fix: load CLI version in ESM

[iccccccccccccc]

Fixes #24

Changes

• create a require function with createRequire(import.meta.url) for the ESM CLI
• read package.json through that ESM-compatible require instead of relying on a missing global require
• keep the existing 0.0.0 fallback if the package metadata cannot be read

Verification

• npm run build
• node dist/cli.js --version -> 1.0.1
• node dist/cli.js --help shows @hailbytes/security-headers v1.0.1
• npm run typecheck

I also ran npm test; it currently gets through 55/59 tests, with four existing Permissions-Policy / grade-boundary assertions failing outside this CLI version path.

[dmchaledev]

Merged — thanks so much for the fix, @iccccccccccccc! 🎉

This was a real bug: with "type": "module" + NodeNext, the global require doesn't exist in the compiled dist/cli.js, so getVersion() was silently falling back to 0.0.0. Using createRequire(import.meta.url) is exactly the right approach, and the ?? '0.0.0' hardening is a nice touch.

Appreciate you also being upfront about the 4 pre-existing test failures — confirmed those are unrelated to this change and already present on main; we're tracking them separately. Thanks again for the clean, well-described PR, and welcome! 🙌

---

Generated by Claude Code