@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/docs/public/commands.md

@@ -0,0 +1,132 @@
+# ArcNet command reference
+
+Generated from the CLI command tree.
+
+## Global Options
+
+| Option | Description |
+| --- | --- |
+| `-V, --version` | output the version number |
+| `--root <directory>` | Target project root |
+| `--json` | Render one JSON result |
+| `--jsonl` | Render structured completion events |
+| `--noninteractive` | Run without prompts (all commands are noninteractive) |
+
+## `arcnet env`
+
+Load ordered encrypted Forum sources and select environment values.
+
+### `arcnet env check`
+
+Validate decryption and mappings; report key names only.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+### `arcnet env export`
+
+Write selected plaintext JSON to stdout for an explicit pipeline.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+### `arcnet env run <command...>`
+
+Run a command with selected keys only; withhold child output.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+## `arcnet secrets`
+
+Attach Forum files, provision GitHub keys and refresh encrypted snapshots.
+
+### `arcnet secrets add`
+
+Attach an existing Forum file and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--existing-key` | Reuse an existing GitHub secret without creating a recipient |
+
+### `arcnet secrets init`
+
+Create a Forum secrets file, prompt for your password and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--input <file>` | Initial plaintext JSON file; defaults to an empty object |
+
+### `arcnet secrets sync`
+
+Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+
+## `arcnet version`
+
+Show the installed package version.
+
+## `arcnet setup <slug>`
+
+Add ArcNet configuration and workflow; pin the CLI in the project manifest.
+
+| Option | Description |
+| --- | --- |
+| `--dry-run` | Report generated files without writing |
+| `--service <name>` | Default container service |
+| `--dockerfile <path>` | Container Dockerfile |
+| `--repository <owner/repo>` | GitHub repository (defaults to origin) |
+| `--services <path>` | Explicit service selection JSON |
+| `--vercel <path>` | Static Vercel references JSON |
+
+## `arcnet check`
+
+Validate project configuration offline.
+
+## `arcnet plan`
+
+Plan deployment (Terraform contacts providers; static Vercel stays offline).
+
+## `arcnet deploy`
+
+Deploy the approved project.
+
+## `arcnet preview`
+
+Deploy static Vercel sites to preview.
+
+## `arcnet inspect`
+
+Verify static Vercel project identities remotely.
+
+## `arcnet create <site>`
+
+Create one explicitly approved Vercel project.
+
+## `arcnet ci`
+
+Validate deployment identity and write GitHub Actions outputs.

