@memoket-ai/cli 2.0.1

package/CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+All notable changes to `@memoket-ai/cli` are documented here. Versions follow
+[Semantic Versioning](https://semver.org/).
+
+## [2.0.1] — 2026-07-14
+
+### Fixed
+
+- **README had the wrong package name.** The H1 title and the `npm install`
+  example both said `@memoket/cli` (typo carried over from the private
+  pre-release history). The actual package on npm is `@memoket-ai/cli`.
+  Users who copy-pasted the install command from the 2.0.0 README on
+  npmjs.org would have hit E404. Both references now point to
+  `@memoket-ai/cli`.
+- **LICENSE file is now shipped.** The 2.0.0 tarball didn't include a
+  `LICENSE` file (the project was using `"license": "UNLICENSED"` as a
+  placeholder). 2.0.1 adds a source-available license file and updates
+  `package.json#files` so it ships in the tarball.
+
+No code changes. No behavior changes. Bump the patch version because the
+install instructions on the npm package page were broken.
+
+## [2.0.0] — 2026-07-14
+
+### First public release on npm
+
+This is the first time `@memoket-ai/cli` ships to the public registry as a
+production package. The 0.2.x development line is collapsed into a clean
+2.0.0 milestone.
+
+### Changed
+
+- **Package visibility**: `publishConfig.access` is now `public` (was
+  `restricted`). The package is the first public release on npmjs.org.
+- **No `--provenance`**: the source repository stays private, and npm
+  refuses to attach Sigstore provenance from private repos (the
+  transparency log is public; attaching a build attestation from a
+  private project would leak build metadata). The package is published
+  as public, only the source is private.
+- **Local publish blocked** (security): the `publish` and `publish:prod`
+  npm scripts have been removed. `node scripts/publish.js` exits with a
+  clear error unless `CI=true`, and the production NPM_TOKEN is
+  IP-restricted to GitHub Actions' public runner range. Local developers
+  can still run `--dry-run` for "what would I publish" sanity checks.
+- **`src/config.js` version constant** bumped to `2.0.0` to match
+  `package.json`.
+- **README** version references updated; added a new "NPM_TOKEN
+  management" section documenting the token-creation settings, rotation
+  schedule, and the two-layer local-publish block.
+- **Release workflow** (`.github/workflows/release.yml`): tag-driven
+  releases (e.g. `git tag v2.0.0 && git push origin v2.0.0`) now publish
+  with `--access public`.
+- **Dispatch workflow** (`.github/workflows/publish.yml`): manual env +
+  tag + dry-run dispatch publishes with `--access public`.
+
+### Security
+
+- **`NPM_TOKEN` must be a Granular Access Token** with IP allowlist pinned
+  to GitHub Actions' public runner range (`140.82.112.0/20`,
+  `4.148.0.0/14`). See `README.md` → "NPM_TOKEN management" for the
+  full settings matrix and rotation schedule (90 days).
+- **`scripts/publish.js`** now refuses to run a real publish outside
+  `CI=true`. This is a fast local fail-safe complementing the
+  IP-restriction on the production token at the npm network layer.
+- **`.gitignore`** explicitly blocks `iam-policies.json`,
+  `security-groups.json`, and `*.tgz` from accidental commits. These
+  were previously untracked but committable.
+
+### Migration notes for the 0.2.x line
+
+- `0.2.1-dev.5` is collapsed into `2.0.0`; no patch is published. If
+  you depend on `@memoket-ai/cli@^0.2.0` from a private registry, your
+  lockfile may need an `npm install @memoket-ai/cli@latest` after this
+  release.
+- `npm run publish` and `npm run publish:prod` are removed; use the
+  GitHub Actions dispatch workflow or push a release tag.

package/LICENSE

@@ -0,0 +1,65 @@
+Memoket CLI Source-Available License
+Copyright (c) 2026 Memoket. All rights reserved.
+
+This license governs use of the software distributed as the npm package
+"@memoket-ai/cli" (the "Software"). By installing, copying, or otherwise
+using the Software, you agree to be bound by the terms below.
