ruvnet-brain 3.9.134-dev → 4.0.2

package/scripts/verify-channels.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+// scripts/verify-channels.mjs — the release-channel protocol. WALK EVERY PATH A USER WALKS.
+//
+// WHY (2026-07-17, Stuart, after a real client hit a broken install): "whenever you push it, you are
+// verifying all the aspects — the explainer page, the GitHub repo, the npm, the npx — all are working
+// flawlessly. Having people find out the experience is lousy because you didn't track it is 100%
+// unacceptable." He is right. The root failure was assuming the repo state equals the user experience
+// (see AgentDB lesson: YOUR ASSUMPTIONS = FAILURE). CI green != it works; committed != shipped;
+// pushed != the npm package is current.
+//
+// This script asserts, against the LIVE endpoints (never the repo, never a guess), that every channel
+// is current AND reachable. Exit 0 = all channels good. Exit 1 = at least one is broken/stale — and
+// the word "shipped" MUST NOT be uttered until this passes.
+//
+// Usage:
+//   node scripts/verify-channels.mjs            # check all channels against the local plugin version
+//   node scripts/verify-channels.mjs --json     # machine-readable
+//
+// Checks (each hits the real thing):
+//   1. npm registry     — `ruvnet-brain` latest dist-tag == the shipping plugin version (not stale)
+//   2. self-update path — the bundle's canonicalManifestUrl actually resolves (no 404 — Jan's bug)
+//   3. release bundle   — releases/latest/download/ruvnet-brain.zip is downloadable (HTTP 200)
+//   4. release signature— the .sig asset exists next to the bundle (auto-apply needs it)
+//   5. explainer (live) — isovision.ai serves the current major.minor AND the update one-liner
+//   6. git remote       — local HEAD is pushed to origin/main (no unpushed shipped code)
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+
+const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const JSON_OUT = process.argv.includes('--json');
+const PRE_PUSH = process.argv.includes('--pre-push'); // git pre-push hook mode: block only on what is KNOWABLE before the push
+const REPO = 'stuinfla/ruvnet-brain';
+const NPM_PKG = 'ruvnet-brain';
+const EXPLAINER = 'https://isovision.ai/ruvnet-brain/';
+
+const c = { g: (s) => `\x1b[32m${s}\x1b[0m`, r: (s) => `\x1b[31m${s}\x1b[0m`, dim: (s) => `\x1b[2m${s}\x1b[0m`, b: (s) => `\x1b[1m${s}\x1b[0m` };
+const pluginVersion = () => JSON.parse(fs.readFileSync(path.join(ROOT, 'plugin/.claude-plugin/plugin.json'), 'utf8')).version;
+const mm = (v) => (String(v).match(/^(\d+\.\d+)/) || [, '?'])[1];
+
+async function head(url, timeout = 20000) {
+  const ctl = AbortSignal.timeout(timeout);
+  try { const r = await fetch(url, { method: 'GET', redirect: 'follow', signal: ctl, headers: { 'user-agent': 'ruvnet-brain-verify' } }); return { ok: r.ok, status: r.status, r }; }
+  catch (e) { return { ok: false, status: 0, error: e.message }; }
+}
+
+const results = [];
+const check = (name, pass, detail) => { results.push({ name, pass: !!pass, detail }); };
+
+async function run() {
+  const V = pluginVersion();
+
+  // ── PRE-PUSH MODE ──────────────────────────────────────────────────────────
+  // Runs from the git pre-push hook. It can ONLY block on things knowable BEFORE the push —
+  // i.e. what I am about to ship. npm-latest and the live explainer are DOWNSTREAM of a push
+  // (publish + Vercel deploy happen after), so blocking on them here would refuse every honest
+  // push. The two things that stranded Jan and are 100% knowable now: (a) the version surfaces
+  // disagree, (b) the self-update manifest in the SOURCE.json I'm shipping 404s. Block on those.