package/docs/public/llms-full.txt

@@ -0,0 +1,182 @@
+# @mp-lb/arcnet
+
+ArcNet's TypeScript CLI for installing deployment configuration and deploying projects. The package owns shared runners, validation, workflow templates and the Vercel Terraform module; projects keep configuration and application-specific Dockerfiles.
+
+From an existing project with Zap, GitHub, and pinned pnpm:
+
+```sh
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world --dry-run
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world
+pnpm install
+pnpm exec arcnet check
+```
+
+Setup pins this package in the existing root manifest. Commit the resulting lockfile. Deployment starts disabled, and setup never provisions cloud resources. Upgrades use the project's normal dependency workflow.
+
+[Project setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/SETUP.md) · [Environment setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/environment/setup.md) · [Audit](https://github.com/mp-lb/stackforge/blob/main/arcnet/AUDIT.md) · [Command reference](docs/public/commands.md)
+
+Zap Arc remains the pinned Terraform engine dependency. Environment bootstrap, health checks and teardown are not implemented by this package yet. The static Vercel adapter retains its existing static-only and explicit-project-reference limitations.
+
+## Layered secrets
+
+`arcnet secrets add` attaches an existing Forum encrypted JSON file. `arcnet secrets init` creates one. Both register a file-specific decryption key in the selected GitHub repository, save an encrypted snapshot, and generate a validation workflow. Setup prompts for your Forum encryption password locally; it never prints the password or recipient key. Use `--existing-key` when the GitHub secret already exists. The local `fm` and `gh` CLIs must be authenticated; the selected Forum parent directory must exist.
+
+The project keeps only `.arcnet/secrets.json`, encrypted snapshots under `.arcnet/secrets/`, and workflow references. Sources merge left to right, with later values winning. Each source names its own key environment variable. JSON must be an object; unused structured values are allowed, while selected environment values must be nonempty strings. Consumer mappings select and rename fields; an array of source names accepts aliases only when their values agree.
+
+```json
+{
+  "version": 1,
+  "repository": "example/hello-world",
+  "sources": [
+    { "name": "standard", "store": "example/company", "path": "/admin/standard.json.enc", "keyEnv": "STANDARD_SECRETS_KEY" },
+    { "name": "project", "store": "example/company", "path": "/admin/hello-world.json.enc", "keyEnv": "PROJECT_SECRETS_KEY" }
+  ],
+  "consumers": {
+    "publish": { "NODE_AUTH_TOKEN": ["NPM_TOKEN", "NODE_AUTH_TOKEN"] },
+    "deploy": { "VERCEL_TOKEN": "VERCEL_API_TOKEN" }
+  }
+}
+```
+
+`secrets sync` fetches ciphertext and adds snapshot identity, revision and checksum to this configuration. Commit config and ciphertext together. CI uses the reviewed snapshots and needs only each file's decryption key, not a Forum login. Sync after editing or rotating a source; obsolete snapshots can be removed after checking that no configuration references them. Setup/sync also wire source-key references into workflow steps that call ArcNet's env or deployment commands.
+
+For live loading, omit a snapshot or select `--live`: the installed `fm` CLI fetches each source using its local login or the source's optional `tokenEnv` access credential. A decryption recipient is **not** a Forum read token. Live CI therefore needs an installed, authenticated `fm` as well as the independent decryption keys. Generated CI intentionally uses snapshots.
+
+`arcnet env check` reports source names and selected key names, never values. `arcnet env export` explicitly emits selected plaintext JSON. `arcnet env run` gives a subprocess only the selected values and a small execution environment; it removes file keys, isolates temporary HOME/cache paths, and withholds subprocess output. Keep npm publishing mappings scoped to publishing credentials. The command reference documents the exact options.
+
+When `.arcnet/secrets.json` exists, deployment commands automatically load it. The `deploy` consumer selects operator credentials; Terraform application values are selected using the existing service env lists in `zap.yaml`. No duplicated application map is required. Offline project checks remain offline. Secrets commands in GitHub Actions require the configured repository's main branch.
+
+Provisioning modifies Forum and GitHub separately. A failed GitHub upload leaves an unused Forum recipient; rerun `secrets add` to create/upload another and remove the unused recipient later. If upload succeeded but snapshot/config writing failed, attach the file with `--existing-key`. Existing sources are not silently rotated on reruns. Provision while nobody else is editing that file: the current fm write interface does not offer atomic revision-conditional writes, though ArcNet checks identity/revision before updating and refuses occupied init paths. GitHub secret names are repository-scoped; environment-level overrides take precedence in jobs that use an environment.
+
+# ArcNet command reference
+
+Generated from the CLI command tree.
+
+## Global Options
+
+| Option | Description |
+| --- | --- |
+| `-V, --version` | output the version number |
+| `--root <directory>` | Target project root |
+| `--json` | Render one JSON result |
+| `--jsonl` | Render structured completion events |
+| `--noninteractive` | Run without prompts (all commands are noninteractive) |
+
+## `arcnet env`
+
+Load ordered encrypted Forum sources and select environment values.
+
+### `arcnet env check`
+
+Validate decryption and mappings; report key names only.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+### `arcnet env export`
+
+Write selected plaintext JSON to stdout for an explicit pipeline.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+### `arcnet env run <command...>`
+
+Run a command with selected keys only; withhold child output.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+
+## `arcnet secrets`
+
+Attach Forum files, provision GitHub keys and refresh encrypted snapshots.
+
+### `arcnet secrets add`
+
+Attach an existing Forum file and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--existing-key` | Reuse an existing GitHub secret without creating a recipient |
+
+### `arcnet secrets init`
+
+Create a Forum secrets file, prompt for your password and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--input <file>` | Initial plaintext JSON file; defaults to an empty object |
+
+### `arcnet secrets sync`
+
+Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+
+## `arcnet version`
+
+Show the installed package version.
+
+## `arcnet setup <slug>`
+
+Add ArcNet configuration and workflow; pin the CLI in the project manifest.
+
+| Option | Description |
+| --- | --- |
+| `--dry-run` | Report generated files without writing |
+| `--service <name>` | Default container service |
+| `--dockerfile <path>` | Container Dockerfile |
+| `--repository <owner/repo>` | GitHub repository (defaults to origin) |
+| `--services <path>` | Explicit service selection JSON |
+| `--vercel <path>` | Static Vercel references JSON |
+
+## `arcnet check`
+
+Validate project configuration offline.
+
+## `arcnet plan`
+
+Plan deployment (Terraform contacts providers; static Vercel stays offline).
+
+## `arcnet deploy`
+
+Deploy the approved project.
+
+## `arcnet preview`
+
+Deploy static Vercel sites to preview.
+
+## `arcnet inspect`
+
+Verify static Vercel project identities remotely.
+
+## `arcnet create <site>`
+
+Create one explicitly approved Vercel project.
+
+## `arcnet ci`
+
+Validate deployment identity and write GitHub Actions outputs.

