import { $ as Runtime, A as Outcome, At as SERVICE_TOKEN_ENV_VAR, B as EngineEvent, C as BrowserWaitRequest, Ct as positional, D as PromptSurface, Dt as CredentialIdentity, E as OpenUrlRequest, Et as Credential, F as Status, Ft as ManagementApiClient, G as SectionValidation, H as StreamEvent, I as Text, It as ManagementApiClientConfig, J as HostProcess, K as defineConfigSection, L as Tone, Lt as TokenStorage, M as Presentations, Mt as StoredSessions, N as PresentedResult, Nt as CredentialRefreshResult, O as Block, Ot as CredentialManager, P as Span, Pt as CredentialRefresher, Q as PRISMA_CONFIG_VERSION, R as TreeNode, S as defineSessionCommand, St as flag, T as OpenUrlOutcome, Tt as ActiveCredential, U as StreamMeta, V as Severity, W as ConfigSection, X as LoadedConfig, Y as InputStream, Z as OutputStream, _ as ServerCommandDefinition, _t as ArgsSpec, a as RedirectSpec, at as ExitWithChildStatusOptions, b as defineCommand, bt as FlagSpec, c as CommandDefinition, ct as SpawnRequest, d as CommandNeeds, dt as PackageManagerId, et as TelemetryPayload, f as CompletedEnvelope, ft as PackageManagerRunRequest, g as NeedsSpec, gt as Args, h as HelpSpec, ht as PackageOperations, i as MountedTree, it as ChildStatusSettlement, j as PRESENTED, jt as Session, k as Format, kt as CredentialOrigin, l as CommandHandler, lt as SpawnedChild, m as Handler, mt as PackageManagerRunner, n as CommandFamily, nt as RunSummary, o as defineCommandFamily, ot as SpawnChild, p as ErroredEnvelope, pt as PackageManagerRunResult, q as Host, r as CommandRedirect, rt as ChildResult, s as AnyCommand, st as SpawnOptions, t as TelemetryDeclaration, tt as EngineCommandSnapshot, u as CommandHelp, ut as exitWithChildStatus, v as SessionCommandDefinition, vt as Char, w as CommandContext, wt as ActiveAccessTokenOptions, x as defineServerCommand, xt as PositionalSpec, y as SpawnDeclarations, yt as CommandArgs, z as Ui } from "./report-DR2h7YIG.js";
import { n as CliStructuredError } from "./protocol-YjqPCCOG.js";

//#region src/active-access-token.d.ts
/** Shared implementation used by every CredentialManager. */
declare function readActiveAccessToken(storage: TokenStorage, refreshCredential: CredentialRefresher | undefined, options: ActiveAccessTokenOptions): Promise<string | null>;
//#endregion
//#region src/ci.d.ts
type Env = Readonly<Record<string, string | undefined>>;
/**
 * Whether this environment is a CI environment, by ci-info's rules
 * applied to the environment the host injected rather than to
 * `process.env`. `CI=false` is an explicit denial that stops every
 * other check, exactly as ci-info treats it.
 */
declare function detectCI(env: Env): boolean;
//#endregion
//#region src/cli.d.ts
/**
 * The observation hooks a bin may attach to a run. Deliberately
 * narrower than the engine's internal hook set (whose other members
 * are test seams reachable only through the ./testing harness).
 */
interface CliRunHooks {
  /** Fired exactly once per run, after settlement, for runs that
   *  reached a mounted command. Never fired for --help/--version.
   *  Errors thrown by the hook are swallowed. */
  readonly onSettled?: (summary: RunSummary) => void;
}
interface Cli {
  /**
   * Parse, execute, render, return the exit code. Never touches
   * process globals — it exits only through the runtime's exit proxy
   * (second-signal force exit) and writes only to the provided streams.
   * `hooks` is the bin's observation seam (telemetry).
   */
  run(argv: readonly string[], runtime: Runtime, hooks?: CliRunHooks): Promise<number>;
}
/**
 * Shell-side construction. Group help is declared with the mount.
 * Collisions, unknown groups, reserved-flag violations, grammar
 * violations, and foreign-section references fail construction (build
 * time, not run time).
