diff --git a/README.md b/README.md
index 27652cd..cb9b8fa 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,8 @@ const identity = resolveBuildIdentity(process.cwd(), 'exadev/build-identity');
 // { kind: 'commit', version: 'a1b2c3d', url: 'https://github.com/exadev/build-identity/commit/a1b2c3d4e5f6...', date: '2026-09-08T09:12:03+01:00', commit: 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2' }
 ```
 
+The same thing is available as a command, for build and deploy steps that cannot import anything -- see [`build-identity` (CLI)](#build-identity-cli).
+
 ## `resolveBuildIdentity(repoRoot, repoSlug, options?)`
 
 ```ts
@@ -116,10 +118,99 @@ const predictedVersion = await predictNextVersion(process.cwd(), releaseRules, a
 const identity = resolvePredictedIdentity(build, predictedVersion);
 ```
 
+## `build-identity` (CLI)
+
+The same three functions, wired together, as a command. It exists for build and deploy steps that are a shell invocation rather than a JavaScript config file, so nothing in them can `import` this package at all -- `wrangler deploy --var RELEASE_VERSION:...` being the case it was built for. A step that *is* a JavaScript config file (`next.config.ts`, `vite.config.ts`) should import the functions directly instead; see [Framework-agnosticism](#framework-agnosticism) below.
+
+```sh
+pnpm add -D @exadev/build-identity
+pnpm exec build-identity --repo exadev/build-identity
+```
+
+```
+Usage: build-identity [options]
+
+Options:
+  -V, --version                output the version number
+  --repo <owner/repo>          GitHub slug used to build the release and commit URLs
+  --root <directory>           git working tree to inspect (default: the current working directory)
+  --tag-name <template>        tag name marking a release, with {version} standing in for the version (default: v{version})
+  --predict                    also predict the version this commit's next release would be
+  --release-rules <json>       commit-analyzer release rules for --predict, as a JSON array
+  --release-rules-file <path>  file holding the same JSON array as --release-rules
+  --format <format>            output format: json or env (default: "json")
+  --prefix <prefix>            prepended to each variable name in --format env (default: "BUILD_")
+  --verbose                    send commit-analyzer's own per-commit narration to stderr
+  -h, --help                   display help for command
+```
+
+`--repo` is the only required flag, and the command's whole output is a single `DisplayIdentity` on stdout:
+
+```sh
+$ build-identity --repo exadev/build-identity
+{
+  "kind": "commit",
+  "version": "a1b2c3d",
+  "url": "https://github.com/exadev/build-identity/commit/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
+  "date": "2026-09-08T09:12:03+01:00",
+  "commit": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
+}
+```
+
+Those are exactly the five fields `DisplayIdentity` declares, under exactly its own names -- there is no CLI-specific shape and no consumer-specific naming. In particular there is no separate `predicted` boolean: `kind` is already `"predicted"` in precisely that case, and a second field asserting the same fact would just be one more thing that could disagree with the first.
+
+### Prediction
+
+`--predict` adds the `predictNextVersion` step, turning an unreleased build's short commit hash into the version that commit would release as. It is opt-in rather than automatic because it costs something real: it needs `@semantic-release/commit-analyzer` (this package's optional peer dependency) to be installed, and it reads every commit since the last tag.
+
+Release rules are yours, not this package's -- your repo's commit-type-to-release-level convention is real configuration, and nothing here invents a default for it. Pass them inline, or from a file when quoting a full rule set through YAML and a shell gets unreadable:
+
+```sh
+build-identity --repo exadev/build-identity --predict \
+  --release-rules '[{"breaking":true,"release":"major"},{"type":"feat","release":"minor"},{"type":"fix","release":"patch"}]'
+
+build-identity --repo exadev/build-identity --predict --release-rules-file release-rules.json
+```
+
+A confirmed release still wins outright: on a commit an actual release tag points at, `--predict` changes nothing at all.
+
+### `--format env`
+
+```sh
+$ build-identity --repo exadev/build-identity --format env --prefix RELEASE_
+RELEASE_KIND=commit
+RELEASE_VERSION=a1b2c3d
+RELEASE_URL=https://github.com/exadev/build-identity/commit/a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
+RELEASE_DATE=2026-09-08T09:12:03+01:00
+RELEASE_COMMIT=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
+```
+
+The variable names are the same generic field names, upper-cased, behind a prefix of your choosing. This format is deliberately additional surface rather than "emit JSON and document a `jq` one-liner": appending to `$GITHUB_ENV` is the realistic use for both of the cases that motivated this CLI, and the one-liner alternative would put a `jq` dependency and a quoting-sensitive shell expression into every consumer's workflow to produce output this package can simply print. A value containing a line break is refused outright rather than emitted, since it would silently swallow or inject `$GITHUB_ENV` entries.
+
+```yaml
+- name: Resolve the build's identity
+  run: pnpm exec build-identity --repo my-org/my-repo --predict --release-rules-file release-rules.json --format env --prefix RELEASE_ >> "$GITHUB_ENV"
+
+- name: Deploy
+  run: wrangler deploy --var RELEASE_VERSION:$RELEASE_VERSION --var RELEASE_COMMIT:$RELEASE_COMMIT
+```
+
+Where a repo's own variable names differ from the generic ones, map them in that repo's own workflow rather than expecting this package to know them -- `--prefix` covers most of it, and `jq` covers the rest:
+
+```sh
+echo "MY_OWN_VERSION_NAME=$(build-identity --repo my-org/my-repo | jq -r .version)" >> "$GITHUB_ENV"
+```
+
+`--verbose` routes commit-analyzer's own per-commit narration to **stderr**, never stdout, so it is always safe to pipe or capture stdout while debugging why a prediction came out as it did.
