import { i as NextAction, n as CliStructuredError, r as Diagnostic, s as Result } from "./protocol-YjqPCCOG.js";
import { ManagementApiClient, TokenStorage } from "@prisma/management-api-sdk";

//#region src/management-api.d.ts
type SdkTokens = NonNullable<Awaited<ReturnType<TokenStorage["getTokens"]>>>;
type StoredTokens = SdkTokens & {
  /** The explicit OAuth lifetime when the access token has no exp claim. */readonly expiresAt?: Date;
};
/**
 * The SDK's typed client, re-exported so consumers never import
 * @prisma/management-api-sdk directly.
 */
type ManagementApiClient$1 = ManagementApiClient;
/**
 * The SDK's token-storage contract plus the explicit OAuth expiry the
 * credential manager persists for opaque access tokens. The extra data and
 * optional setTokens argument are structurally compatible with the SDK, which
 * ignores expiry and continues to call setTokens with one argument.
 */
type TokenStorage$1 = Omit<TokenStorage, "getTokens" | "setTokens"> & {
  getTokens(): Promise<StoredTokens | null>;
  setTokens(tokens: SdkTokens, expiresAt?: Date): Promise<void>;
};
/**
 * SDK client construction config, injected by the bin beside the
 * credential manager. All four fields: the SDK's refreshing fetch
 * requires the full config even though only login paths read
 * redirectUri.
 */
interface ManagementApiClientConfig {
  readonly clientId: string;
  readonly redirectUri: string;
  readonly apiBaseUrl: string;
  readonly authBaseUrl: string;
}
/**
 * The host-side OAuth exchange the engine may request before handing an
 * access-token snapshot to a child. The refresh token crosses only this
 * in-process seam; it is never added to the child's environment.
 *
 * `invalid` is the token endpoint's definitive `invalid_grant` verdict.
 * Transport failures and every other endpoint failure are thrown so the
 * engine can map them to CLI.AUTH_SERVICE_ERROR without exposing endpoint
 * response text.
 */
type CredentialRefreshResult = {
  readonly kind: "success";
  readonly accessToken: string;
  readonly refreshToken: string; /** Absolute lifetime reported by the OAuth token endpoint. */
  readonly expiresAt: Date;
} | {
  readonly kind: "invalid";
};
type CredentialRefresher = (request: {
  readonly refreshToken: string;
  readonly signal: AbortSignal;
}) => Promise<CredentialRefreshResult>;
//#endregion
//#region src/credential-manager.d.ts
/** The environment variables that supply a credential to a process: a
 *  service token, plus the workspace it acts in when the token's own
 *  claims name none. EnvironmentCredentialManager reads the pair; the
 *  spawn path writes it into a child's environment. */
declare const SERVICE_TOKEN_ENV_VAR = "PRISMA_SERVICE_TOKEN";
/**
 * The proof material. Seen by the login flow (which mints it),
 * createSession (which stores it), and the engine (which authenticates
 * with it). Never reaches a command.
 */
interface Credential {
  readonly token: string;
  readonly refreshToken: string | undefined;
  readonly expiresAt: Date | undefined;
}
/**
 * A stored logged-in-ness for one workspace — the only thing called a
 * session. It is what `sessions()` lists, what `selectSession` selects,
 * and what `endSession` ends. The credential behind it is internal.
 */
interface Session {
  readonly workspaceId: string;
  readonly workspaceName: string | undefined;
  /** The stored ACCESS TOKEN's expiry, which rotation changes — not a
   *  deadline on the logged-in-ness. */
  readonly expiresAt: Date | undefined;
}
/**
 * The stored sessions and which one is selected, read together: reads
 * take no lock, so two reads could straddle a write and disagree.
 * `selectedWorkspaceId` always names one of the listed sessions or is
 * absent — a dangling selection never escapes the manager.
 */
interface StoredSessions {
  readonly sessions: readonly Session[];
  readonly selectedWorkspaceId: string | undefined;
}
/** Who the active credential belongs to, decoded from its own claims by
 *  the manager so no command ever holds a token to decode. */
interface CredentialIdentity {
  readonly userId: string | undefined;
  readonly email: string | undefined;
  /** Only an online lookup supplies this; a token's claims do not
   *  carry it. */
  readonly name: string | undefined;
}
/**
 * Where the active credential came from — a question about the
 * resolution, not about a session.
 */
interface CredentialOrigin {
  /** Exists to be PRINTED: it feeds whoami's `source` field verbatim.
   *  Outside whoami's renderer and the credential-rejected error,
   *  comparing against this is a defect. */
  readonly source: "stored" | "environment";
}
/**
 * What this process authenticates as. Carries no token material.
 */
interface ActiveCredential {
  /** Absent when nothing names it — an environment token whose claims
   *  carry no workspace. Never the empty string. */
  readonly workspaceId: string | undefined;
  readonly workspaceName: string | undefined;
  readonly expiresAt: Date | undefined;
  readonly identity: CredentialIdentity | undefined;
  readonly origin: CredentialOrigin;
}
interface ActiveAccessTokenOptions {
  /** Refuse or refresh a token with no more than this lifetime left. */
  readonly minimumValidityMs: number;
  readonly now: Date;
  readonly signal: AbortSignal;
}
/**
 * Manages the credentials this machine holds: the stored per-workspace
 * sessions, which one is selected, and the credential this process
 * authenticates as. Custody only — never opens a browser, never
 * prompts, never talks to the user. Env is a construction input;
 * nothing below the manager reads process.env. It resolves no user
 * input: commands resolve refs against `sessions()` and pass a
 * workspace id.
 */
interface CredentialManager {
  /**
   * What this process authenticates as. The DECISION — which
   * credential, and from where — is pinned at first read; the material
   * is read through the storage on every call, so a session replaced by
   * another process still resolves. Local-only: never touches the
   * network.
   */
  activeCredential(): Promise<ActiveCredential | null>;
  /** The stored sessions and the selection, read fresh. Local-only. */
  sessions(): Promise<StoredSessions>;
  /**
   * Login's write. The caller names the workspace that identifies the
   * session; for workspace-bound credentials the manager verifies the
   * workspace_id claim matches and refuses on mismatch. Upserts by
   * workspaceId and selects it. The workspace name is fetched
   * best-effort after the write — failure leaves it undefined, never
   * fails login.
   */
  createSession(credential: Credential, workspaceId: string): Promise<Session>;
  /**
   * Select a session. Refuses a workspace with no session: there is no
   * state in which it would afterwards be selected. Never sees the
   * environment credential.
   */
  selectSession(workspaceId: string): Promise<Session>;
  /**
   * End one workspace's session. Idempotent — a workspace with no
   * session is already in the state this asks for. Clears the selection
   * if it named that session; never auto-promotes another.
   */
  endSession(workspaceId: string): Promise<void>;
  /** End every session and clear the selection. */
  endAllSessions(): Promise<void>;
  /**
   * ENGINE-FACING. Where the SDK reads and writes the active
   * credential's tokens: file-backed for a stored session, memory-backed
   * for one with no home record. Zero-argument because process pinning
   * already ruled there is one credential per process, and an
   * environment credential may have no workspace id to key on. Only
   * valid once `activeCredential()` has returned non-null.
   *
   * The engine forwards the storage into SDK client config and never
   * calls its methods itself — no exceptions. The engine's own read of
   * token material goes through `activeAccessToken()`.
   */
  activeCredentialStorage(): Promise<TokenStorage$1>;
  /**
   * ENGINE-FACING. The active credential's ACCESS token, read fresh on
   * every call, for handing to a child process that authenticates as
   * this process does. An OAuth pair inside the caller's minimum
   * validity is refreshed under the refresh lock before its access
   * token is returned. Never the refresh token: the child gets a
   * snapshot it cannot refresh. Null when the material is gone (the
   * session ended).
   */
  activeAccessToken(options: ActiveAccessTokenOptions): Promise<string | null>;
}
//#endregion
//#region src/args.d.ts
/**
 * Single-character alias, enforced at the type level: `Char<'q'>` is
 * 'q'; `Char<'ab'>` is never.
