promptfoo 0.125.0 → 0.125.1

package/dist/src/dataUrl-DBMifX6C.js

@@ -0,0 +1,3133 @@
+import { B as safeJsonStringify, D as stripProviderPromptSelectors, H as loadYaml, K as getEnvBool, N as isApiProvider, O as stripTestProviderPromptSelectors, P as isProviderOptions, S as sanitizeRuntimeOptions, W as refreshConfigDirectoryPathFromEnv, at as loadEnvFiles, b as sanitizeConfigForOutput, h as mapTestProviderRefs, j as isProviderTypeMap, k as GRADING_PROVIDER_TYPE_KEYS, l as REDACTED, o as logger, p as isSecretField, rt as parseEnvBool, w as sanitizeUrl, x as sanitizeObject } from "./logger-Gff7RMNF.js";
+import { W as TERMINAL_MAX_WIDTH, X as VERSION, t as fetchWithProxy } from "./fetch-B5KxZuKu.js";
+import { t as invariant } from "./invariant-CHP0zrix.js";
+import { t as getCurrentTimestamp } from "./time-Db5rO0GY.js";
+import { n as PromptfooAttributes } from "./genaiTracer-CuSjHi4t.js";
+import { n as sha256 } from "./createHash-D7vud8fe.js";
+import { r as getDirectory } from "./esm-D2FLmzG-.js";
+import { o as getNunjucksEngine } from "./render-DuOHcYot.js";
+import { i as maybeLoadConfigFromExternalFile } from "./file-Di0ypTgN.js";
+import { E as isResultFailureReason, Nt as getDb, Pt as getDbSignalPath, T as ResultFailureReason, a as evalResultsTable, b as OutputFileExtension } from "./tables-D7gZdWrS.js";
+import { d as createEmptyTokenUsage, o as accumulateGradingTokenUsage, s as accumulateResponseTokenUsage } from "./tokenUsageUtils-BfzeNdYY.js";
+import "./blobs-DiN8G72v.js";
+import { a as collectBlobHashes, n as isBlobStorageEnabled, o as extractBlobHashesFromValue, t as extractAndStoreBinaryData } from "./extractor-NglB5koy.js";
+import { t as isMissingPackageImportError } from "./packageImportErrors-rgCkzu81.js";
+import fs, * as fs$2 from "fs";
+import path, * as path$1 from "path";
+import * as os$1 from "os";
+import * as yaml from "js-yaml";
+import deepEqual from "fast-deep-equal";
+import { isDeepStrictEqual } from "node:util";
+import { randomUUID } from "crypto";
+import dedent from "dedent";
+import * as fsPromises from "fs/promises";
+import { and, eq, gte, inArray, lt, ne, sql } from "drizzle-orm";
+import { LRUCache } from "lru-cache";
+import { XMLBuilder } from "fast-xml-parser";
+import { stringify } from "csv-stringify/sync";
+//#region src/providers/constants.ts
+const FILE_METADATA_KEY = "_promptfooFileMetadata";
+/**
+* Identifier for manual user ratings in componentResults.
+* Used to distinguish human ratings from automated assertions.
+*/
+const HUMAN_ASSERTION_TYPE = "human";
+//#endregion
+//#region src/util/debounce.ts
+/** Coalesce calls at the trailing edge and allow pending work to be cancelled on cleanup. */
+function debounce(callback, wait) {
+	let timeout;
+	function debounced(...args) {
+		clearTimeout(timeout);
+		timeout = setTimeout(() => {
+			timeout = void 0;
+			callback.apply(this, args);
+		}, wait);
+	}
+	debounced.clear = () => {
+		clearTimeout(timeout);
+		timeout = void 0;
+	};
+	return debounced;
+}
+//#endregion
+//#region src/database/signal.ts
+const SIGNAL_WATCHER_DEBOUNCE_MS = 250;
+/**
+* The legacy `evalId:timestamp` text format can't be told apart from a stray short token, so
+* {@link readLegacySignalEvalId} only recovers eval ids at least this long. Generated ids
+* (`eval-<rand>-<iso>`) always clear it; a short caller-provided id (e.g. an imported `demo`) is
+* written as JSON instead, which stores the id explicitly and survives the round trip.
+*/
+const MIN_LEGACY_EVAL_ID_LENGTH = 9;
+/** Whether {@link readLegacySignalEvalId} can recover this id from the legacy text format. */
+function isLegacyRecoverableEvalId(evalId) {
+	return evalId.length >= MIN_LEGACY_EVAL_ID_LENGTH;
+}
+/** Returns the string entries of an unknown value, or undefined if it is not an array. */
+function toStringEvalIds(value) {
+	return Array.isArray(value) ? value.filter((evalId) => typeof evalId === "string") : void 0;
+}
+function writeSignalFile(content) {
+	const filePath = getDbSignalPath();
+	try {
+		fs.writeFileSync(filePath, content);
+	} catch (err) {
+		logger.warn(`Failed to write database signal file: ${err}`);
+	}
+}
+/**
+* Updates the signal file with the current timestamp and optional eval ID.
+* This is used to notify clients that there are new data available.
+*
+* If another signal is still pending in the watcher's debounce window, this folds it into a
+* combined JSON payload so no refresh is lost — scoped updates, a pending unscoped "refresh
+* latest", and pending deletes all survive coalescing. When nothing is pending it keeps the
+* compact legacy `evalId:timestamp` text.
+* This read-modify-write is best-effort within a single process; concurrent writes from separate
+* processes can still race the unlocked file, in which case a dropped signal self-heals on the
+* next one.
+* @param evalId - Optional eval ID that triggered the update
+*/
+function updateSignalFile(evalId) {
+	const now = Date.now();
+	const nowIso = new Date(now).toISOString();
+	const pending = readPendingSignal(now);
+	const pendingUpdateIds = pending ? updateEvalIds(pending) : [];
+	const pendingHasDelete = pending ? hasDeleteComponent(pending) : false;
+	const pendingHasUnscopedUpdate = pending ? hasUnscopedUpdate(pending) : false;
+	const updatedEvalIds = [.../* @__PURE__ */ new Set([...pendingUpdateIds, ...evalId ? [evalId] : []])];
+	const refreshLatest = evalId === void 0 || pendingHasUnscopedUpdate;
+	const needsCoalesce = pendingHasDelete || pendingUpdateIds.some((id) => id !== evalId) || refreshLatest && updatedEvalIds.length > 0;
+	const evalIdNeedsJson = evalId !== void 0 && !isLegacyRecoverableEvalId(evalId);
+	if (needsCoalesce || evalIdNeedsJson) {
+		writeSignalFile(JSON.stringify({
+			type: "update",
+			evalId,
+			updatedEvalIds: updatedEvalIds.length > 0 ? updatedEvalIds : void 0,
+			deletedEvalIds: pendingHasDelete ? pending?.deletedEvalIds ?? [] : void 0,
+			refreshLatest: refreshLatest ? true : void 0,
+			timestamp: nowIso
+		}));
+		return;
+	}
+	writeSignalFile(evalId ? `${evalId}:${nowIso}` : nowIso);
+}
+/** True when the signal carries an update component (a scoped or unscoped eval refresh). */
+function hasUpdateComponent(signal) {
+	return signal.type === "update" || signal.evalId !== void 0 || (signal.updatedEvalIds?.length ?? 0) > 0 || signal.refreshLatest === true;
+}
+/**
+* True when the signal asks to refresh the latest eval (an unscoped update component): the
+* `refreshLatest` marker, or a bare update with no scoped ids (e.g. a legacy bare timestamp). The
+* watcher emits {@link Eval.latest} for these, so a root `/eval` view follows new evals even when a
+* coalesced signal also carries scoped updates or a delete.
+*/
+function hasUnscopedUpdate(signal) {
+	return signal.refreshLatest === true || hasUpdateComponent(signal) && updateEvalIds(signal).length === 0;
+}
+/** True when the signal carries a delete component (specific ids or "all evals deleted"). */
+function hasDeleteComponent(signal) {
+	return signal.type === "delete" || signal.deletedEvalIds !== void 0;
+}
+/**
+* True when a delete component means "all evals were deleted" rather than a specific id list.
+* "All" is encoded as `undefined` by direct delete callers and as `[]` when a pending delete-all
+* is folded into a JSON update, so both count. Only meaningful for a signal that actually carries
+* a delete component (see {@link hasDeleteComponent}); an update-only signal has no ids either.
+*/
+function isAllEvalsDeleted(deletedEvalIds) {
+	return deletedEvalIds === void 0 || deletedEvalIds.length === 0;
+}
+/**
+* The distinct scoped eval ids an update signal refreshes, newest last. Empty for an unscoped
+* update (which means "refresh to the latest eval"). Prefers the accumulated `updatedEvalIds`
+* set and falls back to the single `evalId` for legacy/simple signals.
+*/
+function updateEvalIds(signal) {
+	if (signal.updatedEvalIds && signal.updatedEvalIds.length > 0) return signal.updatedEvalIds;
+	return signal.evalId ? [signal.evalId] : [];
+}
+/**
+* Parses signal-file content as a combined JSON payload, returning the classified signal and
+* its timestamp (used for the debounce-window check), or null if it is not a JSON signal.
+*/
+function parseSignalJson(content) {
+	try {
+		const parsed = JSON.parse(content);
+		if (parsed !== null && typeof parsed === "object" && "type" in parsed && (parsed.type === "delete" || parsed.type === "update")) {
+			const evalId = "evalId" in parsed && typeof parsed.evalId === "string" ? parsed.evalId : void 0;
+			const updatedEvalIds = "updatedEvalIds" in parsed ? toStringEvalIds(parsed.updatedEvalIds) : void 0;
+			const deletedEvalIds = "deletedEvalIds" in parsed ? toStringEvalIds(parsed.deletedEvalIds) : void 0;
+			const timestamp = "timestamp" in parsed && typeof parsed.timestamp === "string" ? parsed.timestamp : void 0;
+			const refreshLatest = "refreshLatest" in parsed && parsed.refreshLatest === true ? true : void 0;
+			return {
+				signal: {
+					type: parsed.type,
+					evalId,
+					updatedEvalIds,
+					deletedEvalIds,
+					refreshLatest
+				},
+				timestamp
+			};
+		}
+	} catch {}
+	return null;
+}
+/**
+* Reads the signal file only if it was written within the watcher's debounce window, so a
+* writer can fold a not-yet-observed signal into its own write instead of clobbering it.
+* Returns null when the file is stale (outside the window), unreadable, or unparseable.
+*/
+function readPendingSignal(now) {
+	const withinWindow = (timestamp) => {
+		if (timestamp === void 0) return false;
+		const elapsed = now - Date.parse(timestamp);
+		return Number.isFinite(elapsed) && elapsed >= 0 && elapsed <= SIGNAL_WATCHER_DEBOUNCE_MS;
+	};
+	try {
+		const content = fs.readFileSync(getDbSignalPath(), "utf8").trim();
+		const json = parseSignalJson(content);
+		if (json) return withinWindow(json.timestamp) ? json.signal : null;
+		const legacyTimestamp = content.match(/(\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)$/)?.[1];
+		if (!withinWindow(legacyTimestamp)) return null;
+		return {
+			type: "update",
+			evalId: readLegacySignalEvalId(content)
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Signals that one or more evals were deleted. Deletions use a JSON payload so the watcher can
+* tell clients exactly which evals to drop (whereas a plain update keeps the legacy
+* `evalId:timestamp` text format unless it has to fold in a pending delete). A delete in the
+* debounce window also carries forward a pending update — scoped ids or an unscoped "refresh
+* latest" — so neither refresh is lost (same-process best-effort, like {@link updateSignalFile};
+* cross-process writes can still race).
+* Pre-PR view servers don't understand this JSON and read it back as "no eval id", falling back
+* to broadcasting the latest eval — a benign degradation, so the view server and CLI should be
+* on matching versions for delete-aware refreshes.
+*/
+function updateSignalFileForDeletedEvals(deletedEvalIds) {
+	const now = Date.now();
+	const pending = readPendingSignal(now);
+	const pendingDelete = pending && hasDeleteComponent(pending) ? pending : null;
+	const mergedDeletedEvalIds = pendingDelete ? isAllEvalsDeleted(pendingDelete.deletedEvalIds) || isAllEvalsDeleted(deletedEvalIds) ? void 0 : [.../* @__PURE__ */ new Set([...pendingDelete.deletedEvalIds ?? [], ...deletedEvalIds ?? []])] : deletedEvalIds;
+	const carriedUpdateIds = pending && hasUpdateComponent(pending) ? updateEvalIds(pending) : [];
+	const carriedRefreshLatest = pending ? hasUnscopedUpdate(pending) : false;
+	writeSignalFile(JSON.stringify({
+		type: "delete",
+		deletedEvalIds: mergedDeletedEvalIds,
+		evalId: carriedUpdateIds[carriedUpdateIds.length - 1],
+		updatedEvalIds: carriedUpdateIds.length > 0 ? carriedUpdateIds : void 0,
+		refreshLatest: carriedRefreshLatest ? true : void 0,
+		timestamp: new Date(now).toISOString()
+	}));
+}
+function readLegacySignalEvalId(content) {
+	if (/^\d{4}-\d{2}-\d{2}T/.test(content)) return;
+	const evalId = content.match(/^(.*):\d{4}-\d{2}-\d{2}T/)?.[1];
+	return evalId && isLegacyRecoverableEvalId(evalId) ? evalId : void 0;
+}
+/**
+* Reads and classifies the signal file into a {@link DatabaseSignal}. It understands the
+* legacy `evalId:timestamp` (or bare timestamp) text written by {@link updateSignalFile} and
+* the JSON payload written by the delete/combined writers. A JSON payload may carry BOTH an
+* update component (`updatedEvalIds` — possibly several ids when scoped updates coalesced) and a
+* delete component (`deletedEvalIds`) when mutations were coalesced inside the watcher's debounce
+* window. Malformed/half-written content or a read error degrades to an unscoped `{type:'update'}`.
+*/
+function readSignalFile() {
+	const filePath = getDbSignalPath();
+	try {
+		const content = fs.readFileSync(filePath, "utf8").trim();
+		const json = parseSignalJson(content);
+		if (json) return json.signal;
+		return {
+			type: "update",
+			evalId: readLegacySignalEvalId(content)
+		};
+	} catch {
+		return { type: "update" };
+	}
+}
+/**
+* Ensures the signal file exists, creating it if necessary.
+*/
+function ensureSignalFile() {
+	const filePath = getDbSignalPath();
+	if (!fs.existsSync(filePath)) {
+		logger.debug(`Creating signal file at ${filePath}`);
+		fs.writeFileSync(filePath, (/* @__PURE__ */ new Date()).toISOString());
+	}
+}
+/**
+* Sets up a watcher on the signal file and calls the callback when it changes.
+* @param onChange - Callback function that is called when the signal file changes
+* @returns The watcher instance
+*/
+function setupSignalWatcher(onChange) {
+	const filePath = getDbSignalPath();
+	logger.debug(`Setting up file watcher on ${filePath}`);
+	ensureSignalFile();
+	try {
+		const watcher = fs.watch(filePath);
+		const handleChange = debounce(onChange, SIGNAL_WATCHER_DEBOUNCE_MS);
+		watcher.on("change", handleChange);
+		watcher.on("close", handleChange.clear);
+		watcher.on("error", (error) => {
+			logger.warn(`File watcher error: ${error}`);
+		});
+		return watcher;
+	} catch (error) {
+		logger.warn(`Failed to set up file watcher: ${error}`);
+		throw error;
+	}
+}
+//#endregion
+//#region src/models/prompt.ts
+/**
+* Generates a unique identifier for a prompt based on its properties.
+*
+* Priority order:
+* 1. If label is truthy, hash the label
+* 2. If id is truthy, hash the id
+* 3. Otherwise, hash the raw content (stringified if object)
+*
+* @param prompt - The prompt object to generate an ID for
+* @returns A SHA-256 hash string
+*/
+function generateIdFromPrompt(prompt) {
+	if (prompt.label) return sha256(prompt.label);
+	if (prompt.id) return sha256(prompt.id);
+	return sha256(typeof prompt.raw === "object" ? JSON.stringify(prompt.raw) : prompt.raw);
+}
+//#endregion
+//#region src/prompts/constants.ts
+const VALID_FILE_EXTENSIONS = [
+	".cjs",
+	".cts",
+	".j2",
+	".js",
+	".json",
+	".jsonl",
+	".md",
+	".mjs",
+	".mts",
+	".py",
+	".ts",
+	".txt",
+	".yml",
+	".yaml"
+];
+//#endregion
+//#region src/prompts/utils.ts
+/**
+* Determines if a string is a valid file path.
+* @param str - The string to check.
+* @returns True if the string is a valid file path, false otherwise.
+*/
+function maybeFilePath(str) {
+	if (typeof str !== "string") throw new Error(`Invalid input: ${JSON.stringify(str)}`);
+	if ([
+		"\n",
+		"portkey://",
+		"langfuse://",
+		"helicone://"
+	].some((substring) => str.includes(substring))) return false;
+	return str.startsWith("file://") || VALID_FILE_EXTENSIONS.some((ext) => {
+		const tokens = str.split(":");
+		const pathOrFunctionToken = tokens[tokens.length - 1];
+		const pathToken = tokens[tokens.length - 2];
+		return pathOrFunctionToken?.endsWith(ext) || pathToken?.endsWith(ext);
+	}) || str.charAt(str.length - 3) === "." || str.charAt(str.length - 4) === "." || str.includes("*") || str.includes("/") || str.includes("\\");
+}
+/**
+* Normalizes the input prompt to an array of prompts, rejecting invalid and empty inputs.
+* @param promptPathOrGlobs - The input prompt.
+* @returns The normalized prompts.
+* @throws If the input is invalid or empty.
