.json();
+		if (result.errors && result.errors.length > 0) throw new ConfigPermissionError(`Not able to continue with config: ${convertErrorsToReadableMessage(result.errors)}`);
+		logger.debug("Permission check passed");
+	} catch (error) {
+		if (error instanceof ConfigPermissionError) throw error;
+		logger.warn(`Error checking permissions: ${error}. Continuing anyway.`);
+	}
+}
+/**
+* Given a list of policy IDs, fetches custom policies from Promptfoo Cloud.
+* @param ids - The IDs of the policies to fetch.
+* @param teamId - The ID of the team to fetch policies from. Note that all policies must belong to this team.
+* @returns A map of policy IDs to their texts and severities.
+*/
+async function getPoliciesFromCloud(ids, teamId) {
+	if (!cloudConfig.isEnabled()) throw new Error(`Could not fetch policies from cloud. Cloud config is not enabled. Please run \`promptfoo auth login\` to login.`);
+	try {
+		const searchParams = new URLSearchParams();
+		ids.forEach((id) => {
+			searchParams.append("id", id);
+		});
+		searchParams.append("teamId", teamId);
+		const response = await makeRequest(`/custom-policies/?${searchParams.toString()}`, "GET");
+		if (!response.ok) {
+			const errorMessage = await response.text();
+			throw new Error(`Failed to fetch policies from cloud: ${errorMessage}. HTTP Status: ${response.status} -- ${response.statusText}.`);
+		}
+		const body = await response.json();
+		const policiesById = /* @__PURE__ */ new Map();
+		body.forEach((policy) => {
+			policiesById.set(policy.id, {
+				text: policy.text,
+				severity: policy.severity,
+				name: policy.name
+			});
+		});
+		return policiesById;
+	} catch (e) {
+		logger.error(`Failed to fetch policies from cloud.`);
+		logger.error(String(e));
+		throw new Error(`Failed to fetch policies from cloud.`);
+	}
+}
+/**
+* Validates linkedTargetId format and existence.
+* linkedTargetId is a Promptfoo Cloud feature that links custom provider results
+* to an existing target instead of creating duplicates.
+*
+* Validates the prefix and checks existence in cloud. Format validation
+* (e.g., UUID format) is deferred to the cloud API for simplicity.
+*
+* @param linkedTargetId - The linkedTargetId to validate
+* @throws Error if validation fails
+*/
+async function validateLinkedTargetId(linkedTargetId) {
+	if (!isCloudProvider(linkedTargetId)) {
+		const appHost = cloudConfig.getApiHost().replace("/api", "").replace(":3201", "");
+		throw new Error(dedent`
+        Invalid linkedTargetId format: "${linkedTargetId}"
+
+        linkedTargetId must start with "${CLOUD_PROVIDER_PREFIX}" followed by a target ID.
+        Example: ${CLOUD_PROVIDER_PREFIX}12345678-1234-1234-1234-123456789abc
+
+        linkedTargetId links your local provider configuration to a cloud target, allowing you to:
+        - Consolidate findings from multiple eval runs
+        - Track performance and vulnerabilities over time
+        - View comprehensive reporting in the cloud dashboard
+
+        To get a valid linkedTargetId:
+        1. Log in to Promptfoo Cloud: ${appHost}
+        2. Navigate to Targets page: ${appHost}/redteam/targets
+        3. Find the target you want to link to and copy its ID
+        4. Format as: ${CLOUD_PROVIDER_PREFIX}<target-id>
+      `);
+	}
+	if (!cloudConfig.isEnabled()) {
+		logger.warn("[Cloud] linkedTargetId specified but cloud is not configured", {
+			linkedTargetId,
+			suggestion: "Run 'promptfoo auth login' to enable cloud features"
+		});
+		return;
+	}
+	const providerId = getCloudDatabaseId(linkedTargetId);
+	try {
+		logger.debug("[Cloud] Validating linkedTargetId exists in cloud", {
+			linkedTargetId,
+			providerId
+		});
+		await getProviderFromCloud(providerId);
+		logger.debug("[Cloud] linkedTargetId validation successful", { linkedTargetId });
+	} catch (error) {
+		logger.error("[Cloud] linkedTargetId validation failed", {
+			linkedTargetId,
+			error
+		});
+		const appHost = cloudConfig.getApiHost().replace("/api", "").replace(":3201", "");
+		throw new Error(dedent`
+        linkedTargetId not found: "${linkedTargetId}"
+
+        This target doesn't exist in your Promptfoo Cloud organization or you don't have access to it.
+
+        Troubleshooting steps:
+        1. Verify you're logged in to the correct organization
+           Run: promptfoo auth status
+
+        2. Check that the target exists in your cloud dashboard:
+           ${appHost}/redteam/targets
+
+        3. Ensure you have permission to access this target
+           (Targets are scoped to your organization)
+
+        4. Verify the target ID is correct and hasn't been deleted
+      `);
+	}
+}
+/**
+* Fetches the current organization and optional team context for display.
+* Returns null if cloud is not enabled or if fetching fails.
+* @returns Promise resolving to organization name and optional team name, or null
+*/
+async function getOrgContext() {
+	if (!cloudConfig.isEnabled()) return null;
+	try {
+		const apiHost = cloudConfig.getApiHost();
+		const response = await fetchWithProxy(`${apiHost}/api/v1/users/me`, { headers: { ...cloudConfig.getAuthHeaders() ?? {} } });
+		if (!response.ok) return null;
+		const { organization } = await response.json();
+		const organizationId = cloudConfig.getCurrentOrganizationId() ?? organization.id;
+		const organizationName = getCloudOrganizationLabel(organization, organizationId);
+		const currentTeamId = cloudConfig.getCurrentTeamId(organizationId);
+		let teamName;
+		if (currentTeamId) try {
+			const team = await getTeamById(currentTeamId);
+			if (team.organizationId === organizationId && team.name !== organizationName) teamName = team.name;
+		} catch {}
+		return {
+			organizationName,
+			teamName
+		};
+	} catch {
+		return null;
+	}
+}
+/** The token's organization name applies only to that organization; otherwise show the active ID. */
+function getCloudOrganizationLabel(tokenOrganization, organizationId = cloudConfig.getCurrentOrganizationId()) {
+	return !organizationId || organizationId === tokenOrganization.id ? tokenOrganization.name : organizationId;
+}
+//#endregion
+export { getPluginSeverityOverridesFromCloud as a, isCloudProvider as c, validateLinkedTargetId as d, getOrgContext as i, makeRequest as l, getCloudDatabaseId as n, getPoliciesFromCloud as o, getEvalConfigFromCloud as r, getProviderFromCloud as s, checkCloudPermissions as t, resolveTeamId as u };
+
+//# sourceMappingURL=cloud-ramjGURF.js.map