 */
type Char<S extends string> = S extends `${string}${infer Rest}` ? Rest extends "" ? S : never : never;
interface FlagSpec<T> {
  /** Phantom type carrier for inference; never present at runtime. */
  readonly __flag?: T;
}
/**
 * Command-declared flags. The shared family (--format/--json,
 * --log-level/--verbose, --quiet, --yes, --interactive, --color) is
 * engine-injected and reserved. Flags are optional by default
 * (requiredString is the exception); positionals are required by
 * default (optionalString is the exception).
 */
declare const flag: {
  string<A extends string = never>(spec: {
    brief: string;
    placeholder?: string;
    alias?: A & Char<A>;
    default?: string;
  }): FlagSpec<string | undefined>;
  requiredString<A extends string = never>(spec: {
    brief: string;
    placeholder?: string;
    alias?: A & Char<A>;
  }): FlagSpec<string>;
  number<A extends string = never>(spec: {
    brief: string;
    placeholder?: string;
    alias?: A & Char<A>;
    default?: number;
  }): FlagSpec<number | undefined>;
  boolean<A extends string = never>(spec: {
    brief: string;
    alias?: A & Char<A>;
  }): FlagSpec<boolean>;
  /**
   * A boolean the user can leave unsaid: `--flag`, `--no-flag`, or
   * neither, which arrives as undefined. Use it when absence means
   * something of its own — "ask me" rather than "no".
   */
  optionalBoolean<A extends string = never>(spec: {
    brief: string;
    alias?: A & Char<A>;
  }): FlagSpec<boolean | undefined>;
  enum<const T extends readonly string[], A extends string = never>(spec: {
    brief: string;
    values: T;
    alias?: A & Char<A>;
    default?: T[number];
  }): FlagSpec<T[number] | undefined>;
  repeated<A extends string = never>(spec: {
    brief: string;
    placeholder?: string;
    alias?: A & Char<A>;
  }): FlagSpec<readonly string[]>;
};
interface PositionalSpec<T> {
  /** Phantom type carrier for inference; never present at runtime. */
  readonly __positional?: T;
}
declare const positional: {
  string(spec: {
    brief: string;
    placeholder: string;
  }): PositionalSpec<string>;
  optionalString(spec: {
    brief: string;
    placeholder: string;
  }): PositionalSpec<string | undefined>;
  /**
   * Zero or more trailing values; at most one, declared last (order =
   * declaration order; keys must not be integer-like).
   */
  variadic(spec: {
    brief: string;
    placeholder: string;
  }): PositionalSpec<readonly string[]>;
};
/** The parse SPI: a command's argument surface, one property. */
interface ArgsSpec<TFlags extends Record<string, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>>> {
  readonly flags?: TFlags;
  readonly positionals?: TPositionals;
}
/**
 * The normalized argument surface a definition carries: both namespaces
 * always present, empty when the command declares none.
 */
interface CommandArgs<TFlags extends Record<string, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>>> {
  readonly flags: TFlags;
  readonly positionals: TPositionals;
}
/**
 * What a handler receives: separate namespaces, symmetric access —
 * `args.flags.to`, `args.positionals.name`. Declared flag keys are
 * camelCase and transliterate to --kebab-case on the CLI.
 */
interface Args<TFlags extends Record<string, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>>> {
  readonly flags: { readonly [K in keyof TFlags]: TFlags[K] extends FlagSpec<infer T> ? T : never };
  readonly positionals: { readonly [K in keyof TPositionals]: TPositionals[K] extends PositionalSpec<infer T> ? T : never };
}
//#endregion
//#region src/package-manager.d.ts
/** The package managers the engine knows how to drive. */
type PackageManagerId = "npm" | "pnpm" | "yarn" | "bun" | "deno";
/**
 * ctx.packages: what a command declaring `installsPackages` may do to
 * the user's project. Both operations resolve — a manager that failed
 * is a value, not a throw — except under cancellation, which throws the
 * abort reason so the run settles the way Ctrl-C settles everywhere
 * else. Neither may be called while the other is still running.
 *
 * Success carries nothing back: the command line stays with the engine,
 * which announces it, streams the manager's output under it, and puts
 * the redacted spelling on a failure's next action.
 */
interface PackageOperations {
  /** Adds dependencies to the project. */
  install(request: {
    /** Specifiers as the user would type them, e.g. "prisma@latest". */readonly packages: readonly string[];
    readonly dev?: boolean; /** Defaults to ctx.cwd. */
    readonly cwd?: string; /** Overrides detection, so a caller can retry with another manager. */
    readonly manager?: PackageManagerId;
  }): Promise<Result<void, CliStructuredError>>;
  /** Runs a package's bin once, without adding a dependency. */
  run(request: {
    /** The package whose bin to execute, e.g. "skills". */readonly package: string;
    readonly args: readonly string[]; /** Defaults to ctx.cwd. */
    readonly cwd?: string; /** Overrides detection, so a caller can retry with another manager. */
    readonly manager?: PackageManagerId;
  }): Promise<Result<void, CliStructuredError>>;
}
/** One package-manager execution, handed to the host to spawn. */
interface PackageManagerRunRequest {
  readonly file: string;
  readonly args: readonly string[];
  readonly cwd: string;
  readonly signal: AbortSignal;
  /** Called with each chunk as the child writes it, so the engine can
   *  emit `output` events while the operation runs. */
  readonly onOutput: (channel: "data" | "diagnostic", chunk: string) => void;
}
/** What the child produced: its exit code — non-zero covers a manager
 *  that failed and an executable that was not there — and its stderr,
 *  bounded to the last 64 KiB. */
interface PackageManagerRunResult {
  readonly exitCode: number;
  readonly stderr: string;
}
/** Spawns a package manager on the engine's behalf. A manager that
 *  fails is a resolved result, never a rejection. */
type PackageManagerRunner = (request: PackageManagerRunRequest) => Promise<PackageManagerRunResult>;
//#endregion
//#region src/spawn.d.ts
/** A fully composed child invocation. `env` is the child's COMPLETE
 *  environment: the engine has already merged the invocation
 *  environment, the handler's additions, and the credential variables. */
interface SpawnRequest {
  readonly command: string;
  readonly args: readonly string[];
  readonly cwd: string;
  readonly env: Readonly<Record<string, string | undefined>>;
  /** "inherit" hands the terminal over unchanged. "diagnostic" MUST
   * route the child's stdout and stderr away from this process's
   * stdout (to the host's diagnostic stream): the engine emits framed
   * NDJSON on stdout in that mode and cannot detect an adapter that
   * ignores this field — inherited child stdout would silently corrupt
   * the stream. Adapters written before this field existed must be
   * updated. */
  readonly output: "inherit" | "diagnostic";
}
/** How a child ended. A signal-killed child carries `signal` and a null
 *  `exitCode`, and is an abort rather than a failure: exitWithChildStatus
 *  settles it as one, and a handler that reads the result itself branches
 *  on `signal` before `exitCode`. */
interface ChildResult {
  readonly exitCode: number | null;
  readonly signal: string | null;
}
/** The live child an adapter returns. */
interface SpawnedChild {
  /** Resolves when the child ends. Rejects when it could not be
   *  launched at all; the engine phrases that as CLI.SPAWN_FAILED. */
  readonly ended: Promise<ChildResult>;
  readonly kill: (signal: "SIGTERM" | "SIGKILL") => void;
}
/**
 * The Runtime seam. In human mode the adapter starts the child with
 * inherited stdio, in the caller's own process group (POSIX) / console
 * (Windows). In structured mode stdin remains inherited while stdout and
 * stderr are routed to the host's diagnostic stream, preserving framed
 * stdout. Neither mode detaches or opens a new console.