+
+The CLI is the one part of this package with a runtime dependency (`commander`, itself dependency-free). It is bundled into `dist/cli.js` alone: importing the library never loads it. It stays on `commander@14` deliberately, rather than the newest major: `commander@15` raises its own floor to Node 22.12, which would contradict this package's declared `engines` of Node 20 and upwards. Raise it alongside that floor, not before it.
+
 ## Framework-agnosticism
 
 This package does pure Node.js filesystem and git access only -- no bundler, framework, or UI assumptions. Wiring its result into a running app is a build-time concern for whichever bundler that app already uses, done in that bundler's own config file, not in this package.
 
+**A config file that is itself JavaScript does not need the CLI** -- it can import the functions directly, which is both simpler and better typed than shelling out and parsing JSON back. Reach for `build-identity` (above) only where there is genuinely nothing to import from: a `wrangler deploy --var ...` line, a `docker build --build-arg ...` line, a plain `sh` deploy script.
+
 ### Next.js
 
 ```ts
diff --git a/package.json b/package.json
index 3c14dcb..5df16ac 100644
--- a/package.json
+++ b/package.json
@@ -12,6 +12,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "bin": {
+    "build-identity": "./dist/cli.js"
+  },
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -33,7 +36,8 @@
     "version",
     "git",
     "release",
-    "commit"
+    "commit",
+    "cli"
   ],
   "repository": {
     "type": "git",
@@ -80,5 +84,8 @@
     "prepublishOnly": "pnpm run lint && pnpm run typecheck && pnpm run test && tsdown && publint && attw --pack",
     "prepare": "husky",
     "release": "semantic-release"
+  },
+  "dependencies": {
+    "commander": "^14.0.3"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 27572e9..8b48ddc 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,6 +25,10 @@ overrides:
 importers:
 
   .:
+    dependencies:
+      commander:
+        specifier: ^14.0.3
+        version: 14.0.3
     devDependencies:
       '@arethetypeswrong/cli':
         specifier: 0.18.5
@@ -1011,6 +1015,10 @@ packages:
     resolution: {integrity: sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==}
     engines: {node: '>=14'}
 
+  commander@14.0.3:
+    resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
+    engines: {node: '>=20'}
+
   compare-func@2.0.0:
     resolution: {integrity: sha512-zHig5N+tPWARooBnb0Zx1MFcdfpyJrfTJ3Y5L+IFvUm8rM74hHz66z0gw0x4tijh5CorKkKUCnW82R2vmpeCRA==}
 
@@ -3527,6 +3535,8 @@ snapshots:
 
   commander@10.0.1: {}
 
+  commander@14.0.3: {}
+
   compare-func@2.0.0:
     dependencies:
       array-ify: 1.0.0
diff --git a/src/cli-program.test.ts b/src/cli-program.test.ts
new file mode 100644
index 0000000..3f4c8dc
--- /dev/null
+++ b/src/cli-program.test.ts
@@ -0,0 +1,182 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { afterEach, describe, expect, it } from 'vitest';
+import type { Command } from 'commander';
+import { createProgram, DEFAULT_ENV_PREFIX, runBuildIdentity, type CliFlags } from './cli-program';
+import { defaultTagName } from './package-version';
+import type { ReleaseRule } from './predict-next-version';
+import { createTestRepo, type TestRepo } from './test-repo';
+
+const COMMIT_TYPE_RULES: readonly ReleaseRule[] = [
+  { breaking: true, release: 'major' },
+  { type: 'feat', release: 'minor' },
+  { type: 'fix', release: 'patch' },
+  { type: 'chore', release: false },
+];
+
+/** Turns commander's own report-and-exit behaviour into a throw, and discards its usage output, so a parse failure is assertable rather than killing the test process. */
+function silentProgram(): Command {
+  const program = createProgram();
+  program.exitOverride();
+  program.configureOutput({ writeOut: () => undefined, writeErr: () => undefined });
+  return program;
+}
+
+async function parseArgs(...args: readonly string[]): Promise<Command> {
+  return silentProgram().parseAsync([...args], { from: 'user' });
+}
+
+function flags(overrides: Partial<CliFlags> & Pick<CliFlags, 'repo' | 'root'>): CliFlags {
+  return {
+    tagName: defaultTagName,
+    predict: undefined,
+    releaseRules: undefined,
+    releaseRulesFile: undefined,
+    format: 'json',
+    prefix: DEFAULT_ENV_PREFIX,
+    verbose: undefined,
+    ...overrides,
+  };
+}
+
+describe('createProgram defaults', () => {
+  it('defaults root to the current working directory, format to json, and prefix to BUILD_', () => {
+    const opts = createProgram().opts<CliFlags>();
+    expect(opts.root).toBe(process.cwd());
+    expect(opts.format).toBe('json');
+    expect(opts.prefix).toBe(DEFAULT_ENV_PREFIX);
+  });
+
+  it('defaults the tag name to the same v-prefixed convention the library itself defaults to', () => {
+    expect(createProgram().opts<CliFlags>().tagName('1.4.0')).toBe(defaultTagName('1.4.0'));
+  });
+});
+
+describe('createProgram argument parsing', () => {
+  it('requires --repo', async () => {
+    await expect(parseArgs()).rejects.toThrow(/--repo/);
+  });
+
+  it('rejects an unknown --format', async () => {
+    await expect(parseArgs('--repo', 'exadev/example', '--format', 'yaml')).rejects.toThrow(/--format must be one of/);
+  });
+
+  it('rejects a --prefix that would not be a legal variable name', async () => {
+    await expect(parseArgs('--repo', 'exadev/example', '--prefix', '1BUILD_')).rejects.toThrow(/--prefix/);
+  });
+
+  it('rejects a --tag-name template with no {version} placeholder', async () => {
+    await expect(parseArgs('--repo', 'exadev/example', '--tag-name', 'latest')).rejects.toThrow(/\{version\}/);
+  });
+
+  it('rejects --release-rules that is not valid JSON', async () => {
+    await expect(parseArgs('--repo', 'exadev/example', '--release-rules', '[{')).rejects.toThrow(/--release-rules is not valid JSON/);
+  });
+
+  it('rejects --release-rules holding something other than release rules', async () => {
+    await expect(parseArgs('--repo', 'exadev/example', '--release-rules', '[{"type":"feat","release":"huge"}]')).rejects.toThrow(/entry 0 must be/);
+  });
+
+  it('turns a --tag-name template into the substituting function both library calls receive', () => {
+    // parseOptions rather than parseAsync: this asserts the option coercion alone, without also running the action against a real repository.