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@mp-lb/arcnet",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "ArcNet project installation and deployment CLI.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "arcnet": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "templates",
+    "README.md",
+    "docs/public",
+    "src"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mp-lb/tools.git",
+    "directory": "packages/arcnet"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@mp-lb/forum-secrets": "0.2.1",
+    "@mp-lb/zapper": "0.21.0",
+    "commander": "14.0.3",
+    "yaml": "2.8.1",
+    "zod": "4.4.1"
+  },
+  "devDependencies": {
+    "@mp-lb/cli-docs": "0.0.1"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc --project tsconfig.json && chmod +x dist/cli.js",
+    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "test": "pnpm build && node --import tsx --test test/*.test.ts && pnpm docs:check",
+    "docs:gen": "pnpm --filter @mp-lb/cli-docs build && tsx scripts/generateDocs.ts",
+    "docs:check": "pnpm --filter @mp-lb/cli-docs build && tsx scripts/generateDocs.ts --check"
+  }
 }

package/src/addDependency.ts

@@ -0,0 +1,41 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { packageVersion } from "./packageInfo.js";
+
+const manifestSchema = z
+  .object({
+    dependencies: z.record(z.string(), z.string()).optional(),
+    devDependencies: z.record(z.string(), z.string()).optional(),
+  })
+  .passthrough();
+
+export const addDependency = (path: string) => {
+  const manifest = manifestSchema.parse(JSON.parse(readFileSync(path, "utf8")));
+
+  const existing =
+    manifest.dependencies?.["@mp-lb/arcnet"] ??
+    manifest.devDependencies?.["@mp-lb/arcnet"];
+
+  if (existing && existing !== packageVersion)
+    throw new Error(
+      "Existing ArcNet dependency differs; review its version before setup.",
+    );
+  if (!manifest.dependencies?.["@mp-lb/arcnet"])
+    manifest.devDependencies = {
+      ...manifest.devDependencies,
+      "@mp-lb/arcnet": packageVersion,
+    };
+  return JSON.stringify(manifest, null, 2) + "\n";
+};
+
+export const hasDependency = (root: string) => {
+  const manifest = manifestSchema.parse(
+    JSON.parse(readFileSync(join(root, "package.json"), "utf8")),
+  );
+
+  return Boolean(
+    manifest.dependencies?.["@mp-lb/arcnet"] ??
+    manifest.devDependencies?.["@mp-lb/arcnet"],
+  );
+};