 */
type SpawnChild = (request: SpawnRequest) => SpawnedChild;
/** What a handler passes to ctx.spawn. */
interface SpawnOptions {
  readonly command: string;
  readonly args?: readonly string[];
  /** Defaults to ctx.cwd. */
  readonly cwd?: string;
  /** Added to, and overriding, the invocation environment. The engine's
   *  credential variables are applied last and cannot be overridden. */
  readonly env?: Readonly<Record<string, string | undefined>>;
}
declare const CHILD_STATUS: unique symbol;
/**
 * The sanctioned settlement outcome for "exit with the child's status
 * verbatim": no envelope, the same settlement bypass server commands
 * use. Built exclusively by exitWithChildStatus, and only settled by a
 * command that declares maySpawn. It carries no exit code, because the
 * code is not the handler's to state: the engine reads it off its own
 * record of the child. `nextActions` render to stderr before the
 * process exits with the child's code.
 */
interface ChildStatusSettlement {
  readonly [CHILD_STATUS]: true;
  readonly nextActions: readonly NextAction[];
}
interface ExitWithChildStatusOptions {
  /** Engine-styled guidance printed to stderr before the exit — a
   *  failed converge's reproduce hint. The envelope stays absent, and
   *  a signal-killed child drops these entirely: the user stopped the
   *  run, so there is nothing to reproduce. */
  readonly nextActions?: readonly NextAction[];
}
/**
 * Settles the run with the status of the child the run spawned — the
 * one `ctx.lastChild()` reports. The handler names no child and no
 * code: this is how a real child's status reaches the exit code, not
 * how a handler picks one, so a run that spawned nothing is a
 * construction error at settlement.
 *
 * A signal-killed child overrules everything the caller asked for: it
 * settles 128 + the signal number with no `nextActions`, because the
 * user stopped the run and there is nothing to reproduce.
 */
declare function exitWithChildStatus(options?: ExitWithChildStatusOptions): ChildStatusSettlement;
//#endregion
//#region src/run-summary.d.ts
/**
 * The value-free command snapshot the engine records at parse time.
 * The engine's own telemetry composes its payload from it at command
 * start, and it rides along on the RunSummary a bin may observe.
 * Carries NO user data — command-path segments, flag names with their
 * value source, and a bare count of positionals. Flag values,
 * positional values, and raw argv never appear here.
 */
interface EngineCommandSnapshot {
  /** Mount-path segments of the executed command ('telemetry status'
   *  → ['telemetry', 'status']). Never includes the binary name. */
  readonly commandPath: readonly string[];
  /**
   * One entry per flag the command accepts (the engine-injected shared
   * family first, then the command's own declarations), named in the
   * user-facing kebab-case spelling. `source` is what the engine knows
   * at parse time: flags explicitly present on argv are 'cli'; the
   * engine reads no flags from the environment today, so everything
   * else is 'default'. 'env' is reserved for a future env-sourced
   * flag mechanism.
   */
  readonly flags: ReadonlyArray<{
    readonly name: string;
    readonly source: "cli" | "env" | "default";
  }>;
  /** How many positional arguments the run supplied — a count only. */
  readonly positionalCount: number;
}
/**
 * What `RunHooks.onSettled` receives, exactly once per run, after the
 * run has settled (exit code determined, terminal output written).
 * Never fired for `--help` or `--version`, and never for a run that
 * failed before a mounted command was reached (nothing executed, so
 * there is no snapshot to report). `durationMs` comes from the
 * engine's injectable clock.
 */
interface RunSummary {
  /** The mounted command's dotted id ('telemetry.status'). Derived
   *  from the same mount entry as `snapshot.commandPath` — it always
   *  equals `snapshot.commandPath.join('.')`. Both are kept: consumers
   *  addressing the command use the id; the snapshot is the value-free
   *  wire projection. */
  readonly commandId: string;
  readonly exitCode: number;
  readonly durationMs: number;
  readonly snapshot: EngineCommandSnapshot;
}
//#endregion
//#region src/telemetry/payload.d.ts
/**
 * The payload the engine composes at command start and hands to
 * `Runtime.spawnTelemetry`. The host forwards it to its own sender,
 * which probes its process (runtime/os/arch, package manager, ts
 * version, agent) for the rest of the event and POSTs it.
 *
 * Both sides version-couple on this shape: the carrier is Node's
 * structured clone over IPC, so there is no on-wire compat to maintain.
 */
interface TelemetryPayload {
  readonly installationId: string;
  readonly version: string;
  /** The command path joined with spaces — `postgres create`. */
  readonly command: string;
  /** Names only, of the flags the user typed. Never values. */
  readonly flags: readonly string[];
  /**
   * Absolute path of the user's project. The sender reads
   * `<projectRoot>/package.json` for `tsVersion`.
   */
  readonly projectRoot: string;
  /** Resolved endpoint URL (already includes the `/events` path). */
  readonly endpoint: string;
  /**
   * Kept for wire compatibility with the ORM CLI's first-`init` flow,
   * where the chosen target is known before the config file exists. The
   * engine never populates it; the wire-format event keeps `null` as its
   * "no target known" marker, but this channel needs only two states so
   * the field is `string | undefined`.
   */
  readonly databaseTarget?: string;
}
//#endregion
//#region src/runtime.d.ts
/** Minimal structural stream types; no NodeJS.* in the public surface. */
interface OutputStream {
  write(text: string): void;
  /** The stream's terminal width, absent when it is not a terminal.
   *  The engine reads it at render time rather than caching it, so a
   *  terminal resized mid-run is respected by the next thing drawn. */
  readonly columns?: number;
}
/**
 * Byte-oriented, so server commands can implement byte-counted
 * protocols (lsp's Content-Length framing). setRawMode is present
 * where the platform supports keypress input.
 */
interface InputStream extends AsyncIterable<Uint8Array> {
  readonly setRawMode?: (enabled: boolean) => void;
}
/** Everything environmental, injected once by the bin (or by a test). */
interface Runtime {
  readonly stdout: OutputStream;
  readonly stderr: OutputStream;
  readonly stdin: InputStream;
  readonly cwd: string;
  readonly env: Readonly<Record<string, string | undefined>>;
  readonly isTty: {
    readonly stdin: boolean;
    readonly stdout: boolean;
    readonly stderr: boolean;
  };
  /**
   * Whether stdout and stderr are the same open device — the case where
   * human blocks and the machine stdout mirror would draw on one screen
   * as visible duplication. Consulted only when both streams are TTYs:
   * `false` there means two separate terminals, so the mirror is kept
   * for whatever is reading stdout. Absent means the host cannot tell,
   * which is treated as "same" — the overwhelmingly common case for two
   * TTYs is one terminal.
   */
  readonly outputStreamsShareDevice?: boolean;
  /**
   * Forces the answer to "is this CI", where telemetry never reports.
   * Absent — the normal case — means the engine detects CI from `env`
   * using ci-info's vendor table, which is why no host has to answer:
   * unlike a TTY, CI-ness is derivable from the environment the host
   * already injects, and every host computing the same boolean was the
   * same detection table forked N ways. Set it only where detection
   * cannot be right — an exotic platform, or a test that needs both
   * sides of the branch. Absence means detected, never false, so a host
   * that says nothing still stays silent in CI.
   */
  readonly isCIOverride?: boolean;
  /**
   * Ends the process. The bin passes process.exit; the engine is the
   * only caller (second-signal force exit, 130/143).
   */
  readonly exit: (code: number) => never;
  /**
   * Subscribes to delivered SIGINT/SIGTERM; returns the unsubscribe.
   * The bin is dumb wiring — the engine owns the whole signal policy:
   * the first signal aborts ctx.signal and awaits teardown; a second
   * calls exit(130|143) immediately.
   */
  readonly onSignal: (cb: (signal: "SIGINT" | "SIGTERM") => void) => () => void;
  /**
   * Reads prisma.config.ts, on demand. The engine calls it only when
   * the command it is about to run declares a config section, so a run
   * that needs no config never touches the file. `configPath` is the
   * file `--config` named: the loader resolves it against the runtime's
   * cwd and reports its absence. Absent means look for prisma.config.ts
   * in cwd, where absence is not an error. The bin wires the real disk
   * loader; tests hand in fixtures.