+  if (PRE_PUSH) {
+    // a) version single-source-of-truth
+    const sv = execFileSync(process.execPath, [path.join(ROOT, 'scripts/sync-version.mjs'), '--check'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    check('version surfaces agree', /agree|✓/i.test(sv), sv.trim().split('\n').pop());
+    // b) the self-update manifest URL in the bundle SOURCE.json resolves (the exact 404 that broke --update)
+    let manifestUrl = null;
+    try { const sj = JSON.parse(fs.readFileSync(path.join(ROOT, 'kb/SOURCE.json'), 'utf8'));
+      const find = (o) => { if (!o || typeof o !== 'object') return null; if (o.canonicalManifestUrl) return o.canonicalManifestUrl; for (const k of Object.keys(o)) { const r = find(o[k]); if (r) return r; } return null; };
+      manifestUrl = find(sj); } catch { /* */ }
+    if (!manifestUrl) check('self-update manifest URL present', false, 'no canonicalManifestUrl in kb/SOURCE.json');
+    else { const h = await head(manifestUrl); check('self-update manifest resolves (no 404)', h.ok, `${manifestUrl} → HTTP ${h.status}${h.ok ? '' : '  ← would strand every --update user, exactly like Jan'}`); }
+
+    const failed = results.filter((r) => !r.pass);
+    console.log(`\n  ${c.b('pre-push gate')} ${c.dim('· shipping ' + V + ' · (npm/explainer are verified post-publish by `release.mjs --publish`)')}`);
+    for (const r of results) console.log(`   ${r.pass ? c.g('✓') : c.r('✗')} ${r.name}  ${c.dim(r.detail || '')}`);
+    if (failed.length) { console.log(`\n  ${c.r('✗ pre-push gate FAILED — push refused. Fix the above; do not --no-verify around it.')}\n`); process.exit(1); }
+    console.log(`\n  ${c.g('✓ version/channel checks passed — document currency runs next.')}\n`);
+    process.exit(0);
+  }
+
+  // 1) npm registry latest == shipping version. npm's read replicas lag a few seconds behind a fresh
+  // publish, so a single immediate `npm view` right after `release.mjs` publishes can still return the
+  // PRIOR version — a false STALE that fails an otherwise-perfect ship (hit exactly this 2026-07-18:
+  // publish succeeded, `+ ruvnet-brain@3.4.9-dev`, yet the immediate view read 3.4.8-dev). Retry with a
+  // short backoff so propagation lag is absorbed, while a publish that genuinely never landed still
+  // fails after the window. A gate that false-fails teaches you to distrust the gate — the worst outcome.
+  {
+    let latest = '', ok = false, lastErr = '';
+    const ATTEMPTS = 6; // up to ~6×5s = 30s of propagation tolerance
+    for (let i = 0; i < ATTEMPTS; i++) {
+      try {
+        latest = execFileSync('npm', ['view', NPM_PKG, 'dist-tags.latest'], { encoding: 'utf8', timeout: 30000 }).trim();
+        if (latest === V) { ok = true; break; }
+      } catch (e) { lastErr = e.message.split('\n')[0]; }
+      if (i < ATTEMPTS - 1) await new Promise((r) => setTimeout(r, 5000));
+    }
+    check('npm latest matches shipping version', ok,
+      ok ? `npm latest=${latest} · shipping=${V}`
+        : `npm latest=${latest || '(view failed: ' + lastErr + ')'} · shipping=${V}${latest && latest !== V ? '  ← STILL STALE after ~' + (ATTEMPTS * 5) + 's: run `npm publish` + `npm dist-tag add ' + NPM_PKG + '@' + V + ' latest`' : ''}`);
+  }
+
+  // 2) the self-update manifest URL actually resolves (the 404 that stranded users)
+  let manifestUrl = null;
+  try {
+    const sj = JSON.parse(fs.readFileSync(path.join(ROOT, 'kb/SOURCE.json'), 'utf8'));
+    const find = (o) => { if (!o || typeof o !== 'object') return null; if (o.canonicalManifestUrl) return o.canonicalManifestUrl; for (const k of Object.keys(o)) { const r = find(o[k]); if (r) return r; } return null; };
+    manifestUrl = find(sj);
+  } catch { /* */ }
+  if (!manifestUrl) check('self-update manifest URL present', false, 'no canonicalManifestUrl in kb/SOURCE.json');
+  else { const h = await head(manifestUrl); check('self-update manifest resolves (no 404)', h.ok, `${manifestUrl} → HTTP ${h.status}${h.ok ? '' : '  ← the exact 404 that broke --update'}`); }
+
+  // 3) release bundle downloadable
+  const bundleUrl = `https://github.com/${REPO}/releases/latest/download/ruvnet-brain.zip`;
+  { const h = await head(bundleUrl); check('release bundle downloads', h.ok, `releases/latest/…/ruvnet-brain.zip → HTTP ${h.status}`); }
+
+  // 3b) …AND IT IS THE VERSION WE ARE SHIPPING. Reachability is not currency.