+*/
+function normalizeInput(promptPathOrGlobs) {
+	if (!promptPathOrGlobs || (typeof promptPathOrGlobs === "string" || Array.isArray(promptPathOrGlobs)) && promptPathOrGlobs.length === 0) throw new Error(`Invalid input prompt: ${JSON.stringify(promptPathOrGlobs)}`);
+	if (typeof promptPathOrGlobs === "string") return [{ raw: promptPathOrGlobs }];
+	if (Array.isArray(promptPathOrGlobs)) return promptPathOrGlobs.map((promptPathOrGlob, _index) => {
+		if (typeof promptPathOrGlob === "string") return { raw: promptPathOrGlob };
+		return {
+			raw: promptPathOrGlob.raw || promptPathOrGlob.id,
+			...promptPathOrGlob
+		};
+	});
+	if (typeof promptPathOrGlobs === "object" && Object.keys(promptPathOrGlobs).length) return Object.entries(promptPathOrGlobs).map(([raw, key]) => ({
+		label: key,
+		raw
+	}));
+	throw new Error(`Invalid input prompt: ${JSON.stringify(promptPathOrGlobs)}`);
+}
+/**
+* Generates a hash identifier for a prompt.
+* This is an alias for generateIdFromPrompt for backward compatibility.
+*
+* @param prompt - The prompt to hash
+* @returns A SHA-256 hash string
+*/
+function hashPrompt(prompt) {
+	return generateIdFromPrompt(prompt);
+}
+//#endregion
+//#region src/util/standaloneEvalCache.ts
+const standaloneEvalCache = new LRUCache({
+	ttl: 72e5,
+	max: 2e3
+});
+function getStandaloneEvalCacheKey({ limit = 100, tag, description } = {}) {
+	return `standalone_evals_${limit}_${tag?.key}_${tag?.value}_${description}`;
+}
+function getCachedStandaloneEvals(cacheKey) {
+	return standaloneEvalCache.get(cacheKey);
+}
+function setCachedStandaloneEvals(cacheKey, evals) {
+	standaloneEvalCache.set(cacheKey, evals);
+}
+function clearStandaloneEvalCache() {
+	standaloneEvalCache.clear();
+}
+//#endregion
+//#region src/models/evalPerformance.ts
+const countCache = /* @__PURE__ */ new Map();
+const CACHE_TTL = 3e5;
+async function getResultCount(evalId, distinct) {
+	const cacheKey = `${distinct ? "distinct" : "total"}:${evalId}`;
+	const cached = countCache.get(cacheKey);
+	if (cached && Date.now() - cached.timestamp < CACHE_TTL) {
+		logger.debug(`Using cached ${distinct ? "distinct count" : "total row count"} for eval ${evalId}: ${cached.count}`);
+		return cached.count;
+	}
+	const db = await getDb();
+	const start = Date.now();
+	const result = await db.select({ count: distinct ? sql`COUNT(DISTINCT test_idx)` : sql`COUNT(*)` }).from(evalResultsTable).where(sql`eval_id = ${evalId}`).all();
+	const count = Number(result[0]?.count ?? 0);
+	const duration = Date.now() - start;
+	logger.debug(`${distinct ? "Distinct count" : "Total row count"} query for eval ${evalId}: ${count} in ${duration}ms`);
+	countCache.set(cacheKey, {
+		count,
+		timestamp: Date.now()
+	});
+	return count;
+}
+/**
+* Get the count of distinct test indices for an eval.
+* This represents the number of unique test cases (rows in the UI table).
+*
+* Use getTotalResultRowCount() if you need the total number of result rows
+* (which may be higher when there are multiple prompts/providers per test case).
+*/
+function getCachedResultsCount(evalId) {
+	return getResultCount(evalId, true);
+}
+/**
+* Get the total count of all result rows for an eval.
+* This counts every result row in the database, including multiple results
+* per test case (e.g., when using multiple prompts or providers).
+*
+* Use this for progress tracking when iterating over all results (e.g., sharing).
+*/
+function getTotalResultRowCount(evalId) {
+	return getResultCount(evalId, false);
+}
+function clearCountCache(evalId) {
+	if (evalId) {
+		countCache.delete(`distinct:${evalId}`);
+		countCache.delete(`total:${evalId}`);
+	} else countCache.clear();
+}
+async function queryTestIndicesOptimized(evalId, opts) {
+	const db = await getDb();
+	const offset = opts.offset ?? 0;
+	const limit = opts.limit ?? 50;
+	const mode = opts.filterMode ?? "all";
+	let baseQuery = sql`eval_id = ${evalId}`;
+	if (mode === "errors") baseQuery = sql`${baseQuery} AND failure_reason = ${2}`;
+	else if (mode === "failures") baseQuery = sql`${baseQuery} AND success = 0 AND failure_reason != ${2}`;
+	else if (mode === "passes") baseQuery = sql`${baseQuery} AND success = 1`;
+	else if (mode === "highlights") baseQuery = sql`${baseQuery} AND json_extract(grading_result, '$.comment') LIKE '!highlight%'`;
+	else if (mode === "user-rated") baseQuery = sql`${baseQuery} AND EXISTS (
+      SELECT 1
+      FROM json_each(grading_result, '$.componentResults')
+      WHERE json_extract(value, '$.assertion.type') = ${HUMAN_ASSERTION_TYPE}
+    )`;
+	let searchCondition = sql`1=1`;
+	if (opts.searchQuery && opts.searchQuery.trim() !== "" && !opts.filters?.length) searchCondition = sql`response LIKE ${`%${opts.searchQuery}%`}`;
+	const whereClause = sql`${baseQuery} AND ${searchCondition}`;
+	const countStart = Date.now();
+	const countQuery = sql`
+    SELECT COUNT(DISTINCT test_idx) as count 
+    FROM ${evalResultsTable} 
+    WHERE ${whereClause}
+  `;
+	const countResult = await db.all(countQuery);
+	const filteredCount = Number(countResult[0]?.count ?? 0);
+	logger.debug(`Optimized count query took ${Date.now() - countStart}ms`);
+	const idxStart = Date.now();
+	const idxQuery = sql`
+    SELECT DISTINCT test_idx 
+    FROM ${evalResultsTable} 
+    WHERE ${whereClause}
+    ORDER BY test_idx 
+    LIMIT ${limit} 
+    OFFSET ${offset}
+  `;
+	const testIndices = (await db.all(idxQuery)).map((row) => row.test_idx);
+	logger.debug(`Optimized index query took ${Date.now() - idxStart}ms`);
+	return {
+		testIndices,
+		filteredCount
+	};
+}
+//#endregion
+//#region src/models/evalMutation.ts
+/**
+* Drops this process's cached eval aggregates so the next read re-queries the DB.
+* Always clears the standalone-eval LRU (keyed by filter combos, no per-eval granularity)
+* and the count cache for `evalId` (or every eval's counts when `evalId` is omitted).
+* Use this for in-process cache coherence only — it does NOT notify the view server.
+*/
+function invalidateEvaluationCache(evalId) {
+	clearStandaloneEvalCache();
+	clearCountCache(evalId);
+}
+/**
+* Like {@link invalidateEvaluationCache} but for several evals at once: clears the standalone-eval
+* LRU once (it has no per-eval granularity, so repeating it per id is wasteful) and the count
+* cache for each id.
+*/
+function invalidateEvaluationCaches(evalIds) {
+	clearStandaloneEvalCache();
+	for (const id of evalIds) clearCountCache(id);
+}
+/**
+* Call after creating or mutating an eval's data (results, prompts, ratings). Invalidates
+* this process's caches and writes a scoped update signal so a running `promptfoo view`
+* server refreshes clients viewing this eval (and the root route, which follows the latest).
+*/
+function notifyEvaluationChanged(evalId) {
+	invalidateEvaluationCache(evalId);
+	updateSignalFile(evalId);
+}
+/**
+* Call after deleting one or more evals. Invalidates this process's caches and writes a
+* delete signal so the view server can navigate clients off the removed evals. Pass no
+* argument (or omit ids) for "all evals deleted".
+*/
+function notifyEvaluationsDeleted(evalIds) {
+	if (evalIds) invalidateEvaluationCaches(evalIds);
+	else invalidateEvaluationCache();
+	updateSignalFileForDeletedEvals(evalIds);
+}
+//#endregion
+//#region src/models/evalResult.ts
+function sanitizeProviderConfig(config) {
+	return sanitizeObject(JSON.parse(safeJsonStringify(config)), {
+		context: "provider config",
+		sanitizeUrls: true,
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
+function stripMediaReferences(value) {
+	if (extractBlobHashesFromValue(value).length > 0 || typeof value === "string" && /^data:[^,]*,/i.test(value)) return "[output stripped]";
+	if (Array.isArray(value)) return value.map(stripMediaReferences);
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, stripMediaReferences(item)]));
+	return value;
+}
+function projectOutputMetadata(metadata, stripOutput, responseMetadata, testMetadata) {
+	if (!stripOutput || !metadata || !responseMetadata || typeof metadata !== "object") return metadata;
+	return Object.fromEntries(Object.entries(metadata).flatMap(([key, value]) => {
+		if (!Object.prototype.hasOwnProperty.call(responseMetadata, key) || testMetadata && isDeepStrictEqual(value, testMetadata[key])) return [[key, value]];
+		return key === "audio" || key === "blobUris" ? [] : [[key, stripMediaReferences(sanitizeForDb(value))]];
+	}));
+}
+function projectProviderResponse(response, options) {
+	if (!response) return response;
+	if (!options.stripMetadata && !options.stripOutput) return response;
+	const projectedResponse = options.stripMetadata ? (({ metadata: _metadata, ...rest }) => rest)(response) : { ...response };
+	if (options.stripOutput) {
+		projectedResponse.output = "[output stripped]";
+		delete projectedResponse.raw;
+		delete projectedResponse.providerTransformedOutput;
+		delete projectedResponse.conversationOutput;
+		delete projectedResponse.audio;
+		delete projectedResponse.video;
+		delete projectedResponse.images;
+		if (projectedResponse.metadata) projectedResponse.metadata = projectOutputMetadata(projectedResponse.metadata, true, projectedResponse.metadata);
+	}
+	return projectedResponse;
+}
+function projectPrompt(prompt, stripPromptText) {
+	return stripPromptText ? {
+		...prompt,
+		raw: "[prompt stripped]",
+		template: void 0,
+		...prompt.config?.provider && { config: {
+			...prompt.config,
+			provider: stripProviderPromptSelectors(prompt.config.provider)
+		} }
+	} : prompt;
+}
+function projectTracesForOutput(traces, { shouldStripMetadata, shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars }) {
+	if (!shouldStripMetadata && !shouldStripPromptText && !shouldStripResponseOutput && !shouldStripTestVars) return traces;
+	return traces.map((trace) => {
+		let projectedTrace = trace;
+		if (shouldStripMetadata) {
+			const { metadata: _metadata, ...traceWithoutMetadata } = trace;
+			projectedTrace = traceWithoutMetadata;
+		} else if (shouldStripTestVars && trace.metadata && "vars" in trace.metadata) {
+			const { metadata: traceMetadata, ...traceWithoutMetadata } = trace;
+			const { vars: _vars, ...metadata } = traceMetadata;
+			projectedTrace = {
+				...traceWithoutMetadata,
+				...Object.keys(metadata).length > 0 && { metadata }
+			};
+		}
+		if (!shouldStripPromptText && !shouldStripResponseOutput) return projectedTrace;
+		return {
+			...projectedTrace,
+			spans: projectedTrace.spans.map((span) => {
+				if (!span.attributes) return span;
+				const projectedAttributes = { ...span.attributes };
+				if (shouldStripPromptText) delete projectedAttributes[PromptfooAttributes.REQUEST_BODY];
+				if (shouldStripResponseOutput) delete projectedAttributes[PromptfooAttributes.RESPONSE_BODY];
+				const { attributes: _attributes, ...projectedSpan } = span;
+				return {
+					...projectedSpan,
+					...Object.keys(projectedAttributes).length > 0 && { attributes: projectedAttributes }
+				};
+			})
+		};
+	});
+}
+function projectTestCase(testCase, options) {
+	if (!options.stripMetadata && !options.stripVars && !options.stripOutput && !options.stripPromptText) return testCase;
+	const projectedTestCase = options.stripMetadata ? (({ metadata: _metadata, ...rest }) => rest)(testCase) : { ...testCase };
+	if (options.stripVars) projectedTestCase.vars = void 0;
+	if (options.stripOutput) delete projectedTestCase.providerOutput;
+	if (options.stripMetadata && testCase.metadata?.__promptfoo?.remote === true) projectedTestCase.metadata = { __promptfoo: { remote: true } };
+	return options.stripPromptText ? stripTestProviderPromptSelectors(projectedTestCase) : projectedTestCase;
+}
+/** Map only grading assertion providers and component results. */
+function mapGradingResultProviderRefs(gradingResult, mapProvider) {
+	const visited = /* @__PURE__ */ new WeakMap();
+	const project = (value) => {
+		const result = asRecord(value);
+		if (!result) return value;
+		const previous = visited.get(result);
+		if (previous) return previous;
+		const projected = { ...result };
+		visited.set(result, projected);
+		if (result.assertion) projected.assertion = mapTestProviderRefs(result.assertion, mapProvider);
+		if (Array.isArray(result.componentResults)) projected.componentResults = result.componentResults.map(project);
+		return projected;
+	};
+	return project(gradingResult);
+}
+/** Project assertion providers only, preserving grading details and unrelated metadata. */
+function projectGradingResult(gradingResult, stripPromptText) {
+	return stripPromptText ? mapGradingResultProviderRefs(gradingResult, stripProviderPromptSelectors) : gradingResult;
+}
+function sanitizeProvider(provider) {
+	try {
+		if (isApiProvider(provider)) return {
+			id: provider.id(),
+			label: provider.label,
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
+		};
+		if (isProviderOptions(provider)) return {
+			id: provider.id,
+			label: provider.label,
+			...provider.config && { config: sanitizeProviderConfig(provider.config) }
+		};
+		if (typeof provider === "object" && provider) {
+			const providerObj = provider;
+			return {
+				id: typeof providerObj.id === "function" ? providerObj.id() : providerObj.id,
+				label: providerObj.label,
+				...providerObj.config && { config: sanitizeProviderConfig(providerObj.config) }
+			};
+		}
+	} catch {}
+	return JSON.parse(safeJsonStringify(provider));
+}
+/** Snapshot live provider references for replay without retaining runtime client state. */
+function toSerializableProviderRef(provider) {
+	if (isApiProvider(provider)) return {
+		...sanitizeProvider(provider),
+		...sanitizeObject({
+			transform: typeof provider.transform === "string" ? provider.transform : void 0,
+			delay: provider.delay,
+			inputs: provider.inputs
+		}, {
+			context: "provider options",
+			sanitizeUrls: true,
+			maxDepth: Number.POSITIVE_INFINITY
+		}),
+		...provider.prompts && { prompts: [...provider.prompts] }
+	};
+	if (Array.isArray(provider)) return provider.map(toSerializableProviderRef);
+	if (isProviderTypeMap(provider)) {
+		let serialized;
+		for (const type of GRADING_PROVIDER_TYPE_KEYS) if (isApiProvider(provider[type])) {
+			serialized ??= { ...provider };
+			serialized[type] = toSerializableProviderRef(provider[type]);
+		}
+		return serialized ?? provider;
+	}
+	return provider;
+}
+/** Snapshot live grading references before generic result serialization invokes provider toJSON. */
+function serializeResultProviderRefs(result) {
+	const record = result;
+	const serializeProvider = (provider) => {
+		if (!isApiProvider(provider) && !isProviderTypeMap(provider)) return provider;
+		return sanitizeObject(toSerializableProviderRef(provider), {
+			context: "grading provider",
+			sanitizeUrls: true,
+			maxDepth: Number.POSITIVE_INFINITY,
+			throwOnError: true
+		});
+	};
+	const projected = { ...record };
+	if (record.testCase) projected.testCase = mapTestProviderRefs(record.testCase, serializeProvider);
+	const prompt = asRecord(record.prompt);
+	const config = asRecord(prompt?.config);
+	if (config?.provider !== void 0) projected.prompt = {
+		...prompt,
+		config: {
+			...config,
+			provider: serializeProvider(config.provider)
+		}
+	};
+	if (record.gradingResult) projected.gradingResult = mapGradingResultProviderRefs(record.gradingResult, serializeProvider);
+	return projected;
+}
+/**
+* Sanitize an object for database storage by removing circular references
+* and non-serializable values (functions, Timeout objects, etc.).
+* Uses safeJsonStringify which handles circular references gracefully.
+*
+* This prevents "Converting circular structure to JSON" errors that can occur
+* when Node.js Timeout objects or other non-serializable data leaks into results.
+* See: https://github.com/promptfoo/promptfoo/issues/7266
+*/
+function sanitizeForDb(obj) {
+	if (obj === null || obj === void 0) return obj;
+	try {
+		const serialized = safeJsonStringify(obj);
+		if (serialized === void 0) {
+			logger.debug("sanitizeForDb: Failed to serialize object, using fallback", {
+				valueType: typeof obj,
+				isArray: Array.isArray(obj)
+			});
+			return Array.isArray(obj) ? [] : null;
+		}
+		return JSON.parse(serialized);
+	} catch (error) {
+		logger.debug("sanitizeForDb: Parse error, using fallback", { error });
+		return Array.isArray(obj) ? [] : null;
+	}
+}
+/**
+* Sanitize a per-test-case field for persistence: strips circular refs,
+* collapses class instances (e.g. live SDK clients that leaked in via
+* `defaultTest.options.provider`), and redacts credential fields (`apiKey`,
+* `token`, etc.) at any depth. Use this for any slot that can carry a provider
+* config — notably `testCase.options.provider` and `prompt.config.provider`,
+* where the resolved runtime provider (with its Anthropic / Bedrock SDK
+* client) flows in from the evaluator. Without this, credentials configured on
+* the judge provider end up in the Eval results both in the DB and in the
+* polling response served by `/api/eval/job/:id`.