+
+1. Permitted use.
+
+   You may use the Software for personal purposes or for the purpose of
+   accessing the services operated by Memoket (the "Service"). You may
+   install and run the Software on devices you own or control.
+
+2. Restrictions.
+
+   You may NOT, without prior written permission from Memoket:
+
+   a. Redistribute the Software, in whole or in part, by any means
+      (including but not limited to: re-publishing on npm or any other
+      package registry, mirroring, bundling into another product,
+      sublicensing, or selling copies).
+   b. Modify the Software and redistribute the modified version.
+   c. Reverse-engineer, decompile, or disassemble the Software except
+      to the extent that such restriction is prohibited by applicable
+      law.
+   d. Use the Software to build a product or service that competes with
+      the Service.
+
+3. Official source of distribution.
+
+   The only authorized distribution channel for the Software is the
+   official npm package "@memoket-ai/cli". Any other copy, in any form,
+   is unauthorized.
+
+4. No warranty.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND
+   NON-INFRINGEMENT. MEMOKET DOES NOT WARRANT THAT THE SOFTWARE WILL BE
+   UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS.
+
+5. Limitation of liability.
+
+   IN NO EVENT SHALL MEMOKET, ITS AFFILIATES, OFFICERS, DIRECTORS,
+   EMPLOYEES, AGENTS, OR LICENSORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+   OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR
+   OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE
+   OR THE USE OR OTHER DEALINGS IN THE SOFTWARE, EVEN IF ADVISED OF THE
+   POSSIBILITY OF SUCH DAMAGE.
+
+6. Termination.
+
+   This license terminates automatically if you breach any of its
+   terms. Upon termination you must stop using the Software and
+   uninstall it from any device on which it is installed.
+
+7. Governing law.
+
+   This license is governed by the laws of the jurisdiction in which
+   Memoket is incorporated, without regard to its conflict-of-laws
+   principles.
+
+For licensing inquiries (commercial use, redistribution, OEM
+agreements), contact Memoket.

package/README.md

@@ -0,0 +1,278 @@
+# @memoket-ai/cli
+
+Let users onboard the Memoket MCP into their local AI client and log in. The CLI only does **register + login + passthrough**; the tool catalog is always pulled live from the server, so it **never drifts**.
+
+> Pure Node.js (ESM), zero native bindings, two runtime dependencies (`commander`, `open`). OAuth: well-known discovery → DCR → PKCE S256 → browser callback.
+
+## Install
+
+```bash
+npm install -g @memoket-ai/cli
+```
+
+Then:
+
+```bash
+memoket doctor   # connectivity + OAuth discovery
+memoket setup    # register into Claude Code / VS Code and log in
+```
+
+## Commands
+
+```
+memoket setup     register MCP into local AI clients (Claude Code / VS Code…) and log in  ← most common
+memoket login     browser-authorize and save the token (for tools/call)
+memoket tools     list tools exposed by the live MCP (tools/list passthrough)
+memoket call <tool> [key=value ...] [--json '{...}']   call a tool (tools/call passthrough)
+memoket endpoints                                      list named endpoints, mark the ACTIVE one
+memoket endpoints use <name>                           switch the active endpoint (persisted)
+memoket token [--scope a,b] [--name X] [--expires-in 90]   issue a Personal API Token (default)
+memoket token --list                                   list API tokens
+memoket token --revoke <id>                             revoke an API token
+memoket token rotate <id>                               rotate a token (旧换新: new mtok, old revoked)
+memoket doctor    connectivity + OAuth discovery + token login status
+```
+
+Backward-compatible: the old nested forms `memoket token create|list|revoke` and
+`memoket status` all still work (kept as hidden aliases).
+`memoket doctor` now also prints the token login status that `status` used to show.
+
+## Endpoints
+
+Each build of the CLI ships with **only its own endpoint** baked in (e.g. a
+`build:dev` / `pack:dev` artifact only knows about `dev`). The active endpoint
+is what's used by every command; the selection is persisted to
+`~/.memoket/config.json`.
