diff --git a/Taskfile.yml b/Taskfile.yml
index 3b1793a..ecb6b21 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -191,15 +191,20 @@ tasks:
 
   # ------------------------------------------------------------------- build --
   build-client:
-    desc: "Emit the dependency-free ESM bundle a browser can <script type=module> import."
+    desc: "Emit the dependency-free ESM a browser can <script type=module> import — per-module, and flattened."
     dir: "{{.CLIENT_DIR}}"
     sources: ["src/**/*.ts", "tsconfig.json", "package.json"]
     generates: ["dist/**/*.js"]
     cmds:
       - npm install --no-audit --no-fund
-      # --no-install: bare `npx tsc` with no node_modules silently downloads a REGISTRY package named
-      # `tsc` (which is not TypeScript) and runs it. Never let a build reach the network by accident.
-      - npx --no-install tsc
+      # Two artifacts, both published: dist/index.js keeps its relative imports (tree-shakeable, for
+      # bundler-based consumers), and dist/krm-stream.js is the same public API flattened into one
+      # file, for a host that vendors the library by copying it and serving it with no bundler.
+      #
+      # `npm run build` and not `npx tsc`: it resolves from node_modules/.bin, so it cannot reach the
+      # network. Bare `npx tsc` with no node_modules silently downloads a REGISTRY package named `tsc`
+      # (which is not TypeScript) and runs it.
+      - npm run --silent build
 
   # ---------------------------------------------------------------- cluster --
   # The one rung a fake watch cannot reach. Everything the gateway BELIEVES about Kubernetes — that a
diff --git a/examples/vanilla-browser/index.html b/examples/vanilla-browser/index.html
index c93ad57..75d9514 100644
--- a/examples/vanilla-browser/index.html
+++ b/examples/vanilla-browser/index.html
@@ -11,6 +11,11 @@
   it is really tested: the browser fetches index.js, which imports ./store.js, which imports
   ./merge.js, and so on. If any of it needed a bundler, this page would simply be blank.
 
+  ?entry=bundle swaps that for the single-file build — /krm-stream/krm-stream.js, the same public API
+  with the module graph already flattened, which is what a host vendors when it copies the library in
+  rather than installing it. Playwright runs this page BOTH ways (see playwright.config.ts), because
+  "the bundle exports the same things" is a claim about a real browser, not about a build log.
+
   It uses NATIVE EventSource — not fetch — because that is the same-origin session-cookie path a v1
   gateway must support (spec §7), and because EventSource's automatic reconnect is a behaviour no
   in-process test can exercise.
@@ -70,10 +75,18 @@ <h2>patch — RFC 7386, editable changes only</h2>
     </section>
 
     <script type="module">
-      // THE import under test. Unbundled, multi-file, straight from the server.
-      import { LiveResourceStore, connectWithEventSource } from "/krm-stream/index.js";
-
+      // THE import under test — and there are two of them, because the library ships two entry points
+      // and a host with no bundler uses the second one.
+      //
+      //   index.js       the per-module build: the browser then fetches ./store.js, ./merge.js, …
+      //   krm-stream.js  the same public API, one file, no relative imports left to resolve
+      //
+      // Dynamic, so one page proves both. A static import cannot be chosen at runtime, and having two
+      // demo pages would mean the second one drifts.
       const params = new URLSearchParams(location.search);
+      const entry = params.get("entry") === "bundle" ? "/krm-stream/krm-stream.js" : "/krm-stream/index.js";
+      const { LiveResourceStore, connectWithEventSource } = await import(entry);
+
       const fixture = params.get("fixture") ?? "status-follow-live";
       const pace = params.get("pace") ?? "600ms";
 
diff --git a/examples/vanilla-browser/playwright.config.ts b/examples/vanilla-browser/playwright.config.ts
index 0739493..65d3475 100644
--- a/examples/vanilla-browser/playwright.config.ts
+++ b/examples/vanilla-browser/playwright.config.ts
@@ -1,4 +1,5 @@
 import { defineConfig } from "@playwright/test";
+import type { Entry } from "./tests/fixtures.ts";
 
 // The browser rung of the e2e ladder — and it needs no cluster.
 //
@@ -8,7 +9,7 @@ import { defineConfig } from "@playwright/test";
 // Authorization header, so the v1 baseline is same-origin session cookies). A demo served from a
 // second port would need CORS, and would then be proving something we do not ship.
 