+    const program = silentProgram();
+    program.parseOptions(['--repo', 'exadev/example', '--tag-name', 'release-{version}']);
+    expect(program.opts<CliFlags>().tagName('2.0.0')).toBe('release-2.0.0');
+  });
+});
+
+describe('runBuildIdentity', () => {
+  let repo: TestRepo | undefined;
+
+  afterEach(() => {
+    repo?.cleanup();
+    repo = undefined;
+  });
+
+  it('reports a commit identity as JSON when no tag points at HEAD', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root })));
+    expect(parsed).toMatchObject({ kind: 'commit', url: expect.stringContaining('https://github.com/exadev/example/commit/') as unknown });
+  });
+
+  it('reports a release identity when the release tag points at HEAD', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root })));
+    expect(parsed).toMatchObject({ kind: 'release', version: '1.4.0' });
+  });
+
+  it('honours a caller-supplied tag convention for both the release check and the prediction base', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '2.0.0' });
+    repo.tag('release-2.0.0');
+    repo.commit('feat: add a thing');
+    const output = await runBuildIdentity(
+      flags({ repo: 'exadev/example', root: repo.root, tagName: (version) => `release-${version}`, predict: true, releaseRules: COMMIT_TYPE_RULES }),
+    );
+    expect(JSON.parse(output)).toMatchObject({ kind: 'predicted', version: '2.1.0' });
+  });
+
+  it('shows the predicted next version instead of a commit hash when --predict is given', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    repo.commit('feat: add a thing');
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRules: COMMIT_TYPE_RULES })));
+    expect(parsed).toMatchObject({ kind: 'predicted', version: '1.5.0' });
+  });
+
+  it('falls back to the commit identity when --predict finds nothing release-worthy', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    repo.commit('chore: tidy up');
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRules: COMMIT_TYPE_RULES })));
+    expect(parsed).toMatchObject({ kind: 'commit' });
+  });
+
+  it('never lets a prediction override a confirmed release', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRules: COMMIT_TYPE_RULES })));
+    expect(parsed).toMatchObject({ kind: 'release', version: '1.4.0' });
+  });
+
+  it('reads rules from --release-rules-file', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    repo.commit('fix: correct a thing');
+    const rulesFile = join(repo.root, 'release-rules.json');
+    writeFileSync(rulesFile, JSON.stringify(COMMIT_TYPE_RULES));
+    const parsed: unknown = JSON.parse(await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRulesFile: rulesFile })));
+    expect(parsed).toMatchObject({ kind: 'predicted', version: '1.4.1' });
+  });
+
+  it('names the file in a --release-rules-file read failure', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    const missing = join(repo.root, 'absent.json');
+    await expect(runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRulesFile: missing }))).rejects.toThrow(/could not be read/);
+  });
+
+  it('rejects both rule sources at once rather than silently preferring one', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    await expect(
+      runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true, releaseRules: COMMIT_TYPE_RULES, releaseRulesFile: 'rules.json' })),
+    ).rejects.toThrow(/pass one, not both/);
+  });
+
+  it('rejects --predict with no rules, rather than predicting against a rule set this package invented', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    await expect(runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, predict: true }))).rejects.toThrow(/--release-rules/);
+  });
+
+  it('rejects rules supplied without --predict, rather than accepting a flag that would do nothing', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    await expect(runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, releaseRules: COMMIT_TYPE_RULES }))).rejects.toThrow(/only take effect with --predict/);
+  });
+
+  it('emits prefixed KEY=VALUE lines in env format', async () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    const lines = (await runBuildIdentity(flags({ repo: 'exadev/example', root: repo.root, format: 'env', prefix: 'RELEASE_' }))).split('\n');
+    expect(lines[0]).toBe('RELEASE_KIND=release');
+    expect(lines[1]).toBe('RELEASE_VERSION=1.4.0');
+  });
+});
diff --git a/src/cli-program.ts b/src/cli-program.ts
new file mode 100644
index 0000000..e20e3a6
--- /dev/null
+++ b/src/cli-program.ts
@@ -0,0 +1,144 @@
+import { readFileSync } from 'node:fs';
+import { format } from 'node:util';
+import { Command, InvalidArgumentError, Option } from 'commander';
+// resolveJsonModule lets rolldown (via tsdown) inline this package's own declared version straight into the bundle at build time -- no runtime fs read.
