mixdog 0.9.147 → 0.9.149

package/scripts/generate-voice-runtime-manifest.test.mjs

@@ -0,0 +1,135 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  VOICE_RUNTIME_CONFIG,
+  VOICE_RUNTIME_TAG,
+  buildVoiceRuntimePlatforms,
+  fetchGithubRelease,
+  voiceRuntimeBuildHash,
+} from './generate-voice-runtime-manifest.mjs'
+import { mergeVoiceRuntimeManifest } from './sync-voice-runtime-manifest.mjs'
+
+const names = VOICE_RUNTIME_CONFIG.platforms.map((platform) => platform.asset)
+
+test('voice runtime release assets produce a complete fail-closed manifest', () => {
+  assert.equal(VOICE_RUNTIME_CONFIG.vulkanSdkVersion, '1.4.309.0')
+  const assets = names.map((name, index) => ({
+    name,
+    size: index + 1,
+    digest: `sha256:${String(index + 1).padStart(64, '0')}`,
+    browser_download_url: `https://github.com/tribgames/mixdog/releases/download/${VOICE_RUNTIME_TAG}/${name}`,
+  }))
+  const platforms = buildVoiceRuntimePlatforms(assets)
+  assert.equal(platforms['win32-x64'].variants[0].id, 'vulkan')
+  assert.equal(platforms['linux-x64'].variants[0].id, 'vulkan')
+  assert.equal(platforms['linux-arm64'].variants[0].id, 'vulkan')
+  assert.equal(platforms['darwin-arm64'].variants[0].id, 'metal')
+  assert.equal(platforms['darwin-x64'].variants[0].id, 'cpu')
+  assert.equal(platforms['win32-x64'].variants[0].executable, 'whisper-server.exe')
+  assert.deepEqual(
+    VOICE_RUNTIME_CONFIG.platforms
+      .filter((platform) => platform.os === 'linux')
+      .map((platform) => platform.runner),
+    ['ubuntu-24.04', 'ubuntu-24.04-arm'],
+  )
+})
+
+test('voice runtime manifest generation rejects a partial release', () => {
+  assert.throws(() => buildVoiceRuntimePlatforms([]), /missing required asset/)
+})
+
+test('voice runtime manifest generation rejects undeclared archives', () => {
+  assert.throws(
+    () => buildVoiceRuntimePlatforms([{
+      name: 'whisper-server-linux-riscv64-cpu.zip',
+      size: 1,
+      digest: `sha256:${'1'.padStart(64, '0')}`,
+      browser_download_url:
+        `https://github.com/tribgames/mixdog/releases/download/${VOICE_RUNTIME_TAG}/whisper-server-linux-riscv64-cpu.zip`,
+    }]),
+    /unexpected runtime asset/,
+  )
+})
+
+test('voice runtime manifest normalizes hidden draft asset URLs to the published tag', () => {
+  const assets = names.map((name, index) => ({
+    name,
+    size: index + 1,
+    digest: `sha256:${String(index + 1).padStart(64, '0')}`,
+    browser_download_url:
+      `https://github.com/tribgames/mixdog/releases/download/untagged-fixture/${name}`,
+  }))
+  const platforms = buildVoiceRuntimePlatforms(assets)
+  assert.equal(
+    platforms['win32-x64'].variants[0].url,
+    `https://github.com/tribgames/mixdog/releases/download/${VOICE_RUNTIME_TAG}/whisper-server-win32-x64-vulkan.zip`,
+  )
+})
+
+test('voice runtime release lookup finds an authenticated untagged draft', async (t) => {
+  const originalFetch = globalThis.fetch
+  t.after(() => {
+    globalThis.fetch = originalFetch
+  })
+  const requests = []
+  globalThis.fetch = async (url) => {
+    requests.push(String(url))
+    if (String(url).includes('/releases/tags/')) {
+      return new Response(null, { status: 404 })
+    }
+    return Response.json([{
+      tag_name: VOICE_RUNTIME_TAG,
+      draft: true,
+      assets: [],
+    }])
+  }
+
+  const release = await fetchGithubRelease(
+    'tribgames/mixdog',
+    VOICE_RUNTIME_TAG,
+    'fixture-token',
+  )
+  assert.equal(release.draft, true)
+  assert.equal(release.tag_name, VOICE_RUNTIME_TAG)
+  assert.equal(requests.length, 2)
+  assert.match(requests[1], /\/releases\?per_page=100&page=1$/)
+})
+
+test('voice runtime build identity is stable and merge preserves model and ffmpeg metadata', async () => {
+  const buildHash = await voiceRuntimeBuildHash()
+  assert.match(buildHash, /^[a-f0-9]{64}$/)
+  const platforms = Object.fromEntries(VOICE_RUNTIME_CONFIG.platforms.map((platform, index) => [
+    platform.key,
+    {
+      variants: [{
+        id: platform.backend,
+        requires: null,
+        url: `https://github.com/tribgames/mixdog/releases/download/${VOICE_RUNTIME_TAG}/${platform.asset}`,
+        sha256: String(index + 1).padStart(64, '0'),
+        size: index + 1,
+        format: 'zip',
+        executable: platform.executable,
+      }],
+    },
+  ]))
+  const current = {
+    version: '1.8.4',
+    source: 'old',
+    model: { id: 'standard' },
+    ffmpeg: { version: 'b6.1.1' },
+    platforms: {},
+  }
+  const released = {
+    ...current,
+    version: VOICE_RUNTIME_CONFIG.runtimeVersion,
+    source: `ggml-org/whisper.cpp@${VOICE_RUNTIME_CONFIG.whisperCommit}`,
+    release_tag: VOICE_RUNTIME_TAG,
+    build_hash: buildHash,
+    platforms,
+  }
+  const merged = await mergeVoiceRuntimeManifest(current, released)
+  assert.strictEqual(merged.model, current.model)
+  assert.strictEqual(merged.ffmpeg, current.ffmpeg)
+  assert.deepEqual(merged.platforms, platforms)
+})

