import { O as getEnvString, j as isCI, o as logger } from "./logger-CtGm8dC_.js";
import { A as cloudConfig, M as writeGlobalConfig, N as writeGlobalConfigPartial, R as TERMINAL_MAX_WIDTH, j as readGlobalConfig, r as fetchWithTimeout } from "./fetch-AchwhzAC.js";
import { z } from "zod";
import chalk from "chalk";
import input from "@inquirer/input";
const BAD_EMAIL_RESULT = "bad_email";
const EmailValidationStatus = {
	OK: "ok",
	EXCEEDED_LIMIT: "exceeded_limit",
	SHOW_USAGE_WARNING: "show_usage_warning",
	EMAIL_VERIFICATION_REQUIRED: "email_verification_required",
	RISKY_EMAIL: "risky_email",
	DISPOSABLE_EMAIL: "disposable_email"
};
const NO_EMAIL_STATUS = "no_email";
//#endregion
//#region src/globalConfig/accounts.ts
const CI_PLACEHOLDER_EMAIL = "ci-placeholder@promptfoo.dev";
var EmailValidationError = class extends Error {
	constructor(reason, message) {
		super(message);
		this.reason = reason;
		this.name = "EmailValidationError";
	}
};
function failEmailValidation(reason, message) {
	throw new EmailValidationError(reason, message);
}
function getUserAuthInfo() {
	const globalConfig = readGlobalConfig();
	const email = globalConfig?.account?.email || null;
	const isLoggedIntoCloud = !!(globalConfig?.cloud?.apiKey || process.env.PROMPTFOO_API_KEY);
	return {
		email,
		isLoggedIntoCloud,
		authMethod: isLoggedIntoCloud ? "api-key" : email ? "email" : "none"
	};
}
function getUserId() {
	let globalConfig = readGlobalConfig();
	if (!globalConfig?.id) {
		const newId = crypto.randomUUID();
		globalConfig = {
			...globalConfig,
			id: newId
		};
		writeGlobalConfig(globalConfig);
		return newId;
	}
	return globalConfig.id;
}
function getUserEmail() {
	return readGlobalConfig()?.account?.email || null;
}
function setUserEmail(email) {
	const account = readGlobalConfig()?.account ?? {};
	account.email = email;
	writeGlobalConfigPartial({ account });
}
function getUserEmailNeedsValidation() {
	return readGlobalConfig()?.account?.emailNeedsValidation || false;
}
function setUserEmailNeedsValidation(needsValidation) {
	const account = readGlobalConfig()?.account ?? {};
	account.emailNeedsValidation = needsValidation;
	writeGlobalConfigPartial({ account });
}
function getUserEmailValidated() {
	return readGlobalConfig()?.account?.emailValidated || false;
}
function setUserEmailValidated(validated) {
	const account = readGlobalConfig()?.account ?? {};
	account.emailValidated = validated;
	writeGlobalConfigPartial({ account });
}
function getAuthor(override) {
	const userEmail = getUserEmail();
	const envAuthor = getEnvString("PROMPTFOO_AUTHOR");
	if (isLoggedIntoCloud() && userEmail) {
		if (override && override !== userEmail) logger.debug("[Author] Ignoring author override because cloud identity takes precedence");
		return userEmail;
	}
	return override || userEmail || envAuthor || null;
}
function isLoggedIntoCloud() {
	return getUserAuthInfo().isLoggedIntoCloud;
}
/**
* Shared function to check email status with the promptfoo API
* Used by both CLI and server routes
*/
async function checkEmailStatus(options) {
	const { default: telemetry } = await import("./telemetry-BNNsn99P.js").then((n) => n.n);
	const ciMode = isCI();
	const userEmail = ciMode ? CI_PLACEHOLDER_EMAIL : getUserEmail();
	if (!userEmail) return {
		status: NO_EMAIL_STATUS,
		hasEmail: false,
		message: "Redteam evals require email verification. Please enter your work email:"
	};
	if (ciMode) return {
		status: EmailValidationStatus.OK,
		hasEmail: true,
		email: userEmail
	};
	try {
		const validateParam = options?.validate ? "&validate=true" : "";
		const timeout = options?.validate ? 3e3 : 500;
		if (options?.validate) logger.info(`Checking email...`);
		const data = await (await fetchWithTimeout(`${cloudConfig.isEnabled() ? cloudConfig.getApiHost() : getEnvString("PROMPTFOO_CLOUD_API_URL", "https://api.promptfoo.app")?.replace(/\/+$/, "")}/api/users/status?email=${encodeURIComponent(userEmail)}${validateParam}`, void 0, timeout)).json();
		if (options?.validate) if (new Set([
			EmailValidationStatus.RISKY_EMAIL,
			EmailValidationStatus.DISPOSABLE_EMAIL,
			EmailValidationStatus.EMAIL_VERIFICATION_REQUIRED
		]).has(data.status)) {
			if (data.status === EmailValidationStatus.EMAIL_VERIFICATION_REQUIRED) {