+import { version as packageVersion } from '../package.json';
+import { formatIdentity, isEnvPrefix, isOutputFormat, OUTPUT_FORMATS, type OutputFormat } from './format-identity';
+import { loadCommitAnalyzer } from './load-commit-analyzer';
+import { defaultTagName } from './package-version';
+import { parseReleaseRules } from './parse-release-rules';
+import { predictNextVersion, type PredictNextVersionOptions, type ReleaseRule } from './predict-next-version';
+import { resolveBuildIdentity } from './resolve-build-identity';
+import { resolvePredictedIdentity } from './resolve-predicted-identity';
+
+const VERSION_PLACEHOLDER = '{version}';
+export const DEFAULT_TAG_TEMPLATE = `v${VERSION_PLACEHOLDER}`;
+export const DEFAULT_ENV_PREFIX = 'BUILD_';
+
+/** `predictNextVersion` narrates through a caller-supplied logger and explicitly warns against routing it to stdout, which carries the machine-readable result. `--verbose` sends it to stderr instead, so a CI step can see why a prediction came out the way it did without contaminating what the next step parses. */
+const STDERR_LOGGER = {
+  log: (...args: readonly unknown[]): void => { writeStderr(args); },
+  error: (...args: readonly unknown[]): void => { writeStderr(args); },
+};
+
+// node:util's format, not a plain join: commit-analyzer narrates with printf-style placeholders ("Analyzing commit: %s", message), which any other joining strategy would leave in the output verbatim next to the value meant to replace them.
+function writeStderr(args: readonly unknown[]): void {
+  process.stderr.write(`${format(...args)}\n`);
+}
+
+/**
+ * A `{version}` template rather than a function, since a command line cannot carry one: `resolveBuildIdentity` and `predictNextVersion` are both given the same resulting function, keeping "which tag marks a release" one convention across the two calls exactly as the library's own docs advise.
+ */
+function parseTagTemplate(template: string): (version: string) => string {
+  if (!template.includes(VERSION_PLACEHOLDER)) {
+    throw new InvalidArgumentError(`--tag-name must contain the ${VERSION_PLACEHOLDER} placeholder, got: ${JSON.stringify(template)}`);
+  }
+  return (version: string): string => template.replaceAll(VERSION_PLACEHOLDER, version);
+}
+
+function parseFormat(value: string): OutputFormat {
+  if (!isOutputFormat(value)) {
+    throw new InvalidArgumentError(`--format must be one of: ${OUTPUT_FORMATS.join(', ')}`);
+  }
+  return value;
+}
+
+function parsePrefix(value: string): string {
+  if (!isEnvPrefix(value)) {
+    throw new InvalidArgumentError(`--prefix must be empty or a legal variable-name prefix ([A-Za-z_][A-Za-z0-9_]*), got: ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+
+function parseInlineReleaseRules(value: string): ReleaseRule[] {
+  try {
+    return parseReleaseRules(value, '--release-rules');
+  } catch (cause) {
+    throw new InvalidArgumentError(cause instanceof Error ? cause.message : String(cause));
+  }
+}
+
+export interface CliFlags {
+  readonly repo: string;
+  readonly root: string;
+  readonly tagName: (version: string) => string;
+  readonly predict: boolean | undefined;
+  readonly releaseRules: readonly ReleaseRule[] | undefined;
+  readonly releaseRulesFile: string | undefined;
+  readonly format: OutputFormat;
+  readonly prefix: string;
+  readonly verbose: boolean | undefined;
+}
+
+function readReleaseRulesFile(path: string): ReleaseRule[] {
+  let raw: string;
+  try {
+    raw = readFileSync(path, 'utf8');
+  } catch (cause) {
+    throw new Error(`--release-rules-file ${path} could not be read: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+  }
+  return parseReleaseRules(raw, `--release-rules-file ${path}`);
+}
+
+/**
+ * The whole CLI as a function of its already-parsed flags: resolves the identity and returns the exact text the command prints, so the wiring between the library's three functions is testable without a subprocess and without capturing stdout.
+ *
+ * Prediction is gated behind `--predict` rather than inferred: it needs `@semantic-release/commit-analyzer`, an optional peer dependency of this package, and reads the whole commit range since the last tag. Both are real costs a caller that only wants `resolveBuildIdentity`'s answer should not silently pay.
+ */
+export async function runBuildIdentity(flags: CliFlags): Promise<string> {
+  if (flags.releaseRules !== undefined && flags.releaseRulesFile !== undefined) {
+    throw new Error('--release-rules and --release-rules-file are alternatives; pass one, not both');
+  }
+
+  const rules = flags.releaseRules ?? (flags.releaseRulesFile === undefined ? undefined : readReleaseRulesFile(flags.releaseRulesFile));
+
+  if (flags.predict === true && rules === undefined) {
+    throw new Error('--predict needs this repo\'s own commit-type release rules: pass --release-rules or --release-rules-file');
+  }
+  if (flags.predict !== true && rules !== undefined) {
+    throw new Error('--release-rules/--release-rules-file only take effect with --predict, which was not passed');
+  }
+
+  const build = resolveBuildIdentity(flags.root, flags.repo, { tagName: flags.tagName });
+
+  let predictedVersion: string | undefined;
+  if (rules !== undefined) {
+    const options: PredictNextVersionOptions = { tagName: flags.tagName, ...(flags.verbose === true ? { logger: STDERR_LOGGER } : {}) };
+    predictedVersion = await predictNextVersion(flags.root, rules, await loadCommitAnalyzer(), options);
+  }
+
+  return formatIdentity(resolvePredictedIdentity(build, predictedVersion), { format: flags.format, prefix: flags.prefix });
+}
+
+/**
+ * Builds the commander program without parsing argv or exiting the process, so the command tree stays testable in isolation. There is no subcommand: the package does exactly one thing, and a subcommand naming it again would be pure ceremony.