package/scripts/native-binary-arch.mjs

@@ -23,9 +23,18 @@ const PE_MACHINE = new Map([[0x8664, 'x64'], [0xaa64, 'arm64'], [0x14c, 'ia32']]
 function machOArch(buffer) {
   if (buffer.length < 8) return null
   const magic = buffer.readUInt32BE(0)
-  // Thin Mach-O: 0xfeedfacf (64-bit) / 0xfeedface (32-bit), either endianness.
-  if (magic === 0xfeedfacf || magic === 0xfeedface) return MACHO_CPU.get(buffer.readUInt32BE(4)) || null
-  if (magic === 0xcffaedfe || magic === 0xcefaedfe) return MACHO_CPU.get(buffer.readUInt32LE(4)) || null
+  // mach_header_64 is 32 bytes; mach_header is 28. Do not trust cputype until
+  // the full header extent is present.
+  if (magic === 0xfeedfacf || magic === 0xcffaedfe) {
+    if (buffer.length < 32) return null
+    const cpu = magic === 0xfeedfacf ? buffer.readUInt32BE(4) : buffer.readUInt32LE(4)
+    return MACHO_CPU.get(cpu) || null
+  }
+  if (magic === 0xfeedface || magic === 0xcefaedfe) {
+    if (buffer.length < 28) return null
+    const cpu = magic === 0xfeedface ? buffer.readUInt32BE(4) : buffer.readUInt32LE(4)
+    return MACHO_CPU.get(cpu) || null
+  }
   return null
 }
 
@@ -40,10 +49,10 @@ function machOFatArches(buffer) {
   const count = buffer.readUInt32BE(4)
   if (!count || count > 16) return null
   const entrySize = wide ? 32 : 20
+  if (buffer.length < 8 + count * entrySize) return null
   const arches = []
   for (let index = 0; index < count; index += 1) {
     const offset = 8 + index * entrySize
-    if (offset + 4 > buffer.length) return null
     const arch = MACHO_CPU.get(buffer.readUInt32BE(offset))
     if (arch) arches.push(arch)
   }
@@ -51,17 +60,26 @@ function machOFatArches(buffer) {
 }
 
