flipstream 0.4.0

package/README.md

@@ -0,0 +1,659 @@
+# flipstream
+
+Flipstream CLI — query your Flipstream data from the terminal. A thin OAuth2 client that
+authenticates once and prints clean **structured JSON** for AI coding agents.
+
+> **Architecture:** this supersedes `flipstream-cli-kickoff.md`. See [`CLAUDE.md`](./CLAUDE.md)
+> for the corrected model (thin client, two hosts, **no natural-language "ask"**).
+
+## Prerequisites
+
+- [Bun](https://bun.sh) (development toolchain)
+- Node.js **20+** (the published CLI runs under Node)
+
+## Install (development)
+
+```sh
+bun install
+bun run build
+```
+
+## Usage
+
+```sh
+./bin/run.js --help          # or during dev: bun bin/dev.js --help
+./bin/run.js --version
+./bin/run.js version --json  # {version,node,platform,contractVersion}
+./bin/run.js auth login      # opens the browser to sign in (OAuth2 + PKCE)
+```
+
+## For agents (Claude Code / Codex / MCP)
+
+The CLI is self-describing. Discover the whole surface in one call, then invoke:
+
+```sh
+flipstream commands --json   # full machine-readable catalog: every command's
+                             # id, summary, description, flags, args, aliases
+flipstream <command> --help  # detail for one command
+```
+
+Output is a deterministic agent contract — **stdout = data** (JSON via `--json`,
+NDJSON via `--ndjson`), **stderr = diagnostics**, and on failure a single
+`{"error":{"code","message","exit"}}` envelope on **stdout** so
+`flipstream <cmd> --json 2>/dev/null | jq .` works on success *and* failure.
+Branch on `error.code` + the exit code. The full contract (exit codes, error
+taxonomy, per-command shapes, `CONTRACT_VERSION`) lives in
+[`docs/AGENT-CONTRACT.md`](./docs/AGENT-CONTRACT.md) and is enforced by a
+conformance suite.
+
+## Scripts
+
+- `bun run build` — compile TypeScript to `dist/`
+- `bun run lint` — eslint (flat config)
+- `bun run check:secrets` — static deny-list gate over `src/lib/auth` (CI-enforced)
+- `bun run format` — prettier
+- `bun test` — run the test suite
+- `bun run dev` — run the CLI from source (`./bin/dev.js`)
+
+## Security
+
+The CLI is a **public OAuth2 client** (Authorization Code + PKCE + Dynamic Client
+Registration) — it holds **no client secret**.
+
+- **Tokens live only in the OS keychain** (`@napi-rs/keyring`, service id
+  `io.flipstream.cli`); nothing is written to disk in plaintext, and the
+  non-secret config under `~/.config/flipstream-cli` never contains tokens.
+- **Tokens are never printed.** Every log/error/`--json` path is routed through a
+  redactor that masks JWT-shaped values, `Authorization: Bearer` headers, and
+  secret URL/form params. `auth login` prints only the decoded (display-only) claims.
+- **PKCE is S256-only**; `state` and the PKCE verifier come from a CSPRNG
+  (`node:crypto`), never `Math.random`.
+- **The loopback redirect binds `127.0.0.1` only** (RFC 8252) — never `0.0.0.0`/`::`.
+- **No command exposes a `--token`/`--secret`/`--verifier`/`--bearer` flag.**
+- **No telemetry, no phone-home.** The CLI collects no analytics and makes no
+  network calls beyond the OAuth provider and the data host you query. There is no
+  update-notifier dependency; were one ever added, its notice would go to **stderr
+  only** (never stdout — it would corrupt `--json`/NDJSON), honor `NO_COLOR`, and be
+  disableable via `FLIPSTREAM_DISABLE_UPDATE_CHECK`.
+
+`bun run check:secrets` (a CI gate) and `test/security/no-secrets.test.ts` enforce
+these invariants on every change.
+
+## Uninstall / purge
+
+`flipstream auth clear-all` removes **every** keychain entry under
+`io.flipstream.cli` (best-effort revoking each host's refresh token first) and
+deletes `~/.config/flipstream-cli`. Run it **before** removing the binary —
+uninstalling the package/Homebrew/Scoop artifact does **not** clean these up, so
+without it the keychain items and config dir are orphaned.