   */
  readonly loadConfig: (configPath?: string) => Promise<LoadedConfig>;
  /**
   * The credential manager the bin wires. It is the only source of
   * the needs check, ctx.activeCredential, and ctx.api; absent means
   * this host has no credentials at all, and every command that needs
   * them fails as signed out.
   */
  readonly credentialManager?: CredentialManager;
  /**
   * SDK client construction config the bin injects beside the
   * manager; the engine builds ctx.api from it. Required whenever a
   * credentialManager is wired.
   */
  readonly managementApiClientConfig?: ManagementApiClientConfig;
  /**
   * Opens a URL in the user's browser, wired by the bin (the login
   * flow's opener). The engine calls it only for interactive sessions,
   * treats a throw as "did not open", and never fails a command over
   * it. Absent means this host cannot open a browser: the engine
   * announces the URL instead.
   */
  readonly openUrl?: (url: string) => Promise<void> | void;
  /**
   * Starts a child process with inherited stdio, wired by the bin (a
   * node:child_process adapter) so the engine never imports it. Absent
   * means this host cannot hand the terminal to a child: a maySpawn
   * command is refused as an internal error before its needs check and
   * handler run, so ctx.spawn is never reached.
   */
  readonly spawn?: SpawnChild;
  /**
   * Fire-and-forget delivery of one composed telemetry payload. The bin
   * owns the process work and the detachment, which is why the engine
   * imports no child_process and performs no network I/O for telemetry.
   * Absent means this host reports nothing — not an error, and the whole
   * sequence is skipped rather than only the delivery: no config read,
   * no disclosure, no mint.
   */
  readonly spawnTelemetry?: (payload: TelemetryPayload) => void;
  /** Management API endpoint config; the bin derives baseUrl from env. */
  readonly managementApi: {
    readonly baseUrl: string;
  };
  /**
   * A host that knows its user's package manager better than detection
   * does. Absent — the normal case — means the engine detects it from
   * the project at cwd.
   */
  readonly packageManager?: PackageManagerId;
  /**
   * Spawns the package manager the engine composed. The engine never
   * imports child_process; this is the only way a manager runs. It is
   * optional so a harness can exercise the no-runner path — every
   * shipped host wires it, and a host without it can run no package
   * operation at all.
   */
  readonly runPackageManager?: PackageManagerRunner;
  /** What this process is running on. The bin reads it once; commands
   *  take it from ctx.host rather than from process. */
  readonly host: Host;
}
/**
 * The facts a command may legitimately need about the machine it runs
 * on: what to put in a bug report, and the rare genuine behavioural
 * difference (symlinks need a privilege on Windows).
 *
 * Deliberately not node-shaped. Products are runtime-agnostic (R4), so
 * the runtime names itself rather than the field naming it.
 */
interface Host {
  readonly runtime: {
    readonly name: string;
    readonly version: string;
  };
  readonly platform: string;
  readonly arch: string;
}
/**
 * The minimal process surface a bin adapts a Runtime from — Node's
 * `process` satisfies it structurally. The engine never reads it; it
 * exists so bins and their tests share one adapter shape.
 */
interface HostProcess {
  readonly argv: readonly string[];
  readonly env: Readonly<Record<string, string | undefined>>;
  readonly version: string;
  readonly versions: Readonly<Record<string, string | undefined>>;
  readonly platform: string;
  readonly arch: string;
  cwd(): string;
  readonly stdout: {
    write(text: string): unknown;
    isTTY?: boolean;
  };
  readonly stderr: {
    write(text: string): unknown;
    isTTY?: boolean;
    columns?: number;
  };
  readonly stdin: {
    isTTY?: boolean;
    setRawMode?(enabled: boolean): unknown;
    [Symbol.asyncIterator](): AsyncIterator<Uint8Array>;
  };
  on(event: "SIGINT" | "SIGTERM", listener: () => void): unknown;
  off(event: "SIGINT" | "SIGTERM", listener: () => void): unknown;
  exit(code: number): never;
}
interface LoadedConfig {
  /**
   * The file this config came from, absolute: the one `--config` named,
   * or prisma.config.ts in cwd. A loader that found no file still names
   * the file it looked for — with no file there are no sections, and
   * the engine reads the path only to name the file when it reports a
   * top-level key that is not one of the CLI's sections.
   */
  readonly path: string;
  /**
   * Raw section values by name; validation happens per command via its
   * command family's section token. The engine, not the loader, checks
   * these names against the sections the CLI declares, so the closed
   * set holds whatever loader a host wires.
   */
  readonly sections: Readonly<Record<string, unknown>>;
  /**
   * File-level problems (unevaluable module, missing version marker)
   * carry section: null and fail only commands with a needs.config
   * section; commands with no config need run normally.
   */
  readonly diagnostics: ReadonlyArray<{
    readonly section: string | null;
    readonly diagnostic: Diagnostic;
  }>;
}
/**
 * The config contract version defineConfig writes as the structural
 * `$prismaConfig` marker; the loader checks it before interpreting
 * anything.
 */
declare const PRISMA_CONFIG_VERSION = 1;
//#endregion
//#region src/config-section.d.ts
/**
 * A command family's named slice of prisma.config.ts. The token couples
 * the section name, its validated type, and its total validator. The
 * validator owns absence: its input is the raw section value, or
 * undefined when the config file has no such section. It returns
 * findings; it never throws.
 */
interface ConfigSection<T> {
  readonly name: string;
  readonly validate: (raw: unknown | undefined) => SectionValidation<T>;
}
/**
 * Diagnostics on an OK validation are warnings: the engine writes them
 * to stderr as commentary (log-level filtered, human and json alike);
 * they never enter the stream or the envelope.
 */
type SectionValidation<T> = {
  readonly ok: true;
  readonly value: T;
  readonly diagnostics: readonly Diagnostic[];
} | {
  readonly ok: false;
  readonly diagnostics: readonly Diagnostic[];
};
declare function defineConfigSection<T>(spec: {
  readonly name: string;
  readonly validate: (raw: unknown | undefined) => SectionValidation<T>;
}): ConfigSection<T>;
//#endregion
//#region src/events.d.ts
/**
 * The commentary severity scale; also the log-level axis. Distinct from
 * Diagnostic severity: 'verbose' grades commentary, which never enters
 * the envelope.
 */
type Severity = "error" | "warn" | "info" | "verbose";
/**
 * The engine event envelope. `kind`-specific fields are the common
 * vocabulary the engine renders (human mode) and streams (json mode);
 * `data` is the command family's extension, passed through untouched.
 * Events are transcript, never aggregated into any envelope. Follow-ups
 * are handler-owned: completed via `presentations.next`, errored via the
 * error's own `nextActions`.
 */
type EngineEvent = {
  readonly kind: "step-started";
  readonly step: string;
  readonly id?: string;
  readonly parentId?: string;
  readonly data?: unknown;
} | {
  readonly kind: "step-finished";
  readonly step: string;
  readonly id?: string;
  readonly outcome: "ok" | "failed" | "skipped" | "warning";
  readonly data?: unknown;
} | {
  readonly kind: "progress";
  readonly step?: string;
  readonly completed: number;
  readonly total?: number;
  readonly data?: unknown;
}
/**
 * Commentary at a severity; display-filtered by log level. 'error' is
 * not valid here: fatal problems are the Result's error;
 * envelope-worthy findings are diagnostics.
 */
| {
  readonly kind: "message";
  readonly severity: Exclude<Severity, "error">;
  readonly text: string;
  readonly data?: unknown;
} | {
  readonly kind: "output";
  readonly source: string;
  readonly channel: "data" | "diagnostic";
  readonly line: string;
  readonly data?: unknown;
}
/**
 * Transcript-only: framed in json mode, never rendered in human mode,
 * never aggregated into any envelope.
 */
| {
  readonly kind: "remediation";
  readonly action: NextAction;
  readonly data?: unknown;
} | {
  readonly kind: "endpoint";
  readonly name: string;
  readonly url: string;
  readonly data?: unknown;
} | {
  readonly kind: "status";
  readonly subject: string;
  readonly status: string;
  readonly from?: string;
  readonly data?: unknown;
} | {
  readonly kind: "artifact";
  readonly path: string;
  readonly description?: string;
  readonly data?: unknown;
};
/**
 * json mode emits one StreamEvent per line: the handler's events,
 * flattened with the stream metadata, then exactly one terminal
 * 'result' member carrying the envelope.