 */
declare function createCli(spec: {
  readonly name: string;
  readonly version: string;
  readonly commandFamilies: readonly CommandFamily[];
  readonly groups: Readonly<Record<string, {
    readonly brief: string;
    readonly description?: string;
  }>>;
  readonly commands: MountedTree; /** Words for the root help card; the engine formats. */
  readonly help?: {
    readonly tagline?: string;
    readonly description?: string;
    readonly examples?: readonly string[];
    readonly docsUrl?: string;
  };
  /**
   * Declaring this, together with a `Runtime.spawnTelemetry` seam,
   * turns telemetry on: the engine reads the user's preference,
   * discloses on the first enabled run, mints the shared installation
   * id, and hands one payload per run to the seam. Both halves are
   * required — with either one missing the CLI reports nothing, and
   * reads no config, prints no disclosure and mints no id.
   */
  readonly telemetry?: TelemetryDeclaration;
}): Cli;
//#endregion
//#region src/config-loader.d.ts
/**
 * Attaches the version marker to a prisma.config.ts export. Each
 * top-level key names a config section, and the recognised section
 * names are exactly the ones the CLI's command families declare. Never
 * throws — bad section values are the section validator's problem, not
 * definePrismaConfig's.
 */
declare function definePrismaConfig<T extends Record<string, unknown>>(config: T): T & {
  readonly $prismaConfig: number;
};
/** @deprecated Renamed to {@link definePrismaConfig}: every family's
 *  config helper carries a unique name, so none needs an import alias. */
declare const defineConfig: typeof definePrismaConfig;
/**
 * The real-disk loader behind Runtime.loadConfig. The bin binds it to
 * the process cwd and its own version; tests hand in fixtures.
 * `cliVersion` names the exact prisma version in the install guidance
 * when the 'prisma/config' entry point cannot be resolved; absent, the
 * guidance names no version rather than an example that installs the
 * wrong one.
 */
declare function loadConfig(cwd: string, configPath?: string, cliVersion?: string): Promise<LoadedConfig>;
//#endregion
//#region src/credential-errors.d.ts
type CredentialsRequiredReason = "unauthenticated" | "expired" | "expiring-soon" | "session-ended" | "sessions-held-none-selected";
/**
 * The single constructor of CLI.CREDENTIALS_REQUIRED. Raised
 * identically by the needs check, ctx.activeCredential, and the
 * engine's request path.
 */
declare function credentialsRequiredError(reason?: CredentialsRequiredReason): CliStructuredError;
/**
 * A refresh attempt failed transiently (the auth service, not the
 * credentials): nothing was cleared, and signing in again is not the
 * fix.
 */
declare function authServiceError(): CliStructuredError;
/**
 * The credential in force was rejected and could never be renewed — it
 * carries no refresh token. The ONE place wording differs by origin;
 * nothing else compares against `origin.source`.
 */
declare function credentialRejectedError(origin: CredentialOrigin, envVar: string): CliStructuredError;
/**
 * A credential's workspace_id claim disagrees with the workspace it is
 * being stored under, or a rotated token would re-scope a session.
 * Raised by every CredentialManager, so a test sees what production
 * raises.
 */
declare function credentialWorkspaceMismatchError(workspaceId: string): CliStructuredError;
/**
 * The env var that supplies a session is set to a blank value. The one
 * structured error for it, raised identically by activeCredential(),
 * the needs check, and the engine's request path.
 */
declare function emptyServiceTokenError(spec: {
  readonly envVar: string;
}): CliStructuredError;
/**
 * No session exists for the named workspace. Sessions are created by
 * `prisma auth login` alone — `workspace use` selects among the ones
 * you have.
 */
declare function noSessionForWorkspaceError(workspaceRef: string): CliStructuredError;
//#endregion
//#region src/environment-credential-manager.d.ts
declare class EnvironmentCredentialManager implements CredentialManager {
  #private;
  constructor(spec: {
    readonly env: Readonly<Record<string, string | undefined>>;
  });
  activeCredential(): Promise<ActiveCredential | null>;
  sessions(): Promise<StoredSessions>;
  createSession(_credential: Credential, _workspaceId: string): Promise<Session>;
  selectSession(_workspaceId: string): Promise<Session>;
  endSession(_workspaceId: string): Promise<void>;
  endAllSessions(): Promise<void>;
  activeCredentialStorage(): Promise<TokenStorage>;
  /** The delegated path's read: the env token passes through directly. It
   *  is already a snapshot with no refresh token behind it. */
  activeAccessToken(options: ActiveAccessTokenOptions): Promise<string | null>;
}
//#endregion
//#region src/telemetry/gating.d.ts
/**
 * Why telemetry resolved the way it did. Total: every resolution carries
 * a reason, enabled or not, so `telemetry status` projects its copy from
 * the resolution instead of re-deriving the decision.