				setUserEmailValidated(false);
				setUserEmailNeedsValidation(true);
			}
			if (data.status === EmailValidationStatus.RISKY_EMAIL || data.status === EmailValidationStatus.DISPOSABLE_EMAIL) await telemetry.saveConsent(userEmail, { source: "filteredInvalidEmail" });
		} else {
			setUserEmailValidated(true);
			await telemetry.saveConsent(userEmail, { source: "promptForEmailValidated" });
		}
		return {
			status: data.status,
			message: data.message ?? data.error,
			email: userEmail,
			hasEmail: true
		};
	} catch (e) {
		logger.debug(`Failed to check user status: ${e}`);
		return {
			status: EmailValidationStatus.OK,
			message: "Unable to verify email status, but proceeding",
			email: userEmail,
			hasEmail: true
		};
	}
}
async function promptForEmailUnverified() {
	const { default: telemetry } = await import("./telemetry-BNNsn99P.js").then((n) => n.n);
	const ciMode = isCI();
	const existingEmail = getUserEmail();
	let email = ciMode ? CI_PLACEHOLDER_EMAIL : existingEmail;
	const existingEmailNeedsValidation = !ciMode && getUserEmailNeedsValidation();
	const existingEmailValidated = ciMode || getUserEmailValidated();
	let emailNeedsValidation = existingEmailNeedsValidation && !existingEmailValidated;
	if (!email) {
		await telemetry.record("feature_used", { feature: "promptForEmailUnverified" });
		const border = "─".repeat(TERMINAL_MAX_WIDTH);
		logger.info("");
		logger.info(chalk.cyan(border));
		logger.info(chalk.cyan.bold("  Email Verification Required"));
		logger.info(chalk.cyan(border));
		logger.info("");
		logger.info("  Red team scans require email verification to continue.");
		logger.info("");
		const emailSchema = z.email();
		try {
			email = await input({
				message: chalk.bold("Work email:"),
				validate: (input) => {
					const result = emailSchema.safeParse(input);
					return result.success || result.error.issues[0].message;
				}
			});
		} catch (error) {
			const err = error;
			if (err?.name === "AbortPromptError" || err?.name === "ExitPromptError") failEmailValidation("prompt_cancelled", "Email prompt cancelled.");
			logger.error(`failed to prompt for email: ${err}`);
			throw err;
		}
		setUserEmail(email);
		setUserEmailNeedsValidation(true);
		setUserEmailValidated(false);
		emailNeedsValidation = true;
		await telemetry.record("feature_used", { feature: "userCompletedPromptForEmailUnverified" });
	}
	return { emailNeedsValidation };
}
/**
* Checks account email status and throws `EmailValidationError` for recoverable
* validation failures that callers should handle at their process boundary.
*/
async function checkEmailStatusAndMaybeExit(options) {
	const result = await checkEmailStatus(options);
	if (isCI()) return "ok";
	if (result.status === EmailValidationStatus.RISKY_EMAIL || result.status === EmailValidationStatus.DISPOSABLE_EMAIL) {
		logger.error("Please use a valid work email.");
		setUserEmail("");
		return BAD_EMAIL_RESULT;
	}
	if (result.status === EmailValidationStatus.EXCEEDED_LIMIT) {
		const message = "You have exceeded the maximum cloud inference limit. Please contact inquiries@promptfoo.dev to upgrade your account.";
		logger.error(message);
		failEmailValidation("exceeded_limit", message);
	} else if (result.status === EmailValidationStatus.EMAIL_VERIFICATION_REQUIRED) {
		setUserEmailNeedsValidation(true);
		setUserEmailValidated(false);
		const message = result.message || "Your email address is not verified. Check your inbox for a verification link, then rerun the command.";
		logger.error(message, {
			status: result.status,
			hasEmail: result.hasEmail
		});
		failEmailValidation("email_verification_required", message);
	} else if (result.status === EmailValidationStatus.SHOW_USAGE_WARNING && result.message) {
		const border = "=".repeat(TERMINAL_MAX_WIDTH);
		logger.info(chalk.yellow(border));
		logger.warn(chalk.yellow(result.message));
		logger.info(chalk.yellow(border));
	}
	return "ok";
}
//#endregion
export { getUserEmail as a, promptForEmailUnverified as c, getUserAuthInfo as i, setUserEmail as l, checkEmailStatusAndMaybeExit as n, getUserId as o, getAuthor as r, isLoggedIntoCloud as s, EmailValidationError as t };

//# sourceMappingURL=accounts-B1w_ge6E.js.map