+ */
+export function createProgram(): Command {
+  const program = new Command('build-identity');
+  program.description("Resolve a build's true identity -- a real, already-tagged release, or the commit it was built from -- from live git state, with an optional predicted-version display layer.");
+  program.version(packageVersion);
+
+  program.requiredOption('--repo <owner/repo>', 'GitHub slug used to build the release and commit URLs, e.g. exadev/build-identity');
+  program.addOption(
+    new Option('--root <directory>', 'git working tree to inspect; must contain package.json at its root').default(process.cwd(), 'the current working directory'),
+  );
+  // The default is described rather than shown: commander renders a default value through JSON.stringify, which turns the tagName function into nothing at all.
+  program.addOption(
+    new Option('--tag-name <template>', `tag name marking a release, with ${VERSION_PLACEHOLDER} standing in for the version`)
+      .argParser(parseTagTemplate)
+      .default(defaultTagName, DEFAULT_TAG_TEMPLATE),
+  );
+  program.option('--predict', "also predict the version this commit's next release would be, and show that instead of a bare commit hash when there is no release tag on HEAD");
+  program.option('--release-rules <json>', 'commit-analyzer release rules for --predict, as a JSON array', parseInlineReleaseRules);
+  program.option('--release-rules-file <path>', 'file holding the same JSON array as --release-rules, for a rule set too awkward to quote inline');
+  // parseFormat rather than commander's own .choices(), so the parsed value is genuinely narrowed to OutputFormat rather than left a bare string that only happens to be one of them.
+  program.option('--format <format>', `output format: ${OUTPUT_FORMATS.join(' or ')}`, parseFormat, 'json');
+  program.option('--prefix <prefix>', 'prepended to each variable name in --format env', parsePrefix, DEFAULT_ENV_PREFIX);
+  program.option('--verbose', "send commit-analyzer's own per-commit narration to stderr");
+
+  program.action(async (flags: CliFlags) => {
+    process.stdout.write(`${await runBuildIdentity(flags)}\n`);
+  });
+
+  return program;
+}
diff --git a/src/cli.e2e.test.ts b/src/cli.e2e.test.ts
new file mode 100644
index 0000000..8a00587
--- /dev/null
+++ b/src/cli.e2e.test.ts
@@ -0,0 +1,133 @@
+import { execFileSync, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import { afterEach, beforeAll, describe, expect, it } from 'vitest';
+import { createTestRepo, type TestRepo } from './test-repo';
+
+const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url));
+const CLI_PATH = join(PACKAGE_ROOT, 'dist', 'cli.js');
+const TSDOWN_PATH = join(PACKAGE_ROOT, 'node_modules', '.bin', 'tsdown');
+
+/** Generous: this hook runs a real bundler, on a cold cache, on whatever CI runner or laptop happens to be executing the suite. */
+const BUILD_TIMEOUT_MS = 180_000;
+/** git's own default `--short` length, which `resolveBuildIdentity` reports verbatim as an unreleased build's version. */
+const SHORT_SHA_LENGTH = 7;
+/** The `env` format emits exactly one line per DisplayIdentity field: kind, version, url, date, commit. */
+const IDENTITY_FIELD_COUNT = 5;
+
+const RULES = JSON.stringify([
+  { breaking: true, release: 'major' },
+  { type: 'feat', release: 'minor' },
+  { type: 'chore', release: false },
+]);
+
+interface CliResult {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+function runCli(...args: readonly string[]): CliResult {
+  const result = spawnSync(process.execPath, [CLI_PATH, ...args], { encoding: 'utf8' });
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+}
+
+describe('build-identity CLI, as actually built and executed', () => {
+  let repo: TestRepo | undefined;
+
+  beforeAll(() => {
+    // This suite exercises the real bin script, so it has to run against a real build rather than the TypeScript sources: shebang, bundling, the inlined package version and the bin's own exit codes are all properties of the built artefact only. Building here rather than depending on a prior `pnpm build` keeps `pnpm test` self-contained and, more importantly, guarantees the binary under test is the current source rather than whatever a previous build happened to leave in dist.
+    execFileSync(TSDOWN_PATH, { cwd: PACKAGE_ROOT, encoding: 'utf8', stdio: 'pipe' });
+  }, BUILD_TIMEOUT_MS);
+
+  afterEach(() => {
+    repo?.cleanup();
+    repo = undefined;
+  });
+
+  it('prints its own version', () => {
+    const result = runCli('--version');
+    expect(result.status).toBe(0);
+    expect(result.stdout.trim()).toMatch(/^\d+\.\d+\.\d+/);
+  });
+
+  it('prints a commit identity as JSON on stdout, and nothing on stderr', () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    const headSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repo.root, encoding: 'utf8' }).trim();
+
+    const result = runCli('--repo', 'exadev/example', '--root', repo.root);
+
+    expect(result.status).toBe(0);
+    expect(result.stderr).toBe('');
+    expect(JSON.parse(result.stdout)).toEqual({
+      kind: 'commit',
+      version: headSha.slice(0, SHORT_SHA_LENGTH),