+
+If you already removed the binary, clean up manually:
+
+- **macOS:** Keychain Access → search `io.flipstream.cli` → delete the items.
+- **Linux:** `secret-tool clear service io.flipstream.cli` (libsecret).
+- **Windows:** Credential Manager → remove `io.flipstream.cli` entries.
+- **All:** `rm -rf ~/.config/flipstream-cli`.
+
+## Commands
+
+<!-- commands -->
+* [`flipstream auth clear-all`](#flipstream-auth-clear-all)
+* [`flipstream auth login`](#flipstream-auth-login)
+* [`flipstream auth logout`](#flipstream-auth-logout)
+* [`flipstream auth status`](#flipstream-auth-status)
+* [`flipstream commands`](#flipstream-commands)
+* [`flipstream conn list`](#flipstream-conn-list)
+* [`flipstream connections list`](#flipstream-connections-list)
+* [`flipstream query`](#flipstream-query)
+* [`flipstream version`](#flipstream-version)
+* [`flipstream workspaces connections ID`](#flipstream-workspaces-connections-id)
+* [`flipstream workspaces get ID`](#flipstream-workspaces-get-id)
+* [`flipstream workspaces list`](#flipstream-workspaces-list)
+* [`flipstream ws connections ID`](#flipstream-ws-connections-id)
+* [`flipstream ws get ID`](#flipstream-ws-get-id)
+* [`flipstream ws list`](#flipstream-ws-list)
+
+## `flipstream auth clear-all`
+
+Purge ALL credentials: every keychain entry and the local config dir.
+
+```
+USAGE
+  $ flipstream auth clear-all [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--no-revoke]
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --no-revoke        Clear local credentials only; skip the per-host server revocation calls.
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Purge ALL credentials: every keychain entry and the local config dir.
+
+  Purge ALL Flipstream credentials: every keychain entry and the local config directory.
+
+EXAMPLES
+  $ flipstream auth clear-all
+
+  $ flipstream auth clear-all --no-revoke
+```
+
+## `flipstream auth login`
+
+Log in via the browser (OAuth2 + PKCE).
+
+```
+USAGE
+  $ flipstream auth login [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--no-browser]
+    [--scope <value>...]
+
+FLAGS
+  -H, --host=<value>      OAuth provider host (defaults to the prod issuer).
+      --ndjson            Stream output as NDJSON (one compact JSON object per line).
+      --no-browser        Headless mode: print the authorization URL, then paste the redirected URL back (no browser).
+      --scope=<value>...  OAuth scope (repeatable).
+      --timeout=<value>   Network timeout in milliseconds.
+      --verbose           Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Log in via the browser (OAuth2 + PKCE).
+
+  Log in to Flipstream in the browser (OAuth2 Authorization Code + PKCE).
+
+EXAMPLES
+  $ flipstream auth login
+
+  $ flipstream auth login --no-browser
+```
+
+## `flipstream auth logout`
+
+Log out: revoke the token (best-effort) and clear the keychain.
+
+```
+USAGE
+  $ flipstream auth logout [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--no-revoke]
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --no-revoke        Clear local credentials only; skip the server revocation call.
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Log out: revoke the token (best-effort) and clear the keychain.
+
+  Log out of Flipstream: revoke the token (best-effort) and clear the keychain.
+
+EXAMPLES
+  $ flipstream auth logout
+
+  $ flipstream auth logout --no-revoke
+```
+
+## `flipstream auth status`
+
+Show whether you are logged in, and your account, scopes, and expiry.
+
+```
+USAGE
+  $ flipstream auth status [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose]
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Show whether you are logged in, and your account, scopes, and expiry.
+
+  Show the current Flipstream authentication status for a host.
+
+EXAMPLES
+  $ flipstream auth status
+
+  $ flipstream auth status --json
+```
+
+## `flipstream commands`
+
+List all flipstream commands.
+
+```
+USAGE
+  $ flipstream commands [--json] [-c id|plugin|summary|type... | --tree] [--deprecated] [-x | ] [--hidden]
+    [--no-truncate | ] [--sort id|plugin|summary|type | ]
+
+FLAGS
+  -c, --columns=<option>...  Only show provided columns (comma-separated).