 */
type StreamEvent = (EngineEvent & StreamMeta) | ({
  readonly kind: "result";
  readonly envelope: CompletedEnvelope | ErroredEnvelope;
} & StreamMeta);
interface StreamMeta {
  readonly commandId: string;
  /** ISO 8601 UTC. Injectable clock in tests. */
  readonly timestamp: string;
}
//#endregion
//#region src/presentation.d.ts
type Format = "human" | "json";
/**
 * What a command concluded, stated at the return site. `exitCode` is
 * required at every return site iff the command documents exit codes,
 * and forbidden otherwise. `diagnostics` may be omitted at the call
 * site; the presented result always carries an array.
 */
type Outcome<T, TCode extends number = never> = [TCode] extends [never] ? {
  readonly data: T;
  readonly diagnostics?: readonly Diagnostic[];
} : {
  readonly data: T;
  readonly exitCode: TCode | 0;
  readonly diagnostics?: readonly Diagnostic[];
};
declare const PRESENTED: unique symbol;
/**
 * What a completed command's handler returns inside `ok(...)`: the
 * outcome plus the presentation the active format already materialized.
 * Built exclusively by ctx.present — the brand makes hand-construction
 * a type error. Human rendering writes the blocks, next-action lines,
 * and diagnostics to stderr and the `stdout` lines to stdout — human
 * mode is pipe-clean (operator ruling, 2026-08-09).
 */
interface PresentedResult<T> {
  readonly [PRESENTED]: true;
  readonly data: T;
  /** 0 unless the outcome selected a documented code. */
  readonly exitCode: number;
  /** Never undefined; empty when the outcome recorded no findings. */
  readonly diagnostics: readonly Diagnostic[];
  /**
   * Only the active format's presentation is materialized; the other
   * format's fields are normalized to empty. In human mode `json` is
   * undefined because the json presentation was never invoked.
   */
  readonly presentation: {
    readonly human: readonly Block[];
    readonly stdout: readonly string[];
    readonly json: unknown;
    readonly next: readonly NextAction[];
  };
}
/**
 * The per-format presentation functions a handler supplies to
 * ctx.present. Every one is required: a command states each output
 * surface it publishes rather than inheriting one by omission. Only the
 * active format's functions are invoked, at the return site. `human`
 * composes engine primitives, rendered to stderr; `stdout` is the
 * machine-consumable data lines — what a pipe receives, the human
 * mode's only stdout writes; `json` is the `--json` envelope's
 * `result`; `next` is the suggested follow-up actions.
 */
interface Presentations {
  readonly human: (ui: Ui) => readonly Block[];
  readonly stdout: () => readonly string[];
  readonly json: () => unknown;
  readonly next: () => readonly NextAction[];
}
/**
 * What happened: it selects the glyph (✔ ✘ ⚠ ℹ) and carries a default
 * Tone of the same name. Separate from Tone because a failure can be
 * painted in a colour that is not `error` — a tree node in its branch
 * lane's hue, say — and a colour can be chosen where nothing happened.
 */
type Status = "ok" | "error" | "warn" | "info";
/**
 * What colour to paint, and nothing else. Semantic names and indexed
 * colours in one union: a command asks for meaning where it has one and
 * for a distinguishable colour where it does not. The indexed colours
 * are for telling adjacent things apart — one per branch lane in a
 * graph, say — and deliberately exclude red so no series member reads
 * as an error.
 */
type Tone = "ok" | "warn" | "error" | "info" | "heading" | "identifier" | "ref" | "placeholder" | "link" | "emphasis" | "muted" | "structure" | "highlight" | "color-1" | "color-2" | "color-3" | "color-4" | "color-5" | "color-6";
/**
 * A run of text and the meaning of its colour. A handler never emits
 * escape sequences: the engine measures width from `text`, so colour
 * cannot break alignment, and the same spans can be re-themed or
 * stripped without re-rendering.
 */
interface Span {
  readonly text: string;
  readonly tone?: Tone;
}
/** Display text anywhere a block or Ui takes it. A bare string is untoned. */
type Text = string | readonly Span[];
/**
 * Deliberately small; grows by the same evidence rule as events.
 * Recorded findings are NOT a Block — they are the outcome's
 * diagnostics; the engine renders them and carries them into the
 * envelope, so the two surfaces cannot diverge.
 */
type Block = {
  readonly kind: "summary";
  readonly status: Status; /** Overrides the colour the status implies. Never the glyph. */
  readonly tone?: Tone;
  readonly text: Text;
} | {
  /** A key/value card: the engine pads the keys so every value
   *  starts in the same column. */
  readonly kind: "fields";
  readonly rows: ReadonlyArray<{
    readonly label: Text;
    readonly value: Text;
    readonly sensitive?: boolean;
  }>;
  /** Draws the dim `│` rail down the left of the card. A command
   *  knows whether it is drawing a header card or a plain one, so
   *  this is per block rather than a global setting. */
  readonly rail?: boolean;
} | {
  /** The engine sizes every column to its widest cell. */readonly kind: "table";
  readonly columns: readonly Text[];
  readonly rows: ReadonlyArray<readonly Text[]>;
} | {
  readonly kind: "list";
  readonly items: readonly Text[];
} | {
  readonly kind: "tree";
  readonly roots: readonly TreeNode[];
} | {
  /**
   * Lines of spans, rendered verbatim — no layout, no reflow, no
   * truncation. For output whose two-dimensional structure the
   * engine cannot derive, such as a migration graph's lane gutter,
   * where the same hue has to reach the gutter cell, the node glyph
   * and the label alike.
   */
  readonly kind: "drawing";
  readonly lines: readonly Text[];
};
interface TreeNode {
  readonly label: Text;
  /** Renders its glyph before the label. */
  readonly status?: Status;
  /** Colours the glyph and the label; defaults to the status. */
  readonly tone?: Tone;
  readonly children?: readonly TreeNode[];
}
/** Styling helpers usable inside block text; no direct writing. */
interface Ui {
  /**
   * How much room the command has: stderr's terminal width, or
   * Number.POSITIVE_INFINITY when stderr is not a terminal. Only the
   * command knows what to sacrifice, so the engine hands over the number
   * and prints an overrun unmodified.
   */
  readonly width: number;
  readonly emphasize: (text: string) => string;
  readonly dim: (text: string) => string;
  readonly code: (text: string) => string;
  readonly tone: (tone: Tone, text: string) => string;
}
//#endregion
//#region src/context.d.ts
/** The handler context — the whole world arrives as one argument. */
interface CommandContext<TConfig = undefined, TCode extends number = never> {
  /**
   * The validated value of the command's needed config section —
   * exactly TConfig; absence semantics belong to the section's
   * validator. Commands with no config need get undefined.
   */
  readonly config: TConfig;
  /**
   * Builds the PresentedResult for the active format. The only
   * constructor of PresentedResult.
   */
  readonly present: <T>(outcome: Outcome<T, TCode>, presentations: Presentations) => PresentedResult<T>;
  /**
   * What this process authenticates as (the manager's pinned
   * credential), or null when signed out. Carries no token material.
   * Read-only and local-only — safe to call anywhere; never touches
   * the network. Throws the same structured errors the needs check
   * raises for broken-but-not-signed-out states (sessions held, none
   * selected).
   */
  readonly activeCredential: () => Promise<ActiveCredential | null>;
  /**
   * The Management API client, constructed and owned by the ENGINE:
   * the pinned credential's client, built on first method call, once
   * per run. A request made while signed out throws the structured
   * CLI.CREDENTIALS_REQUIRED error (the same constructor the
   * needs.credentials check uses).
   */
  readonly api: ManagementApiClient$1;
  /**
   * Hands the terminal to a child process and resolves when it ends.