+      url: `https://github.com/exadev/example/commit/${headSha}`,
+      date: expect.stringMatching(/^\d{4}-\d{2}-\d{2}T/) as unknown,
+      commit: headSha,
+    });
+  });
+
+  it('prints a release identity when the release tag points at HEAD', () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+
+    const result = runCli('--repo', 'exadev/example', '--root', repo.root);
+
+    expect(result.status).toBe(0);
+    expect(JSON.parse(result.stdout)).toMatchObject({ kind: 'release', version: '1.4.0', url: 'https://github.com/exadev/example/releases/tag/v1.4.0' });
+  });
+
+  it('predicts the next version, loading the real commit analyzer, when --predict is given', () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    repo.commit('feat: add a thing');
+
+    const result = runCli('--repo', 'exadev/example', '--root', repo.root, '--predict', '--release-rules', RULES);
+
+    expect(result.status).toBe(0);
+    expect(JSON.parse(result.stdout)).toMatchObject({ kind: 'predicted', version: '1.5.0' });
+  });
+
+  it('emits KEY=VALUE lines ready to append to $GITHUB_ENV, keeping stdout free of analyzer narration under --verbose', () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+    repo.tag('v1.4.0');
+    repo.commit('feat: add a thing');
+
+    const result = runCli('--repo', 'exadev/example', '--root', repo.root, '--predict', '--release-rules', RULES, '--format', 'env', '--prefix', 'RELEASE_', '--verbose');
+
+    expect(result.status).toBe(0);
+    const lines = result.stdout.trim().split('\n');
+    expect(lines).toHaveLength(IDENTITY_FIELD_COUNT);
+    expect(lines[0]).toBe('RELEASE_KIND=predicted');
+    expect(lines[1]).toBe('RELEASE_VERSION=1.5.0');
+    for (const line of lines) {
+      expect(line).toMatch(/^RELEASE_[A-Z]+=/);
+    }
+    expect(result.stderr).toContain('Analyzing commit');
+  });
+
+  it('exits non-zero with a message, not a bare stack, when the root is not a git repository', () => {
+    const result = runCli('--repo', 'exadev/example', '--root', join(PACKAGE_ROOT, 'definitely-not-a-directory'));
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toBe('');
+    expect(result.stderr).toContain('build-identity:');
+  });
+
+  it('exits non-zero when --predict is given with no release rules', () => {
+    repo = createTestRepo({ name: 'fixture', version: '1.4.0' });
+
+    const result = runCli('--repo', 'exadev/example', '--root', repo.root, '--predict');
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain('--release-rules');
+  });
+
+  it('exits non-zero when --repo is missing', () => {
+    const result = runCli('--root', PACKAGE_ROOT);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain('--repo');
+  });
+});
diff --git a/src/cli.ts b/src/cli.ts
new file mode 100644
index 0000000..7be165c
--- /dev/null
+++ b/src/cli.ts
@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { createProgram } from './cli-program';
+
+// This file is deliberately nothing but the bootstrap: everything worth testing lives in ./cli-program, which has no top-level side effects, so importing it from a test never parses the test runner's own argv. parseAsync rather than parse: the action is async, and a sync parse would surface any failure as an unhandled rejection instead of the message and exit code below. Usage failures (a missing required option, --help, --version) never reach here at all -- commander reports and exits on those itself -- so everything caught here is a genuine failure of the resolution this command exists to do.
+createProgram()
+  .parseAsync(process.argv)
+  .catch((cause: unknown) => {
+    process.stderr.write(`build-identity: ${cause instanceof Error ? (cause.stack ?? cause.message) : String(cause)}\n`);
+    process.exitCode = 1;
+  });
diff --git a/src/format-identity.test.ts b/src/format-identity.test.ts
new file mode 100644
index 0000000..409dfb6
--- /dev/null
+++ b/src/format-identity.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it } from 'vitest';
+import { formatIdentity, isEnvPrefix, isOutputFormat } from './format-identity';
+import type { DisplayIdentity } from './types';
+
+const RELEASE: DisplayIdentity = {
+  kind: 'release',
+  version: '1.4.0',
+  url: 'https://github.com/exadev/example/releases/tag/v1.4.0',
+  date: '2026-09-08T09:12:03+01:00',
+  commit: 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
+};
+
+describe('isOutputFormat', () => {
+  it.each(['json', 'env'])('accepts %j', (value) => {
+    expect(isOutputFormat(value)).toBe(true);
+  });
+
+  it.each([undefined, null, '', 'JSON', 'yaml', 'dotenv', 0])('rejects %j', (value) => {
+    expect(isOutputFormat(value)).toBe(false);
+  });
+});
+
+describe('isEnvPrefix', () => {
+  it.each(['', 'BUILD_', 'RELEASE_', '_', 'a1_'])('accepts %j', (value) => {
+    expect(isEnvPrefix(value)).toBe(true);
+  });
+
+  it.each(['1BUILD_', 'BUILD-', 'BUILD ', 'BUILD.', 'BUILD\n'])('rejects %j', (value) => {
+    expect(isEnvPrefix(value)).toBe(false);
+  });
+});
+
+describe('formatIdentity json', () => {
+  it('emits exactly the DisplayIdentity fields, and no CLI-invented ones', () => {
+    const parsed: unknown = JSON.parse(formatIdentity(RELEASE, { format: 'json', prefix: 'BUILD_' }));