+
+```bash
+memoket endpoints                                  # list; the ACTIVE one is marked with *
+memoket endpoints add myenv https://api.example.com  # add a custom one
+memoket endpoints use myenv                        # switch to it (persisted)
+memoket endpoints remove myenv                     # drop a custom one
+```
+
+A prod-built artifact looks like:
+
+```
+NAME  BASE URL                 ACTIVE
+prod  https://mcp.memoket.ai  *
+```
+
+Need a different environment? Run `npm run pack:<env>` (see
+[Build targets](#build-targets)) — runtime `memoket endpoints use` only switches
+among what's already baked in plus your customs. To expose more endpoints in
+one binary, edit `config/<env>.json` and rebuild.
+
+Global flags: `--url <url>` (one-off endpoint override, wins over the active endpoint) / `--name <name>`.
+
+## Build targets
+
+The default active endpoint is decided at build time. `config/<env>.json` holds
+the per-target table (`defaultEndpoints` + `defaultActiveEndpoint`); the build
+script stamps the selected file into `src/config.local.js`, which `src/config.js`
+imports at runtime.
+
+**Public npm publishes are prod-only.** `dev` and `test` builds exist for local
+development and internal tarballs; they are never pushed to the public registry.
+The single source of truth for the published artifact is the GitHub release
+workflow (see [Release](#release) below), which always runs `build:prod`
+before `npm publish --access public`.
+
+### Build (bake config, no pack)
+
+| Command | baked endpoint | writes to | public? |
+|---|---|---|---|
+| `npm run build:dev`  | `dev`  | `src/config.local.js` | no — local only |
+| `npm run build:test` | `test` | `src/config.local.js` | no — local only |
+| `npm run build:prod` | `prod` | `src/config.local.js` | yes — release flow bakes this |
+| `npm run build`      | `prod` (alias for the publish target) | `src/config.local.js` | yes |
+
+### Pack (bake config + produce flavored tarball)
+
+Each `pack:*` runs `build:<env>` first to stamp the right default, then `npm pack
+--ignore-scripts` (so `prepack` doesn't clobber it back to prod). Output:
+`memoket-cli-2.0.0.tgz` in the cwd. Only the **prod** tarball is intended for
+distribution; `pack:dev` / `pack:test` exist so internal staging environments
+can verify a build before the release workflow runs.
+
+| Command | baked endpoint | tarball | intended audience |
+|---|---|---|---|
+| `npm run pack:dev`  | `dev`  | `memoket-cli-2.0.0.tgz` | internal staging only |
+| `npm run pack:test` | `test` | `memoket-cli-2.0.0.tgz` | internal staging only |
+| `npm run pack:prod` | `prod` | `memoket-cli-2.0.0.tgz` | **public (via release workflow)** |
+| `npm run pack`      | `prod` (alias) | `memoket-cli-2.0.0.tgz` | **public (via release workflow)** |
+
+### Interactive build
+
+If you don't pass an env, `build` prompts for one (TTY only):
+
+```bash
+npm run build       # interactive pick → bake src/config.local.js
+```
+
+The prompt lists `1) dev / 2) test / 3) prod`. There is no interactive publish
+— public publishes always go through [Release](#release). For local sanity
+checks before tagging, use `npm run pack:<env> --ignore-scripts` and inspect
+the resulting tarball, or `npm run publish:<env> -- --dry-run` to verify the
+npm view without uploading.
+
+`npm test` runs `pretest` → `build:dev` automatically, so the smoke test always
+uses the dev gateway. Local testing uses `pack:<env>` instead of plain
+`npm pack` to choose the flavor. The tarball only contains the one endpoint
+(plus the build script + `config/prod.json`, so consumers can rebuild against
+the prod endpoint or use `memoket --url <host>` for one-off overrides).
+
+`src/config.local.js` is gitignored. When it's missing (fresh checkout, no build
+run yet) the CLI falls back to a single prod endpoint so `node bin/memoket.js ...`
+still works out of the box.