+                             <options: id|plugin|summary|type>
+  -x, --extended             Show extra columns.
+      --deprecated           Show deprecated commands.
+      --hidden               Show hidden commands.
+      --no-truncate          Do not truncate output.
+      --sort=<option>        [default: id] Property to sort by.
+                             <options: id|plugin|summary|type>
+      --tree                 Show tree of commands.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List all flipstream commands.
+```
+
+_See code: [@oclif/plugin-commands](https://github.com/oclif/plugin-commands/blob/4.1.59/src/commands/commands.ts)_
+
+## `flipstream conn list`
+
+List connections, org-wide or for one workspace.
+
+```
+USAGE
+  $ flipstream conn list [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>] [--workspace <value>]
+
+FLAGS
+  -H, --host=<value>       OAuth provider host (defaults to the prod issuer).
+      --all                Fetch every page (drains pagination).
+      --limit=<value>      [default: 50] Page size.
+      --ndjson             Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>     Starting offset.
+      --q=<value>          Free-text filter.
+      --sort=<value>       Sort field.
+      --timeout=<value>    Network timeout in milliseconds.
+      --verbose            Print redacted diagnostics to stderr.
+      --workspace=<value>  List only this workspace's connections (UUID).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List connections, org-wide or for one workspace.
+
+  List connections (data sources) — org-wide, or for one workspace via --workspace (or `ws connections <id>`). Returns
+  each connection id + source metadata; secret_id / parameters are redacted. Targets the OAuth/admin host.
+
+ALIASES
+  $ flipstream conn list
+
+EXAMPLES
+  $ flipstream connections list
+
+  $ flipstream connections list --workspace <id> --json
+
+  $ flipstream conn list --all
+```
+
+## `flipstream connections list`
+
+List connections, org-wide or for one workspace.
+
+```
+USAGE
+  $ flipstream connections list [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>] [--workspace <value>]
+
+FLAGS
+  -H, --host=<value>       OAuth provider host (defaults to the prod issuer).
+      --all                Fetch every page (drains pagination).
+      --limit=<value>      [default: 50] Page size.
+      --ndjson             Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>     Starting offset.
+      --q=<value>          Free-text filter.
+      --sort=<value>       Sort field.
+      --timeout=<value>    Network timeout in milliseconds.
+      --verbose            Print redacted diagnostics to stderr.
+      --workspace=<value>  List only this workspace's connections (UUID).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List connections, org-wide or for one workspace.
+
+  List connections (data sources) — org-wide, or for one workspace via --workspace (or `ws connections <id>`). Returns
+  each connection id + source metadata; secret_id / parameters are redacted. Targets the OAuth/admin host.
+
+ALIASES
+  $ flipstream conn list
+
+EXAMPLES
+  $ flipstream connections list
+
+  $ flipstream connections list --workspace <id> --json
+
+  $ flipstream conn list --all
+```
+
+## `flipstream query`
+
+Run an opaque query against the Flipstream data API.
+
+```
+USAGE
+  $ flipstream query [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--auth-host <value>]
+    [--body <value> | --body-file <value>]
+
+FLAGS
+  -H, --host=<value>       OAuth provider host (defaults to the prod issuer).
+      --auth-host=<value>  OAuth issuer host for credentials/refresh (defaults to the prod issuer).
+      --body=<value>       Opaque JSON request body as a string.
+      --body-file=<value>  Path to a file holding the opaque JSON request body.
+      --ndjson             Stream output as NDJSON (one compact JSON object per line).
+      --timeout=<value>    Network timeout in milliseconds.
+      --verbose            Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Run an opaque query against the Flipstream data API.
+
+  Send an OPAQUE JSON body (--body, --body-file, or piped stdin) to the Flipstream data API and print the structured
+  JSON response. The CLI never constructs, validates, or transforms the query payload — the body is forwarded verbatim
+  (your agent/Skill builds it).