+  //
+  // MEASURED 2026-07-24, and this gate reported SHIPPED while it was false. npm was moved to
+  // 3.9.50-dev by `release.mjs --publish`; the GitHub Release stayed at v3.9.18-dev from 2026-07-23,
+  // THIRTY-TWO versions behind. Every check above passed — the manifest resolved, the bundle
+  // downloaded, the signature was present — because they all ask "does the latest release respond?"
+  // and none asked "is the latest release the one we just built?" A 32-version-old bundle answers
+  // HTTP 200 perfectly well.
+  //
+  // WHY THE GAP EXISTED AT ALL: the ship path is SPLIT and nothing said so. `release.mjs --publish`
+  // publishes to npm and contains zero `gh release` calls; GitHub Releases are cut only by
+  // `self-update.mjs`, which runs from the NIGHTLY. The nightly had been aborting since 2026-07-23 on
+  // its (correct) main-only branch guard, so releases silently froze while npm advanced. Two channels,
+  // two owners, one of them broken, and a verifier that could not tell.
+  //
+  // This is the same defect shape this repo has now fixed four times in one day: a proxy measured in
+  // place of the thing (receipt-count for "is routing running", backlog-remaining for "is promotion in
+  // force", cache-exists for "is this measurement current"). Reachability is the proxy; version is the
+  // thing. Users updating via the release bundle get whatever THIS says, not whatever npm says.
+  {
+    let tag = null, err = null;
+    try {
+      const r = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+        headers: { 'User-Agent': 'ruvnet-brain-verify-channels' },
+      });
+      if (r.ok) tag = (await r.json()).tag_name || null; else err = `HTTP ${r.status}`;
+    } catch (e) { err = String(e && e.message || e); }
+    // Tags carry a leading `v`; the version does not. Compare the bare versions.
+    const bare = (s) => String(s || '').replace(/^v/, '');
+    check('GitHub Release IS the shipping version', tag != null && bare(tag) === bare(V),
+      tag == null
+        ? `could not read releases/latest (${err}) — release currency NOT verified`
+        : `release=${tag} · shipping=${V}${bare(tag) === bare(V) ? '' : `  ← ${bare(tag) !== bare(V) ? 'STALE: the release channel is behind npm. Cut the release, or users on --update stay on ' + tag : ''}`}`);
+  }
+
+  // 4) release signature present (auto-apply verifies against it)
+  { const h = await head(`${bundleUrl}.sig`); check('release signature present', h.ok, `ruvnet-brain.zip.sig → HTTP ${h.status}`); }
+
+  // 5) explainer live shows current major.minor AND the update command
+  { const h = await head(EXPLAINER);
+    if (!h.ok) check('explainer live + current', false, `${EXPLAINER} → HTTP ${h.status}`);
+    else { const html = await h.r.text().catch(() => '');
+      const bare = html.replace(/<[^>]+>/g, '').replace(/&(?:rsquo|apos|#8217|#39);/gi, "'");
+      const newIn = [...bare.matchAll(/what[’']?s new in (\d+\.\d+)/gi)].map((m) => m[1]);
+      const stale = newIn.filter((x) => x !== mm(V));
+      const hasCmd = /ruvnet-brain@latest --update --auto/.test(bare);
+      check('explainer live shows current version', stale.length === 0, stale.length ? `live still says "What's new in ${stale.join(', ')}" while ${mm(V)} ships` : `"What's new in ${mm(V)}" ✓`);
+      check('explainer live shows the update command', hasCmd, hasCmd ? 'update one-liner present' : 'the --update --auto command is MISSING from the live page');
+    }
+  }
+
+  // 6) local HEAD pushed to origin/main (no unpushed shipped code)
+  try {