+
+**Note:** `config/dev.json` and `config/test.json` are intentionally **not**
+shipped in the public tarball — they contain internal staging URLs and live
+only in the source repository. Team members running the CLI from a clone
+already have them via git; consumers installing from npm use `--url` to point
+at non-prod gateways.
+
+## Generic HTTP integrations
+
+For n8n, Make, Zapier HTTP Request, scripts, and customer backends, use the generic HTTP integration commands. These are not n8n-specific; they create the same primitives any HTTP client can use.
+
+```bash
+memoket login
+
+memoket token \
+  --name "My automation" \
+  --scope recordings:read,summaries:read,transcripts:read,search:read
+```
+
+The command creates a Personal API Token (`mk_pat_...`) for customer -> Memoket API calls. Use it as:
+
+```http
+Authorization: Bearer mk_pat_...
+```
+
+The underlying management commands are also available directly:
+
+```bash
+memoket token --name "n8n" --scope recordings:read,summaries:read --expires-in 90
+memoket token --list
+memoket token --revoke <id>
+memoket token rotate <id>   # 旧换新：签发新 mtok，旧 token 立即失效
+# 旧形式仍兼容：memoket token create ...
+```
+
+These commands target the Gateway REST management API (`/v1/api-tokens`). If the backend endpoint is not deployed yet, the CLI will fail with the returned HTTP status.
+
+## Backend contract
+
+The generic HTTP integration commands expect the Memoket REST management API below. The CLI authenticates with the existing `memoket login` OAuth token and sends it as `Authorization: Bearer <token>`.
+
+```http
+POST   /v1/api-tokens
+GET    /v1/api-tokens
+DELETE /v1/api-tokens/{id}
+```
+
+Create API token request:
+
+```json
+{
+  "name": "My automation API",
+  "scopes": ["recordings:read", "summaries:read"],
+  "expires_in_days": 90
+}
+```
+
+Create API token response must return the cleartext token once, either top-level or under `data`:
+
+```json
+{
+  "id": "tok_123",
+  "token": "mk_pat_xxx",
+  "scopes": ["recordings:read", "summaries:read"],
+  "expires_at": "2026-10-04T00:00:00Z"
+}
+```
+
+The CLI derives the API base from the MCP URL. Override with `MEMOKET_API_URL` or `MEMOKET_GATEWAY_URL` during development.
+
+## Why "passthrough" rather than hardcoded commands
+
+The MCP's tool catalog is loaded at runtime from the server, not hardcoded. Hardcoding tools in the CLI would drift. This CLI passes `tools/list` / `tools/call` through, so any add/change/drop on the server is followed automatically.
+
+## Build & try from source
+
+```bash
+git clone https://github.com/memoket/memoket-cli.git
+cd memoket-cli
+npm install
+npm run build:dev        # bake dev as the default active
+node bin/memoket.js doctor
+node bin/memoket.js tools
+node bin/memoket.js setup            # registers into clients + browser login
+node bin/memoket.js call get_memoket_overview
+```
+
+Requires Node ≥ 18 (tested on Node 20+).
+
+## One honest caveat
+
+**`memoket login`'s token is for this CLI's own `tools` / `call` only; it is not shared with Claude Code.** Claude Code does its own OAuth: after `memoket setup` registers the MCP, you still need to run `/mcp` in Claude Code and pick `memoket` to log in there. The CLI writes the config; each client does its own login. This is a client limitation, not something the CLI can route around.
+
+## Layout
+
+```
+bin/memoket.js     entry point
+src/
+  cli.js               commander command definitions
+  http-integration.js  generic HTTP integration management commands
+  mcp-client.js        JSON-RPC / SSE MCP client
+  oauth.js             OAuth 2.0 + PKCE + DCR + callback + creds
+  register.js      shell out to `claude mcp add` / `code --add-mcp`
+  config.js        constants, version, credential path; imports config.local.js
+  config.local.js  build-time-stamped endpoints table (gitignored)
+  utils.js         tier / strip / coerce / short / or
+config/
+  dev.json             per-build-target endpoint table (build:dev)
+  test.json            per-build-target endpoint table (build:test)
+  prod.json            per-build-target endpoint table (build:prod)
+scripts/
+  build.js             node scripts/build.js <dev|test|prod>
+```
+
+## Release
+
+`git tag v2.0.0 && git push origin v2.0.0` triggers `.github/workflows/release.yml`.