 function elfArch(buffer) {
-  if (buffer.length < 20) return null
-  if (buffer.readUInt32BE(0) !== 0x7f454c46) return null
-  const littleEndian = buffer[5] === 1
+  if (buffer.length < 16 || buffer.readUInt32BE(0) !== 0x7f454c46) return null
+  const eiClass = buffer[4]
+  const eiData = buffer[5]
+  if (eiData !== 1 && eiData !== 2) return null
+  const headerSize = eiClass === 1 ? 52 : eiClass === 2 ? 64 : 0
+  if (!headerSize || buffer.length < headerSize) return null
+  const littleEndian = eiData === 1
   const machine = littleEndian ? buffer.readUInt16LE(18) : buffer.readUInt16BE(18)
-  return ELF_MACHINE.get(machine) || null
+  const arch = ELF_MACHINE.get(machine)
+  if (!arch) return null
+  const expectedClass = arch === 'ia32' ? 1 : 2
+  if (eiClass !== expectedClass) return null
+  return arch
 }
 
 function peArch(buffer) {
   if (buffer.length < 64 || buffer.readUInt16LE(0) !== 0x5a4d) return null
   const headerOffset = buffer.readUInt32LE(60)
-  if (headerOffset + 6 > buffer.length) return null
+  // IMAGE_NT_HEADERS starts at e_lfanew: 4-byte PE signature + 20-byte COFF header.
+  if (headerOffset < 64 || headerOffset + 24 > buffer.length) return null
   if (buffer.readUInt32LE(headerOffset) !== 0x00004550) return null
   return PE_MACHINE.get(buffer.readUInt16LE(headerOffset + 4)) || null
 }
@@ -83,11 +101,10 @@ export function nativeBinaryArch(buffer) {
 }
 
 /**
- * True when the artifact can run on `arch`. An unrecognized header answers
- * true: the caller is verifying compiled objects, and refusing every file it
- * cannot parse would fail builds over unrelated payloads.
+ * True when the artifact can run on `arch`. Unknown, truncated, or unsupported
+ * headers answer false so a wrong-arch or unreadable object cannot publish.
  */
 export function nativeBinaryRunsOn(buffer, arch) {
   const arches = nativeBinaryArches(buffer)
-  return arches === null || arches.includes(arch)
+  return Array.isArray(arches) && arches.includes(arch)
 }

package/scripts/native-binary-arch.test.mjs

@@ -28,9 +28,10 @@ function machOFat(cpus) {
   return buffer
 }
 
-function elf(machine) {
-  const buffer = Buffer.alloc(32)
+function elf(machine, { eiClass = 2 } = {}) {
+  const buffer = Buffer.alloc(eiClass === 1 ? 52 : 64)
   buffer.writeUInt32BE(0x7f454c46, 0)
+  buffer[4] = eiClass
   buffer[5] = 1
   buffer.writeUInt16LE(machine, 18)
   return buffer
@@ -60,16 +61,51 @@ test('universal binaries report every slice they carry', () => {
 test('ELF and PE headers are read too', () => {
   assert.equal(nativeBinaryArch(elf(0x3e)), 'x64')
   assert.equal(nativeBinaryArch(elf(0xb7)), 'arm64')
+  assert.equal(nativeBinaryArch(elf(0x03, { eiClass: 1 })), 'ia32')
   assert.equal(nativeBinaryArch(pe(0x8664)), 'x64')
   assert.equal(nativeBinaryArch(pe(0xaa64)), 'arm64')
 })
 
+test('ELF class must match the named machine', () => {
+  assert.equal(nativeBinaryArch(elf(0x3e, { eiClass: 1 })), null)
+  assert.equal(nativeBinaryRunsOn(elf(0x3e, { eiClass: 1 }), 'x64'), false)
+  assert.equal(nativeBinaryArch(elf(0xb7, { eiClass: 1 })), null)
+  assert.equal(nativeBinaryArch(elf(0x03)), null)
+})
+
 test('a foreign architecture is rejected for the target', () => {
   assert.equal(nativeBinaryRunsOn(machO({ cpu: 0x0100000c }), 'x64'), false)
   assert.equal(nativeBinaryRunsOn(elf(0x3e), 'arm64'), false)
 })
 