 */
type TelemetryDisabledReason = "ci" | "env-opt-out" | "stored-opt-out";
type TelemetryEnabledReason = "stored-opt-in" | "default-on";
type TelemetryStatusReason = TelemetryDisabledReason | TelemetryEnabledReason;
//#endregion
//#region src/telemetry/commands.d.ts
interface TelemetryStatus {
  readonly enabled: boolean;
  readonly reason: TelemetryStatusReason;
  readonly configPath: string;
  readonly installationIdStored: boolean;
}
/**
 * The three commands with the group help text that belongs to them,
 * ready to spread into `createCli`. `docsUrl` is the same URL the
 * telemetry declaration names; the group description points users at it
 * for what is collected and why.
 *
 * ```ts
 * const telemetry = telemetryCommandGroup({ docsUrl: DOCS_URL });
 * createCli({
 *   commands: { ...telemetry.commands, ...ownCommands },
 *   groups: { ...telemetry.groups, ...ownGroups },
 *   telemetry: { docsUrl: DOCS_URL },
 * });
 * ```
 */
declare function telemetryCommandGroup(options: {
  readonly docsUrl: string;
}): {
  readonly commands: MountedTree;
  readonly groups: Readonly<Record<string, {
    readonly brief: string;
    readonly description?: string;
  }>>;
};
//#endregion
//#region src/token-claims.d.ts
/**
 * The workspace a credential names. One derivation, because a token
 * says it one of two ways and every caller wants the same answer: an
 * OAuth token carries `workspace_id`, while a service token names its
 * workspace through `sub` and carries no `workspace_id` at all. Reading
 * only the claim was a second path that happened to work because
 * service tokens reached it by a different route — a split nothing
 * enforced.
 */
declare function credentialWorkspaceId(token: string): string | undefined;
declare function claimedExpiresAt(token: string): Date | undefined;
/**
 * Who a credential belongs to, from its own claims. A service token's
 * subject names a workspace rather than a person, so it yields no user
 * — reporting `workspace:ws_1` as a user id was a real defect.
 */
declare function claimedIdentity(token: string): CredentialIdentity | undefined;
//#endregion
export { type ActiveAccessTokenOptions, type ActiveCredential, type AnyCommand, type Args, type ArgsSpec, type Block, type BrowserWaitRequest, type Char, type ChildResult, type ChildStatusSettlement, type Cli, type CliRunHooks, type CommandArgs, type CommandContext, type CommandDefinition, type CommandFamily, type CommandHandler, type CommandHelp, type CommandNeeds, type CommandRedirect, type CompletedEnvelope, type ConfigSection, type Credential, type CredentialIdentity, type CredentialManager, type CredentialOrigin, type CredentialRefreshResult, type CredentialRefresher, type CredentialsRequiredReason, type EngineCommandSnapshot, type EngineEvent, EnvironmentCredentialManager, type ErroredEnvelope, type ExitWithChildStatusOptions, type FlagSpec, type Format, type Handler, type HelpSpec, type Host, type HostProcess, type InputStream, type LoadedConfig, type ManagementApiClient, type ManagementApiClientConfig, type MountedTree, type NeedsSpec, type OpenUrlOutcome, type OpenUrlRequest, type Outcome, type OutputStream, PRESENTED, PRISMA_CONFIG_VERSION, type PackageManagerId, type PackageManagerRunRequest, type PackageManagerRunResult, type PackageManagerRunner, type PackageOperations, type PositionalSpec, type Presentations, type PresentedResult, type PromptSurface, type RedirectSpec, type RunSummary, type Runtime, SERVICE_TOKEN_ENV_VAR, type SectionValidation, type ServerCommandDefinition, type Session, type SessionCommandDefinition, type Severity, type Span, type SpawnChild, type SpawnDeclarations, type SpawnOptions, type SpawnRequest, type SpawnedChild, type Status, type StoredSessions, type StreamEvent, type StreamMeta, type TelemetryDeclaration, type TelemetryPayload, type TelemetryStatus, type TelemetryStatusReason, type Text, type TokenStorage, type Tone, type TreeNode, type Ui, authServiceError, claimedExpiresAt, claimedIdentity, createCli, credentialRejectedError, credentialWorkspaceId, credentialWorkspaceMismatchError, credentialsRequiredError, defineCommand, defineCommandFamily, defineConfig, defineConfigSection, definePrismaConfig, defineServerCommand, defineSessionCommand, detectCI, emptyServiceTokenError, exitWithChildStatus, flag, loadConfig, noSessionForWorkspaceError, positional, readActiveAccessToken, telemetryCommandGroup };