+*/
+function sanitizeForDbWithSecrets(obj) {
+	if (obj === null || obj === void 0) return obj;
+	return sanitizeObject(obj, {
+		context: "evalResult field",
+		maxDepth: Number.POSITIVE_INFINITY
+	});
+}
+const SENSITIVE_RESPONSE_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+	"openai-organization",
+	"openai-project",
+	"openai-version",
+	"x-request-id",
+	"x-amzn-requestid",
+	"x-amzn-trace-id",
+	"x-amz-security-token",
+	"x-amz-cf-id",
+	"x-azure-ref",
+	"x-correlation-id",
+	"x-trace-id",
+	"cf-ray",
+	"cf-cache-status",
+	"x-openai-proxy-wasm",
+	"via"
+]);
+const SENSITIVE_RESPONSE_HEADER_PREFIXES = ["x-ratelimit-"];
+function isSensitiveResponseHeader(headerName) {
+	const normalized = headerName.toLowerCase();
+	if (SENSITIVE_RESPONSE_HEADER_NAMES.has(normalized)) return true;
+	return SENSITIVE_RESPONSE_HEADER_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function isSensitiveRequestHeader(headerName) {
+	return isSensitiveResponseHeader(headerName) || isSecretField(headerName);
+}
+function redactSensitiveHeaders(headers, sourceHeaders = headers, isSensitiveHeader = isSensitiveResponseHeader) {
+	let mutated = false;
+	const next = {};
+	for (const [key, value] of Object.entries(headers)) if (Object.prototype.hasOwnProperty.call(sourceHeaders, key) && isDeepStrictEqual(sourceHeaders[key], value) && isSensitiveHeader(key)) {
+		next[key] = REDACTED;
+		mutated = true;
+	} else next[key] = value;
+	return mutated ? next : null;
+}
+function redactHttpHeadersOnMetadata(metadata, options) {
+	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return metadata;
+	const m = metadata;
+	let nextMetadata;
+	const legacyHeaders = m.headers;
+	const legacyHeadersSource = options?.redactLegacyHeaders ? legacyHeaders : (options?.legacyHeadersSource)?.headers;
+	if (legacyHeaders && typeof legacyHeaders === "object" && !Array.isArray(legacyHeaders) && legacyHeadersSource && typeof legacyHeadersSource === "object" && !Array.isArray(legacyHeadersSource)) {
+		const redacted = redactSensitiveHeaders(legacyHeaders, legacyHeadersSource, isSensitiveRequestHeader);
+		if (redacted) nextMetadata = {
+			...m,
+			headers: redacted
+		};
+	}
+	const http = m.http;
+	if (!http || typeof http !== "object" || Array.isArray(http)) return nextMetadata ?? metadata;
+	const httpRecord = http;
+	let nextHttp;
+	for (const slot of ["headers", "requestHeaders"]) {
+		const slotValue = httpRecord[slot];
+		if (slotValue && typeof slotValue === "object" && !Array.isArray(slotValue)) {
+			const redacted = slot === "requestHeaders" ? redactSensitiveHeaders(slotValue, slotValue, isSensitiveRequestHeader) : redactSensitiveHeaders(slotValue);
+			if (redacted) {
+				nextHttp ??= { ...httpRecord };
+				nextHttp[slot] = redacted;
+			}
+		}
+	}
+	if (!nextHttp) return nextMetadata ?? metadata;
+	nextMetadata ??= { ...m };
+	nextMetadata.http = nextHttp;
+	return nextMetadata;
+}
+function redactHttpHeadersOnGradingResult(gradingResult) {
+	if (!gradingResult || typeof gradingResult !== "object" || Array.isArray(gradingResult)) return gradingResult;
+	const gr = gradingResult;
+	let mutated = false;
+	const next = { ...gr };
+	if (gr.metadata !== void 0) {
+		const redacted = redactHttpHeadersOnMetadata(gr.metadata);
+		if (redacted !== gr.metadata) {
+			next.metadata = redacted;
+			mutated = true;
+		}
+	}
+	if (Array.isArray(gr.componentResults)) {
+		let componentMutated = false;
+		const nextComponents = gr.componentResults.map((component) => {
+			const redacted = redactHttpHeadersOnGradingResult(component);
+			if (redacted !== component) componentMutated = true;
+			return redacted;
+		});
+		if (componentMutated) {
+			next.componentResults = nextComponents;
+			mutated = true;
+		}
+	}
+	return mutated ? next : gradingResult;
+}
+function sanitizeResponseForDb(response) {
+	if (!response) return response;
+	const redactedMetadata = redactHttpHeadersOnMetadata(response.metadata, { redactLegacyHeaders: true });
+	if (redactedMetadata === response.metadata) return response;
+	return {
+		...response,
+		metadata: redactedMetadata
+	};
+}
+function sanitizeMetadataForDb(metadata, responseMetadata) {
+	return redactHttpHeadersOnMetadata(metadata, { legacyHeadersSource: sanitizeForDb(responseMetadata) });
+}
+function sanitizeGradingResultAssertions(gradingResult) {
+	if (!gradingResult || typeof gradingResult !== "object" || Array.isArray(gradingResult)) return gradingResult;
+	const gr = gradingResult;
+	const assertion = asRecord(gr.assertion);
+	const sanitizedAssertion = assertion && { ...assertion };
+	if (sanitizedAssertion) {
+		for (const field of ["provider", "config"]) if (Object.prototype.hasOwnProperty.call(sanitizedAssertion, field)) sanitizedAssertion[field] = sanitizeObject(sanitizedAssertion[field], {
+			context: "grading assertion",
+			maxDepth: Number.POSITIVE_INFINITY,
+			sanitizeUrls: true,
+			throwOnError: true
+		});
+	}
+	return {
+		...gr,
+		...sanitizedAssertion && { assertion: sanitizedAssertion },
+		...Array.isArray(gr.componentResults) && { componentResults: gr.componentResults.map(sanitizeGradingResultAssertions) }
+	};
+}
+function sanitizeGradingResultForDb(gradingResult) {
+	return redactHttpHeadersOnGradingResult(sanitizeGradingResultAssertions(gradingResult));
+}
+const PROMPTFOO_METADATA_KEY = "__promptfoo";
+const TRACE_LINKAGE_KEY = "traceLinkage";
+const REPEAT_LINKAGE_KEY = "repeatLinkage";
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function persistTraceMetadata(metadata, traceId, evaluationId) {
+	if (!traceId && !evaluationId) return stripTraceLinkageFromMetadata(metadata);
+	const metadataRecord = metadata ?? {};
+	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
+	if (metadataRecord["__promptfoo"] !== void 0 && promptfooMetadata === void 0) logger.warn(`[EvalResult] Overwriting non-object metadata.${PROMPTFOO_METADATA_KEY} with internal trace linkage; the key is reserved for promptfoo internals.`);
+	if (promptfooMetadata && TRACE_LINKAGE_KEY in promptfooMetadata) logger.warn(`[EvalResult] Overwriting metadata.${PROMPTFOO_METADATA_KEY}.${TRACE_LINKAGE_KEY} with internal trace linkage; the path is reserved for promptfoo internals.`);
+	return {
+		...metadataRecord,
+		[PROMPTFOO_METADATA_KEY]: {
+			...promptfooMetadata ?? {},
+			[TRACE_LINKAGE_KEY]: {
+				traceId,
+				evaluationId
+			}
+		}
+	};
+}
+function stripTraceLinkageFromMetadata(metadata) {
+	const metadataRecord = asRecord(metadata);
+	const promptfooMetadata = asRecord(metadataRecord?.[PROMPTFOO_METADATA_KEY]);
+	if (!metadataRecord || !promptfooMetadata || !(TRACE_LINKAGE_KEY in promptfooMetadata)) return metadata;
+	const { [TRACE_LINKAGE_KEY]: _traceLinkage, ...remainingPromptfooMetadata } = promptfooMetadata;
+	const strippedMetadata = { ...metadataRecord };
+	delete strippedMetadata[PROMPTFOO_METADATA_KEY];
+	if (Object.keys(remainingPromptfooMetadata).length > 0) strippedMetadata[PROMPTFOO_METADATA_KEY] = remainingPromptfooMetadata;
+	return strippedMetadata;
+}
+function persistRepeatMetadata(metadata, repeatIndex, repeatGroupId) {
+	if (repeatIndex === void 0 || !repeatGroupId) return stripRepeatLinkageFromMetadata(metadata);
+	const metadataRecord = metadata ?? {};
+	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
+	if (metadataRecord["__promptfoo"] !== void 0 && promptfooMetadata === void 0) logger.warn(`[EvalResult] Overwriting non-object metadata.${PROMPTFOO_METADATA_KEY} with internal repeat linkage; the key is reserved for promptfoo internals.`);
+	if (promptfooMetadata && REPEAT_LINKAGE_KEY in promptfooMetadata) logger.warn(`[EvalResult] Overwriting metadata.${PROMPTFOO_METADATA_KEY}.${REPEAT_LINKAGE_KEY} with internal repeat linkage; the path is reserved for promptfoo internals.`);
+	return {
+		...metadataRecord,
+		[PROMPTFOO_METADATA_KEY]: {
+			...promptfooMetadata ?? {},
+			[REPEAT_LINKAGE_KEY]: {
+				repeatIndex,
+				repeatGroupId
+			}
+		}
+	};
+}
+function stripRepeatLinkageFromMetadata(metadata) {
+	const metadataRecord = asRecord(metadata);
+	const promptfooMetadata = asRecord(metadataRecord?.[PROMPTFOO_METADATA_KEY]);
+	if (!metadataRecord || !promptfooMetadata || !(REPEAT_LINKAGE_KEY in promptfooMetadata)) return metadata;
+	const { [REPEAT_LINKAGE_KEY]: _repeatLinkage, ...remainingPromptfooMetadata } = promptfooMetadata;
+	const strippedMetadata = { ...metadataRecord };
+	delete strippedMetadata[PROMPTFOO_METADATA_KEY];
+	if (Object.keys(remainingPromptfooMetadata).length > 0) strippedMetadata[PROMPTFOO_METADATA_KEY] = remainingPromptfooMetadata;
+	return strippedMetadata;
+}
+function surfaceRepeatMetadata(metadata) {
+	const metadataRecord = metadata ?? {};
+	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
+	const repeatLinkage = asRecord(promptfooMetadata?.[REPEAT_LINKAGE_KEY]);
+	return {
+		repeatIndex: typeof repeatLinkage?.repeatIndex === "number" && Number.isInteger(repeatLinkage.repeatIndex) && repeatLinkage.repeatIndex >= 0 ? repeatLinkage.repeatIndex : void 0,
+		repeatGroupId: typeof repeatLinkage?.repeatGroupId === "string" && repeatLinkage.repeatGroupId.length > 0 ? repeatLinkage.repeatGroupId : void 0,
+		metadata: promptfooMetadata != null && REPEAT_LINKAGE_KEY in promptfooMetadata ? stripRepeatLinkageFromMetadata(metadataRecord) : metadataRecord
+	};
+}
+function surfaceTraceMetadata(metadata) {
+	const metadataRecord = metadata ?? {};
+	const promptfooMetadata = asRecord(metadataRecord[PROMPTFOO_METADATA_KEY]);
+	const traceLinkage = asRecord(promptfooMetadata?.[TRACE_LINKAGE_KEY]);
+	const traceId = typeof traceLinkage?.traceId === "string" ? traceLinkage.traceId : void 0;
+	const evaluationId = typeof traceLinkage?.evaluationId === "string" ? traceLinkage.evaluationId : void 0;
+	if (!(promptfooMetadata != null && TRACE_LINKAGE_KEY in promptfooMetadata)) return {
+		traceId,
+		evaluationId,
+		metadata: metadataRecord
+	};
+	return {
+		traceId,
+		evaluationId,
+		metadata: stripTraceLinkageFromMetadata(metadataRecord)
+	};
+}
+function redactSensitiveResultFieldsForDb(fields) {
+	return {
+		response: sanitizeResponseForDb(fields.response),
+		gradingResult: sanitizeGradingResultForDb(fields.gradingResult),
+		metadata: sanitizeMetadataForDb(fields.metadata, fields.response?.metadata)
+	};
+}
+function getStripFlags(env) {
+	const getFlag = (key) => {
+		const value = env?.[key];
+		return value === void 0 ? getEnvBool(key, false) : parseEnvBool(String(value), false);
+	};
+	return {
+		shouldStripPromptText: getFlag("PROMPTFOO_STRIP_PROMPT_TEXT"),
+		shouldStripResponseOutput: getFlag("PROMPTFOO_STRIP_RESPONSE_OUTPUT"),
+		shouldStripTestVars: getFlag("PROMPTFOO_STRIP_TEST_VARS"),
+		shouldStripGradingResult: getFlag("PROMPTFOO_STRIP_GRADING_RESULT"),
+		shouldStripMetadata: getFlag("PROMPTFOO_STRIP_METADATA")
+	};
+}
+/**
+* Sanitize a result before it is serialized into a JSONL output artifact. This is the
+* JSONL-boundary equivalent of the database-persistence sanitization and must stay in sync
+* with it: it redacts credential-bearing HTTP headers from the response / grading / metadata
+* and applies the `PROMPTFOO_STRIP_*` projections (prompt text, response output, test vars,
+* grading result, metadata). In-memory rows keep their real values for hooks; only the
+* on-disk copy is sanitized.
+*/
+function sanitizeResultForJsonlArtifact(result, stripFlags = getStripFlags()) {
+	const { shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars, shouldStripGradingResult, shouldStripMetadata } = stripFlags;
+	const artifactResult = serializeResultProviderRefs(result);
+	const redacted = redactSensitiveResultFieldsForDb({
+		response: sanitizeForDb(artifactResult.response),
+		gradingResult: sanitizeForDb(artifactResult.gradingResult),
+		metadata: sanitizeForDb(artifactResult.metadata)
+	});
+	const response = projectProviderResponse(redacted.response ?? void 0, {
+		stripMetadata: shouldStripMetadata,
+		stripOutput: shouldStripResponseOutput
+	});
+	return {
+		...result,
+		...artifactResult.testCase ? { testCase: projectTestCase(sanitizeForDbWithSecrets(artifactResult.testCase), {
+			stripMetadata: shouldStripMetadata,
+			stripVars: shouldStripTestVars,
+			stripOutput: shouldStripResponseOutput,
+			stripPromptText: shouldStripPromptText
+		}) } : {},
+		...artifactResult.vars === void 0 ? {} : { vars: shouldStripTestVars ? {} : sanitizeForDbWithSecrets(artifactResult.vars) },
+		...artifactResult.prompt ? { prompt: projectPrompt(sanitizeForDbWithSecrets(artifactResult.prompt), shouldStripPromptText) } : {},
+		...artifactResult.provider ? { provider: sanitizeProvider(artifactResult.provider) } : {},
+		response,
+		gradingResult: shouldStripGradingResult ? null : projectGradingResult(redacted.gradingResult, shouldStripPromptText),
+		namedScores: sanitizeForDb(artifactResult.namedScores),
+		metadata: shouldStripMetadata ? {} : projectOutputMetadata(redacted.metadata, shouldStripResponseOutput, redacted.response?.metadata, artifactResult.testCase?.metadata)
+	};
+}
+var EvalResult = class EvalResult {
+	static async createFromEvaluateResult(evalId, result, opts) {
+		const persist = opts?.persist == null ? true : opts.persist;
+		const { prompt, error, score, latencyMs, success, provider, gradingResult, namedScores, cost, metadata, failureReason, testCase, traceId, evaluationId, repeatIndex, repeatGroupId } = serializeResultProviderRefs(result);
+		const persistedMetadata = persistTraceMetadata(persistRepeatMetadata(metadata, repeatIndex, repeatGroupId), traceId, evaluationId);
+		const processedResponse = await extractAndStoreBinaryData(result.response, {
+			evalId,
+			testIdx: result.testIdx,
+			promptIdx: result.promptIdx
+		});
+		const args = {
+			id: crypto.randomUUID(),
+			evalId,
+			testCase: sanitizeForDbWithSecrets(testCase),
+			promptIdx: result.promptIdx,
+			testIdx: result.testIdx,
+			prompt: sanitizeForDbWithSecrets(prompt),
+			promptId: hashPrompt(prompt),
+			error: error?.toString(),
+			success,
+			score: score == null ? 0 : score,
+			response: sanitizeForDb(processedResponse || null),
+			gradingResult: sanitizeForDb(gradingResult || null),
+			namedScores: sanitizeForDb(namedScores),
+			provider: sanitizeProvider(provider),
+			latencyMs,
+			cost,
+			metadata: sanitizeForDb(persistedMetadata),
+			failureReason
+		};
+		if (persist) {
+			const db = await getDb();
+			const redacted = redactSensitiveResultFieldsForDb({
+				response: args.response,
+				gradingResult: args.gradingResult,
+				metadata: args.metadata
+			});
+			args.response = redacted.response;
+			args.gradingResult = redacted.gradingResult;
+			args.metadata = redacted.metadata;
+			const dbResult = await db.insert(evalResultsTable).values(args).returning();
+			clearCountCache(evalId);
+			return new EvalResult({
+				...dbResult[0],
+				persisted: true
+			});
+		}
+		return new EvalResult(args);
+	}
+	static async createManyFromEvaluateResult(results, evalId) {
+		const db = await getDb();
+		const returnResults = [];
+		const processedResults = [];
+		for (const result of results) {
+			const processedResponse = isBlobStorageEnabled() ? await extractAndStoreBinaryData(result.response, {
+				evalId,
+				testIdx: result.testIdx,
+				promptIdx: result.promptIdx
+			}) : result.response;
+			processedResults.push({
+				...serializeResultProviderRefs(result),
+				response: processedResponse ?? void 0
+			});
+		}
+		await db.transaction(async (tx) => {
+			for (const result of processedResults) {
+				const { traceId: _traceId, evaluationId: _evaluationId, repeatIndex: _repeatIndex, repeatGroupId: _repeatGroupId, ...rest } = result;
+				const sanitizedResult = {
+					...rest,
+					testCase: sanitizeForDbWithSecrets(result.testCase),
+					prompt: sanitizeForDbWithSecrets(result.prompt),
+					...redactSensitiveResultFieldsForDb({
+						response: sanitizeForDb(result.response),
+						gradingResult: sanitizeForDb(result.gradingResult),
+						metadata: sanitizeForDb(persistTraceMetadata(persistRepeatMetadata(result.metadata, result.repeatIndex, result.repeatGroupId), result.traceId, result.evaluationId))
+					}),
+					namedScores: sanitizeForDb(result.namedScores),
+					provider: result.provider ? sanitizeProvider(result.provider) : result.provider
+				};
+				const dbResult = await tx.insert(evalResultsTable).values({
+					...sanitizedResult,
+					evalId,
+					id: crypto.randomUUID()
+				}).returning().get();
+				returnResults.push(new EvalResult({
+					...dbResult,
+					persisted: true
+				}));
+			}
+		});
+		clearCountCache(evalId);
+		return returnResults;
+	}
+	static async findById(id) {
+		const result = await (await getDb()).select().from(evalResultsTable).where(eq(evalResultsTable.id, id));
+		return result.length > 0 ? new EvalResult({
+			...result[0],
+			persisted: true
+		}) : null;
+	}
+	static async findManyByEvalId(evalId, opts) {
+		return (await (await getDb()).select().from(evalResultsTable).where(and(eq(evalResultsTable.evalId, evalId), opts?.testIdx == null ? void 0 : eq(evalResultsTable.testIdx, opts.testIdx)))).map((result) => new EvalResult({
+			...result,
+			persisted: true
+		}));
+	}
+	static async findManyByEvalIdAndTestIndices(evalId, testIndices) {
+		if (!testIndices.length) return [];
+		return (await (await getDb()).select().from(evalResultsTable).where(and(eq(evalResultsTable.evalId, evalId), testIndices.length === 1 ? eq(evalResultsTable.testIdx, testIndices[0]) : inArray(evalResultsTable.testIdx, testIndices)))).map((result) => new EvalResult({
+			...result,
+			persisted: true
+		}));
+	}
+	/**
+	* Returns a set of completed (testIdx,promptIdx) pairs for a given eval.