-test('bytes without a recognizable object header do not fail a build', () => {
+test('unknown, truncated, or unsupported headers are not architecture-compatible', () => {
   assert.equal(nativeBinaryArches(Buffer.from('#!/bin/sh\nexec node "$0"\n')), null)
-  assert.equal(nativeBinaryRunsOn(Buffer.alloc(4), 'x64'), true)
+  assert.equal(nativeBinaryRunsOn(Buffer.alloc(4), 'x64'), false)
+  assert.equal(nativeBinaryRunsOn(Buffer.from('#!/bin/sh\n'), 'arm64'), false)
+  assert.equal(nativeBinaryRunsOn(elf(0xf3), 'x64'), false)
+
+  const truncatedMachO = Buffer.alloc(8)
+  truncatedMachO.writeUInt32BE(0xcffaedfe, 0)
+  truncatedMachO.writeUInt32LE(0x01000007, 4)
+  assert.equal(nativeBinaryRunsOn(truncatedMachO, 'x64'), false)
+
+  const truncatedElf = Buffer.alloc(20)
+  truncatedElf.writeUInt32BE(0x7f454c46, 0)
+  truncatedElf[4] = 1
+  truncatedElf[5] = 1
+  truncatedElf.writeUInt16LE(0x3e, 18)
+  assert.equal(nativeBinaryRunsOn(truncatedElf, 'x64'), false)
+
+  const truncatedPe = Buffer.alloc(70)
+  truncatedPe.writeUInt16LE(0x5a4d, 0)
+  truncatedPe.writeUInt32LE(64, 60)
+  truncatedPe.writeUInt32LE(0x00004550, 64)
+  truncatedPe.writeUInt16LE(0x8664, 68)
+  assert.equal(nativeBinaryRunsOn(truncatedPe, 'x64'), false)
+
+  const truncatedFat = Buffer.alloc(12)
+  truncatedFat.writeUInt32BE(0xcafebabe, 0)
+  truncatedFat.writeUInt32BE(1, 4)
+  truncatedFat.writeUInt32BE(0x01000007, 8)
+  assert.equal(nativeBinaryRunsOn(truncatedFat, 'x64'), false)
 })

package/scripts/plan-voice-runtime-release.mjs

@@ -0,0 +1,73 @@
+import { appendFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+
+import {
+  VOICE_RUNTIME_CONFIG,
+  VOICE_RUNTIME_TAG,
+  assertVoiceRuntimeManifestIdentity,
+  compareSemver,
+  downloadReleaseAsset,
+  fetchGithubRelease,
+  sameVoiceRuntimeIdentity,
+} from './generate-voice-runtime-manifest.mjs'
+
+async function main() {
+  const repository = String(process.env.GITHUB_REPOSITORY || 'tribgames/mixdog')
+  const requestedTag = String(process.env.INPUT_TAG || '').trim()
+  if (requestedTag && requestedTag !== VOICE_RUNTIME_TAG) {
+    throw new Error(`voice runtime tag must be ${VOICE_RUNTIME_TAG}, got ${requestedTag}`)
+  }
+
+  const bundledPath = resolve('src/runtime/channels/data/voice-runtime-manifest.json')
+  const bundled = JSON.parse(await readFile(bundledPath, 'utf8'))
+  if (compareSemver(bundled.version, VOICE_RUNTIME_CONFIG.runtimeVersion) > 0) {
+    throw new Error(
+      `refusing voice runtime downgrade from ${bundled.version} to ${VOICE_RUNTIME_CONFIG.runtimeVersion}`,
+    )
+  }
+
+  const release = await fetchGithubRelease(repository, VOICE_RUNTIME_TAG, process.env.GITHUB_TOKEN, {
+    allowMissing: true,
+  })
+  let buildNeeded = true
+  let syncNeeded = true
+  let releaseState = 'missing'
+
+  if (release?.draft) {
+    releaseState = 'draft'
+  } else if (release) {
+    releaseState = 'published'
+    if (release.prerelease) throw new Error(`${VOICE_RUNTIME_TAG} must not be a prerelease`)
+    const manifestAsset = release.assets?.find((asset) => asset.name === 'voice-runtime-manifest.json')
+    if (!manifestAsset) {
+      throw new Error(`published ${VOICE_RUNTIME_TAG} has no voice-runtime-manifest.json`)
+    }
+    const released = JSON.parse(
+      (await downloadReleaseAsset(manifestAsset, process.env.GITHUB_TOKEN)).toString('utf8'),
+    )
+    await assertVoiceRuntimeManifestIdentity(released, { repository })
+    buildNeeded = false
+    syncNeeded = !sameVoiceRuntimeIdentity(bundled, released)
+  }
+
+  const values = {
+    tag: VOICE_RUNTIME_TAG,
+    version: VOICE_RUNTIME_CONFIG.runtimeVersion,
+    commit: VOICE_RUNTIME_CONFIG.whisperCommit,
+    vulkan_sdk_version: VOICE_RUNTIME_CONFIG.vulkanSdkVersion,
+    matrix: JSON.stringify(VOICE_RUNTIME_CONFIG.platforms),
+    build_needed: String(buildNeeded),
+    sync_needed: String(syncNeeded),
+  }
+  const output = process.env.GITHUB_OUTPUT
+  if (output) {
+    for (const [key, value] of Object.entries(values)) appendFileSync(output, `${key}=${value}\n`)
+  }
+  console.log(JSON.stringify({ release_state: releaseState, ...values }, null, 2))
+}
+
+main().catch((error) => {
+  console.error(error?.stack || error)
+  process.exitCode = 1
+})