+
+EXAMPLES
+  $ flipstream query --body '{"opaque":true}'
+
+  echo '{"opaque":true}' | flipstream query
+
+  $ flipstream query --body-file query.json --json
+```
+
+## `flipstream version`
+
+Print version, runtime, and agent-contract version.
+
+```
+USAGE
+  $ flipstream version [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose]
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Print version, runtime, and agent-contract version.
+
+  Print the CLI version, runtime, and agent-contract version as JSON.
+
+EXAMPLES
+  $ flipstream version
+
+  $ flipstream version --json
+```
+
+## `flipstream workspaces connections ID`
+
+List one workspace's connections.
+
+```
+USAGE
+  $ flipstream workspaces connections ID [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>]
+
+ARGUMENTS
+  ID  Workspace id (UUID).
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --all              Fetch every page (drains pagination).
+      --limit=<value>    [default: 50] Page size.
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>   Starting offset.
+      --q=<value>        Free-text filter.
+      --sort=<value>     Sort field.
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List one workspace's connections.
+
+  List one workspace's connections — the ergonomic form of `connections list --workspace <id>`. Targets the OAuth/admin
+  host.
+
+ALIASES
+  $ flipstream ws connections
+
+EXAMPLES
+  $ flipstream workspaces connections <id>
+
+  $ flipstream ws connections <id> --json
+
+  $ flipstream ws connections <id> --all
+```
+
+## `flipstream workspaces get ID`
+
+Show one workspace by id.
+
+```
+USAGE
+  $ flipstream workspaces get ID [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--refresh]
+    [--with-connection-count]
+
+ARGUMENTS
+  ID  Workspace id (UUID).
+
+FLAGS
+  -H, --host=<value>           OAuth provider host (defaults to the prod issuer).
+      --ndjson                 Stream output as NDJSON (one compact JSON object per line).
+      --refresh                Ask the server to refresh derived data (refresh=true).
+      --timeout=<value>        Network timeout in milliseconds.
+      --verbose                Print redacted diagnostics to stderr.
+      --with-connection-count  Include connection_count (one extra request to the connections endpoint).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Show one workspace by id.
+
+  Fetch one workspace by id (the admin API "Client"). A foreign or missing id collapses to a single not-found message
+  (no existence leak). Targets the OAuth/admin host.
+
+ALIASES
+  $ flipstream ws get
+
+EXAMPLES
+  $ flipstream workspaces get <id>
+
+  $ flipstream ws get <id> --json
+
+  $ flipstream ws get <id> --with-connection-count
+```
+
+## `flipstream workspaces list`
+
+List your organization's workspaces.
+
+```
+USAGE
+  $ flipstream workspaces list [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>] [--with-connection-counts]
+
+FLAGS
+  -H, --host=<value>            OAuth provider host (defaults to the prod issuer).
+      --all                     Fetch every page (drains pagination).
+      --limit=<value>           [default: 50] Page size.
+      --ndjson                  Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>          Starting offset.
+      --q=<value>               Free-text filter.
+      --sort=<value>            Sort field.
+      --timeout=<value>         Network timeout in milliseconds.
+      --verbose                 Print redacted diagnostics to stderr.
+      --with-connection-counts  Add connection_count per workspace (opt-in: one extra request each, N+1).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List your organization's workspaces.
+
+  List the workspaces (the Flipstream business entity, "Client" in the admin API) in your organization. Account-scoped
+  server-side (the CLI sends no org id). Targets the OAuth/admin host (whereas `query` targets the data host).
+
+ALIASES
+  $ flipstream ws list
+
+EXAMPLES
+  $ flipstream workspaces list
+
+  $ flipstream ws list --json
+
+  $ flipstream ws list --all
+
+  $ flipstream ws list --q acme --limit 10
+```
+
+## `flipstream ws connections ID`
+
+List one workspace's connections.
+
+```
+USAGE
+  $ flipstream ws connections ID [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>]
+
+ARGUMENTS
+  ID  Workspace id (UUID).
+
+FLAGS
+  -H, --host=<value>     OAuth provider host (defaults to the prod issuer).
+      --all              Fetch every page (drains pagination).
+      --limit=<value>    [default: 50] Page size.
+      --ndjson           Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>   Starting offset.
+      --q=<value>        Free-text filter.