+This is the **only** path that publishes to the public npm registry.
+
+1. Stamps `package.json` version
+2. `npm ci` + `node bin/memoket.js doctor` smoke test
+3. Creates a GitHub Release
+4. Runs `npm run build:prod` (so the published tarball bakes `prod` as the default endpoint)
+5. `npm publish --access public` (skipped if `NPM_TOKEN` secret is unset)
+
+The `@memoket-ai` npm org must exist and a publish token must be set via `gh secret set NPM_TOKEN --repo memoket/memoket-cli`.
+
+### NPM_TOKEN management
+
+**The `NPM_TOKEN` secret is the only credential with publish rights.** It must be a
+[Granular Access Token](https://docs.npmjs.com/creating-and-viewing-access-tokens)
+created at <https://www.npmjs.com/settings/memoket-ai/> → Access tokens, with:
+
+| Setting | Value | Why |
+|---|---|---|
+| Packages | `@memoket-ai` (Read and Write) | Least privilege |
+| Scope | Automation | CI/CD use only |
+| Bypass 2FA | ✅ enabled | Required for headless `npm publish` |
+| **IP allowlist** | `140.82.112.0/20`, `4.148.0.0/14` | **Pin to GitHub Actions public runner range** — this is what stops the token from being used locally even if leaked |
+| Expiration | 90 days | Rotate via the npm UI; set a calendar reminder |
+
+**Local publish is intentionally blocked on two layers:**
+- The `publish` / `publish:prod` npm scripts have been removed from `package.json`; `node scripts/publish.js` exits with an error unless `CI=true`.
+- The token itself is IP-restricted to GitHub Actions, so even with a stolen token, `npm publish` from a developer machine is rejected at the network layer.
+
+The release workflow (`.github/workflows/release.yml`) and the manual dispatch
+workflow (`.github/workflows/publish.yml`) are the **only** sanctioned publish paths.
+Both read `secrets.NPM_TOKEN` at runtime — the value is never written to disk or
+echoed in logs.
+
+**Do not run `npm run publish:dev` / `npm run publish:test` against the public registry** — those scripts have been removed from `package.json`. The only local entry point is `node scripts/publish.js` (dry-run only, requires `CI=true` to actually publish). The release / dispatch workflows are the only sanctioned publish path.

package/bin/memoket.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// Memoket CLI entry point. All command logic lives in src/; this file just
+// wires up commander and translates unhandled errors into exit codes.
+
+import { installProxy } from "../src/proxy.js";
+import { buildProgram } from "../src/cli.js";
+
+installProxy();
+
+const program = buildProgram();
+try {
+  await program.parseAsync(process.argv);
+} catch (e) {
+  const cause = e.cause;
+  const causeMsg = cause && cause.code ? ` (${cause.code})` : "";
+  console.error("✗ " + (e.message || e) + causeMsg);
+  process.exit(1);
+}

package/config/prod.json

@@ -0,0 +1,7 @@
+{
+  "defaultEndpoints": {
+    "prod": "https://mcp.memoket.ai"
+  },
+  "defaultActiveEndpoint": "prod",
+  "apiBase": "https://api.memoket.ai"
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@memoket-ai/cli",
+  "version": "2.0.1",
+  "description": "Memoket MCP onboarding & passthrough CLI — register the Memoket MCP into your AI client and use it.",
+  "type": "module",
+  "bin": {
+    "memoket": "bin/memoket.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "config/prod.json",
+    "scripts",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node scripts/build.js",
+    "build:dev": "node scripts/build.js dev",
+    "build:test": "node scripts/build.js test",
+    "build:prod": "node scripts/build.js prod",
+    "pack": "npm run pack:prod",
+    "pack:dev": "npm run build:dev && npm pack --ignore-scripts",
+    "pack:test": "npm run build:test && npm pack --ignore-scripts",
+    "pack:prod": "npm run build:prod && npm pack --ignore-scripts",
+    "pretest": "npm run build:dev",
+    "test": "node bin/memoket.js doctor",
+    "prepack": "npm run build:prod"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "open": "^10.2.0",
+    "undici": "^6.0.0"
+  },
+  "keywords": [
+    "memoket",
+    "mcp",
+    "cli"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/build.js

@@ -0,0 +1,100 @@
+// build.js — pick a build target (dev|test|prod) and stamp src/config.local.js
+// from config/<target>.json.