package/scripts/prepare-native-assets.mjs

@@ -22,17 +22,40 @@ import { ensureTokenAddon } from '../src/runtime/agent/orchestrator/tools/token-
 
 const DEFAULT_PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
+export const NATIVE_ASSET_PLATFORMS = Object.freeze([
+  'darwin-arm64',
+  'darwin-x64',
+  'linux-arm64',
+  'linux-x64',
+  'win32-x64',
+]);
+
 export const REQUIRED_NATIVE_INSTALLERS = Object.freeze({
   graph: ensureGraphBinary,
   patch: ensurePatchBinary,
   spawn: ensureSpawnBinary,
+});
+
+export const OPTIONAL_NATIVE_INSTALLERS = Object.freeze({
   token: ensureTokenAddon,
 });
 
+export function nativeAssetPlatformKey(platform = process.platform, arch = process.arch) {
+  return `${platform}-${arch}`;
+}
+
 export async function prepareRequiredNativeAssets({
   packageRoot = DEFAULT_PACKAGE_ROOT,
-  installers = REQUIRED_NATIVE_INSTALLERS,
+  installers = { ...REQUIRED_NATIVE_INSTALLERS, ...OPTIONAL_NATIVE_INSTALLERS },
+  platform = process.platform,
+  arch = process.arch,
 } = {}) {
+  const platformKey = nativeAssetPlatformKey(platform, arch);
+  if (!NATIVE_ASSET_PLATFORMS.includes(platformKey)) {
+    throw new Error(
+      `native assets are not published for ${platformKey}; supported: ${NATIVE_ASSET_PLATFORMS.join(', ')}`,
+    );
+  }
   const root = resolve(String(packageRoot || ''));
   const target = packageNativeToolsDir(root);
   const stagingRoot = await mkdtemp(join(root, '.native-tools-install-'));
@@ -40,24 +63,42 @@ export async function prepareRequiredNativeAssets({
   const stagedToolsDir = join(stagingRoot, 'native-tools');
   try {
     await mkdir(stagedToolsDir, { recursive: true });
-    const entries = await Promise.all(
-      Object.entries(NATIVE_TOOL_FILENAMES).map(async ([name, fileName]) => {
-        const install = installers[name];
+    const installOne = async (name, fileName, { optional }) => {
+      const install = installers[name];
       if (typeof install !== 'function') {
+        if (optional) {
+          console.warn(`[native-assets] optional ${name} skipped: installer is invalid`);
+          return null;
+        }
         throw new Error(`native asset installer is invalid: ${name}`);
       }
+      try {
         const installedPath = await install(downloadDataDir);
-      if (typeof installedPath !== 'string' || installedPath.length === 0) {
-        throw new Error(`native asset installer returned no path: ${name}`);
-      }
+        if (typeof installedPath !== 'string' || installedPath.length === 0) {
+          throw new Error(`native asset installer returned no path: ${name}`);
+        }
         const destination = join(stagedToolsDir, fileName);
         await copyFile(installedPath, destination);
         if (process.platform !== 'win32' && name !== 'token') {
           await chmod(destination, 0o755);
         }
         return [name, join(target, fileName)];
-      }),
+      } catch (error) {
+        if (!optional) throw error;
+        console.warn(`[native-assets] optional ${name} skipped: ${error?.message || error}`);
+        return null;
+      }
+    };
+    const requiredEntries = await Promise.all(
+      Object.keys(REQUIRED_NATIVE_INSTALLERS).map((name) => (
+        installOne(name, NATIVE_TOOL_FILENAMES[name], { optional: false })
+      )),
     );
+    const optionalEntries = [];
+    for (const name of Object.keys(OPTIONAL_NATIVE_INSTALLERS)) {
+      const entry = await installOne(name, NATIVE_TOOL_FILENAMES[name], { optional: true });
+      if (entry) optionalEntries.push(entry);
+    }
     await rm(target, {
       recursive: true,
       force: true,
@@ -65,7 +106,7 @@ export async function prepareRequiredNativeAssets({
       retryDelay: 100,
     });
     await rename(stagedToolsDir, target);
-    return Object.fromEntries(entries);
+    return Object.fromEntries([...requiredEntries, ...optionalEntries]);
   } finally {
     // Antivirus and process scanners can briefly retain freshly copied .exe
     // handles on Windows. Cleanup must not replace the installer's real error