+	* Key format: `${testIdx}:${promptIdx}`
+	*
+	* @param evalId - The evaluation ID to query
+	* @param opts.excludeErrors - If true, excludes results with ERROR failureReason (used in retry mode)
+	*/
+	static async getCompletedIndexPairs(evalId, opts) {
+		const db = await getDb();
+		const whereClause = opts?.excludeErrors ? and(eq(evalResultsTable.evalId, evalId), ne(evalResultsTable.failureReason, ResultFailureReason.ERROR)) : eq(evalResultsTable.evalId, evalId);
+		const rows = await db.select({
+			testIdx: evalResultsTable.testIdx,
+			promptIdx: evalResultsTable.promptIdx
+		}).from(evalResultsTable).where(whereClause);
+		const ret = /* @__PURE__ */ new Set();
+		for (const r of rows) ret.add(`${r.testIdx}:${r.promptIdx}`);
+		return ret;
+	}
+	static async *findManyByEvalIdBatched(evalId, opts) {
+		const db = await getDb();
+		const batchSize = opts?.batchSize || 100;
+		let offset = 0;
+		while (true) {
+			const nextResult = await db.select({ testIdx: evalResultsTable.testIdx }).from(evalResultsTable).where(and(eq(evalResultsTable.evalId, evalId), gte(evalResultsTable.testIdx, offset))).orderBy(evalResultsTable.testIdx).limit(1).get();
+			if (!nextResult) break;
+			offset = nextResult.testIdx;
+			yield (await db.select().from(evalResultsTable).where(and(eq(evalResultsTable.evalId, evalId), gte(evalResultsTable.testIdx, offset), lt(evalResultsTable.testIdx, offset + batchSize))).all()).map((result) => new EvalResult({
+				...result,
+				persisted: true
+			}));
+			offset += batchSize;
+		}
+	}
+	id;
+	evalId;
+	description;
+	promptIdx;
+	testIdx;
+	testCase;
+	prompt;
+	promptId;
+	error;
+	success;
+	score;
+	response;
+	gradingResult;
+	namedScores;
+	provider;
+	latencyMs;
+	cost;
+	metadata;
+	traceId;
+	evaluationId;
+	repeatIndex;
+	repeatGroupId;
+	failureReason;
+	persisted;
+	pluginId;
+	constructor(opts) {
+		this.id = opts.id;
+		this.evalId = opts.evalId;
+		this.promptIdx = opts.promptIdx;
+		this.testIdx = opts.testIdx;
+		this.testCase = opts.testCase;
+		this.prompt = opts.prompt;
+		this.promptId = opts.promptId || hashPrompt(opts.prompt);
+		this.error = opts.error;
+		this.score = opts.score;
+		this.success = opts.success;
+		this.response = opts.response || void 0;
+		this.gradingResult = opts.gradingResult;
+		this.namedScores = opts.namedScores || {};
+		this.provider = opts.provider;
+		this.latencyMs = opts.latencyMs || 0;
+		this.cost = opts.cost || 0;
+		const surfacedTrace = surfaceTraceMetadata(opts.metadata);
+		const surfacedRepeat = surfaceRepeatMetadata(surfacedTrace.metadata);
+		this.metadata = surfacedRepeat.metadata;
+		this.traceId = surfacedTrace.traceId;
+		this.evaluationId = surfacedTrace.evaluationId;
+		this.repeatIndex = surfacedRepeat.repeatIndex;
+		this.repeatGroupId = surfacedRepeat.repeatGroupId;
+		this.failureReason = isResultFailureReason(opts.failureReason) ? opts.failureReason : ResultFailureReason.NONE;
+		this.persisted = opts.persisted || false;
+		this.pluginId = opts.testCase.metadata?.pluginId;
+	}
+	async save() {
+		const db = await getDb();
+		const { traceId: _traceId, evaluationId: _evaluationId, repeatIndex: _repeatIndex, repeatGroupId: _repeatGroupId, pluginId: _pluginId, ...rest } = serializeResultProviderRefs(this);
+		const persistedValues = {
+			...rest,
+			error: this.error ?? null,
+			gradingResult: sanitizeGradingResultForDb(rest.gradingResult),
+			metadata: persistTraceMetadata(persistRepeatMetadata(this.metadata, this.repeatIndex, this.repeatGroupId), this.traceId, this.evaluationId)
+		};
+		if (this.persisted) await db.update(evalResultsTable).set({
+			...persistedValues,
+			updatedAt: getCurrentTimestamp()
+		}).where(eq(evalResultsTable.id, this.id)).run();
+		else {
+			const result = await db.insert(evalResultsTable).values(persistedValues).returning();
+			this.id = result[0].id;
+			this.persisted = true;
+		}
+		invalidateEvaluationCache(this.evalId);
+	}
+	toEvaluateResult(stripFlags = getStripFlags()) {
+		const { shouldStripPromptText, shouldStripResponseOutput, shouldStripTestVars, shouldStripGradingResult, shouldStripMetadata } = stripFlags;
+		const response = projectProviderResponse(this.response, {
+			stripMetadata: shouldStripMetadata,
+			stripOutput: shouldStripResponseOutput
+		});
+		const prompt = projectPrompt(this.prompt, shouldStripPromptText);
+		const testCase = projectTestCase(this.testCase, {
+			stripMetadata: shouldStripMetadata,
+			stripVars: shouldStripTestVars,
+			stripOutput: shouldStripResponseOutput,
+			stripPromptText: shouldStripPromptText
+		});
+		const tokenUsage = createEmptyTokenUsage();
+		if (this.response) accumulateResponseTokenUsage(tokenUsage, this.response);
+		if (this.gradingResult) accumulateGradingTokenUsage(tokenUsage, this.gradingResult.tokensUsed, { cached: this.gradingResult.metadata?.cachedResponse });
+		return {
+			cost: this.cost,
+			...this.response?.incurredCost !== void 0 && { incurredCost: this.response.incurredCost },
+			description: this.description || void 0,
+			error: this.error || void 0,
+			gradingResult: shouldStripGradingResult ? null : projectGradingResult(this.gradingResult, shouldStripPromptText),
+			id: this.id,
+			latencyMs: this.latencyMs,
+			namedScores: this.namedScores,
+			prompt,
+			promptId: this.promptId,
+			promptIdx: this.promptIdx,
+			...this.traceId ? { traceId: this.traceId } : {},
+			...this.evaluationId ? { evaluationId: this.evaluationId } : {},
+			...this.repeatGroupId !== void 0 && {
+				repeatGroupId: this.repeatGroupId,
+				repeatIndex: this.repeatIndex
+			},
+			provider: {
+				id: this.provider.id,
+				label: this.provider.label
+			},
+			response,
+			score: this.score,
+			success: this.success,
+			testCase,
+			testIdx: this.testIdx,
+			tokenUsage,
+			vars: shouldStripTestVars ? {} : this.testCase.vars || {},
+			metadata: shouldStripMetadata ? {} : projectOutputMetadata(this.metadata, shouldStripResponseOutput, this.response?.metadata, this.testCase.metadata),
+			failureReason: this.failureReason
+		};
+	}
+};
+/** Normalize an `EvalResult` model instance or a plain `EvaluateResult` to `EvaluateResult`. */
+function asEvaluateResult(result, stripFlags = getStripFlags()) {
+	return "toEvaluateResult" in result ? result.toEvaluateResult(stripFlags) : result;
+}
+/** Canonical `testIdx:promptIdx` key used to dedupe/look up a result across the streaming,
+* recovery, and comparison paths. */
+function getResultIndexKey(result) {
+	return `${result.testIdx}:${result.promptIdx}`;
+}
+//#endregion
+//#region src/util/providerRef.ts
+const PROVIDER_OPTION_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"label",
+	"config",
+	"prompts",
+	"transform",
+	"delay",
+	"env",
+	"inputs"
+]);
+/** Returns true if the value is a non-empty string suitable as a provider identifier. */
+function isValidProviderId(id) {
+	return typeof id === "string" && id !== "";
+}
+function getProviderLabel(provider) {
+	if ((typeof provider === "object" || typeof provider === "function") && provider !== null && "label" in provider && typeof provider.label === "string") return provider.label;
+}
+/**
+* Resolves relative file paths in provider IDs to absolute paths for consistent matching.
+* Handles file://, exec:, python:, golang: prefixes and bare .js/.ts/.mjs paths.
+*/
+function canonicalizeProviderId(id) {
+	if (id.startsWith("file://")) {
+		const filePath = id.slice(7);
+		return path.isAbsolute(filePath) ? id : `file://${path.resolve(filePath)}`;
+	}
+	for (const prefix of [
+		"exec:",
+		"python:",
+		"golang:"
+	]) if (id.startsWith(prefix)) {
+		const filePath = id.slice(prefix.length);
+		if (filePath.includes("/") || filePath.includes("\\")) return `${prefix}${path.resolve(filePath)}`;
+		return id;
+	}
+	if ((id.endsWith(".js") || id.endsWith(".ts") || id.endsWith(".mjs")) && (id.includes("/") || id.includes("\\"))) return `file://${path.resolve(id)}`;
+	return id;
+}
+/**
+* Returns true for provider refs that should be expanded from YAML/JSON config files.
+*/
+function isProviderConfigFileReference(providerPath) {
+	return providerPath.startsWith("file://") && (providerPath.endsWith(".yaml") || providerPath.endsWith(".yml") || providerPath.endsWith(".json"));
+}
+/**
+* Reads a provider config file and normalizes single-provider and multi-provider files.
+* An explicit base path also scopes nested configuration files; otherwise their
+* caller scope is retained.
+* Returns a `wasArray` flag so callers can detect multi-provider files that require
+* `loadApiProviders` instead of `loadApiProvider`.
+*/
+function readProviderConfigFile(providerPath, basePath) {
+	const relativePath = providerPath.slice(7);
+	const resolvedPath = path.isAbsolute(relativePath) ? relativePath : path.join(basePath || process.cwd(), relativePath);
+	let rawContent;
+	try {
+		rawContent = loadYaml(fs.readFileSync(resolvedPath, "utf8"));
+	} catch (err) {
+		throw new Error(`Failed to load provider config ${relativePath}: ${err instanceof Error ? err.message : err}`);
+	}
+	const fileContent = maybeLoadConfigFromExternalFile(rawContent, void 0, basePath);
+	invariant(fileContent, `Provider config ${relativePath} is undefined`);
+	return {
+		configs: [fileContent].flat(),
+		relativePath,
+		wasArray: Array.isArray(fileContent)
+	};
+}
+/**
+* Loads provider config objects from a file-backed provider reference.
+*/
+function loadProviderConfigsFromFile(providerPath, basePath) {
+	return readProviderConfigFile(providerPath, basePath).configs;
+}
+/**
+* Pure, synchronous classifier that converts every supported provider reference shape
+* into a discriminated descriptor. Does not read files or instantiate providers.
+*/
+function normalizeProviderRef(provider, options = {}) {
+	const { index } = options;
+	if (typeof provider === "string") {
+		if (!isValidProviderId(provider)) return {
+			kind: "unknown",
+			id: index === void 0 ? "unknown" : `unknown-${index}`
+		};
+		if (isProviderConfigFileReference(provider)) return {
+			kind: "file",
+			id: provider,
+			loadProviderPath: provider
+		};
+		return {
+			kind: "named",
+			id: provider,
+			loadProviderPath: provider
+		};
+	}
+	if (typeof provider === "function") {
+		const label = getProviderLabel(provider);
+		return {
+			kind: "function",
+			id: label ?? (index === void 0 ? "custom-function" : `custom-function-${index}`),
+			label
+		};
+	}
+	if (typeof provider === "object" && provider !== null && !Array.isArray(provider)) {
+		const providerId = provider.id;
+		const label = getProviderLabel(provider);
+		if (isValidProviderId(providerId)) return {
+			kind: "options",
+			id: providerId,
+			label,
+			loadOptions: provider,
+			loadProviderPath: providerId
+		};
+		const keys = Object.keys(provider);
+		if (keys.length === 1 && !PROVIDER_OPTION_KEYS.has(keys[0])) {
+			const originalId = keys[0];
+			const providerObject = provider[originalId];
+			if (typeof providerObject === "object" && providerObject !== null && !Array.isArray(providerObject) && isValidProviderId(originalId)) {
+				const id = isValidProviderId(providerObject.id) ? providerObject.id : originalId;
+				return {
+					kind: "map",
+					id,
+					label: getProviderLabel(providerObject),
+					loadOptions: {
+						...providerObject,
+						id
+					},
+					loadProviderPath: originalId
+				};
+			}
+		}
+		if (isValidProviderId(label)) return {
+			kind: "unknown",
+			id: label,
+			label
+		};
+	}
+	return {
+		kind: "unknown",
+		id: index === void 0 ? "unknown" : `unknown-${index}`
+	};
+}
+//#endregion
+//#region src/util/provider.ts
+function providerToIdentifier(provider) {
+	if (!provider) return;
+	if (typeof provider === "string") return canonicalizeProviderId(provider);
+	const { label } = normalizeProviderRef(provider);
+	if (label) return label;
+	if (isApiProvider(provider)) return canonicalizeProviderId(provider.id());
+	if (isProviderOptions(provider)) {
+		if (provider.id) return canonicalizeProviderId(provider.id);
+		return;
+	}
+	if (typeof provider === "object" && "id" in provider && typeof provider.id === "string") return canonicalizeProviderId(provider.id);
+}
+/**
+* Gets the identifier string for a provider (label or id).
+*/
+function getProviderIdentifier(provider) {
+	return provider.label || provider.id();
+}
+/**
+* Gets a descriptive identifier string for a provider, showing both label and ID when both exist.
+* Useful for error messages to help users debug provider reference issues.
+*/
+function getProviderDescription(provider) {
+	const label = provider.label;
+	const id = provider.id();
+	if (label && label !== id) return `${label} (${id})`;
+	return id;
+}
+function sanitizeProviderIdForLog(providerId) {
+	const descriptionMatch = providerId.match(/^(\S+)(\s+\(.+\))$/);
+	if (descriptionMatch) {
+		const [, id, description] = descriptionMatch;
+		return `${sanitizeProviderIdForLog(id)}${description}`;
+	}
+	return providerId.includes("://") || providerId.startsWith("/") ? sanitizeUrl(providerId) : providerId;
+}
+/**
+* Checks if a provider reference matches a given provider.
+* Supports exact matching and wildcard patterns.
+*/
+function doesProviderRefMatch(ref, provider) {
+	const label = provider.label;
+	const id = provider.id();
+	const canonicalRef = canonicalizeProviderId(ref);
+	const canonicalId = canonicalizeProviderId(id);
+	if (label && label === ref) return true;
+	if (id === ref || canonicalId === canonicalRef) return true;
+	if (ref.endsWith("*")) {
+		const prefix = ref.slice(0, -1);
+		if (label?.startsWith(prefix) || id.startsWith(prefix) || canonicalId.startsWith(prefix)) return true;
+	}
+	if (label?.startsWith(`${ref}:`) || id.startsWith(`${ref}:`) || canonicalId.startsWith(`${ref}:`)) return true;
+	return false;
+}
+/**
+* Checks if a provider is allowed based on a list of allowed references.
+*/
+function isProviderAllowed(provider, allowedProviders) {
+	if (!Array.isArray(allowedProviders)) return true;
+	if (allowedProviders.length === 0) return false;
+	return allowedProviders.some((ref) => doesProviderRefMatch(ref, provider));
+}
+/**
+* Detects if a provider uses OpenAI models.
+* This includes direct OpenAI providers and Azure OpenAI.
+*/
+function isOpenAiProvider(providerId) {
+	const lowerProviderId = providerId.toLowerCase();
+	if (lowerProviderId.startsWith("openai:")) return true;
+	if (lowerProviderId.startsWith("azureopenai:")) return true;
+	if (lowerProviderId.startsWith("azure:")) {
+		if ([
+			"gpt",
+			"openai",
+			"davinci",
+			"curie",
+			"babbage",
+			"ada",
+			"text-embedding",
+			"whisper",
+			"dall-e",
+			"tts"
+		].some((indicator) => lowerProviderId.includes(indicator))) return true;
+	}
+	return false;
+}
+/**
+* Detects if a provider uses Anthropic/Claude models.
+* This includes direct Anthropic providers, Bedrock with Claude, and Vertex with Claude.