+      --sort=<value>     Sort field.
+      --timeout=<value>  Network timeout in milliseconds.
+      --verbose          Print redacted diagnostics to stderr.
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List one workspace's connections.
+
+  List one workspace's connections — the ergonomic form of `connections list --workspace <id>`. Targets the OAuth/admin
+  host.
+
+ALIASES
+  $ flipstream ws connections
+
+EXAMPLES
+  $ flipstream workspaces connections <id>
+
+  $ flipstream ws connections <id> --json
+
+  $ flipstream ws connections <id> --all
+```
+
+## `flipstream ws get ID`
+
+Show one workspace by id.
+
+```
+USAGE
+  $ flipstream ws get ID [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--refresh]
+    [--with-connection-count]
+
+ARGUMENTS
+  ID  Workspace id (UUID).
+
+FLAGS
+  -H, --host=<value>           OAuth provider host (defaults to the prod issuer).
+      --ndjson                 Stream output as NDJSON (one compact JSON object per line).
+      --refresh                Ask the server to refresh derived data (refresh=true).
+      --timeout=<value>        Network timeout in milliseconds.
+      --verbose                Print redacted diagnostics to stderr.
+      --with-connection-count  Include connection_count (one extra request to the connections endpoint).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  Show one workspace by id.
+
+  Fetch one workspace by id (the admin API "Client"). A foreign or missing id collapses to a single not-found message
+  (no existence leak). Targets the OAuth/admin host.
+
+ALIASES
+  $ flipstream ws get
+
+EXAMPLES
+  $ flipstream workspaces get <id>
+
+  $ flipstream ws get <id> --json
+
+  $ flipstream ws get <id> --with-connection-count
+```
+
+## `flipstream ws list`
+
+List your organization's workspaces.
+
+```
+USAGE
+  $ flipstream ws list [--json] [-H <value>] [--ndjson] [--timeout <value>] [--verbose] [--all] [--limit
+    <value>] [--offset <value>] [--q <value>] [--sort <value>] [--with-connection-counts]
+
+FLAGS
+  -H, --host=<value>            OAuth provider host (defaults to the prod issuer).
+      --all                     Fetch every page (drains pagination).
+      --limit=<value>           [default: 50] Page size.
+      --ndjson                  Stream output as NDJSON (one compact JSON object per line).
+      --offset=<value>          Starting offset.
+      --q=<value>               Free-text filter.
+      --sort=<value>            Sort field.
+      --timeout=<value>         Network timeout in milliseconds.
+      --verbose                 Print redacted diagnostics to stderr.
+      --with-connection-counts  Add connection_count per workspace (opt-in: one extra request each, N+1).
+
+GLOBAL FLAGS
+  --json  Format output as json.
+
+DESCRIPTION
+  List your organization's workspaces.
+
+  List the workspaces (the Flipstream business entity, "Client" in the admin API) in your organization. Account-scoped
+  server-side (the CLI sends no org id). Targets the OAuth/admin host (whereas `query` targets the data host).
+
+ALIASES
+  $ flipstream ws list
+
+EXAMPLES
+  $ flipstream workspaces list
+
+  $ flipstream ws list --json
+
+  $ flipstream ws list --all
+
+  $ flipstream ws list --q acme --limit 10
+```
+<!-- commandsstop -->

package/bin/dev.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env bun
+// Dev entry: runs the TypeScript source directly (Bun transpiles on the fly).
+import {execute} from '@oclif/core'
+
+// eslint-disable-next-line n/no-unpublished-import -- dev entry runs from src, never shipped
+import {installCrashHandlers} from '../src/lib/command/crash.js'
+
+installCrashHandlers()
+await execute({development: true, dir: import.meta.url})

package/bin/run.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import {execute} from '@oclif/core'
+
+import {installCrashHandlers} from '../dist/lib/command/crash.js'
+
+installCrashHandlers()
+await execute({dir: import.meta.url})

package/dist/commands/auth/clear-all.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../lib/command/base.js';
+export default class AuthClearAll extends BaseCommand<typeof AuthClearAll> {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'no-revoke': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    static summary: string;
+    run(): Promise<Record<string, unknown>>;
+}