-export default defineConfig({
+export default defineConfig<{ entry: Entry }>({
   testDir: "./tests",
   fullyParallel: true,
   forbidOnly: !!process.env["CI"],
@@ -18,20 +19,29 @@ export default defineConfig({
     baseURL: "http://127.0.0.1:8100",
     trace: "retain-on-failure",
   },
-  projects: [{ name: "chromium", use: { browserName: "chromium" } }],
+  // The same suite, twice, against the two published entry points. `./bundle` is not a convenience
+  // build that can be allowed to rot: it is what a host with no node_modules actually vendors, so it
+  // gets the same real browser, the same real EventSource, and the same assertions as index.js. If a
+  // flattening step ever dropped an export or a polyfill crept in, the bundle project goes red on its
+  // own while the module project stays green — which is exactly the signal you want.
+  projects: [
+    { name: "chromium", use: { browserName: "chromium", entry: "index" } },
+    { name: "chromium-bundle", use: { browserName: "chromium", entry: "bundle" } },
+  ],
 
   // Build the library first — `dist/` is what the browser imports, unbundled, and a stale dist is a
   // test of last week's library.
   //
-  // `npx --no-install`, and it is not a style preference. Bare `npx tsc` in a directory with no
-  // node_modules does not fail — it goes to the REGISTRY, downloads whatever is published under the
+  // `npm run build` rather than a hand-copied `tsc` line: the build is now two steps (tsc, then the
+  // esbuild flatten into dist/krm-stream.js), and a browser test that builds them differently from a
+  // release is testing a file nobody ships. It resolves binaries from node_modules/.bin, so it never
+  // reaches the network — which is the property that matters here. Bare `npx tsc` in a directory with
+  // no node_modules does NOT fail: it goes to the REGISTRY, downloads whatever is published under the
   // name `tsc` (a squatter package, not TypeScript), and runs it. That is what this job did on its
-  // first-ever CI run, and it is a supply-chain hole that happened to announce itself by failing.
-  // --no-install makes a missing dependency loud instead of resolving it from the internet. Run
-  // `task e2e-browser`, which installs the library's devDependencies first.
+  // first-ever CI run. Run `task e2e-browser`, which installs the library's devDependencies first.
   webServer: {
     command:
-      "cd ../../packages/krm-stream && npx --no-install tsc && " +
+      "cd ../../packages/krm-stream && npm run --silent build && " +
       "cd ../../gateway && go run ./cmd/replay " +
       "--addr 127.0.0.1:8100 --corpus ../conformance " +
       "--static ../examples/vanilla-browser --dist ../packages/krm-stream/dist",
diff --git a/examples/vanilla-browser/tests/fixtures.ts b/examples/vanilla-browser/tests/fixtures.ts
new file mode 100644
index 0000000..8115414
--- /dev/null
+++ b/examples/vanilla-browser/tests/fixtures.ts
@@ -0,0 +1,30 @@
+// One suite, two entry points.
+//
+// The library publishes the per-module build (dist/index.js, which imports ./store.js, which imports
+// ./merge.js…) AND a flattened single file (dist/krm-stream.js) for hosts that vendor the library by
+// copying it and have no bundler to resolve that graph. Both are public API. Only one of them was
+// ever loaded in a real browser.
+//
+// So `entry` is a project option rather than a parameter of any one test: playwright.config.ts runs
+// this entire spec twice, once per entry point, and `visit` puts the choice in the URL the demo page
+// reads. A test that forgets to thread it through does not silently test index.js twice — it cannot
+// navigate at all.
+
+import { test as base } from "@playwright/test";
+
+export type Entry = "index" | "bundle";
+
+export const test = base.extend<{
+  entry: Entry;
+  /** Open the demo page for a fixture, on whichever entry point this project is exercising. */
+  visit: (query: string) => Promise<void>;
+}>({
+  entry: ["index", { option: true }],
+  visit: async ({ page, entry }, use) => {
+    await use(async (query) => {
+      await page.goto(`/?entry=${entry}&${query}`);
+    });
+  },
+});
+
+export { expect } from "@playwright/test";
diff --git a/examples/vanilla-browser/tests/live-krm.spec.ts b/examples/vanilla-browser/tests/live-krm.spec.ts
index 7df7ab1..6d6c1ce 100644
--- a/examples/vanilla-browser/tests/live-krm.spec.ts
+++ b/examples/vanilla-browser/tests/live-krm.spec.ts
@@ -14,16 +14,16 @@
 //   - a user can type into a field while the server changes the object underneath them, and keep
 //     what they typed.
 