+*/
+function isAnthropicProvider(providerId) {
+	const lowerProviderId = providerId.toLowerCase();
+	if (lowerProviderId.startsWith("anthropic:")) return true;
+	if (lowerProviderId.startsWith("bedrock:")) {
+		if (lowerProviderId.includes("claude") || lowerProviderId.includes("anthropic")) return true;
+	}
+	if (lowerProviderId.startsWith("vertex:")) {
+		if (lowerProviderId.includes("claude")) return true;
+	}
+	return false;
+}
+const KNOWN_ENV_VARS = {
+	openai: "OPENAI_API_KEY",
+	anthropic: "ANTHROPIC_API_KEY",
+	google: "GOOGLE_API_KEY",
+	mistral: "MISTRAL_API_KEY",
+	cohere: "COHERE_API_KEY",
+	replicate: "REPLICATE_API_TOKEN",
+	voyage: "VOYAGE_API_KEY",
+	ai21: "AI21_API_KEY",
+	xai: "XAI_API_KEY",
+	groq: "GROQ_API_KEY",
+	deepseek: "DEEPSEEK_API_KEY",
+	meta: "MODEL_API_KEY",
+	moonshot: "MOONSHOT_API_KEY",
+	perplexity: "PERPLEXITY_API_KEY",
+	hyperbolic: "HYPERBOLIC_API_KEY",
+	cerebras: "CEREBRAS_API_KEY",
+	togetherai: "TOGETHER_API_KEY",
+	fal: "FAL_KEY",
+	huggingface: "HF_TOKEN",
+	"cloudflare-ai": "CLOUDFLARE_API_KEY"
+};
+function getDefaultEnvVar(providerId) {
+	const prefix = providerId.split(":")[0];
+	return KNOWN_ENV_VARS[prefix] || `${prefix.toUpperCase()}_API_KEY`;
+}
+/**
+* Pre-checks providers for missing API keys before evaluation starts.
+* Assumes getApiKey() is side-effect free (no network calls or token refresh).
+* Returns stable provider IDs by default; descriptions are for user-facing diagnostics only.
+*/
+function checkProviderApiKeys(providers, options = {}) {
+	const missingApiKeys = /* @__PURE__ */ new Map();
+	for (const provider of providers) {
+		const p = provider;
+		if (typeof p.getApiKey !== "function") continue;
+		if (provider.id().startsWith("azure:")) continue;
+		const requiresKey = typeof p.requiresApiKey === "function" ? p.requiresApiKey() : p.config?.apiKeyRequired !== false;
+		let apiKey;
+		try {
+			apiKey = p.getApiKey();
+		} catch {
+			apiKey = void 0;
+		}
+		if (requiresKey && !apiKey) {
+			const envVar = p.config?.apiKeyEnvar || getDefaultEnvVar(provider.id());
+			const providerIdentifier = options.useDescriptions ? getProviderDescription(provider) : provider.id();
+			if (!missingApiKeys.has(envVar)) missingApiKeys.set(envVar, []);
+			missingApiKeys.get(envVar).push(providerIdentifier);
+		}
+	}
+	return missingApiKeys;
+}
+/**
+* Detects if a provider uses Google models.
+* This includes direct Google/Vertex providers with Gemini and other Google models.
+* Note: Vertex with Claude models is NOT counted as Google (it's Anthropic).
+*/
+function isGoogleProvider(providerId) {
+	const lowerProviderId = providerId.toLowerCase();
+	if (lowerProviderId.startsWith("google:")) return true;
+	if (lowerProviderId.startsWith("vertex:")) {
+		if (!lowerProviderId.includes("claude")) return true;
+	}
+	return false;
+}
+//#endregion
+//#region src/util/comparison.ts
+/**
+* Explicit runtime variable names that don't follow the underscore convention.
+* These are added during evaluation but aren't part of the original test definition.
+*
+* - sessionId: Added by multi-turn strategy providers (GOAT, Crescendo)
+*
+* Note: Variables starting with underscore (e.g., _conversation) are automatically
+* treated as runtime variables and filtered out.
+*/
+const EXPLICIT_RUNTIME_VAR_KEYS = ["sessionId"];
+/**
+* Checks if a variable key is a runtime-only variable that should be filtered
+* when comparing test cases.
+*
+* Runtime variables are identified by:
+* 1. Starting with underscore (_) - convention for internal/runtime vars
+* 2. Being in the explicit runtime var list (for legacy vars like sessionId)
+*/
+function isRuntimeVar(key) {
+	return key.startsWith("_") || EXPLICIT_RUNTIME_VAR_KEYS.includes(key);
+}
+/**
+* Filters out runtime-only variables that are added during evaluation
+* but aren't part of the original test definition.
+*
+* This is used when comparing test cases to determine if a result
+* corresponds to a particular test, regardless of runtime state.
+*
+* Runtime variables are identified by:
+* - Starting with underscore (e.g., _conversation, _metadata)
+* - Being in the explicit list (e.g., sessionId for backward compatibility)
+*/
+function filterRuntimeVars(vars) {
+	if (!vars || typeof vars !== "object" || Array.isArray(vars)) return vars;
+	const filtered = {};
+	for (const [key, value] of Object.entries(vars)) if (!isRuntimeVar(key)) filtered[key] = value;
+	return filtered;
+}
+/**
+* Extracts only runtime variables from a vars object.
+* This is the inverse of filterRuntimeVars.
+*
+* Used to restore runtime state when re-running filtered tests.
+*/
+function extractRuntimeVars(vars) {
+	if (!vars || typeof vars !== "object" || Array.isArray(vars)) return;
+	const extracted = {};
+	for (const [key, value] of Object.entries(vars)) if (isRuntimeVar(key)) extracted[key] = value;
+	return Object.keys(extracted).length > 0 ? extracted : void 0;
+}
+function varsMatch(vars1, vars2) {
+	return deepEqual(vars1, vars2);
+}
+/**
+* Generate a unique key for a test case for deduplication purposes.
+* Excludes runtime variables and includes strategyId to distinguish tests
+* with the same prompt but different strategies.
+*
+* @param testCase - The test case to generate a key for
+* @returns A JSON string that uniquely identifies the test case
+*/
+function getTestCaseDeduplicationKey(testCase) {
+	const filteredVars = filterRuntimeVars(testCase.vars);
+	const strategyId = testCase.metadata?.strategyId || "none";
+	return JSON.stringify({
+		vars: filteredVars,
+		strategyId
+	});
+}
+/**
+* Deduplicates an array of test cases based on their vars and strategyId.
+* Tests with the same vars but different strategies are considered different.
+* Runtime variables (like _conversation, sessionId) are filtered out before comparison.
+*
+* @param tests - Array of test cases to deduplicate
+* @returns Deduplicated array of test cases
+*/
+function deduplicateTestCases(tests) {
+	const seen = /* @__PURE__ */ new Set();
+	return tests.filter((test) => {
+		const key = getTestCaseDeduplicationKey(test);
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function resultIsForTestCase(result, testCase) {
+	const testProviderId = testCase.provider ? providerToIdentifier(testCase.provider) : void 0;
+	const resultProviderId = providerToIdentifier(result.provider);
+	const providersMatch = !testProviderId || !resultProviderId || testProviderId === resultProviderId;
+	const resultVars = filterRuntimeVars(result.vars);
+	const testVars = filterRuntimeVars(testCase.vars);
+	const doVarsMatch = varsMatch(testVars, resultVars);
+	const isMatch = doVarsMatch && providersMatch;
+	if (!isMatch) {
+		const varKeys = testVars ? Object.keys(testVars).join(", ") : "none";
+		logger.debug(`[resultIsForTestCase] No match: vars=${doVarsMatch}, providers=${providersMatch}`, {
+			testProvider: testProviderId || "none",
+			resultProvider: resultProviderId || "none",
+			testVarKeys: varKeys
+		});
+	}
+	return isMatch;
+}
+//#endregion
+//#region src/util/env.ts
+/**
+* Load environment variables from .env file(s).
+* @param envPath - Single path, array of paths, or undefined for default .env loading.
+*                  When paths are explicitly specified, all files must exist or an error is thrown.
+*                  When multiple files are provided, later files override values from earlier files.
+*/
+function setupEnv(envPath, options = {}) {
+	const paths = (Array.isArray(envPath) ? envPath : [envPath ?? ""]).flatMap((p) => p.split(",").map((s) => s.trim())).filter(Boolean);
+	if (paths.length > 0) {
+		for (const p of paths) if (!fs$2.existsSync(p)) throw new Error(`Environment file not found: ${p}`);
+		if (paths.length === 1) logger.info(`Loading environment variables from ${paths[0]}`);
+		else logger.info(`Loading environment variables from: ${paths.join(", ")}`);
+	}
+	const previousEnv = { ...options.processEnv };
+	loadEnvFiles(paths.length > 0 ? paths : void 0, {
+		...paths.length > 0 && { override: true },
+		...options.processEnv && { processEnv: options.processEnv }
+	});
+	if (options.processEnv && paths.length === 0) {
+		for (const key of Object.keys(options.processEnv)) if (!Object.prototype.hasOwnProperty.call(previousEnv, key) && process.env[key] !== void 0) delete options.processEnv[key];
+	}
+	if (options.refreshConfigDirectory) refreshConfigDirectoryPathFromEnv();
+}
+//#endregion
+//#region src/googleSheets.ts
+var GoogleSheetAuthenticationRequiredError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "GoogleSheetAuthenticationRequiredError";
+	}
+};
+async function loadGoogleSheetsApi() {
+	try {
+		return await import("@googleapis/sheets");
+	} catch (error) {
+		if (isMissingPackageImportError(error, "@googleapis/sheets")) throw new Error("The @googleapis/sheets package is required for authenticated Google Sheets access. Install it with: npm install @googleapis/sheets");
+		throw error;
+	}
+}
+async function checkGoogleSheetAccess(url) {
+	try {
+		const response = await fetchWithProxy(url);
+		if (response.ok) return {
+			public: true,
+			status: response.status
+		};
+		else return {
+			public: false,
+			status: response.status
+		};
+	} catch (error) {
+		logger.error(`Error checking sheet access: ${error}`);
+		return { public: false };
+	}
+}
+function isHtmlExportResponse(response, body) {
+	const contentType = response.headers?.get("content-type")?.toLowerCase() ?? "";
+	if (contentType.includes("text/html")) return true;
+	if (contentType.includes("text/csv") || contentType.includes("application/csv")) return false;
+	const prefix = body.trimStart().slice(0, 32).toLowerCase();
+	return prefix.startsWith("<!doctype html") || prefix.startsWith("<html");
+}
+/**
+* Returns the sheet id (`gid`) a Google Sheets URL selects. The browser keeps it in the fragment
+* (`/edit#gid=123`); newer URLs also repeat it in the query (`/edit?gid=123#gid=123`). It stays a
+* string so that sheet id 0 is still truthy.
+*/
+function getSheetGid(url) {
+	const { searchParams, hash } = new URL(url);
+	return searchParams.get("gid") || new URLSearchParams(hash.slice(1)).get("gid") || void 0;
+}
+async function fetchCsvFromGoogleSheetUnauthenticated(url) {
+	const { parse: parseCsv } = await import("csv-parse/sync");
+	const gid = getSheetGid(url);
+	const csvUrl = `${url.replace(/\/edit.*$/, "/export")}?format=csv${gid ? `&gid=${gid}` : ""}`;
+	const response = await fetchWithProxy(csvUrl);
+	if (response.status !== 200) throw new Error(`Failed to fetch CSV from Google Sheets URL: ${url}`);
+	const csvData = await response.text();
+	if (isHtmlExportResponse(response, csvData)) throw new GoogleSheetAuthenticationRequiredError(`Failed to fetch CSV from Google Sheets URL: ${url}`);
+	return parseCsv(csvData, { columns: true });
+}
+async function fetchCsvFromGoogleSheetAuthenticated(url) {
+	const { sheets: googleSheets, auth: googleAuth } = await loadGoogleSheetsApi();
+	const auth = new googleAuth.GoogleAuth({ scopes: ["https://www.googleapis.com/auth/spreadsheets.readonly"] });
+	const sheets = googleSheets("v4");
+	const match = url.match(/\/d\/([^/]+)/);
+	if (!match) throw new Error(`Invalid Google Sheets URL: ${url}`);
+	const spreadsheetId = match[1];
+	let range;
+	const gid = getSheetGid(url);
+	if (gid) {
+		const sheet = (await sheets.spreadsheets.get({
+			spreadsheetId,
+			auth
+		})).data.sheets?.find((sheet) => sheet.properties?.sheetId === Number(gid));
+		if (!sheet || !sheet.properties?.title) throw new Error(`Sheet not found for gid: ${gid}`);
+		range = sheet.properties.title;
+	} else {
+		const firstSheet = (await sheets.spreadsheets.get({
+			spreadsheetId,
+			auth
+		})).data.sheets?.[0];
+		if (!firstSheet || !firstSheet.properties?.title) throw new Error(`No sheets found in spreadsheet`);
+		range = firstSheet.properties.title;
+	}
+	const rows = (await sheets.spreadsheets.values.get({
+		spreadsheetId,
+		range,
+		auth
+	})).data.values;
+	if (!rows?.length) throw new Error(`No data found in Google Sheets URL: ${url}`);
+	const headers = rows[0];
+	return rows.slice(1).map((row) => {
+		const csvRow = {};
+		headers.forEach((header, index) => {
+			csvRow[header] = row[index] ?? "";
+		});
+		return csvRow;
+	});
+}
+async function fetchCsvFromGoogleSheet(url) {
+	const access = await checkGoogleSheetAccess(url);
+	const { public: isPublic } = access;
+	logger.debug(`Google Sheets URL: ${url}, isPublic: ${isPublic}`);
+	if (isPublic) try {
+		return await fetchCsvFromGoogleSheetUnauthenticated(url);
+	} catch (error) {
+		if (error instanceof GoogleSheetAuthenticationRequiredError) return fetchCsvFromGoogleSheetAuthenticated(url);
+		throw error;
+	}
+	if (!("status" in access)) try {
+		return await fetchCsvFromGoogleSheetUnauthenticated(url);
+	} catch {
+		return fetchCsvFromGoogleSheetAuthenticated(url);
+	}
+	return fetchCsvFromGoogleSheetAuthenticated(url);
+}
+async function writeCsvToGoogleSheet(rows, url) {
+	const { sheets: googleSheets, auth: googleAuth } = await loadGoogleSheetsApi();
+	const auth = new googleAuth.GoogleAuth({ scopes: ["https://www.googleapis.com/auth/spreadsheets"] });
+	const sheets = googleSheets("v4");
+	const match = url.match(/\/d\/([^/]+)/);
+	if (!match) throw new Error(`Invalid Google Sheets URL: ${url}`);
+	const spreadsheetId = match[1];
+	const headers = Object.keys(rows[0]);
+	const values = [headers, ...rows.map((row) => headers.map((header) => row[header]))];
+	const getColumnLetter = (col) => {
+		let letter = "";
+		while (col > 0) {
+			col--;
+			letter = String.fromCharCode(65 + col % 26) + letter;
+			col = Math.floor(col / 26);
+		}
+		return letter;
+	};
+	const numRows = values.length;
+	const numCols = headers.length;
+	const endColumn = getColumnLetter(numCols);
+	let range;
+	const gid = getSheetGid(url);
+	if (gid) {
+		const sheet = (await sheets.spreadsheets.get({
+			spreadsheetId,
+			auth
+		})).data.sheets?.find((sheet) => sheet.properties?.sheetId === Number(gid));
+		if (!sheet || !sheet.properties?.title) throw new Error(`Sheet not found for gid: ${gid}`);
+		range = `${sheet.properties.title}!A1:${endColumn}${numRows}`;
+	} else {
+		const newSheetTitle = `Sheet${Date.now()}`;
+		await sheets.spreadsheets.batchUpdate({
+			spreadsheetId,
+			auth,
+			requestBody: { requests: [{ addSheet: { properties: { title: newSheetTitle } } }] }
+		});
+		range = `${newSheetTitle}!A1:${endColumn}${numRows}`;
+	}
+	logger.debug(`Writing CSV to Google Sheets URL: ${url} with ${values.length} rows`);
+	await sheets.spreadsheets.values.update({
+		spreadsheetId,
+		range,
+		valueInputOption: "USER_ENTERED",
+		auth,
+		requestBody: { values }
+	});
+}
+//#endregion
+//#region src/util/eval/evalTableUtils.ts
+/**
+* Error thrown when a comparison eval is not found.
+*/
+var ComparisonEvalNotFoundError = class extends Error {
+	constructor(evalId) {
+		super(`Comparison eval not found: ${evalId}`);
+		this.name = "ComparisonEvalNotFoundError";
+	}
+};
+/**
+* Keep this in its current order, as it is used to map the columns in the CSV, so it needs to be static.
+*
+* The keys are the names of the columns in the metadata object, and the values are the names of the columns in the CSV.
+*
+* This is imported by enterprise so it doesn't need to be copied.
+*/
+const REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES = {
+	messages: "Messages",
+	redteamHistory: "RedteamHistory",
+	redteamTreeHistory: "RedteamTreeHistory",
+	pluginId: "pluginId",
+	strategyId: "strategyId",
+	sessionId: "sessionId",
+	sessionIds: "sessionIds"
+};
+const REDTEAM_METADATA_COLUMNS = Object.values(REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES);
+/**
+* Get the status string for an output
+*/
+function getOutputStatus(output) {
+	if (output.pass) return "PASS";
+	return output.failureReason === ResultFailureReason.ASSERT ? "FAIL" : "ERROR";
+}
+/**
+* Format named scores for CSV output.
+* Returns empty string if no named scores, otherwise JSON string.
+*/
+function formatNamedScores(namedScores) {
+	if (!namedScores || Object.keys(namedScores).length === 0) return "";
+	const rounded = {};
+	for (const [key, value] of Object.entries(namedScores)) if (typeof value === "number" && !Number.isNaN(value)) rounded[key] = Number(value.toFixed(2));
+	if (Object.keys(rounded).length === 0) return "";
+	return JSON.stringify(rounded);
+}
+function formatNamedScoreValue(value) {
+	return typeof value === "number" && !Number.isNaN(value) ? value.toFixed(2) : "";
+}
+/**
+* Build a per-prompt list of `Metric: <name>` column names, deduplicated and
+* sorted with `localeCompare`. Shared shell for both the row-scanning helper
+* (WebUI path) and the aggregate-reading helper (streaming CLI path); see the
+* two call sites below.
