From a3d4afe5a800c78235aca5e53a92dcf67985e295 Mon Sep 17 00:00:00 2001
From: Simon Koudijs <simonkoudijs@gmail.com>
Date: Tue, 14 Jul 2026 09:29:18 +0000
Subject: [PATCH] feat(client): publish a single-file browser bundle as
 ./bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gitops-api embeds the client rather than bundling it: the Go server
go:embeds the published ESM and serves it, with no npm, no node_modules
and no bundler anywhere in that build. That is the constraint the library
was designed around, and it works — but vendoring means copying all eleven
files of dist/, because index.js imports ./store.js imports ./merge.js and
the browser resolves that graph at runtime.

Publish the graph flattened as well:

  dist/index.js       unchanged, per-module, tree-shakeable
  dist/krm-stream.js  same public API, one file, no relative imports

addressable as @configbutler/krm-stream/bundle. A host with no bundler now
vendors one file instead of eleven.

esbuild is the fourth devDependency, and it carries the same one-line
justification as the other three: it runs once per release here so that
every no-bundler consumer does not each reinvent the step, it emits no
polyfill and no runtime dependency, and no sourcemap — a host serving the
file publicly should not have to serve a .map or field a console warning
for not doing so.

The browser suite now runs twice, once per entry point (chromium and
chromium-bundle projects), against a real EventSource. "The bundle exports
the same things" is a claim about a browser, not about a build log — if a
flatten ever drops an export, the bundle project goes red on its own.

Also fixes the package README, which still told npm readers the package
"has not been published to npm yet".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Taskfile.yml                                  |  13 +-
 examples/vanilla-browser/index.html           |  19 +-
 examples/vanilla-browser/playwright.config.ts |  26 +-
 examples/vanilla-browser/tests/fixtures.ts    |  30 ++
 .../vanilla-browser/tests/live-krm.spec.ts    |  26 +-
 packages/krm-stream/README.md                 |  28 +-
 packages/krm-stream/package-lock.json         | 485 ++++++++++++++++++
 packages/krm-stream/package.json              |  11 +-
 8 files changed, 606 insertions(+), 32 deletions(-)
 create mode 100644 examples/vanilla-browser/tests/fixtures.ts

diff --git a/Taskfile.yml b/Taskfile.yml
index 3b1793a..ecb6b21 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -191,15 +191,20 @@ tasks:
 
   # ------------------------------------------------------------------- build --
   build-client:
-    desc: "Emit the dependency-free ESM bundle a browser can <script type=module> import."
+    desc: "Emit the dependency-free ESM a browser can <script type=module> import — per-module, and flattened."
     dir: "{{.CLIENT_DIR}}"
     sources: ["src/**/*.ts", "tsconfig.json", "package.json"]
     generates: ["dist/**/*.js"]
     cmds:
       - npm install --no-audit --no-fund
-      # --no-install: bare `npx tsc` with no node_modules silently downloads a REGISTRY package named
-      # `tsc` (which is not TypeScript) and runs it. Never let a build reach the network by accident.
-      - npx --no-install tsc
+      # Two artifacts, both published: dist/index.js keeps its relative imports (tree-shakeable, for
+      # bundler-based consumers), and dist/krm-stream.js is the same public API flattened into one
+      # file, for a host that vendors the library by copying it and serving it with no bundler.
+      #
+      # `npm run build` and not `npx tsc`: it resolves from node_modules/.bin, so it cannot reach the
+      # network. Bare `npx tsc` with no node_modules silently downloads a REGISTRY package named `tsc`
+      # (which is not TypeScript) and runs it.
+      - npm run --silent build
 
   # ---------------------------------------------------------------- cluster --
   # The one rung a fake watch cannot reach. Everything the gateway BELIEVES about Kubernetes — that a
diff --git a/examples/vanilla-browser/index.html b/examples/vanilla-browser/index.html
index c93ad57..75d9514 100644
--- a/examples/vanilla-browser/index.html
+++ b/examples/vanilla-browser/index.html
@@ -11,6 +11,11 @@
   it is really tested: the browser fetches index.js, which imports ./store.js, which imports
   ./merge.js, and so on. If any of it needed a bundler, this page would simply be blank.
 