-import { expect, test } from "@playwright/test";
+import { expect, test } from "./fixtures.ts";
 
 const path = (...segments: (string | number)[]) => JSON.stringify(segments);
 
-test("the built ESM imports in a browser with no bundler at all", async ({ page }) => {
+test("the built ESM imports in a browser with no bundler at all", async ({ page, visit }) => {
   const errors: string[] = [];
   page.on("pageerror", (e) => errors.push(e.message));
   page.on("console", (m) => m.type() === "error" && errors.push(m.text()));
 
-  await page.goto("/?fixture=snapshot-then-deltas&pace=0ms");
+  await visit("fixture=snapshot-then-deltas&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
 
   // If a single bare specifier or a missing extension had crept into the emitted JS, the module graph
@@ -31,10 +31,10 @@ test("the built ESM imports in a browser with no bundler at all", async ({ page
   expect(errors, `the browser could not load the library:\n${errors.join("\n")}`).toEqual([]);
 });
 
-test("status follows the server live and FLASHES what moved — and never becomes an edit", async ({ page }) => {
+test("status follows the server live and FLASHES what moved — and never becomes an edit", async ({ page, visit }) => {
   // deploy-web.v1 -> v2 is a status-only change: readyReplicas 1 -> 2, Available False -> True.
   // The spec is byte-identical. This is the dominant traffic on a real stream, and the demo.
-  await page.goto("/?fixture=status-follow-live&pace=250ms");
+  await visit("fixture=status-follow-live&pace=250ms");
 
   const ready = page.getByTestId(`value:${path("status", "readyReplicas")}`);
   await expect(ready).toHaveText(/^1/); // the snapshot
@@ -56,11 +56,11 @@ test("status follows the server live and FLASHES what moved — and never become
   await expect(page.getByTestId("patch")).toHaveText(JSON.stringify({ spec: { replicas: 4 } }, null, 2));
 });
 
-test("a conflict is raised, the typing is never overwritten, and it clears on convergence", async ({ page }) => {
+test("a conflict is raised, the typing is never overwritten, and it clears on convergence", async ({ page, visit }) => {
   // The server moves data.log-level to `warn` while the user is typing `debug` (a real conflict), and
   // then a colleague makes the same change the user did — so the server ARRIVES at `debug` and the
   // conflict must clear itself. A cached dirty flag gets the second half wrong and stays red forever.
-  await page.goto("/?fixture=conflict-and-converge&pace=700ms");
+  await visit("fixture=conflict-and-converge&pace=700ms");
 
   const logLevel = page.getByTestId(`input:${path("data", "log-level")}`);
   await expect(logLevel).toHaveValue("info");
@@ -79,10 +79,10 @@ test("a conflict is raised, the typing is never overwritten, and it clears on co
   await expect(page.getByTestId("patch")).toHaveText("null"); // nothing left to save
 });
 
-test("an unrelated server change never disturbs the field you are editing", async ({ page }) => {
+test("an unrelated server change never disturbs the field you are editing", async ({ page, visit }) => {
   // R-THREEWAY. The server bumps `replicas`; nobody touched `log-level`. Compare the incoming object
   // to the DRAFT instead of to the previous SERVER object and this false-conflicts on every heartbeat.
-  await page.goto("/?fixture=edit-vs-unrelated-change&pace=700ms");
+  await visit("fixture=edit-vs-unrelated-change&pace=700ms");
 
   const logLevel = page.getByTestId(`input:${path("data", "log-level")}`);
   await expect(logLevel).toHaveValue("info");
@@ -96,11 +96,11 @@ test("an unrelated server change never disturbs the field you are editing", asyn
   await expect(page.getByTestId("patch")).toHaveText(JSON.stringify({ data: { "log-level": "debug" } }, null, 2));
 });
 
-test("a redacted Secret value is not in the page at all — the mask is drawn, not received", async ({ page }) => {
+test("a redacted Secret value is not in the page at all — the mask is drawn, not received", async ({ page, visit }) => {
   // The rule that makes a Secret safe to display: a value you never RECEIVED cannot round-trip over
   // the real one. The mask is something this page DRAWS from `redacted` — it is not a value the
   // wire carried, and there is therefore nothing to save back (proposal 0003).
-  await page.goto("/?fixture=secret-redaction&pace=0ms");
+  await visit("fixture=secret-redaction&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
 
   // Keys-only disclosure: you can see THAT `token` exists…
@@ -118,10 +118,10 @@ test("a redacted Secret value is not in the page at all — the mask is drawn, n
   await expect(page.getByTestId("patch")).toHaveText("null");
 });
 