+    expect(parsed).toEqual(RELEASE);
+    expect(Object.keys(RELEASE)).toEqual(['kind', 'version', 'url', 'date', 'commit']);
+  });
+
+  it('reports a predicted build through kind alone, not a second field', () => {
+    const predicted: DisplayIdentity = { ...RELEASE, kind: 'predicted', version: '1.5.0' };
+    const parsed: unknown = JSON.parse(formatIdentity(predicted, { format: 'json', prefix: 'BUILD_' }));
+    expect(parsed).toEqual(predicted);
+  });
+
+  it('ignores the prefix, which only applies to the env format', () => {
+    expect(formatIdentity(RELEASE, { format: 'json', prefix: 'ANYTHING_' })).toBe(formatIdentity(RELEASE, { format: 'json', prefix: '' }));
+  });
+});
+
+describe('formatIdentity env', () => {
+  it('emits one upper-cased, prefixed KEY=VALUE line per field, in declaration order', () => {
+    expect(formatIdentity(RELEASE, { format: 'env', prefix: 'BUILD_' })).toBe(
+      [
+        'BUILD_KIND=release',
+        'BUILD_VERSION=1.4.0',
+        'BUILD_URL=https://github.com/exadev/example/releases/tag/v1.4.0',
+        'BUILD_DATE=2026-09-08T09:12:03+01:00',
+        'BUILD_COMMIT=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2',
+      ].join('\n'),
+    );
+  });
+
+  it('applies a caller-supplied prefix', () => {
+    expect(formatIdentity(RELEASE, { format: 'env', prefix: 'RELEASE_' }).split('\n')[0]).toBe('RELEASE_KIND=release');
+  });
+
+  it('emits bare field names for an empty prefix', () => {
+    expect(formatIdentity(RELEASE, { format: 'env', prefix: '' }).split('\n')[0]).toBe('KIND=release');
+  });
+
+  it('rejects a prefix that would not be a legal variable name', () => {
+    expect(() => formatIdentity(RELEASE, { format: 'env', prefix: '1BUILD_' })).toThrow(/--prefix/);
+  });
+
+  it.each(['\n', '\r'])('refuses to emit a value containing %j, rather than silently corrupting the KEY=VALUE stream', (lineBreak) => {
+    const corrupt: DisplayIdentity = { ...RELEASE, version: `1.4.0${lineBreak}INJECTED=yes` };
+    expect(() => formatIdentity(corrupt, { format: 'env', prefix: 'BUILD_' })).toThrow(/line break/);
+  });
+});
diff --git a/src/format-identity.ts b/src/format-identity.ts
new file mode 100644
index 0000000..8c9d9f4
--- /dev/null
+++ b/src/format-identity.ts
@@ -0,0 +1,51 @@
+import type { DisplayIdentity } from './types';
+
+export type OutputFormat = 'json' | 'env';
+
+export const OUTPUT_FORMATS: readonly OutputFormat[] = ['json', 'env'];
+
+export function isOutputFormat(value: unknown): value is OutputFormat {
+  return value === 'json' || value === 'env';
+}
+
+/** Every field of `DisplayIdentity`, in the order it is declared there. The `env` format derives its variable names by upper-casing these directly, so there is no second name mapping that could drift out of step with the type itself. */
+const IDENTITY_FIELDS: readonly (keyof DisplayIdentity)[] = ['kind', 'version', 'url', 'date', 'commit'];
+
+/** A prefix is glued straight onto an already-upper-case field name, so it only has to keep the result a legal shell/GitHub Actions variable name. An empty prefix is legitimate (bare `KIND=`, `VERSION=`, ...) for a caller that genuinely wants the unprefixed names. */
+const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$|^$/;
+
+export function isEnvPrefix(value: string): boolean {
+  return ENV_PREFIX_PATTERN.test(value);
+}
+
+export interface FormatIdentityOptions {
+  readonly format: OutputFormat;
+  /** Prepended to each variable name in the `env` format; ignored by `json`. */
+  readonly prefix: string;
+}
+
+/**
+ * Renders a resolved identity for stdout, in whichever of the two formats the caller asked for.
+ *
+ * `json` emits the `DisplayIdentity` object verbatim -- the same five field names the library's own type declares, with no CLI-invented additions. In particular there is no separate `predicted` boolean: `kind` is already `'predicted'` in exactly that case, and a second field asserting the same fact would be one more thing every writer has to keep in step.
+ *
+ * `env` emits one `PREFIX_FIELD=value` line per field, upper-cased, ready to append straight to `$GITHUB_ENV` (or `eval`/`source` in a plain shell). Each repo maps these generic names onto whatever it calls them itself; this package never emits a consumer-specific name.
+ */
+export function formatIdentity(identity: DisplayIdentity, options: FormatIdentityOptions): string {
+  if (options.format === 'json') {
+    return JSON.stringify(identity, null, 2);
+  }
+
+  if (!isEnvPrefix(options.prefix)) {
+    throw new Error(`--prefix must be empty or a legal variable-name prefix ([A-Za-z_][A-Za-z0-9_]*), got: ${JSON.stringify(options.prefix)}`);
+  }
+
+  return IDENTITY_FIELDS.map((field) => {
+    const value = identity[field];
+    // A newline inside a value would silently swallow the rest of the identity into one variable, or inject an arbitrary further variable, once appended to $GITHUB_ENV. None of git's own output can contain one, but `version` on a release build comes from package.json, which is only ever checked for being a non-empty string -- so this is a real corruption the CLI refuses to emit rather than a hypothetical one.