   * The child inherits stdio and runs in this process's own group
   * (POSIX) or console (Windows), so Ctrl-C reaches it natively.
   *
   * While a child is live the engine neither aborts nor exits on a
   * delivered signal: it records signals and replays them into its
   * normal ladder once the child has ended, so the engine always
   * outlives the child. SIGTERM, which has no native path to the child,
   * is forwarded to it. A programmatic abort of ctx.signal terminates
   * the child with SIGTERM, a grace period, then SIGKILL.
   *
   * ctx.report is buffered for the duration and flushed in order when
   * the child ends; ctx.present during a live child, and a second
   * concurrent ctx.spawn, are engine-internal errors. A launch failure
   * (no such command) throws CLI.SPAWN_FAILED.
   *
   * Only commands declaring `maySpawn` may call it. Branch on `signal`
   * before `exitCode`: a signal-killed child is an abort, not a
   * failure.
   */
  readonly spawn: (options: SpawnOptions) => Promise<ChildResult>;
  /**
   * How the run's most recent completed child ended, or undefined when
   * none has run. The engine records every child ctx.spawn returns, so
   * a handler whose spawn happens deep in its own layering can still
   * ask "did my child fail?" where it settles, without threading the
   * result back by hand. This is the same record exitWithChildStatus
   * settles from.
   */
  readonly lastChild: () => ChildResult | undefined;
  /** The one way to emit while running. */
  readonly report: (event: EngineEvent) => void;
  /** Interactive input. */
  readonly prompt: PromptSurface;
  /**
   * Shows the user a URL and, in an interactive session, opens it in
   * their browser. Always announces the URL on the commentary channel
   * (an `endpoint` event: a stderr line in human mode, a frame in json
   * mode), so a non-interactive run — which never opens anything — can
   * still be completed by hand. Never fails: a browser that could not
   * be opened reports `opened: false`. To wait for the user to finish
   * something in that browser, use prompt.browserWait.
   */
  readonly openUrl: (request: OpenUrlRequest) => Promise<OpenUrlOutcome>;
  /**
   * Fires on Ctrl-C/SIGTERM (engine-owned; a second signal force-exits
   * through the runtime's exit proxy). Session commands run until it
   * fires.
   *
   * Once it has fired the engine settles the run at 130/143 from its
   * own record of the signal, whatever the handler goes on to return —
   * so cleanup code never states an exit code of its own.
   */
  readonly signal: AbortSignal;
  /** Where the user invoked the CLI. Handlers never read process.cwd(). */
  readonly cwd: string;
  /**
   * The invocation's environment, from Runtime.env. Handlers read env
   * via ctx.env, never process.env.
   */
  readonly env: Readonly<Record<string, string | undefined>>;
  /**
   * What this process runs on, from Runtime.host. Handlers read the
   * runtime version, platform and architecture here — never from
   * `process` — so a bug-report payload and the occasional real
   * platform difference do not each reinvent the lookup.
   */
  readonly host: Host;
  /**
   * Whether this run is in CI: detected from the environment the host
   * injected, or forced by Runtime.isCIOverride. This is what telemetry
   * gates on. It is one input to the engine's interactivity decision
   * rather than the whole of it (which also weighs a TTY stdin and
   * --interactive/--no-interactive), so prompts and spinners follow
   * ctx.prompt and the engine's interaction handling, not this.
   */
  readonly isCI: boolean;
  /**
   * Conditional optional-dependency need. Resolves when the
   * optional peer dependency is importable from the user's project;
   * otherwise returns the engine's structured missing-dependency error
   * for the handler to pass to notOk.
   */
  readonly requireDependency: (specifier: string) => Promise<Result<void, CliStructuredError>>;
}
interface OpenUrlRequest {
  readonly url: string;
  /** The announcement label — what the URL is for, in the user's
   *  terms ("Finish signing in"). */
  readonly message: string;
}
interface OpenUrlOutcome {
  /** False whenever the browser was not launched: a non-interactive
   *  session, a host with no opener wired, or an opener that failed. */
  readonly opened: boolean;
}
interface BrowserWaitRequest {
  readonly url: string;
  /** The announcement label — what the user is being sent to do. */
  readonly message: string;
  /**
   * Asks whether the user has finished. The engine calls it on its own
   * interval and passes ctx.signal, so a poll that makes a request can
   * abort with the command.
   */
  readonly poll: (signal: AbortSignal) => Promise<boolean>;
  /** Milliseconds to keep polling before giving up. */
  readonly timeout: number;
  /** Milliseconds between polls. Defaults to the engine's own
   *  interval; a command with its own configurable cadence passes it. */
  readonly interval?: number;
}
/**
 * Prompts. Every prompt resolves to its answered value directly.
 * Failures THROW engine-internal structured errors the engine catches
 * and settles: cancellation exits 3; a prompt that cannot be operated
 * (no default under --yes or non-interactive, an invalid answer) exits
 * 2. A handler that does not catch simply propagates; one that catches
 * cannot swallow the settlement — rethrow or return notOk.
 *
 * Every prompt except `consent` may carry a declared `default`. Under
 * --yes and in non-interactive contexts (no TTY stdin, CI,
 * --no-interactive — format never decides interactivity) a prompt with
 * a default resolves to it; one without a default throws. The prompt UI
 * writes to stderr, so an interactive json run prompts without touching
 * the stdout stream.
 */
interface PromptSurface {
  readonly confirm: (question: string, opts?: {
    readonly default?: boolean;
  }) => Promise<boolean>;
  /**
   * A question requiring explicit consent — never inferable.
   * Structurally undefaultable: no default parameter exists, so --yes
   * and Enter-through can never satisfy it.
   *
   * `token` is the natural noun of what is being consented to — an app
   * name, a hostname. Supplying one changes both halves of the prompt:
   * interactively the user must type the token exactly instead of
   * answering yes/no, and non-interactively the consent is granted by
   * `--confirm <token>` on the command line (one `--confirm` value per
   * consent). Without a token there is no non-interactive way to
   * consent at all.
   */
  readonly consent: (question: string, opts?: {
    readonly token?: string;
  }) => Promise<boolean>;
  readonly select: <T extends string>(question: string, options: ReadonlyArray<{
    value: T;
    label: string;
  }>, opts?: {
    readonly default?: T;
  }) => Promise<T>;
  readonly text: (question: string, opts?: {
    readonly placeholder?: string;
    readonly default?: string;
  }) => Promise<string>;
  /**
   * Sends the user to a URL and waits for them to finish there:
   * announces the URL, opens the browser, then polls until `poll`
   * returns true. Resolves when it does; throws the structured timeout
   * error when `timeout` elapses first, and the usual prompt-cancelled
   * error (exit 3) on Ctrl-C.
   *
   * Non-interactively it throws the interaction-required error before
   * opening or polling anything, with the URL in the message so the
   * user can finish by hand. A command that cannot do anything useful
   * without an interactive terminal should declare `needs.interaction`
   * instead and fail before it starts.
   */
  readonly browserWait: (request: BrowserWaitRequest) => Promise<void>;
}
//#endregion
//#region src/commands.d.ts
/**
 * Command definitions carry no mount path and are runtime-discriminated
 * by `kind`. Definitions load their handler's import graph at startup;
 * handler bodies defer heavy work to execution time.
 *
 * The define* constructors accept ergonomic specs (optional help
 * details, args, needs, exitCodes) and normalize them: every definition
 * field is always present, with empty collections and explicit
 * undefined instead of conditional properties.
 */
/** The help SPI: words only — the engine formats. */
interface HelpSpec {
  /** One line, imperative, shown in listings. */
  readonly summary: string;
  readonly description?: string;
  /**
   * Invocations WITHOUT the binary name: at help render time every
   * `{bin}` is substituted with createCli's `name`; an example
   * containing no `{bin}` gets the name prepended.
   */
  readonly examples?: readonly string[];
}
/** The normalized help a definition carries. */
interface CommandHelp {
  readonly summary: string;
  readonly description: string | undefined;
  readonly examples: readonly string[];
}
/**
 * The preconditions SPI: everything the engine enforces BEFORE the
 * handler runs. Each unmet need fails the command early with the
 * engine's own structured error.