-test("a named object that does not exist renders as empty, not as a ghost and not as an error", async ({ page }) => {
+test("a named object that does not exist renders as empty, not as a ghost and not as an error", async ({ page, visit }) => {
   // reset, synced — and nothing else. The fixture that kills the "named scopes may skip the snapshot"
   // optimization: skip it, and a delete-while-disconnected leaves the object on screen forever.
-  await page.goto("/?fixture=named-object-absent&pace=0ms");
+  await visit("fixture=named-object-absent&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
   await expect(page.getByTestId("editable-body")).toBeEmpty();
   await expect(page.getByTestId("patch")).toHaveText("null");
diff --git a/packages/krm-stream/README.md b/packages/krm-stream/README.md
index 231c832..04ab390 100644
--- a/packages/krm-stream/README.md
+++ b/packages/krm-stream/README.md
@@ -21,6 +21,30 @@ connectWithEventSource(
 );
 ```
 
-The unscoped `krm-stream` package is a compatibility forwarder. This project is pre-1.0 and has not
-been published to npm yet. See the repository [README](../../README.md),
+## Vendoring it without a bundler
+
+The default entry point is the per-module build: `dist/index.js` imports `./store.js`, which imports
+`./merge.js`, and so on. A bundler resolves that graph and tree-shakes it, and a browser resolves it
+at runtime, so every file has to be there.
+
+If you have no bundler and no `node_modules` — you copy the library in and serve it yourself — import
+the flattened build instead. Same public API, one file, no relative imports left to resolve:
+
+```ts
+import { LiveResourceStore } from "@configbutler/krm-stream/bundle";
+```
+
+Vendored, that is one file to copy (`dist/krm-stream.js`) and one path to serve:
+
+```js
+import { LiveResourceStore, connectWithEventSource } from "/krm-stream/krm-stream.js";
+```
+
+Both entry points are built from the same source and are exercised by the same browser test suite
+against a real `EventSource`. Neither has a runtime dependency.
+
+## Status
+
+The unscoped `krm-stream` package is a compatibility forwarder. This project is pre-1.0: the protocol
+and the API may still change before 1.0. See the repository [README](../../README.md),
 [client state model](../../docs/client-state-model.md), and [release guide](../../docs/releasing.md).
diff --git a/packages/krm-stream/package-lock.json b/packages/krm-stream/package-lock.json
index a4a5cf5..96b9ee5 100644
--- a/packages/krm-stream/package-lock.json
+++ b/packages/krm-stream/package-lock.json
@@ -11,6 +11,7 @@
       "devDependencies": {
         "@biomejs/biome": "^2.5.3",
         "@types/node": "^26.1.1",
+        "esbuild": "^0.25.0",
         "typescript": "^5.9.0"
       },
       "engines": {
@@ -180,6 +181,448 @@
         "node": ">=14.21.3"
       }
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@types/node": {
       "version": "26.1.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
@@ -190,6 +633,48 @@
         "undici-types": "~8.3.0"
       }
     },
+    "node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
diff --git a/packages/krm-stream/package.json b/packages/krm-stream/package.json
index 84e7037..b807866 100644
--- a/packages/krm-stream/package.json
+++ b/packages/krm-stream/package.json
@@ -25,6 +25,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./bundle": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/krm-stream.js"
     }
   },
   "files": [
@@ -35,16 +39,19 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && npm run build:bundle",
+    "//build:bundle": "Flatten the emitted module graph into ONE file for hosts with no bundler and no node_modules — the ones that vendor the library by copying it and serving it. Bundling dist/index.js (not src/) keeps a single source of truth: the file a bundler-based consumer imports is the file this flattens. --target=es2022 pins it to the same output tsconfig emits, so a bundle can never quietly acquire a polyfill the per-module build does not have. No sourcemap: a host serving this publicly should not have to also serve a .map, or field a console warning for not doing so.",
+    "build:bundle": "esbuild dist/index.js --bundle --format=esm --target=es2022 --legal-comments=none --outfile=dist/krm-stream.js",
     "test": "node --test",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "lint": "biome check",
     "format": "biome check --write"
   },
-  "//": "ZERO dependencies, and that one is absolute: the engine emits plain ESM a browser imports with no bundler, and gitops-api has no bundler and is not getting one. devDependencies ship NOTHING and are kept to the three that pay for themselves: typescript (the compiler), @types/node (without it `tsc` cannot see test/ at all, because the tests import node:test — and `node --test` STRIPS types rather than checking them, so the suite that IS the contract check would be the one unverified file in the repo), and biome (lint + format in one binary, the TypeScript half of what gofmt/go vet/golangci-lint do for the gateway).",
+  "//": "ZERO dependencies, and that one is absolute: the engine emits plain ESM a browser imports with no bundler, and gitops-api has no bundler and is not getting one. devDependencies ship NOTHING and are kept to the four that pay for themselves: typescript (the compiler), @types/node (without it `tsc` cannot see test/ at all, because the tests import node:test — and `node --test` STRIPS types rather than checking them, so the suite that IS the contract check would be the one unverified file in the repo), biome (lint + format in one binary, the TypeScript half of what gofmt/go vet/golangci-lint do for the gateway), and esbuild (flattens dist/ into the single-file ./bundle — it runs ONCE per release here, so that every no-bundler consumer does not each reinvent it, and it is the reason a host can vendor ONE file instead of eleven; it emits no polyfill and no runtime dependency, and if it ever needs to, the bundle is wrong).",
   "devDependencies": {
     "@biomejs/biome": "^2.5.3",
     "@types/node": "^26.1.1",
+    "esbuild": "^0.25.0",
     "typescript": "^5.9.0"
   }
 }