+    const local = execFileSync('git', ['-C', ROOT, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+    const remote = execFileSync('git', ['-C', ROOT, 'ls-remote', 'origin', 'main'], { encoding: 'utf8' }).trim().split(/\s+/)[0];
+    check('local HEAD pushed to origin/main', local === remote, local === remote ? 'in sync' : `local ${local.slice(0, 7)} != origin ${(remote || '').slice(0, 7)} — unpushed commits`);
+  } catch (e) { check('local HEAD pushed to origin/main', false, `git check failed: ${e.message.split('\n')[0]}`); }
+
+  const failed = results.filter((r) => !r.pass);
+  if (JSON_OUT) { console.log(JSON.stringify({ version: V, ok: failed.length === 0, results }, null, 2)); process.exit(failed.length ? 1 : 0); }
+
+  console.log(`\n  ${c.b('RuvNet Brain — channel verification')} ${c.dim('· shipping ' + V)}\n`);
+  for (const r of results) console.log(`   ${r.pass ? c.g('✓') : c.r('✗')} ${r.name}\n      ${c.dim(r.detail || '')}`);
+  if (failed.length) { console.log(`\n  ${c.r('✗ ' + failed.length + ' channel(s) BROKEN or STALE — this is NOT shipped. Fix, then re-run.')}\n`); process.exit(1); }
+  console.log(`\n  ${c.g('✓ every channel is current and reachable — a user on any path gets the working, current build.')}\n`);
+  process.exit(0);
+}
+run();

package/scripts/verify-model-catalog.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+// scripts/verify-model-catalog.mjs — THE WALL for model facts.
+//
+// Every model in data/model-catalog.json must EXIST in the live OpenRouter catalog and be priced
+// correctly. A missing model, a wrong price, or a stale snapshot is a HARD FAILURE (exit 1). This is the
+// enforcement of Rule 0 for the one place it kept getting skipped: model/version claims. The fact no
+// longer lives in anyone's memory where it can be asserted lazily — it lives in verified data, and this
+// gate refuses to let a wrong or stale one through. ADR-0016.
+//
+// CI runs it offline against the committed snapshot (data/openrouter-catalog-snapshot.json, refreshed
+// nightly by refresh-model-catalog.mjs). Run with --live to check against OpenRouter directly.
+//
+// Usage: node scripts/verify-model-catalog.mjs [--live]
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
+const CATALOG = path.join(ROOT, 'data/model-catalog.json');
+const SNAPSHOT = path.join(ROOT, 'data/openrouter-catalog-snapshot.json');
+
+/** Resolve a catalog model id against the live-catalog map, tolerating bare Claude ids. */
+export function findModel(models, id) {
+  if (models[id]) return models[id];
+  if (!id.includes('/') && models['anthropic/' + id]) return models['anthropic/' + id];
+  return null;
+}
+
+/**
+ * Pure verifier: check every catalog model against a {pulledAt, models} source. Returns
+ * { ok, checked, ageDays, fails[] }. No I/O — fully unit-testable, which a wall must be.
+ */
+export function verifyCatalog(catalog, source, { now = Date.now(), maxAgeDays = 14, priceTol = 0.05 } = {}) {
+  const models = source.models || {};
+  const fails = [];
+  const ageDays = (now - new Date(source.pulledAt).getTime()) / 86400000;
+  if (!(ageDays <= maxAgeDays)) fails.push(`STALE: source pulled ${source.pulledAt} (${ageDays.toFixed(1)}d old > ${maxAgeDays}d) — run refresh-model-catalog.mjs`);
+
+  let checked = 0;
+  for (const [pid, p] of Object.entries(catalog.providers || {})) {
+    if (p.aliasOf) continue;
+    // Every provider MUST have a verified frontier (the personalized escalation + savings baseline);
+    // mid/cheap are optional because real provider lineups vary in depth (e.g. xAI has no budget SKU).