 */
interface NeedsSpec<TConfig> {
  /**
   * The command family's config section token: validate it, fail me on
   * its error diagnostics, hand me the value as ctx.config.
   */
  readonly config?: ConfigSection<TConfig>;
  /**
   * Fail early with the sign-in error when unauthenticated. The
   * `"child"` form (S3) additionally makes the engine compose the
   * active credential into every child environment
   * (PRISMA_SERVICE_TOKEN, PRISMA_WORKSPACE_ID). Before the handler it
   * refreshes a stored OAuth session that expires too soon, or refuses
   * an unrefreshable credential — a child cannot refresh the snapshot
   * it is given. It
   * requires `maySpawn` (construction error otherwise) and entails
   * the plain credentials need.
   */
  readonly credentials?: true | "child";
  /**
   * Optional peer dependencies this command cannot run without; the
   * engine probes resolvability and phrases the install error.
   * (Conditional needs use ctx.requireDependency instead.)
   */
  readonly dependencies?: readonly string[];
  /**
   * Fail early in non-interactive contexts (no TTY stdin, CI, or
   * --no-interactive; format never decides interactivity). This is a
   * MECHANICAL precondition — "an interactive terminal is required" —
   * and deliberately NOT an agent barrier: the client's nature is
   * unverifiable, and a flag claiming to exclude agents would be a
   * false guarantee. Anything requiring a verified human belongs
   * server-side, where identity actually exists.
   */
  readonly interaction?: true;
}
/** The normalized preconditions a definition carries. */
interface CommandNeeds<TConfig> {
  readonly config: ConfigSection<TConfig> | undefined;
  readonly credentials: boolean | "child";
  readonly dependencies: readonly string[];
  readonly interaction: boolean;
}
/**
 * The terminal-handoff declaration, normalized onto every definition
 * (server commands normalize to false: they own stdio already).
 *
 * `maySpawn` unlocks ctx.spawn. In human mode the child inherits the
 * terminal; in json mode its output is routed to diagnostics so stdout
 * remains framed. Handing credentials to the child is a precondition, declared as
 * `needs: { credentials: "child" }`.
 */
interface SpawnDeclarations {
  readonly maySpawn?: boolean;
}
interface CommandDefinition<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>> = Record<never, PositionalSpec<unknown>>, TConfig = undefined, TCode extends number = never, TManagesCredentials extends boolean = false, TInstallsPackages extends boolean = false> {
  readonly kind: "result-command";
  readonly help: CommandHelp;
  readonly args: CommandArgs<TFlags, TPositionals>;
  readonly needs: CommandNeeds<TConfig>;
  /**
   * The command's documented exit codes (4–99): code → meaning. The
   * keys type the outcome's exitCode, making it REQUIRED at every
   * return site (`0` or a documented code). Empty = the command only
   * exits 0/1/2/3 and the outcome carries no exitCode.
   */
  readonly exitCodes: Readonly<Record<TCode, string>>;
  /**
   * A CAPABILITY, not a need: when true, ctx.credentialManager appears
   * on the context. Declaring it never fails a run — this is
   * documentation and testability, not enforcement. Declared by
   * exactly the auth commands that operate ON the credential
   * machinery.
   */
  readonly managesCredentials: TManagesCredentials;
  /** See SpawnDeclarations. */
  readonly maySpawn: boolean;
  /**
   * A CAPABILITY, not a need: when true, ctx.packages appears on the
   * context and the command may run the user's package manager in the
   * user's project. Declaring it never fails a run.
   */
  readonly installsPackages: TInstallsPackages;
  /**
   * The handler function, referenced directly — never a dynamic import
   * (operator ruling, 2026-08-09). A handler that needs heavy
   * dependencies imports them at execution time, inside its body. A
   * handler defined in another file is imported statically and
   * annotated CommandHandler<typeof def>.
   */
  readonly handler: Handler<TFlags, TPositionals, TConfig, TCode, TManagesCredentials, TInstallsPackages>;
}
type Handler<TFlags extends Record<string, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>>, TConfig, TCode extends number = never, TManagesCredentials extends boolean = false, TInstallsPackages extends boolean = false> = (args: Args<TFlags, TPositionals>, ctx: CommandContext<TConfig, TCode> & (TManagesCredentials extends true ? {
  readonly credentialManager: CredentialManager;
} : unknown) & (TInstallsPackages extends true ? {
  readonly packages: PackageOperations;
} : unknown)) => Promise<Result<PresentedResult<unknown> | ChildStatusSettlement, CliStructuredError>>;
/** For impl files: `const run: CommandHandler<typeof migrateCommand> = …` */
type CommandHandler<D> = D extends CommandDefinition<infer F, infer P, infer C, infer K, infer M, infer I> ? Handler<F, P, C, K, M, I> : never;
declare function defineCommand<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>> = Record<never, PositionalSpec<unknown>>, TConfig = undefined, TCode extends number = never, TManagesCredentials extends boolean = false, TInstallsPackages extends boolean = false>(def: {
  readonly help: HelpSpec;
  readonly args?: ArgsSpec<TFlags, TPositionals>;
  readonly needs?: NeedsSpec<TConfig>;
  readonly exitCodes?: Readonly<Record<TCode, string>>;
  readonly managesCredentials?: TManagesCredentials;
  readonly installsPackages?: TInstallsPackages;
  readonly handler: Handler<TFlags, TPositionals, TConfig, TCode, TManagesCredentials, TInstallsPackages>;
} & SpawnDeclarations): CommandDefinition<TFlags, TPositionals, TConfig, TCode, TManagesCredentials, TInstallsPackages>;
/**
 * A session command (dev, log tail): runs until the signal fires,
 * speaks entirely through events, returns Result<void>. No
 * presentation, no exit-code set.
 *
 * A session supports json mode — the event stream is its json surface.
 * When it declares `maySpawn`, child output is routed to diagnostics while
 * the engine retains ownership of structured stdout. A session that returns
 * ok(undefined) exits 0 — or 130/143 when a signal ended the run, which
 * the engine settles from its own record of that signal, not from
 * anything the handler returns; one that returns
 * ok(exitWithChildStatus()) exits with the status of the child it
 * spawned.
 */
interface SessionCommandDefinition<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>> = Record<never, PositionalSpec<unknown>>, TConfig = undefined> {
  readonly kind: "session-command";
  readonly help: CommandHelp;
  readonly args: CommandArgs<TFlags, TPositionals>;
  readonly needs: CommandNeeds<TConfig>;
  /** See SpawnDeclarations. */
  readonly maySpawn: boolean;
  readonly handler: (args: Args<TFlags, TPositionals>, ctx: CommandContext<TConfig>) => Promise<Result<undefined | ChildStatusSettlement, CliStructuredError>>;
}
declare function defineSessionCommand<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TPositionals extends Record<string, PositionalSpec<unknown>> = Record<never, PositionalSpec<unknown>>, TConfig = undefined>(def: {
  readonly help: HelpSpec;
  readonly args?: ArgsSpec<TFlags, TPositionals>;
  readonly needs?: NeedsSpec<TConfig>;
  readonly handler: SessionCommandDefinition<TFlags, TPositionals, TConfig>["handler"];
} & SpawnDeclarations): SessionCommandDefinition<TFlags, TPositionals, TConfig>;
/**
 * A server command (lsp): a foreign client on the other end of stdio
 * owns the conversation, so the engine hands over the streams. Events,
 * presentation, formats, and prompts do not apply; the handler returns
 * the exit code directly. The shared flag family is NOT injected.