package/src/apiClient.ts

@@ -0,0 +1,51 @@
+import { fail } from "./fail.js";
+import type { VercelRequest } from "./schemas.js";
+import { vercelResponseSchema } from "./schemas.js";
+
+export const apiClient = (
+  token: string | undefined,
+  fetcher: typeof fetch = fetch,
+): VercelRequest => {
+  if (!token)
+    fail(
+      "VERCEL_TOKEN is required for remote operations; check and plan remain offline.",
+    );
+
+  return async (method, path, account, body) => {
+    const url = new URL(path, "https://api.vercel.com");
+    if (account.type === "team") url.searchParams.set("teamId", account.id);
+    let response;
+
+    try {
+      response = await fetcher(url, {
+        method,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(30000),
+      });
+    } catch {
+      fail(
+        method === "POST"
+          ? "Creation outcome uncertain. Inspect the named project before retrying; no automatic retry was attempted."
+          : "Vercel read failed; no changes attempted.",
+      );
+    }
+
+    if (response.status === 404 && method === "GET") return null;
+    if (!response.ok)
+      fail(
+        `Vercel ${method} failed (HTTP ${response.status}). Check scope/access; response content omitted.`,
+      );
+
+    try {
+      return vercelResponseSchema.parse(await response.json());
+    } catch {
+      fail(
+        "Vercel returned an invalid response; inspect the project before retrying.",
+      );
+    }
+  };
+};

package/src/checkIdentity.ts

@@ -0,0 +1,18 @@
+import { fail } from "./fail.js";
+import type { VercelAccount, VercelResponse, VercelSite } from "./schemas.js";
+
+export const checkIdentity = (
+  project: VercelResponse | null,
+  site: VercelSite,
+  account: VercelAccount,
+) => {
+  if (
+    !project ||
+    project.id !== site.projectId ||
+    project.name !== site.projectName ||
+    project.accountId !== account.id
+  )
+    fail(
+      `Project identity/scope mismatch for ${site.projectName}. No deployment attempted.`,
+    );
+};

package/src/ciOutputs.ts

@@ -0,0 +1,47 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { terraformConfigSchema } from "./schemas.js";
+import { validateConfig } from "./validateConfig.js";
+
+export const ciOutputs = (root: string): Record<string, string> => {
+  const input: unknown = JSON.parse(
+    readFileSync(join(root, ".arcnet/project.json"), "utf8"),
+  );
+
+  if (
+    z.object({ mode: z.string().optional() }).parse(input).mode === "vercel"
+  ) {
+    const c = validateConfig(input, root);
+    return {
+      approved: String(
+        c.approved &&
+          Object.values(c.sites).every((s) => s.mode === "existing"),
+      ),
+    };
+  }
+
+  const c = terraformConfigSchema.parse(input);
+
+  const n = z
+    .object({ region: z.string().regex(/^[a-z]+-[a-z]+[0-9]$/) })
+    .parse(parse(readFileSync(join(root, ".arcnet/network.yaml"), "utf8")));
+
+  if (
+    c.approved &&
+    (!/^projects\/\d+\/locations\/global\/workloadIdentityPools\/github\/providers\/github-actions$/.test(
+      c.workloadIdentityProvider,
+    ) ||
+      !/^arc-deploy@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/.test(
+        c.serviceAccount,
+      ))
+  )
+    throw new Error("Complete WIF configuration before approval.");
+  return {
+    approved: String(c.approved),
+    provider: c.approved ? c.workloadIdentityProvider : "",
+    account: c.approved ? c.serviceAccount : "",
+    registry: `${n.region}-docker.pkg.dev`,
+  };
+};

package/src/cli.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { createCli } from "./createCli.js";
+await createCli()
+  .parseAsync()
+  .catch((error: unknown) => {
+    process.stderr.write(
+      `ArcNet: ${error instanceof Error ? error.message : "Command failed"}\n`,
+    );
+
+    process.exitCode = 1;
+  });