+    if (!p.frontier) fails.push(`INCOMPLETE: ${pid} has no frontier tier`);
+    for (const tier of ['frontier', 'mid', 'cheap']) {
+      const e = p[tier];
+      if (!e) continue;
+      checked++;
+      const live = findModel(models, e.model);
+      if (!live) { fails.push(`MISSING: ${pid}.${tier} "${e.model}" is NOT in the live OpenRouter catalog`); continue; }
+      for (const k of ['in', 'out']) {
+        const rel = live[k] === 0 ? (e[k] === 0 ? 0 : 1) : Math.abs(e[k] - live[k]) / live[k];
+        if (rel > priceTol) fails.push(`PRICE: ${pid}.${tier} "${e.model}" ${k} = catalog $${e[k]} vs live $${live[k]} (${(rel * 100).toFixed(0)}% off)`);
+      }
+    }
+  }
+  return { ok: fails.length === 0, checked, ageDays, fails };
+}
+
+function loadKey() {
+  if (process.env.OPENROUTER_API_KEY) return process.env.OPENROUTER_API_KEY;
+  try {
+    const env = fs.readFileSync(path.join(ROOT, '.env'), 'utf8');
+    const m = env.match(/^OPENROUTER_API_KEY=(.+)$/m);
+    if (m) return m[1].trim().replace(/^["']|["']$/g, '');
+  } catch { /* none */ }
+  return null;
+}
+
+async function liveSource() {
+  const key = loadKey();
+  const res = await fetch('https://openrouter.ai/api/v1/models', { headers: key ? { Authorization: `Bearer ${key}` } : {} });
+  if (!res.ok) throw new Error(`OpenRouter /models HTTP ${res.status}`);
+  const data = (await res.json()).data || [];
+  const models = {};
+  for (const m of data) { const p = m.pricing || {}; models[m.id] = { in: +(+p.prompt * 1e6).toFixed(4), out: +(+p.completion * 1e6).toFixed(4) }; }
+  return { pulledAt: new Date().toISOString(), models };
+}
+
+export async function main(argv = process.argv) {
+  const live = argv.includes('--live');
+  const catalog = JSON.parse(fs.readFileSync(CATALOG, 'utf8'));
+  let source;
+  if (live) source = await liveSource();
+  else {
+    if (!fs.existsSync(SNAPSHOT)) { console.error('✗ no snapshot — run: node scripts/refresh-model-catalog.mjs'); process.exit(1); }
+    const s = JSON.parse(fs.readFileSync(SNAPSHOT, 'utf8'));
+    source = { pulledAt: s._meta.pulledAt, models: s.models };
+  }
+  const r = verifyCatalog(catalog, source);
+  if (!r.ok) {
+    console.error(`\n✗ model-catalog verification FAILED — ${r.fails.length} issue(s) [source: ${live ? 'LIVE OpenRouter' : 'snapshot'} @ ${source.pulledAt}]:`);
+    for (const f of r.fails) console.error('  - ' + f);
+    console.error('\nA model fact cannot ship unless it is verified live. Fix data/model-catalog.json (or refresh the snapshot).');
+    process.exit(1);
+  }
+  console.log(`✓ model-catalog VERIFIED: ${r.checked} model facts match the ${live ? 'LIVE OpenRouter' : 'committed snapshot'} catalog (pulled ${source.pulledAt}, ${r.ageDays.toFixed(1)}d old ≤ 14d).`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((e) => { console.error('verify-model-catalog error:', e.message); process.exit(1); });
+}

package/scripts/verify-nightly-close-issue4.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# verify-nightly-close-issue4.sh — one-shot morning check for issue #4 (runs 07:17, then removes itself).
+# Closes the issue ONLY on proof: releases/latest must have ADVANCED past v0.5.0-dev within the last
+# 24h (i.e., tonight's 3:15 publish worked). Otherwise it posts the honest failure and stays open.