+  ?entry=bundle swaps that for the single-file build — /krm-stream/krm-stream.js, the same public API
+  with the module graph already flattened, which is what a host vendors when it copies the library in
+  rather than installing it. Playwright runs this page BOTH ways (see playwright.config.ts), because
+  "the bundle exports the same things" is a claim about a real browser, not about a build log.
+
   It uses NATIVE EventSource — not fetch — because that is the same-origin session-cookie path a v1
   gateway must support (spec §7), and because EventSource's automatic reconnect is a behaviour no
   in-process test can exercise.
@@ -70,10 +75,18 @@ <h2>patch — RFC 7386, editable changes only</h2>
     </section>
 
     <script type="module">
-      // THE import under test. Unbundled, multi-file, straight from the server.
-      import { LiveResourceStore, connectWithEventSource } from "/krm-stream/index.js";
-
+      // THE import under test — and there are two of them, because the library ships two entry points
+      // and a host with no bundler uses the second one.
+      //
+      //   index.js       the per-module build: the browser then fetches ./store.js, ./merge.js, …
+      //   krm-stream.js  the same public API, one file, no relative imports left to resolve
+      //
+      // Dynamic, so one page proves both. A static import cannot be chosen at runtime, and having two
+      // demo pages would mean the second one drifts.
       const params = new URLSearchParams(location.search);
+      const entry = params.get("entry") === "bundle" ? "/krm-stream/krm-stream.js" : "/krm-stream/index.js";
+      const { LiveResourceStore, connectWithEventSource } = await import(entry);
+
       const fixture = params.get("fixture") ?? "status-follow-live";
       const pace = params.get("pace") ?? "600ms";
 
diff --git a/examples/vanilla-browser/playwright.config.ts b/examples/vanilla-browser/playwright.config.ts
index 0739493..65d3475 100644
--- a/examples/vanilla-browser/playwright.config.ts
+++ b/examples/vanilla-browser/playwright.config.ts
@@ -1,4 +1,5 @@
 import { defineConfig } from "@playwright/test";
+import type { Entry } from "./tests/fixtures.ts";
 
 // The browser rung of the e2e ladder — and it needs no cluster.
 //
@@ -8,7 +9,7 @@ import { defineConfig } from "@playwright/test";
 // Authorization header, so the v1 baseline is same-origin session cookies). A demo served from a
 // second port would need CORS, and would then be proving something we do not ship.
 
-export default defineConfig({
+export default defineConfig<{ entry: Entry }>({
   testDir: "./tests",
   fullyParallel: true,
   forbidOnly: !!process.env["CI"],
@@ -18,20 +19,29 @@ export default defineConfig({
     baseURL: "http://127.0.0.1:8100",
     trace: "retain-on-failure",
   },
-  projects: [{ name: "chromium", use: { browserName: "chromium" } }],
+  // The same suite, twice, against the two published entry points. `./bundle` is not a convenience
+  // build that can be allowed to rot: it is what a host with no node_modules actually vendors, so it
+  // gets the same real browser, the same real EventSource, and the same assertions as index.js. If a
+  // flattening step ever dropped an export or a polyfill crept in, the bundle project goes red on its
+  // own while the module project stays green — which is exactly the signal you want.
+  projects: [
+    { name: "chromium", use: { browserName: "chromium", entry: "index" } },
+    { name: "chromium-bundle", use: { browserName: "chromium", entry: "bundle" } },
+  ],
 