package/scripts/prune-embedding-runtime.mjs

@@ -99,7 +99,7 @@ export async function pruneEmbeddingRuntime(packageRoot, options = {}) {
   )))).find(Boolean)
   if (!ortRoot) throw new Error('Embedding runtime is incomplete: onnxruntime-node is unavailable')
 
-  const targetBinaryDir = join(ortRoot, 'bin', 'napi-v3', target.platform, target.arch)
+  const targetBinaryDir = join(ortRoot, 'bin', 'napi-v6', target.platform, target.arch)
   if (!(await exists(join(targetBinaryDir, 'onnxruntime_binding.node')))) {
     throw new Error(`Embedding runtime is incomplete: missing ${target.key} ONNX binding`)
   }
@@ -118,9 +118,9 @@ export async function pruneEmbeddingRuntime(packageRoot, options = {}) {
   ]))
 
   // onnxruntime-node resolves exactly:
-  // bin/napi-v3/${process.platform}/${process.arch}/onnxruntime_binding.node.
+  // bin/napi-v6/${process.platform}/${process.arch}/onnxruntime_binding.node.
   // Keep one native payload and remove every foreign OS/architecture.
-  const napiRoot = join(ortRoot, 'bin', 'napi-v3')
+  const napiRoot = join(ortRoot, 'bin', 'napi-v6')
   await removeChildrenExcept(napiRoot, new Set([target.platform]))
   await removeChildrenExcept(join(napiRoot, target.platform), new Set([target.arch]))
   await removeChildrenExcept(ortRoot, new Set([

package/scripts/sync-voice-runtime-manifest.mjs

@@ -0,0 +1,46 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+import {
+  assertVoiceRuntimeManifestIdentity,
+  compareSemver,
+} from './generate-voice-runtime-manifest.mjs'
+
+export async function mergeVoiceRuntimeManifest(current, released, options = {}) {
+  await assertVoiceRuntimeManifestIdentity(released, options)
+  if (compareSemver(current.version, released.version) > 0) {
+    throw new Error(`refusing voice runtime manifest downgrade from ${current.version} to ${released.version}`)
+  }
+  return {
+    ...current,
+    version: released.version,
+    source: released.source,
+    release_tag: released.release_tag,
+    build_hash: released.build_hash,
+    platforms: released.platforms,
+  }
+}
+
+async function main() {
+  const releasedPath = resolve(process.argv[2] || 'dist/voice-runtime-manifest.json')
+  const bundledPath = resolve(
+    process.argv[3] || 'src/runtime/channels/data/voice-runtime-manifest.json',
+  )
+  const [released, current] = await Promise.all([
+    readFile(releasedPath, 'utf8').then(JSON.parse),
+    readFile(bundledPath, 'utf8').then(JSON.parse),
+  ])
+  const repository = String(process.env.GITHUB_REPOSITORY || 'tribgames/mixdog')
+  const merged = await mergeVoiceRuntimeManifest(current, released, { repository })
+  await writeFile(bundledPath, `${JSON.stringify(merged, null, 2)}\n`)
+  console.log(`synchronized ${bundledPath} from ${releasedPath}`)
+}
+
+const invokedPath = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href : ''
+if (invokedPath === import.meta.url) {
+  main().catch((error) => {
+    console.error(error?.stack || error)
+    process.exitCode = 1
+  })
+}