+set -u
+export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+cd /Users/stuartkerr/Code/ruvnet-brain || exit 1
+LOG=logs/issue4-verify.log
+{
+  echo "[$(date '+%Y-%m-%dT%H:%M:%S')] checking releases/latest"
+  TAG=$(gh release view --json tagName -q .tagName 2>/dev/null)
+  PUB=$(gh release view --json publishedAt -q .publishedAt 2>/dev/null)
+  echo "  latest: $TAG published $PUB"
+  FRESH=0
+  if [ -n "$PUB" ] && [ "$TAG" != "v0.5.0-dev" ]; then # sync-version-ignore: the stale BUNDLE tag being compared against, not a product version
+    AGE=$(( $(date +%s) - $(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$PUB" +%s 2>/dev/null || echo 0) ))
+    [ "$AGE" -gt 0 ] && [ "$AGE" -lt 86400 ] && FRESH=1
+  fi
+  if [ "$FRESH" = "1" ]; then
+    # The full professional close note, with the real receipt substituted in at close time.
+    NOTE=$(sed -e "s/__TAG__/${TAG}/g" -e "s|__PUB__|${PUB}|g" scripts/issue4-close-note.md)
+    gh issue close 4 --comment "$NOTE"
+    echo "  CLOSED issue #4 with the full note (tag=$TAG)"
+  else
+    gh issue comment 4 --body "Honest status: the overnight publish did **not** advance releases/latest (still $TAG). The PATH fix is in but something else is failing — investigating; leaving this open. Log: logs/nightly.log"
+    echo "  release did NOT advance — commented, left open"
+  fi
+  launchctl bootout "gui/$(id -u)/com.ruvnet.issue4-verify" 2>/dev/null
+  rm -f "$HOME/Library/LaunchAgents/com.ruvnet.issue4-verify.plist"
+  echo "  one-shot agent removed"
+} >> "$LOG" 2>&1

package/scripts/version.mjs

@@ -0,0 +1,40 @@
+// version.mjs — THE single source of truth for the product version (SEC-0010 #2 / ADR-0009 decision 1).
+// plugin/.claude-plugin/plugin.json `version` is the one hand-edited number. EVERY other surface
+// (installer, stamp, bundle, README, manifest, npm package) inherits it — at runtime via getVersion()
+// for code paths, or written once by sync-version.mjs for files that must carry a literal.
+// Never hardcode a version string anywhere else; scripts/sync-version.mjs --check fails the build if you do.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const PLUGIN_JSON = path.join(ROOT, 'plugin', '.claude-plugin', 'plugin.json');
+
+/** The product version, e.g. "1.9.1-dev" — read live from the single source of truth. */
+export function getVersion() {
+  const v = JSON.parse(fs.readFileSync(PLUGIN_JSON, 'utf8')).version;
+  if (!v || typeof v !== 'string') throw new Error(`no version in ${PLUGIN_JSON}`);
+  return v;
+}
+
+/** The product version with a leading "v", e.g. "v1.9.1-dev" (Release-tag form). */
+export function getVersionTag() {
+  return `v${getVersion()}`;
+}
+
+/**
+ * Strip the Release-tag "v" so a value is safe to write into a version FIELD.
+ *
+ * There are two legitimate forms of the same number: the Release tag (`v1.14.1-dev`, used for git
+ * tags, Release URLs and human stamps) and the bare literal (`1.14.1-dev`, used in package.json and
+ * every other version field). sync-version.mjs owns the fields and compares them bare. brain-stamp
+ * and build-bundle both carried the TAG into `data/manifest.json.brainVersion`, so `--check` went
+ * red on a clean tree, every time either ran — two writers, two formats, a contradiction no amount
+ * of re-syncing could settle. Cross the boundary once, here.
+ */
+export const stripTag = (v) => String(v).replace(/^v/, '');
+
+// CLI: `node scripts/version.mjs` prints the version (handy for shell scripts).
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.stdout.write(getVersion() + '\n');
+}