package/src/createCli.ts

@@ -0,0 +1,128 @@
+import { Command } from "commander";
+import { appendFileSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { ciOutputs } from "./ciOutputs.js";
+import { createSetupCommand } from "./createSetupCommand.js";
+import { packageVersion } from "./packageInfo.js";
+import { renderResult } from "./renderResult.js";
+import { runTerraform } from "./runTerraform.js";
+import { runVercel } from "./runVercel.js";
+import { setup } from "./setup.js";
+import { createSecretsCommands } from "./secrets/createSecretsCommands.js";
+import { withDeploymentSecrets } from "./secrets/withDeploymentSecrets.js";
+
+export const createCli = () => {
+  const cli = new Command("arcnet")
+    .description("Install and deploy ArcNet projects.")
+    .version(packageVersion)
+    .option("--root <directory>", "Target project root", process.cwd())
+    .option("--json", "Render one JSON result")
+    .option("--jsonl", "Render structured completion events")
+    .option(
+      "--noninteractive",
+      "Run without prompts (all commands are noninteractive)",
+    );
+
+  cli.hook("preAction", () => {
+    if (cli.opts().json && cli.opts().jsonl)
+      throw new Error("Choose either --json or --jsonl.");
+  });
+
+  const output = (result: unknown) => {
+    process.stdout.write(renderResult(result, cli.opts()) + "\n");
+  };
+
+  createSecretsCommands(cli, output);
+
+  cli
+    .command("version")
+    .description("Show the installed package version.")
+    .action(() => output({ version: packageVersion }));
+
+  const install = createSetupCommand();
+  install.action(() =>
+    output({
+      ...setup(
+        install.args.concat(
+          install.options.flatMap((option) => {
+            const key = option.attributeName();
+            if (install.getOptionValueSource(key) !== "cli") return [];
+            const value: unknown = install.opts()[key];
+            return value === true
+              ? [option.long!]
+              : [option.long!, String(value)];
+          }),
+        ),
+        realpathSync(cli.opts().root),
+      ),
+    }),
+  );
+
+  cli.addCommand(install);
+
+  for (const [name, description] of Object.entries({
+    check: "Validate project configuration offline.",
+    plan: "Plan deployment (Terraform contacts providers; static Vercel stays offline).",
+    deploy: "Deploy the approved project.",
+    preview: "Deploy static Vercel sites to preview.",
+    inspect: "Verify static Vercel project identities remotely.",
+    create: "Create one explicitly approved Vercel project.",
+  })) {
+    const command = cli.command(name).description(description);
+    if (name === "create") command.argument("<site>", "Configured site name");
+    command.action(async (site: unknown) => {
+      const root = realpathSync(cli.opts().root);
+
+      const mode = z
+        .object({ mode: z.string().optional() })
+        .parse(
+          JSON.parse(readFileSync(join(root, ".arcnet/project.json"), "utf8")),
+        ).mode;
+
+      const machine = Boolean(cli.opts().json || cli.opts().jsonl);
+
+      const execute = async () => {
+        if (mode === "vercel")
+          return runVercel(
+            name,
+            root,
+            typeof site === "string" ? site : undefined,
+            machine,
+          );
+        if (name === "check" || name === "plan" || name === "deploy")
+          return runTerraform(name, root, machine);
+        throw new Error(
+          `${name} is only supported for static Vercel references.`,
+        );
+      };
+
+      output(
+        await (name === "check" || (name === "plan" && mode === "vercel")
+          ? execute()
+          : withDeploymentSecrets(root, mode, execute)),
+      );
+    });
+  }
+
+  cli
+    .command("ci")
+    .description(
+      "Validate deployment identity and write GitHub Actions outputs.",
+    )
+    .action(() => {
+      const outputs = ciOutputs(realpathSync(cli.opts().root));
+      if (!process.env.GITHUB_OUTPUT)
+        throw new Error("GITHUB_OUTPUT is required for the ci command.");
+      appendFileSync(
+        process.env.GITHUB_OUTPUT,
+        Object.entries(outputs)
+          .map(([key, value]) => `${key}=${value}\n`)
+          .join(""),
+      );
+
+      output(outputs);
+    });
+
+  return cli;
+};