+*/
+function collectMetricNamesByPrompt(items, namesFor) {
+	return items.map((item, index) => [...new Set(namesFor(item, index))].sort((a, b) => a.localeCompare(b)));
+}
+/**
+* Collect per-row named metric names by scanning row outputs. Used by the
+* non-streaming WebUI export, which has the full table in memory.
+*
+* Returns one sorted name list per prompt, aligned with `table.head.prompts`.
+* Names whose only values are non-numeric or NaN are skipped so we don't emit
+* blank columns for invalid data.
+*/
+function collectNamedScoreNamesByPrompt(table) {
+	return collectMetricNamesByPrompt(table.head.prompts, (_, promptIndex) => {
+		const names = [];
+		for (const row of table.body) {
+			const namedScores = row.outputs[promptIndex]?.namedScores;
+			if (!namedScores) continue;
+			for (const [name, value] of Object.entries(namedScores)) if (typeof value === "number" && !Number.isNaN(value)) names.push(name);
+		}
+		return names;
+	});
+}
+/**
+* Collect per-row named metric names from prompt-level aggregate metrics, for
+* use by the streaming CSV path which cannot scan rows up front.
+*
+* Uses `namedScoresCount` because it is incremented only when a per-row
+* result contributes a metric (`src/util/namedMetrics.ts`). Derived metrics
+* write to `namedScores` but not `namedScoresCount` (`src/evaluator.ts`
+* `updateDerivedMetrics`), so this keeps the streaming column set aligned
+* with what `collectNamedScoreNamesByPrompt` would produce from row outputs.
+*
+* Returns an empty list both for prompts with no per-row contributions
+* (`namedScoresCount: {}` — modern eval with no named metrics configured)
+* and for prompts whose count map is missing entirely (legacy/imported
+* evals). Use `promptNeedsDiscoveryFallback` to distinguish the two: only
+* the latter requires a row-scan pre-pass.
+*/
+function collectNamedScoreNamesByPromptFromAggregate(prompts) {
+	return collectMetricNamesByPrompt(prompts, (prompt) => {
+		const counts = prompt.metrics?.namedScoresCount;
+		if (!counts) return [];
+		return Object.keys(counts).filter((name) => (counts[name] ?? 0) > 0);
+	});
+}
+/**
+* True when a prompt's aggregate `metrics.namedScoresCount` is missing/absent,
+* not merely empty. Legacy evals persisted before count tracking shipped, and
+* external imports via `POST /api/eval` that don't backfill the count, both
+* land here. Modern evals always have an object (possibly empty) and skip the
+* discovery pass.
+*/
+function promptNeedsDiscoveryFallback(prompt) {
+	const metrics = prompt.metrics;
+	return !metrics || !metrics.namedScoresCount;
+}
+/**
+* Scan one batch of `EvalResult` rows for the metric names that will need
+* dedicated `Metric: <name>` columns. Only inspects the prompts in
+* `fallbackPromptIndices` (those whose aggregate `namedScoresCount` is
+* missing/empty), and only touches `namedScores` + `testCase.description` —
+* not the full row shape — so the discovery pass stays allocation-light even
+* for very large legacy evals.
+*
+* Mirrors the row-output filter in `collectNamedScoreNamesByPrompt` so the
+* streaming CSV column set matches the WebUI CSV column set.
+*/
+function scanBatchForDiscovery(batchResults, acc, fallbackPromptIndices) {
+	for (const result of batchResults) {
+		if (!acc.hasDescriptions && result.testCase?.description) acc.hasDescriptions = true;
+		if (!fallbackPromptIndices.has(result.promptIdx)) continue;
+		const namedScores = result.namedScores;
+		if (!namedScores) continue;
+		let names = acc.metricNamesByPrompt.get(result.promptIdx);
+		if (!names) {
+			names = /* @__PURE__ */ new Set();
+			acc.metricNamesByPrompt.set(result.promptIdx, names);
+		}
+		for (const [name, value] of Object.entries(namedScores)) if (typeof value === "number" && !Number.isNaN(value)) names.add(name);
+	}
+}
+/**
+* Convert a batch of `EvalResult` rows (grouped by testIdx) into the table-row
+* shape that `tableRowToCsvValues` accepts. Used by `streamEvalCsv` to keep its
+* per-batch processing tight; the outputs array is pre-sized so columns line up
+* with prompts even when results arrive out of promptIdx order.
+*/
+function batchToStreamRows(batchResults, varNames, numPrompts) {
+	const rowsByTestIdx = /* @__PURE__ */ new Map();
+	for (const result of batchResults) {
+		let row = rowsByTestIdx.get(result.testIdx);
+		if (!row) {
+			row = {
+				vars: varNames.map((varName) => {
+					const value = result.testCase?.vars?.[varName];
+					return value === void 0 ? "" : String(value);
+				}),
+				outputs: new Array(numPrompts).fill(null),
+				test: { description: result.testCase?.description }
+			};
+			rowsByTestIdx.set(result.testIdx, row);
+		}
+		row.outputs[result.promptIdx] = {
+			text: result.response?.output ?? "",
+			pass: result.success,
+			score: result.score,
+			namedScores: result.namedScores,
+			failureReason: result.failureReason,
+			gradingResult: result.gradingResult,
+			metadata: result.metadata
+		};
+	}
+	return Array.from(rowsByTestIdx.values());
+}
+/**
+* Build CSV headers for an evaluation table.
+*
+* @param vars - Variable names from the table head
+* @param prompts - Prompt definitions from the table head
+* @param options - Export options
+* @param options.namedScoreNamesByPrompt - Named metric names that should get
+*   dedicated `Metric: <name>` columns, one sorted list per prompt (aligned
+*   with `prompts`). Must match the value passed to `tableRowToCsvValues` so
+*   header and row column counts stay in sync.
+* @returns Array of header strings
+*/
+function buildCsvHeaders(vars, prompts, options = {}) {
+	const headers = [
+		...options.hasDescriptions ? ["Description"] : [],
+		...vars,
+		...prompts.flatMap((prompt, promptIndex) => {
+			const provider = prompt.provider || "";
+			return [
+				provider ? `[${provider}] ${prompt.label}` : prompt.label,
+				"Status",
+				"Score",
+				"Named Scores",
+				...(options.namedScoreNamesByPrompt?.[promptIndex] || []).map((name) => `Metric: ${name}`),
+				"Grader Reason",
+				"Comment"
+			];
+		})
+	];
+	if (options.isRedteam) headers.push(...REDTEAM_METADATA_COLUMNS);
+	return headers;
+}
+/**
+* Convert a single table row to CSV row values.
+*
+* @param row - The table row to convert
+* @param options - Export options (`namedScoreNamesByPrompt` must match the
+*   array passed to `buildCsvHeaders`)
+* @returns Array of values for the CSV row
+*/
+function tableRowToCsvValues(row, options = {}) {
+	const rowValues = [
+		...options.hasDescriptions ? [row.test.description || ""] : [],
+		...row.vars,
+		...row.outputs.flatMap((output, outputIndex) => {
+			const namedScoreNames = options.namedScoreNamesByPrompt?.[outputIndex] || [];
+			if (!output) return [
+				"",
+				"",
+				"",
+				"",
+				...namedScoreNames.map(() => ""),
+				"",
+				""
+			];
+			const status = getOutputStatus(output);
+			const score = output.score?.toFixed(2) ?? "";
+			const namedScores = formatNamedScores(output.namedScores);
+			const namedScoreValues = namedScoreNames.map((name) => formatNamedScoreValue(output.namedScores?.[name]));
+			return [
+				output.text || "",
+				status,
+				score,
+				namedScores,
+				...namedScoreValues,
+				output.gradingResult?.reason || "",
+				output.gradingResult?.comment || ""
+			];
+		})
+	];
+	if (options.isRedteam) {
+		const redteamKeys = Object.keys(REDTEAM_METADATA_KEYS_TO_CSV_COLUMN_NAMES);
+		const firstOutputMetadata = row.outputs[0]?.metadata;
+		for (const key of redteamKeys) {
+			let value = firstOutputMetadata?.[key];
+			if (key === "strategyId" && (value === null || value === void 0)) value = "basic";
+			if (value === null || value === void 0) rowValues.push("");
+			else if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") rowValues.push(value.toString());
+			else rowValues.push(JSON.stringify(value));
+		}
+	}
+	return rowValues;
+}
+/**
+* Escape every cell of a CSV row matrix (headers + body) against spreadsheet
+* formula injection (CWE-1236), unless disabled via
+* `PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING`. Numbers and booleans pass through
+* untouched; only string cells are inspected. Applied at the `csvStringify`
+* boundary so `buildCsvHeaders`/`tableRowToCsvValues` stay pure and re-importable
+* CSVs are never produced from un-escaped data.
+*/
+function escapeCsvRowsForFormulaInjection(rows, env) {
+	const configuredValue = env?.PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING ?? process.env.PROMPTFOO_DISABLE_CSV_FORMULA_ESCAPING;
+	if ([
+		"1",
+		"true",
+		"yes",
+		"yup",
+		"yeppers"
+	].includes(configuredValue?.toLowerCase() ?? "")) return rows;
+	return rows.map((row) => row.map((cell) => typeof cell === "string" ? escapeCsvFormula(cell) : cell));
+}
+function isNumericCell(value) {
+	return value.trim() !== "" && Number.isFinite(Number(value));
+}
+/**
+* Neutralize spreadsheet formula (CSV) injection at eval export time (CWE-1236).
+*
+* Spreadsheet applications execute cells beginning with `=`, `+`, `-`, or `@`
+* as formulas. Exported eval data can contain attacker-controlled model output,
+* variables, and grader comments, and CSV quoting alone does not neutralize
+* those formulas. Prefix dangerous values with the spreadsheet-native text
+* marker while preserving finite signed numbers.
+*
+* Leading whitespace and zero-width characters are ignored when identifying a
+* trigger because spreadsheet applications can strip them before evaluation.
+*/
+function escapeCsvFormula(value) {
+	if (value.length === 0) return value;
+	const unpadded = value.replace(/^[\s\u200B\u200C\u200D]+/, "");
+	const firstChar = unpadded[0];
+	if (firstChar === void 0) return value;
+	return firstChar === "=" || firstChar === "@" || (firstChar === "-" || firstChar === "+") && !isNumericCell(unpadded) ? `'${value}` : value;
+}
+/**
+* Generates CSV data from evaluation table data.
+*
+* Column structure per prompt:
+* - Output: Pure LLM output text (no pass/fail prefix)
+* - Status: PASS | FAIL | ERROR
+* - Score: Numeric score (e.g., "1.00")
+* - Named Scores: JSON object with per-assertion scores (e.g., {"clarity": 0.90, "accuracy": 0.85})
+* - Metric: <name>: One dedicated column per distinct per-row named score,
+*   sorted alphabetically by name. Empty when a row has no value for that
+*   metric. Derived metrics are intentionally omitted (they live on the
+*   aggregate prompt metrics, not on individual rows).
+* - Grader Reason: Explanation from the grader
+* - Comment: Additional grader comment
+*
+* This function is the single source of truth for CSV generation,
+* used by both the WebUI export and CLI export.
+*
+* @param table - The evaluation table data
+* @param options - Export options
+* @returns CSV formatted string
+*/
+function evalTableToCsv(table, options = {}) {
+	const { env, isRedteam = false } = options;
+	const hasDescriptions = table.body.some((row) => row.test.description);
+	const namedScoreNamesByPrompt = collectNamedScoreNamesByPrompt(table);
+	const csvRows = [buildCsvHeaders(table.head.vars, table.head.prompts, {
+		hasDescriptions,
+		isRedteam,
+		namedScoreNamesByPrompt
+	}), ...table.body.map((row) => tableRowToCsvValues(row, {
+		hasDescriptions,
+		isRedteam,
+		namedScoreNamesByPrompt
+	}))];
+	return stringify(escapeCsvRowsForFormulaInjection(csvRows, env));
+}
+/**
+* Generate JSON data from evaluation table
+* @param table Evaluation table data
+* @returns JSON object
+*/
+function evalTableToJson(table) {
+	return table;
+}
+function getEvalTableOutputPromptLocationsBySize(payload) {
+	return payload.table.body.flatMap((row, rowIndex) => row.outputs.flatMap((output, outputIndex) => output?.prompt ? [{
+		rowIndex,
+		outputIndex,
+		length: output.prompt.length
+	}] : [])).sort((a, b) => b.length - a.length);
+}
+function stripEvalTableOutputPrompts(payload, locationsToStrip) {
+	return {
+		...payload,
+		table: {
+			...payload.table,
+			body: payload.table.body.map((row, rowIndex) => ({
+				...row,
+				outputs: row.outputs.map((output, outputIndex) => {
+					if (!output || !locationsToStrip.has(`${rowIndex}:${outputIndex}`)) return output;
+					return {
+						...output,
+						prompt: ""
+					};
+				})
+			}))
+		}
+	};
+}
+function getEvalTablePromptStrippedPayload(payload, promptLocations, promptCountToStrip) {
+	return stripEvalTableOutputPrompts(payload, new Set(promptLocations.slice(0, promptCountToStrip).map(({ rowIndex, outputIndex }) => `${rowIndex}:${outputIndex}`)));
+}
+/**
+* Merges comparison tables with the main table for side-by-side CSV export.
+*
+* @param mainEvalId - The ID of the main evaluation
+* @param mainTable - The main evaluation table
+* @param comparisonData - Array of comparison eval data (eval ID and table)
+* @returns Merged table with all prompts and outputs combined
+*/
+function mergeComparisonTables(mainEvalId, mainTable, comparisonData) {
+	return {
+		head: {
+			prompts: [...mainTable.head.prompts.map((prompt) => ({
+				...prompt,
+				label: `[${mainEvalId}] ${prompt.label || ""}`
+			})), ...comparisonData.flatMap(({ evalId, table }) => table.head.prompts.map((prompt) => ({
+				...prompt,
+				label: `[${evalId}] ${prompt.label || ""}`
+			})))],
+			vars: mainTable.head.vars
+		},
+		body: mainTable.body.map((row) => {
+			const testIdx = row.testIdx;
+			const matchingRows = comparisonData.map(({ table }) => table.body.find((compRow) => compRow.testIdx === testIdx)).filter((r) => r !== void 0);
+			return {
+				...row,
+				outputs: [...row.outputs, ...matchingRows.flatMap((r) => r.outputs)]
+			};
+		})
+	};
+}
+/**
+* High-level function to generate CSV from an evaluation.
+*
+* Used by WebUI for CSV downloads (with or without comparison evals).
+* For CLI exports, use `streamEvalCsv` which is more memory-efficient
+* for large datasets.
+*
+* Both functions use the same underlying formatting (`evalTableToCsv`,
+* `buildCsvHeaders`, `tableRowToCsvValues`) to ensure consistent output.
+*
+* @param eval_ - The evaluation to export
+* @param options - Export options including filters and comparison eval IDs
+* @returns CSV formatted string
+* @throws ComparisonEvalNotFoundError if a comparison eval ID is not found
+* @throws Error if comparison exports requested without findEvalById callback
+*/
+async function generateEvalCsv(eval_, options = {}) {
+	const UNLIMITED_RESULTS = Number.MAX_SAFE_INTEGER;
+	const mainTable = await eval_.getTablePage({
+		offset: 0,
+		limit: UNLIMITED_RESULTS,
+		filterMode: options.filterMode,
+		searchQuery: options.searchQuery,
+		filters: options.filters
+	});
+	let finalTable = mainTable;
+	if (options.comparisonEvalIds && options.comparisonEvalIds.length > 0) {
+		if (!options.findEvalById) throw new Error("findEvalById callback is required for comparison exports. Pass Eval.findById when calling from server routes.");
+		const indices = mainTable.body.map((row) => row.testIdx);
+		const comparisonData = await Promise.all(options.comparisonEvalIds.map(async (comparisonEvalId) => {
+			const comparisonEval = await options.findEvalById(comparisonEvalId);
+			if (!comparisonEval) throw new ComparisonEvalNotFoundError(comparisonEvalId);
+			const table = await comparisonEval.getTablePage({
+				offset: 0,
+				limit: indices.length,
+				filterMode: "all",
+				testIndices: indices,
+				searchQuery: options.searchQuery,
+				filters: options.filters
+			});
+			return {
+				evalId: comparisonEval.id,
+				table
+			};
+		}));
+		finalTable = mergeComparisonTables(eval_.id, mainTable, comparisonData);
+	}
+	return evalTableToCsv(finalTable, {
+		env: eval_.config.env,
+		isRedteam: Boolean(eval_.config.redteam)
+	});
+}
+/**
+* Stream CSV data from an evaluation in batches.
+*
+* This is more memory-efficient for large evaluations as it processes
+* results in batches rather than loading everything into memory.
+*
+* Used by the CLI export (`promptfoo eval -o output.csv`) to maintain
+* consistent CSV format with WebUI exports while handling large datasets.