+//
+//   node scripts/build.js [target]   # target optional, interactive if missing
+//   npm run build                    # interactive: pick dev / test / prod
+//   npm run build:dev                # explicit, no prompt
+//   npm run build:test
+//   npm run build:prod
+//
+// When the generated file is missing, src/config.js falls back to the last
+// build's output; running `npm run build` once is required after a fresh
+// checkout (prepack / pretest hooks do this automatically).
+
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, "..");
+
+const TARGETS = ["dev", "test", "prod"];
+
+async function promptTarget() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    console.log("Select build environment:");
+    for (const [i, t] of TARGETS.entries()) console.log(`  ${i + 1}) ${t}`);
+    rl.question("> ", (answer) => {
+      rl.close();
+      const idx = parseInt(answer, 10) - 1;
+      const t = TARGETS[idx];
+      if (!t) {
+        console.error(`✗ invalid choice: ${answer}`);
+        process.exit(1);
+      }
+      resolve(t);
+    });
+  });
+}
+
+const arg = process.argv[2];
+const target = (arg ? arg.toLowerCase() : await promptTarget());
+
+if (!TARGETS.includes(target)) {
+  console.error(`✗ unknown build target: ${target}`);
+  console.error(`  expected one of: ${TARGETS.join(", ")}`);
+  process.exit(1);
+}
+
+const srcPath = join(root, "config", `${target}.json`);
+if (!existsSync(srcPath)) {
+  console.error(`✗ config file not found: ${srcPath}`);
+  process.exit(1);
+}
+
+const raw = readFileSync(srcPath, "utf8");
+let parsed;
+try {
+  parsed = JSON.parse(raw);
+} catch (e) {
+  console.error(`✗ invalid JSON in ${srcPath}: ${e.message}`);
+  process.exit(1);
+}
+
+const { defaultEndpoints, defaultActiveEndpoint, apiBase } = parsed;
+if (!defaultEndpoints || typeof defaultEndpoints !== "object") {
+  console.error(`✗ ${srcPath}: missing "defaultEndpoints" object`);
+  process.exit(1);
+}
+if (!defaultActiveEndpoint || !(defaultActiveEndpoint in defaultEndpoints)) {
+  console.error(
+    `✗ ${srcPath}: "defaultActiveEndpoint" must be one of ${Object.keys(defaultEndpoints).join(", ")}`,
+  );
+  process.exit(1);
+}
+  if (!apiBase || typeof apiBase !== "string") {
+    console.error(`✗ ${srcPath}: missing "apiBase" string (the API base URL, e.g. "https://api.example.com")`);
+    process.exit(1);
+  }
+
+const outPath = join(root, "src", "config.local.js");
+const banner = `// AUTO-GENERATED by scripts/build.js — do not edit.
+// Source: config/${target}.json
+// Regenerate with: npm run build:${target}
+`;
+
+const body = `${banner}
+export const defaultEndpoints = ${JSON.stringify(defaultEndpoints, null, 2)};
+
+export const defaultActiveEndpoint = ${JSON.stringify(defaultActiveEndpoint)};
+
+export const apiBase = ${JSON.stringify(apiBase)};
+`;
+
+writeFileSync(outPath, body, "utf8");
+console.log(`✓ build target = ${target}`);
+console.log(`  config.local.js written (default active = ${defaultActiveEndpoint})`);
+console.log(`  endpoints: ${Object.keys(defaultEndpoints).join(", ")}`);
+console.log(`  apiBase:   ${apiBase}`);