 */
interface ServerCommandDefinition<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TConfig = undefined> {
  readonly kind: "server-command";
  readonly help: CommandHelp;
  readonly args: CommandArgs<TFlags, Record<never, PositionalSpec<unknown>>>;
  readonly needs: CommandNeeds<TConfig>;
  /** Always false — a server command owns stdio already. Normalized so
   *  every definition carries the field and callers read it directly. */
  readonly maySpawn: false;
  readonly handler: (args: Args<TFlags, Record<never, PositionalSpec<unknown>>>, io: {
    readonly stdin: InputStream;
    readonly stdout: OutputStream;
    readonly stderr: OutputStream;
    readonly signal: AbortSignal;
    readonly cwd: string;
    readonly env: Readonly<Record<string, string | undefined>>;
    readonly config: TConfig;
  }) => Promise<number>;
}
declare function defineServerCommand<TFlags extends Record<string, FlagSpec<unknown>> = Record<never, FlagSpec<unknown>>, TConfig = undefined>(def: {
  readonly help: HelpSpec;
  readonly args?: ArgsSpec<TFlags, Record<never, PositionalSpec<unknown>>>;
  readonly needs?: NeedsSpec<TConfig>;
  readonly handler: ServerCommandDefinition<TFlags, TConfig>["handler"];
}): ServerCommandDefinition<TFlags, TConfig>;
/**
 * Erased union for command families and mount maps; `kind`
 * discriminates. Handler functions are erased to `unknown` here — the
 * concrete types travel through each definition's generics, not through
 * this union.
 */
type AnyCommand = (Omit<CommandDefinition<Record<string, FlagSpec<unknown>>, Record<string, PositionalSpec<unknown>>, unknown, number, boolean, boolean>, "handler"> & {
  readonly handler: unknown;
}) | (Omit<SessionCommandDefinition<Record<string, FlagSpec<unknown>>, Record<string, PositionalSpec<unknown>>, unknown>, "handler"> & {
  readonly handler: unknown;
}) | (Omit<ServerCommandDefinition<Record<string, FlagSpec<unknown>>, unknown>, "handler"> & {
  readonly handler: unknown;
});
interface CompletedEnvelope<T = unknown> {
  /**
   * ok = COMPLETED (the command executed to its end). A completed
   * result may still carry findings and a non-zero exit code — bad
   * news is a result, not an error.
   */
  readonly ok: true;
  /**
   * The command's stable dotted identity — its full command path
   * ('project.env.add'). The schema-dispatch key for machine consumers.
   */
  readonly commandId: string;
  readonly result: T;
  readonly exitCode: number;
  /** The recorded findings, verbatim from the presented outcome. */
  readonly diagnostics: readonly Diagnostic[];
  readonly nextActions: readonly NextAction[];
}
interface ErroredEnvelope {
  /** ok = false: the command did NOT complete. */
  readonly ok: false;
  readonly commandId: string;
  /**
   * The PRIMARY error — what aborted the command. Severity 'error' by
   * definition. A thrown CliStructuredError serializes to exactly this
   * shape.
   */
  readonly error: Diagnostic;
  /** Accompanying findings when the abort had several. */
  readonly diagnostics: readonly Diagnostic[];
  /**
   * Copied from the error's own nextActions — the uniform consumer
   * read path (envelope.nextActions) on both settlement paths.
   */
  readonly nextActions: readonly NextAction[];
}
//#endregion
//#region src/command-family.d.ts
/**
 * A retired invocation and the invocation that replaced it. Redirects
 * are metadata, never commands: they stay out of help and out of the
 * command tree, and are consulted only when an invocation fails to
 * resolve.
 */
interface RedirectSpec {
  /**
   * The retired invocation as the user types it: a space-separated
   * absolute path in the mounted tree, the same convention as
   * MountedTree keys. Whitespace only separates segments, so it is
   * normalized away — `'  migration \t apply '` is `'migration apply'`.
   */
  readonly from: string;
  /**
   * When present, a retired FLAG on a live command: `from` names the
   * live command's path and this the retired flag's camelCase name
   * (rendered --kebab-case, as flag declarations are).
   */
  readonly flag?: string;
  /**
   * The replacement invocation, written the way help examples are
   * written: no binary name, `{bin}` available when the name has to sit
   * mid-string. Placeholder arguments use angle brackets (`<ref>`).
   */
  readonly replacement: string;
  /** One sentence of context, surfaced as the error's `why`. */
  readonly reason?: string;
}
/** The normalized redirect a command family carries. */
interface CommandRedirect {
  readonly from: string;
  readonly flag: string | undefined;
  readonly replacement: string;
  readonly reason: string | undefined;
}
/**
 * The unit of contribution and ownership a package exports for CLI
 * purposes: its config section (declared once — a family-level fact)
 * and its commands by NAME. A command whose needs.config token is not
 * its command family's section is a construction error. The shell owns
 * the tree; a command family owns its section.
 */
interface CommandFamily {
  readonly configSection: ConfigSection<unknown> | undefined;
  readonly commands: Readonly<Record<string, AnyCommand>>;
  /**
   * The family's documentation base URL. The engine derives each
   * diagnostic's docs link from base + code.
   */
  readonly docsBaseUrl: string | undefined;
  /** The invocations this family retired. */
  readonly redirects: readonly CommandRedirect[];
}
declare function defineCommandFamily(spec: {
  readonly configSection?: ConfigSection<unknown>;
  readonly commands: Readonly<Record<string, AnyCommand>>;
  readonly docsBaseUrl?: string;
  readonly redirects?: readonly RedirectSpec[];
}): CommandFamily;
/** What the shell builds: commands by PATH (space-separated, 'db migrate'). */
type MountedTree = Readonly<Record<string, AnyCommand>>;
//#endregion
//#region src/telemetry/report.d.ts
/**
 * What a CLI declares to report. One field: the endpoint, the opt-out
 * variable names, the config path and the disclosure wording are Prisma
 * constants the engine owns. Omitting the declaration means the CLI
 * reports nothing at all.
 */
interface TelemetryDeclaration {
  /** Named in the first-run disclosure as where to read what is collected. */
  readonly docsUrl: string;
}
//#endregion
export { Runtime as $, Outcome as A, SERVICE_TOKEN_ENV_VAR as At, EngineEvent as B, BrowserWaitRequest as C, positional as Ct, PromptSurface as D, CredentialIdentity as Dt, OpenUrlRequest as E, Credential as Et, Status as F, ManagementApiClient$1 as Ft, SectionValidation as G, StreamEvent as H, Text as I, ManagementApiClientConfig as It, HostProcess as J, defineConfigSection as K, Tone as L, TokenStorage$1 as Lt, Presentations as M, StoredSessions as Mt, PresentedResult as N, CredentialRefreshResult as Nt, Block as O, CredentialManager as Ot, Span as P, CredentialRefresher as Pt, PRISMA_CONFIG_VERSION as Q, TreeNode as R, defineSessionCommand as S, flag as St, OpenUrlOutcome as T, ActiveCredential as Tt, StreamMeta as U, Severity as V, ConfigSection as W, LoadedConfig as X, InputStream as Y, OutputStream as Z, ServerCommandDefinition as _, ArgsSpec as _t, RedirectSpec as a, ExitWithChildStatusOptions as at, defineCommand as b, FlagSpec as bt, CommandDefinition as c, SpawnRequest as ct, CommandNeeds as d, PackageManagerId as dt, TelemetryPayload as et, CompletedEnvelope as f, PackageManagerRunRequest as ft, NeedsSpec as g, Args as gt, HelpSpec as h, PackageOperations as ht, MountedTree as i, ChildStatusSettlement as it, PRESENTED as j, Session as jt, Format as k, CredentialOrigin as kt, CommandHandler as l, SpawnedChild as lt, Handler as m, PackageManagerRunner as mt, CommandFamily as n, RunSummary as nt, defineCommandFamily as o, SpawnChild as ot, ErroredEnvelope as p, PackageManagerRunResult as pt, Host as q, CommandRedirect as r, ChildResult as rt, AnyCommand as s, SpawnOptions as st, TelemetryDeclaration as t, EngineCommandSnapshot as tt, CommandHelp as u, exitWithChildStatus as ut, SessionCommandDefinition as v, Char as vt, CommandContext as w, ActiveAccessTokenOptions as wt, defineServerCommand as x, PositionalSpec as xt, SpawnDeclarations as y, CommandArgs as yt, Ui as z };