+*
+* @param eval_ - The evaluation to export
+* @param options - Streaming options including the write callback
+*/
+async function streamEvalCsv(eval_, options) {
+	const { isRedteam = false, write } = options;
+	const env = eval_.config?.env;
+	const varNames = eval_.vars;
+	const prompts = eval_.prompts;
+	const numPrompts = prompts.length;
+	const namedScoreNamesByPrompt = collectNamedScoreNamesByPromptFromAggregate(prompts);
+	const fallbackPromptIndices = prompts.flatMap((prompt, promptIndex) => promptNeedsDiscoveryFallback(prompt) ? [promptIndex] : []);
+	const fallbackPromptIndexSet = new Set(fallbackPromptIndices);
+	const accumulator = {
+		metricNamesByPrompt: /* @__PURE__ */ new Map(),
+		hasDescriptions: false
+	};
+	for await (const batchResults of eval_.fetchResultsBatched()) scanBatchForDiscovery(batchResults, accumulator, fallbackPromptIndexSet);
+	const hasDescriptions = accumulator.hasDescriptions;
+	for (const promptIndex of fallbackPromptIndices) {
+		const names = accumulator.metricNamesByPrompt.get(promptIndex);
+		namedScoreNamesByPrompt[promptIndex] = names ? [...names].sort((a, b) => a.localeCompare(b)) : [];
+	}
+	const headers = buildCsvHeaders(varNames, prompts, {
+		hasDescriptions,
+		isRedteam,
+		namedScoreNamesByPrompt
+	});
+	await write(stringify(escapeCsvRowsForFormulaInjection([headers], env)));
+	for await (const batchResults of eval_.fetchResultsBatched()) {
+		const csvRows = batchToStreamRows(batchResults, varNames, numPrompts).map((row) => tableRowToCsvValues(row, {
+			hasDescriptions,
+			isRedteam,
+			namedScoreNamesByPrompt
+		}));
+		if (csvRows.length > 0) await write(stringify(escapeCsvRowsForFormulaInjection(csvRows, env)));
+	}
+}
+//#endregion
+//#region src/util/junit.ts
+const MAX_JUNIT_NAME_LENGTH = 512;
+const MAX_JUNIT_DETAIL_LENGTH = 8192;
+const JUNIT_ASSERTION_FAILURE_MESSAGE = "Assertion failed";
+const JUNIT_EVALUATION_ERROR_MESSAGE = "Evaluation error";
+const INVALID_XML_CHARACTERS = /[^\t\n\r\u0020-\ud7ff\ue000-\ufffd\u{10000}-\u{10ffff}]/gu;
+function truncateText(value, maxLength) {
+	if (value.length <= maxLength) return value;
+	const cutoff = maxLength - 3;
+	const end = (value.codePointAt(cutoff - 1) ?? 0) > 65535 ? cutoff + 1 : cutoff;
+	return `${value.slice(0, end)}...`;
+}
+function normalizeInlineText(value, fallback, maxLength = MAX_JUNIT_NAME_LENGTH) {
+	return truncateText((value ?? "").replace(/\s+/g, " ").replace(INVALID_XML_CHARACTERS, "").replace(/\s+/g, " ").trim() || fallback, maxLength);
+}
+function formatDurationSeconds(durationMs) {
+	return Number(((typeof durationMs === "number" && Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0) / 1e3).toFixed(3)).toString();
+}
+function getEvaluationTimestamp(evalRecord) {
+	const date = new Date(evalRecord.createdAt);
+	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+function getTestCaseName(result) {
+	const prefix = `test ${result.testIdx + 1}`;
+	const description = normalizeInlineText(result.description || result.testCase.description, "");
+	return description ? `${prefix}: ${description}` : prefix;
+}
+function getFailedComponentResults(gradingResult) {
+	return gradingResult?.componentResults?.filter((component) => !component.pass) ?? [];
+}
+function getAssertionLabel(gradingResult) {
+	return gradingResult.assertion?.type ?? "assertion";
+}
+function getFailedAssertionLabels(gradingResult) {
+	const failedComponents = getFailedComponentResults(gradingResult);
+	if (failedComponents.length > 0) return failedComponents.map(getAssertionLabel);
+	return gradingResult ? [getAssertionLabel(gradingResult)] : [];
+}
+function getFailureDetails(result) {
+	const lines = [`Score: ${result.score}`, `Reason: ${JUNIT_ASSERTION_FAILURE_MESSAGE}`];
+	const failedAssertionLabels = getFailedAssertionLabels(result.gradingResult);
+	if (failedAssertionLabels.length > 0) {
+		lines.push("Failed assertions:");
+		for (const label of failedAssertionLabels) lines.push(`- ${label}`);
+	}
+	return truncateText(lines.join("\n").replace(INVALID_XML_CHARACTERS, ""), MAX_JUNIT_DETAIL_LENGTH);
+}
+function projectEvalResult(result) {
+	const projected = "toEvaluateResult" in result ? result.toEvaluateResult() : result;
+	return {
+		description: projected.description,
+		error: projected.error,
+		failureReason: projected.failureReason,
+		gradingResult: projected.gradingResult,
+		latencyMs: projected.latencyMs,
+		prompt: projected.prompt,
+		promptId: projected.promptId,
+		promptIdx: projected.promptIdx,
+		provider: projected.provider,
+		score: projected.score,
+		success: projected.success,
+		testCase: projected.testCase,
+		testIdx: projected.testIdx
+	};
+}
+async function* iterateJunitProjectedResults(evalRecord) {
+	if (evalRecord.useOldResults()) {
+		const results = await evalRecord.getResults();
+		for (const result of results) yield projectEvalResult(result);
+		return;
+	}
+	if (!evalRecord.persisted) {
+		for (const result of evalRecord.results) yield projectEvalResult(result);
+		return;
+	}
+	for await (const batchResults of evalRecord.fetchResultsBatched()) for (const result of batchResults) yield projectEvalResult(result);
+}
+async function buildJunitSuites(evalRecord) {
+	const suites = /* @__PURE__ */ new Map();
+	const providersByDisplayName = /* @__PURE__ */ new Map();
+	for await (const result of iterateJunitProjectedResults(evalRecord)) {
+		const { provider } = result;
+		const providerKey = JSON.stringify([provider.id ?? "", provider.label ?? ""]);
+		const promptKey = result.promptId || `prompt-index:${result.promptIdx}`;
+		const key = JSON.stringify([providerKey, promptKey]);
+		let suite = suites.get(key);
+		if (!suite) {
+			const rawName = provider.label || provider.id || "";
+			const displayName = normalizeInlineText(rawName, "unknown provider");
+			const providers = providersByDisplayName.get(displayName) ?? /* @__PURE__ */ new Set();
+			providers.add(providerKey);
+			providersByDisplayName.set(displayName, providers);
+			suite = {
+				providerKey,
+				rawName,
+				promptKey,
+				promptIdx: result.promptIdx,
+				displayName: "",
+				errors: 0,
+				failures: 0,
+				testcases: [],
+				timeMs: 0
+			};
+			suites.set(key, suite);
+		}
+		suite.promptIdx = Math.min(suite.promptIdx, result.promptIdx);
+		suite.testcases.push({
+			testcase: buildJunitTestCase(result),
+			testIdx: result.testIdx
+		});
+		suite.timeMs += result.latencyMs;
+		if (!result.success) {
+			if (result.failureReason === ResultFailureReason.ASSERT) suite.failures += 1;
+			else suite.errors += 1;
+		}
+	}
+	const promptCountsByProvider = /* @__PURE__ */ new Map();
+	const orderedSuites = [...suites.values()].sort((a, b) => a.promptIdx - b.promptIdx || a.promptKey.localeCompare(b.promptKey));
+	for (const suite of orderedSuites) {
+		const baseName = normalizeInlineText(suite.rawName, "unknown provider");
+		const suffix = (providersByDisplayName.get(baseName)?.size ?? 0) > 1 || suite.rawName.search(INVALID_XML_CHARACTERS) !== -1 ? ` (${sha256(suite.providerKey).slice(0, 16)})` : "";
+		const providerName = normalizeInlineText(suite.rawName, "unknown provider", MAX_JUNIT_NAME_LENGTH - suffix.length);
+		const ordinal = (promptCountsByProvider.get(suite.providerKey) ?? 0) + 1;
+		promptCountsByProvider.set(suite.providerKey, ordinal);
+		suite.displayName = `[${providerName}] prompt ${ordinal}${suffix}`;
+		for (const { testcase } of suite.testcases) testcase["@_classname"] = suite.displayName;
+	}
+	return [...suites.values()];
+}
+function buildJunitTestCase(result) {
+	const testcase = {
+		"@_name": getTestCaseName(result),
+		"@_time": formatDurationSeconds(result.latencyMs)
+	};
+	if (!result.success) {
+		if (result.failureReason === ResultFailureReason.ASSERT) testcase.failure = {
+			"#text": getFailureDetails(result),
+			"@_message": JUNIT_ASSERTION_FAILURE_MESSAGE,
+			"@_type": "assertion"
+		};
+		else testcase.error = {
+			"#text": `Reason: ${JUNIT_EVALUATION_ERROR_MESSAGE}`,
+			"@_message": JUNIT_EVALUATION_ERROR_MESSAGE,
+			"@_type": "error"
+		};
+	}
+	return testcase;
+}
+async function createJunitXml(evalRecord) {
+	const suites = await buildJunitSuites(evalRecord);
+	const tests = suites.reduce((sum, suite) => sum + suite.testcases.length, 0);
+	const failures = suites.reduce((sum, suite) => sum + suite.failures, 0);
+	const errors = suites.reduce((sum, suite) => sum + suite.errors, 0);
+	const totalTimeMs = suites.reduce((sum, suite) => sum + suite.timeMs, 0);
+	const timestamp = getEvaluationTimestamp(evalRecord);
+	return new XMLBuilder({
+		format: true,
+		ignoreAttributes: false,
+		indentBy: "  "
+	}).build({
+		"?xml": {
+			"@_version": "1.0",
+			"@_encoding": "UTF-8"
+		},
+		testsuites: {
+			"@_errors": errors,
+			"@_failures": failures,
+			"@_name": "promptfoo",
+			"@_skipped": 0,
+			"@_tests": tests,
+			"@_time": formatDurationSeconds(totalTimeMs),
+			testsuite: suites.map((suite) => ({
+				"@_errors": suite.errors,
+				"@_failures": suite.failures,
+				"@_name": suite.displayName,
+				"@_skipped": 0,
+				"@_tests": suite.testcases.length,
+				"@_time": formatDurationSeconds(suite.timeMs),
+				...timestamp ? { "@_timestamp": timestamp } : {},
+				testcase: suite.testcases.sort((a, b) => a.testIdx - b.testIdx).map(({ testcase }) => testcase)
+			}))
+		}
+	}).replace(INVALID_XML_CHARACTERS, "");
+}
+async function writeJunitXmlOutput(outputPath, evalRecord) {
+	await fsPromises.writeFile(outputPath, await createJunitXml(evalRecord));
+}
+const SUPPORTED_OUTPUT_FILE_FORMATS = [...OutputFileExtension.options, "junit.xml"];
+function getOutputFileFormat(outputPath) {
+	if (outputPath.toLowerCase().endsWith(".junit.xml")) return "junit.xml";
+	return OutputFileExtension.safeParse(path$1.extname(outputPath).slice(1).toLowerCase()).data;
+}
+//#endregion
+//#region src/util/output.ts
+function warnOnDegradedJsonlRecovery(evalRecord, outputPaths) {
+	if (!evalRecord.resultPersistenceFailed) return;
+	if (outputPaths.some((outputPath) => getOutputFileFormat(outputPath) === "jsonl")) logger.warn("[Output] Reconciling JSONL from streamed rows and the eval record because one or more rows failed to persist");
+}
+function isFileNotFoundError(error) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
+}
+function isPermissionDeniedError(error) {
+	return error !== null && typeof error === "object" && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+}
+async function resolveJsonlOutputPath(outputPath) {
+	try {
+		if (!(await fsPromises.lstat(outputPath)).isSymbolicLink()) return outputPath;
+		try {
+			return await fsPromises.realpath(outputPath);
+		} catch (error) {
+			if (isFileNotFoundError(error)) return path$1.resolve(path$1.dirname(outputPath), await fsPromises.readlink(outputPath));
+			throw error;
+		}
+	} catch (error) {
+		if (isFileNotFoundError(error)) return outputPath;
+		throw error;
+	}
+}
+async function appendJsonlResultBatch(outputPath, results, stripFlags) {
+	if (results.length === 0) return;
+	const text = results.map((result) => JSON.stringify(sanitizeResultForJsonlArtifact(result, stripFlags))).join(os$1.EOL) + os$1.EOL;
+	await fsPromises.appendFile(outputPath, text);
+}
+async function readStreamedJsonlResults(outputPath) {
+	let contents;
+	try {
+		contents = await fsPromises.readFile(outputPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	const results = [];
+	const lines = contents.split(/\r?\n/).filter(Boolean);
+	for (const [index, line] of lines.entries()) try {
+		results.push(JSON.parse(line));
+	} catch (error) {
+		logger.warn(`[Output] Skipping malformed streamed JSONL row at ${outputPath}:${index + 1} during recovery: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return results;
+}
+async function collectJsonlResultsAfterPersistenceFailure(outputPath, evalRecord) {
+	const stripFlags = getStripFlags(evalRecord.config.env);
+	const finalResults = /* @__PURE__ */ new Map();
+	const put = (result) => finalResults.set(getResultIndexKey(result), result);
+	for (const result of await readStreamedJsonlResults(outputPath)) put(result);
+	for await (const batchResults of evalRecord.fetchResultsBatched()) for (const result of batchResults) {
+		const evaluateResult = asEvaluateResult(result, stripFlags);
+		if (!evalRecord.hasResultPersistenceFailure(evaluateResult)) put(evaluateResult);
+	}
+	for (const result of evalRecord.getFinalJsonlResults()) put(result);
+	return Array.from(finalResults.values());
+}
+async function getExistingFileMode(outputPath) {
+	try {
+		return (await fsPromises.stat(outputPath)).mode & 4095;
+	} catch (error) {
+		if (isFileNotFoundError(error)) return;
+		throw error;
+	}
+}
+async function appendJsonlResults(outputPath, evalRecord, recoveredResults) {
+	const stripFlags = getStripFlags(evalRecord.config.env);
+	if (recoveredResults) {
+		await appendJsonlResultBatch(outputPath, recoveredResults, stripFlags);
+		return;
+	}
+	for await (const batchResults of evalRecord.fetchResultsBatched()) await appendJsonlResultBatch(outputPath, batchResults.map((result) => asEvaluateResult(result, stripFlags)), stripFlags);
+}
+async function rewriteJsonlWithExternalBackup(outputPath, outputMode, evalRecord, preparedReplacementPath, recoveredResults) {
+	const tempDirectory = await fsPromises.mkdtemp(path$1.join(os$1.tmpdir(), "promptfoo-jsonl-"));
+	const backupPath = path$1.join(tempDirectory, "backup.jsonl");
+	const replacementPath = path$1.join(tempDirectory, "replacement.jsonl");
+	let overwriteAttempted = false;
+	let preserveTempDirectory = false;
+	let hasBackup = false;
+	try {
+		try {
+			await fsPromises.copyFile(outputPath, backupPath);
+			hasBackup = true;
+		} catch (error) {
+			if (!isFileNotFoundError(error)) throw error;
+		}
+		if (preparedReplacementPath) await fsPromises.copyFile(preparedReplacementPath, replacementPath);
+		else {
+			if (outputMode === void 0) await fsPromises.writeFile(replacementPath, "");
+			else await fsPromises.writeFile(replacementPath, "", { mode: outputMode });
+			await appendJsonlResults(replacementPath, evalRecord, recoveredResults);
+		}
+		overwriteAttempted = true;
+		await fsPromises.copyFile(replacementPath, outputPath);
+		if (outputMode !== void 0) await fsPromises.chmod(outputPath, outputMode);
+	} catch (error) {
+		if (overwriteAttempted && hasBackup) try {
+			await fsPromises.copyFile(backupPath, outputPath);
+		} catch (restoreError) {
+			preserveTempDirectory = true;
+			logger.error("[Output] Failed to restore JSONL output after rewrite failure", {
+				backupPath,
+				error: restoreError
+			});
+			throw new Error(`Failed to rewrite JSONL output (${error instanceof Error ? error.message : String(error)}) and restore backup (${restoreError instanceof Error ? restoreError.message : String(restoreError)}). Backup retained at ${backupPath}`);
+		}
+		throw error;
+	} finally {
+		if (!preserveTempDirectory) await fsPromises.rm(tempDirectory, {
+			recursive: true,
+			force: true
+		}).catch((error) => {
+			logger.warn("[Output] Failed to remove temporary JSONL backup directory", {
+				error,
+				tempDirectory
+			});
+		});
+	}
+}
+async function removeTemporaryJsonlOutput(tempOutputPath) {
+	await fsPromises.rm(tempOutputPath, { force: true }).catch((error) => {
+		logger.warn("[Output] Failed to remove temporary JSONL output", {
+			error,
+			tempOutputPath
+		});
+	});
+}
+const outputToSimpleString = (output) => {
+	const passFailText = output.pass ? "[PASS]" : output.failureReason === ResultFailureReason.ASSERT ? "[FAIL]" : "[ERROR]";
+	const namedScoresText = Object.entries(output.namedScores).map(([name, value]) => `${name}: ${value?.toFixed(2)}`).join(", ");
+	const scoreText = namedScoresText.length > 0 ? `(${output.score?.toFixed(2)}, ${namedScoresText})` : `(${output.score?.toFixed(2)})`;
+	const gradingResultText = output.gradingResult ? `${output.pass ? "Pass" : "Fail"} Reason: ${output.gradingResult.reason}` : "";
+	return dedent`
+      ${passFailText} ${scoreText}
+
+      ${output.text}
+
+      ${gradingResultText}
+    `.trim();
+};
+const outputToHtmlReportCell = (output) => {
+	const status = output.pass ? "pass" : output.failureReason === ResultFailureReason.ERROR ? "error" : "fail";
+	const namedScores = Object.entries(output.namedScores).map(([name, value]) => ({
+		name,
+		value: value?.toFixed(2)
+	}));
+	return {
+		status,
+		statusLabel: status.toUpperCase(),
+		score: output.score?.toFixed(2),
+		namedScores,
+		text: output.text,
+		reason: output.gradingResult?.reason || "",
+		prompt: output.prompt,
+		provider: output.provider || "",
+		error: output.error || "",
+		failureReason: output.failureReason,
+		latencyDisplay: Number.isFinite(output.latencyMs) ? `${output.latencyMs.toFixed(0)} ms` : "",
+		costDisplay: Number.isFinite(output.cost) && output.cost > 0 ? `$${output.cost.toFixed(6)}` : "",
+		totalTokensDisplay: typeof output.tokenUsage?.total === "number" ? output.tokenUsage.total.toLocaleString("en-US") : "",
+		promptTokensDisplay: typeof output.tokenUsage?.prompt === "number" ? output.tokenUsage.prompt.toLocaleString("en-US") : "",
+		completionTokensDisplay: typeof output.tokenUsage?.completion === "number" ? output.tokenUsage.completion.toLocaleString("en-US") : ""
+	};
+};
+async function createOutputSummary(evalRecord, stripFlags) {
+	const summary = await evalRecord.toEvaluateSummary();
+	const prompts = ("prompts" in summary ? summary.prompts : summary.table.head.prompts).map((prompt) => prompt.config ? {
+		...prompt,
+		config: sanitizeConfigForOutput(prompt.config, stripFlags)
+	} : prompt);
+	return "prompts" in summary ? {
+		...summary,
+		prompts
+	} : {
+		...summary,
+		table: {
+			...summary.table,
+			head: {
+				...summary.table.head,
+				prompts
+			}
+		}
+	};
+}
+function resultsForMediaExportScan(results, shouldStripResponseOutput) {
+	if (!shouldStripResponseOutput) return results;
+	return {
+		...results,
+		results: results.results.map((result) => {
+			const response = result.response;
+			if (!response?.metadata || !("blobUris" in response.metadata)) return result;
+			const { metadata: responseMetadata, ...projectedResponse } = response;
+			const { blobUris: _blobUris, ...metadata } = responseMetadata;
+			return {
+				...result,
+				response: {
+					...projectedResponse,
+					...Object.keys(metadata).length > 0 && { metadata }
+				}
+			};
+		})
+	};
+}
+function createOutputMetadata(evalRecord) {
+	let evaluationCreatedAt;
+	if (evalRecord.createdAt) try {
+		const date = new Date(evalRecord.createdAt);
+		evaluationCreatedAt = Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+	} catch {
+		evaluationCreatedAt = void 0;
+	}
+	return {
+		promptfooVersion: VERSION,
+		nodeVersion: process.version,
+		platform: os$1.platform(),
+		arch: os$1.arch(),
+		exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		evaluationCreatedAt,
+		author: evalRecord.author ?? void 0
+	};
+}
+async function createOutputData(evalRecord, shareableUrl, options = {}) {
+	const stripFlags = getStripFlags(evalRecord.config.env);
+	const summary = await createOutputSummary(evalRecord, stripFlags);
+	const redactedConfig = sanitizeConfigForOutput(evalRecord.config, stripFlags);
+	let traces;
+	try {
+		const { getTraceStore } = await import("./store-zGP98TMs.js").then((n) => n.n);
+		traces = await getTraceStore().getTracesByEvaluation(evalRecord.id);
+	} catch (error) {
+		logger.warn(`Failed to fetch traces for output ${evalRecord.id}; traces omitted from export: ${error}`);
+	}
+	const output = {
+		evalId: evalRecord.id,
+		results: summary,
+		config: redactedConfig,
+		shareableUrl,
+		metadata: createOutputMetadata(evalRecord),
+		...evalRecord.vars?.length > 0 && { vars: [...evalRecord.vars] },
+		...evalRecord.runtimeOptions && { runtimeOptions: sanitizeRuntimeOptions(evalRecord.runtimeOptions) },
+		...traces && traces.length > 0 && { traces: projectTracesForOutput(traces, stripFlags) }
+	};
+	if (options.includeMedia) {
+		const blobAssets = await exportBlobAssets(evalRecord.id, summary, stripFlags.shouldStripResponseOutput, output.traces);
+		if (blobAssets.length > 0) output.blobAssets = blobAssets;
+	}
+	return output;
+}
+async function exportBlobAssets(evalId, results, shouldStripResponseOutput, traces) {
+	const { getShareAuthorizedBlob } = await import("./blobs-DiN8G72v.js").then((n) => n.t);
+	const assets = [];
+	for (const hash of collectBlobHashes({
+		results: resultsForMediaExportScan(results, shouldStripResponseOutput),
+		traces
+	})) try {
+		const blob = await getShareAuthorizedBlob(hash, evalId);
+		if (!blob) continue;
+		if (blob.data.length > 52428800) {
+			logger.warn("[Output] Skipping oversized blob in eval export", {
+				hash,
+				sizeBytes: blob.data.length
+			});
+			continue;
+		}
+		assets.push({
+			hash,
+			mimeType: blob.metadata.mimeType,
+			sizeBytes: blob.data.length,
+			data: blob.data.toString("base64")
+		});
+	} catch (error) {
+		logger.warn("[Output] Skipping missing blob in eval export", {
+			error,
+			hash
+		});
+	}
+	return assets;
+}
+/**
+* JSON writer with improved error handling for large datasets.