+    if (/[\r\n]/.test(value)) {
+      throw new Error(`${field} contains a line break, which cannot be represented as a KEY=VALUE line: ${JSON.stringify(value)}`);
+    }
+    return `${options.prefix}${field.toUpperCase()}=${value}`;
+  }).join('\n');
+}
diff --git a/src/parse-release-rules.test.ts b/src/parse-release-rules.test.ts
new file mode 100644
index 0000000..3fb0f6f
--- /dev/null
+++ b/src/parse-release-rules.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import { isReleaseRule, parseReleaseRules } from './parse-release-rules';
+
+describe('isReleaseRule', () => {
+  it.each([
+    { type: 'feat', release: 'minor' },
+    { type: 'fix', release: 'patch' },
+    { type: 'chore', release: false },
+    { breaking: true, release: 'major' },
+  ])('accepts %j', (value) => {
+    expect(isReleaseRule(value)).toBe(true);
+  });
+
+  it.each([
+    undefined,
+    null,
+    'feat',
+    [],
+    {},
+    { type: 'feat' },
+    { release: 'minor' },
+    { type: 'feat', release: 'breaking' },
+    { type: 'feat', release: true },
+    { type: '', release: 'minor' },
+    { type: 42, release: 'minor' },
+    { breaking: false, release: 'major' },
+  ])('rejects %j', (value) => {
+    expect(isReleaseRule(value)).toBe(false);
+  });
+});
+
+describe('parseReleaseRules', () => {
+  it('parses a real rule set', () => {
+    const raw = '[{"breaking":true,"release":"major"},{"type":"feat","release":"minor"},{"type":"chore","release":false}]';
+    expect(parseReleaseRules(raw, '--release-rules')).toEqual([
+      { breaking: true, release: 'major' },
+      { type: 'feat', release: 'minor' },
+      { type: 'chore', release: false },
+    ]);
+  });
+
+  it('accepts an empty rule set, which is a real (if unhelpful) configuration rather than an error', () => {
+    expect(parseReleaseRules('[]', '--release-rules')).toEqual([]);
+  });
+
+  it('names the source in a malformed-JSON failure', () => {
+    expect(() => parseReleaseRules('[{', '--release-rules-file rules.json')).toThrow(/--release-rules-file rules\.json is not valid JSON/);
+  });
+
+  it('rejects JSON that is not an array', () => {
+    expect(() => parseReleaseRules('{"type":"feat","release":"minor"}', '--release-rules')).toThrow(/must be a JSON array/);
+  });
+
+  it('names the offending entry index', () => {
+    expect(() => parseReleaseRules('[{"type":"feat","release":"minor"},{"type":"fix","release":"nope"}]', '--release-rules')).toThrow(/entry 1 must be/);
+  });
+});
diff --git a/src/parse-release-rules.ts b/src/parse-release-rules.ts
new file mode 100644
index 0000000..7a9a19c
--- /dev/null
+++ b/src/parse-release-rules.ts
@@ -0,0 +1,52 @@
+import { isReleaseLevel, type ReleaseLevel, type ReleaseRule } from './predict-next-version';
+
+function isUnknownArray(value: unknown): value is readonly unknown[] {
+  return Array.isArray(value);
+}
+
+function isReleaseValue(value: unknown): value is ReleaseLevel | false {
+  return value === false || isReleaseLevel(value);
+}
+
+export function isReleaseRule(value: unknown): value is ReleaseRule {
+  if (typeof value !== 'object' || value === null) {
+    return false;
+  }
+  if (!('release' in value) || !isReleaseValue(value.release)) {
+    return false;
+  }
+  if ('breaking' in value) {
+    return value.breaking === true;
+  }
+  if (!('type' in value)) {
+    return false;
+  }
+  return typeof value.type === 'string' && value.type.length > 0;
+}
+
+/**
+ * Validates a JSON array of `@semantic-release/commit-analyzer` release rules supplied on the command line, into the `ReleaseRule[]` `predictNextVersion` takes.
+ *
+ * The library deliberately hardcodes no rules of its own -- a repo's commit-type-to-release-level convention is real, repo-specific configuration -- so the CLI cannot either, and this is the only route by which it learns them. Every failure names `source` (the flag or file path the JSON came from) so a malformed rule set is traceable back to whichever of the two supplied it.
+ */
+export function parseReleaseRules(raw: string, source: string): ReleaseRule[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    throw new Error(`${source} is not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+  }
+
+  if (!isUnknownArray(parsed)) {
+    throw new Error(`${source} must be a JSON array of commit-analyzer release rules, e.g. [{"breaking":true,"release":"major"},{"type":"feat","release":"minor"}]`);
+  }
+
+  const rules: ReleaseRule[] = [];
+  for (const [index, entry] of parsed.entries()) {
+    if (!isReleaseRule(entry)) {
+      throw new Error(`${source}: entry ${String(index)} must be {"type":<string>,"release":"major"|"minor"|"patch"|false} or {"breaking":true,"release":"major"|"minor"|"patch"|false}, got: ${JSON.stringify(entry)}`);
+    }
+    rules.push(entry);
+  }
+  return rules;
+}
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 974312d..b7d97b1 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -1,10 +1,27 @@
 import { defineConfig } from 'tsdown';
 
-export default defineConfig({
-  entry: ['src/index.ts'],
-  root: 'src',
-  format: ['esm', 'cjs'],
-  dts: true,
-  platform: 'neutral',
-  clean: true,
-});
+// Two build passes: the library ("." export, imported directly by a bundler's own config file) and the bin script. They differ in every setting that matters, which is why they are separate entries rather than one entry list.
+export default defineConfig([
+  {
+    entry: ['src/index.ts'],
+    root: 'src',
+    format: ['esm', 'cjs'],
+    dts: true,
+    // The library itself only ever runs inside whatever toolchain imports it, and declares no platform assumptions of its own.
+    platform: 'neutral',
+    clean: true,
+  },
+  {
+    // ESM only -- a bin script is executed, never require()'d, and nothing imports it for its types. The shebang (written as the literal first line of src/cli.ts) is preserved at the top of the output chunk by Rolldown, and tsdown's own shebang plugin chmods the resulting file during writeBundle, so no postbuild chmod +x step is needed.
+    entry: ['src/cli.ts'],
+    root: 'src',
+    format: ['esm'],
+    dts: false,
+    // Unlike the library, the bin script genuinely is a node program: it reads process.argv, writes to process.stdout/stderr, and sets an exit code.
+    platform: 'node',
+    // Must not clean: this pass runs after the library pass above, into the same dist directory.
+    clean: false,
+    // platform: 'node' defaults fixedExtension to true (always .mjs/.cjs), which would emit dist/cli.mjs and not match package.json's bin field (./dist/cli.js). Disabling it lets the extension follow package.json's "type": "module" instead.
+    fixedExtension: false,
+  },
+]);