+* Provides helpful error messages when memory limits are exceeded.
+*/
+async function writeJsonOutputSafely(outputPath, evalRecord, shareableUrl, options) {
+	try {
+		const outputData = await createOutputData(evalRecord, shareableUrl, options);
+		const jsonString = JSON.stringify(outputData, null, 2);
+		await fsPromises.writeFile(outputPath, jsonString);
+	} catch (error) {
+		const msg = error?.message ?? "";
+		const isStringLen = error instanceof RangeError && msg.includes("Invalid string length");
+		const isHeapOOM = /heap out of memory|Array buffer allocation failed|ERR_STRING_TOO_LONG/i.test(msg);
+		if (isStringLen || isHeapOOM) {
+			const resultCount = await evalRecord.getResultsCount();
+			logger.error(`Dataset too large for JSON export (${resultCount} results).`);
+			throw new Error(`Dataset too large for JSON export. The evaluation has ${resultCount} results which exceeds memory limits. Consider using JSONL format instead: --output output.jsonl`);
+		} else throw error;
+	}
+}
+async function writeOutput(outputPath, evalRecord, shareableUrl, options = {}) {
+	if (outputPath.match(/^https:\/\/docs\.google\.com\/spreadsheets\//)) {
+		const table = await evalRecord.getTable();
+		const rows = table.body.map((row) => {
+			const csvRow = {};
+			table.head.vars.forEach((varName, index) => {
+				csvRow[varName] = row.vars[index];
+			});
+			table.head.prompts.forEach((prompt, index) => {
+				csvRow[`[${prompt.provider}] ${prompt.label}`] = outputToSimpleString(row.outputs[index]);
+			});
+			return csvRow;
+		});
+		logger.info(`Writing ${rows.length} rows to Google Sheets...`);
+		await writeCsvToGoogleSheet(rows, outputPath);
+		return;
+	}
+	const outputExtension = getOutputFileFormat(outputPath);
+	invariant(outputExtension, `Unsupported output file format ${path$1.extname(outputPath).slice(1).toLowerCase()}. Please use one of: ${SUPPORTED_OUTPUT_FILE_FORMATS.join(", ")}.`);
+	const outputDir = path$1.dirname(outputPath);
+	await fsPromises.mkdir(outputDir, { recursive: true });
+	if (outputExtension === "junit.xml") await writeJunitXmlOutput(outputPath, evalRecord);
+	else if (outputExtension === "csv") {
+		const fileHandle = await fsPromises.open(outputPath, "w");
+		try {
+			await streamEvalCsv(evalRecord, {
+				isRedteam: Boolean(evalRecord.config.redteam),
+				write: async (data) => {
+					await fileHandle.write(data);
+				}
+			});
+		} finally {
+			await fileHandle.close();
+		}
+	} else if (outputExtension === "json") await writeJsonOutputSafely(outputPath, evalRecord, shareableUrl, options);
+	else if (outputExtension === "yaml" || outputExtension === "yml" || outputExtension === "txt") await fsPromises.writeFile(outputPath, yaml.dump(await createOutputData(evalRecord, shareableUrl, options)));
+	else if (outputExtension === "html") {
+		const table = await evalRecord.getTable();
+		const stripFlags = getStripFlags(evalRecord.config.env);
+		const summary = await createOutputSummary(evalRecord, stripFlags);
+		const redactedConfig = sanitizeConfigForOutput(evalRecord.config, stripFlags);
+		const metadata = createOutputMetadata(evalRecord);
+		const template = await fsPromises.readFile(path$1.join(getDirectory(), "tableOutput.html"), "utf-8");
+		const htmlTable = [[...table.head.vars, ...table.head.prompts.map((prompt) => `[${prompt.provider}] ${prompt.label}`)], ...table.body.map((row, rowIndex) => [...row.vars.map((value, variableIndex) => ({
+			kind: "variable",
+			name: table.head.vars[variableIndex],
+			text: value
+		})), ...row.outputs.map((output, outputIndex) => ({
+			kind: "output",
+			detailId: `result-detail-${rowIndex}-${outputIndex}`,
+			detailTitle: `Result detail - row ${rowIndex + 1}, prompt ${outputIndex + 1}`,
+			description: row.description || row.test?.description || "",
+			...outputToHtmlReportCell(output)
+		}))])];
+		const reportOutputs = table.body.flatMap((row) => row.outputs);
+		const totalResults = reportOutputs.length;
+		const successes = reportOutputs.filter((output) => output.pass).length;
+		const errors = reportOutputs.filter((output) => !output.pass && output.failureReason === ResultFailureReason.ERROR).length;
+		const failures = totalResults - successes - errors;
+		const passRate = totalResults > 0 ? successes / totalResults * 100 : 0;
+		const htmlOutput = getNunjucksEngine().renderString(template, {
+			config: redactedConfig,
+			table: htmlTable,
+			results: summary,
+			metadata,
+			report: {
+				totalResults,
+				totalRows: table.body.length,
+				promptCount: table.head.prompts.length,
+				variableCount: table.head.vars.length,
+				successes,
+				failures,
+				errors,
+				passRateDisplay: `${passRate.toFixed(1)}%`
+			}
+		});
+		await fsPromises.writeFile(outputPath, htmlOutput);
+	} else if (outputExtension === "jsonl") {
+		const jsonlOutputPath = await resolveJsonlOutputPath(outputPath);
+		if (jsonlOutputPath !== outputPath) await fsPromises.mkdir(path$1.dirname(jsonlOutputPath), { recursive: true });
+		const outputMode = await getExistingFileMode(jsonlOutputPath);
+		const recoveredResults = evalRecord.resultPersistenceFailed ? await collectJsonlResultsAfterPersistenceFailure(jsonlOutputPath, evalRecord) : void 0;
+		const tempOutputPath = path$1.join(path$1.dirname(jsonlOutputPath), `.promptfoo-${randomUUID()}.tmp`);
+		try {
+			try {
+				await fsPromises.writeFile(tempOutputPath, "");
+			} catch (error) {
+				if (isPermissionDeniedError(error)) {
+					logger.warn("[Output] Falling back to JSONL rewrite with external backup because the output directory is not writable");
+					await rewriteJsonlWithExternalBackup(jsonlOutputPath, outputMode, evalRecord, void 0, recoveredResults);
+					return;
+				}
+				throw error;
+			}
+			await appendJsonlResults(tempOutputPath, evalRecord, recoveredResults);
+			if (outputMode !== void 0) await fsPromises.chmod(tempOutputPath, outputMode);
+			try {
+				await fsPromises.rename(tempOutputPath, jsonlOutputPath);
+			} catch (error) {
+				if (isPermissionDeniedError(error)) {
+					logger.warn("[Output] Falling back to JSONL rewrite with external backup because replacing the output file is not permitted");
+					await rewriteJsonlWithExternalBackup(jsonlOutputPath, outputMode, evalRecord, tempOutputPath);
+					await removeTemporaryJsonlOutput(tempOutputPath);
+					return;
+				}
+				throw error;
+			}
+		} catch (error) {
+			await removeTemporaryJsonlOutput(tempOutputPath);
+			throw error;
+		}
+	} else if (outputExtension === "xml") {
+		const stripFlags = getStripFlags(evalRecord.config.env);
+		const summary = await createOutputSummary(evalRecord, stripFlags);
+		const redactedConfig = sanitizeConfigForOutput(evalRecord.config, stripFlags);
+		const sanitizeForXml = (obj) => {
+			if (obj === null || obj === void 0) return "";
+			if (Array.isArray(obj)) return obj.map(sanitizeForXml);
+			if (typeof obj === "object") {
+				const sanitized = {};
+				for (const [key, value] of Object.entries(obj)) sanitized[key] = sanitizeForXml(value);
+				return sanitized;
+			}
+			return String(obj);
+		};
+		const xmlData = new XMLBuilder({
+			ignoreAttributes: false,
+			format: true,
+			indentBy: "  "
+		}).build({ promptfoo: {
+			evalId: evalRecord.id,
+			results: sanitizeForXml(summary),
+			config: sanitizeForXml(redactedConfig),
+			shareableUrl: shareableUrl || ""
+		} });
+		await fsPromises.writeFile(outputPath, xmlData);
+	}
+}
+async function writeMultipleOutputs(outputPaths, evalRecord, shareableUrl) {
+	const errors = (await Promise.allSettled(outputPaths.map((outputPath) => writeOutput(outputPath, evalRecord, shareableUrl)))).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+	if (errors.length > 0) throw Object.assign(/* @__PURE__ */ new Error("One or more output writes failed"), { errors });
+}
+//#endregion
+//#region src/util/runtime.ts
+function printBorder() {
+	const border = "=".repeat(TERMINAL_MAX_WIDTH);
+	logger.info(border);
+}
+//#endregion
+//#region src/util/dataUrl.ts
+/**
+* Check if a string is a data URL
+* @param value String to check
+* @returns true if value is a data URL (starts with "data:")
+*
+* @example
+* isDataUrl("data:image/jpeg;base64,/9j/...") // true
+* isDataUrl("/9j/4AAQSkZJRg...") // false
+* isDataUrl("https://example.com/image.jpg") // false
+*/
+function isDataUrl(value) {
+	return typeof value === "string" && value.startsWith("data:") && value.length > 5;
+}
+/**
+* Parse a data URL into its components
+*
+* Handles data URLs with optional parameters (e.g., charset, name):
+* - `data:image/jpeg;base64,<data>` - Standard format
+* - `data:image/jpeg;charset=utf-8;base64,<data>` - With charset
+* - `data:image/jpeg;name=photo.jpg;base64,<data>` - With filename
+*
+* @param dataUrl Data URL string
+* @returns Parsed components (mimeType and base64Data) or null if invalid
+*
+* @example
+* parseDataUrl("data:image/jpeg;base64,/9j/...")
+* // { mimeType: "image/jpeg", base64Data: "/9j/..." }
+*
+* parseDataUrl("data:image/jpeg;charset=utf-8;base64,/9j/...")
+* // { mimeType: "image/jpeg", base64Data: "/9j/..." }
+*
+* parseDataUrl("invalid") // null
+*/
+function parseDataUrl(dataUrl) {
+	if (!isDataUrl(dataUrl)) return null;
+	const match = dataUrl.match(/^data:([^;,]+)(?:;[^,]*)?;base64,(.+)$/);
+	if (!match) return null;
+	return {
+		mimeType: match[1].trim(),
+		base64Data: match[2].trim()
+	};
+}
+/**
+* Extract base64 data from a data URL or return original if not a data URL
+* Useful for providers that expect raw base64 (Anthropic, Google)
+*
+* @param value Data URL or raw base64 string
+* @returns Raw base64 string (data URL prefix stripped if present)
+*
+* @example
+* extractBase64FromDataUrl("data:image/jpeg;base64,/9j/...")
+* // "/9j/..."
+*
+* extractBase64FromDataUrl("/9j/...") // "/9j/..." (unchanged)
+*/
+function extractBase64FromDataUrl(value) {
+	const parsed = parseDataUrl(value);
+	return parsed ? parsed.base64Data : value;
+}
+/**
+* Build a data URI from a MIME type and base64 data.
+*
+* @param mimeType MIME type (e.g. "image/png")
+* @param base64Data Raw base64-encoded data
+* @returns Data URI string
+*
+* @example
+* toDataUri("image/png", "iVBORw0KGgo...")
+* // "data:image/png;base64,iVBORw0KGgo..."
+*/
+function toDataUri(mimeType, base64Data) {
+	return `data:${mimeType};base64,${base64Data}`;
+}
+//#endregion
+export { queryTestIndicesOptimized as $, sanitizeProviderIdForLog as A, persistRepeatMetadata as B, getProviderDescription as C, isOpenAiProvider as D, isGoogleProvider as E, EvalResult as F, stripTraceLinkageFromMetadata as G, projectPrompt as H, PROMPTFOO_METADATA_KEY as I, invalidateEvaluationCaches as J, toSerializableProviderRef as K, asEvaluateResult as L, loadProviderConfigsFromFile as M, normalizeProviderRef as N, isProviderAllowed as O, readProviderConfigFile as P, getTotalResultRowCount as Q, getResultIndexKey as R, doesProviderRefMatch as S, isAnthropicProvider as T, projectTracesForOutput as U, persistTraceMetadata as V, sanitizeResultForJsonlArtifact as W, notifyEvaluationsDeleted as X, notifyEvaluationChanged as Y, getCachedResultsCount as Z, deduplicateTestCases as _, printBorder as a, normalizeInput as at, resultIsForTestCase as b, getOutputFileFormat as c, hasUnscopedUpdate as ct, generateEvalCsv as d, setupSignalWatcher as dt, getCachedStandaloneEvals as et, getEvalTableOutputPromptLocationsBySize as f, updateEvalIds as ft, setupEnv as g, fetchCsvFromGoogleSheet as h, toDataUri as i, maybeFilePath as it, isProviderConfigFileReference as j, providerToIdentifier as k, ComparisonEvalNotFoundError as l, isAllEvalsDeleted as lt, mergeComparisonTables as m, HUMAN_ASSERTION_TYPE as mt, isDataUrl as n, setCachedStandaloneEvals as nt, warnOnDegradedJsonlRecovery as o, generateIdFromPrompt as ot, getEvalTablePromptStrippedPayload as p, FILE_METADATA_KEY as pt, invalidateEvaluationCache as q, parseDataUrl as r, hashPrompt as rt, writeMultipleOutputs as s, hasDeleteComponent as st, extractBase64FromDataUrl as t, getStandaloneEvalCacheKey as tt, evalTableToJson as u, readSignalFile as ut, extractRuntimeVars as v, getProviderIdentifier as w, checkProviderApiKeys as x, filterRuntimeVars as y, getStripFlags as z };
+
+//# sourceMappingURL=dataUrl-DBMifX6C.js.map