   // Build the library first — `dist/` is what the browser imports, unbundled, and a stale dist is a
   // test of last week's library.
   //
-  // `npx --no-install`, and it is not a style preference. Bare `npx tsc` in a directory with no
-  // node_modules does not fail — it goes to the REGISTRY, downloads whatever is published under the
+  // `npm run build` rather than a hand-copied `tsc` line: the build is now two steps (tsc, then the
+  // esbuild flatten into dist/krm-stream.js), and a browser test that builds them differently from a
+  // release is testing a file nobody ships. It resolves binaries from node_modules/.bin, so it never
+  // reaches the network — which is the property that matters here. Bare `npx tsc` in a directory with
+  // no node_modules does NOT fail: it goes to the REGISTRY, downloads whatever is published under the
   // name `tsc` (a squatter package, not TypeScript), and runs it. That is what this job did on its
-  // first-ever CI run, and it is a supply-chain hole that happened to announce itself by failing.
-  // --no-install makes a missing dependency loud instead of resolving it from the internet. Run
-  // `task e2e-browser`, which installs the library's devDependencies first.
+  // first-ever CI run. Run `task e2e-browser`, which installs the library's devDependencies first.
   webServer: {
     command:
-      "cd ../../packages/krm-stream && npx --no-install tsc && " +
+      "cd ../../packages/krm-stream && npm run --silent build && " +
       "cd ../../gateway && go run ./cmd/replay " +
       "--addr 127.0.0.1:8100 --corpus ../conformance " +
       "--static ../examples/vanilla-browser --dist ../packages/krm-stream/dist",
diff --git a/examples/vanilla-browser/tests/fixtures.ts b/examples/vanilla-browser/tests/fixtures.ts
new file mode 100644
index 0000000..8115414
--- /dev/null
+++ b/examples/vanilla-browser/tests/fixtures.ts
@@ -0,0 +1,30 @@
+// One suite, two entry points.
+//
+// The library publishes the per-module build (dist/index.js, which imports ./store.js, which imports
+// ./merge.js…) AND a flattened single file (dist/krm-stream.js) for hosts that vendor the library by
+// copying it and have no bundler to resolve that graph. Both are public API. Only one of them was
+// ever loaded in a real browser.
+//
+// So `entry` is a project option rather than a parameter of any one test: playwright.config.ts runs
+// this entire spec twice, once per entry point, and `visit` puts the choice in the URL the demo page
+// reads. A test that forgets to thread it through does not silently test index.js twice — it cannot
+// navigate at all.
+
+import { test as base } from "@playwright/test";
+
+export type Entry = "index" | "bundle";
+
+export const test = base.extend<{
+  entry: Entry;
+  /** Open the demo page for a fixture, on whichever entry point this project is exercising. */
+  visit: (query: string) => Promise<void>;
+}>({
+  entry: ["index", { option: true }],
+  visit: async ({ page, entry }, use) => {
+    await use(async (query) => {
+      await page.goto(`/?entry=${entry}&${query}`);
+    });
+  },
+});
+
+export { expect } from "@playwright/test";
diff --git a/examples/vanilla-browser/tests/live-krm.spec.ts b/examples/vanilla-browser/tests/live-krm.spec.ts
index 7df7ab1..6d6c1ce 100644
--- a/examples/vanilla-browser/tests/live-krm.spec.ts
+++ b/examples/vanilla-browser/tests/live-krm.spec.ts
@@ -14,16 +14,16 @@
 //   - a user can type into a field while the server changes the object underneath them, and keep
 //     what they typed.
 
-import { expect, test } from "@playwright/test";
+import { expect, test } from "./fixtures.ts";
 
 const path = (...segments: (string | number)[]) => JSON.stringify(segments);
 
-test("the built ESM imports in a browser with no bundler at all", async ({ page }) => {
+test("the built ESM imports in a browser with no bundler at all", async ({ page, visit }) => {
   const errors: string[] = [];
   page.on("pageerror", (e) => errors.push(e.message));
   page.on("console", (m) => m.type() === "error" && errors.push(m.text()));
 
-  await page.goto("/?fixture=snapshot-then-deltas&pace=0ms");
+  await visit("fixture=snapshot-then-deltas&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
 
   // If a single bare specifier or a missing extension had crept into the emitted JS, the module graph
@@ -31,10 +31,10 @@ test("the built ESM imports in a browser with no bundler at all", async ({ page
   expect(errors, `the browser could not load the library:\n${errors.join("\n")}`).toEqual([]);
 });
 
-test("status follows the server live and FLASHES what moved — and never becomes an edit", async ({ page }) => {
+test("status follows the server live and FLASHES what moved — and never becomes an edit", async ({ page, visit }) => {
   // deploy-web.v1 -> v2 is a status-only change: readyReplicas 1 -> 2, Available False -> True.
   // The spec is byte-identical. This is the dominant traffic on a real stream, and the demo.
-  await page.goto("/?fixture=status-follow-live&pace=250ms");
+  await visit("fixture=status-follow-live&pace=250ms");
 
   const ready = page.getByTestId(`value:${path("status", "readyReplicas")}`);
   await expect(ready).toHaveText(/^1/); // the snapshot
@@ -56,11 +56,11 @@ test("status follows the server live and FLASHES what moved — and never become
   await expect(page.getByTestId("patch")).toHaveText(JSON.stringify({ spec: { replicas: 4 } }, null, 2));
 });
 
-test("a conflict is raised, the typing is never overwritten, and it clears on convergence", async ({ page }) => {
+test("a conflict is raised, the typing is never overwritten, and it clears on convergence", async ({ page, visit }) => {
   // The server moves data.log-level to `warn` while the user is typing `debug` (a real conflict), and
   // then a colleague makes the same change the user did — so the server ARRIVES at `debug` and the
   // conflict must clear itself. A cached dirty flag gets the second half wrong and stays red forever.
-  await page.goto("/?fixture=conflict-and-converge&pace=700ms");
+  await visit("fixture=conflict-and-converge&pace=700ms");
 
   const logLevel = page.getByTestId(`input:${path("data", "log-level")}`);
   await expect(logLevel).toHaveValue("info");
@@ -79,10 +79,10 @@ test("a conflict is raised, the typing is never overwritten, and it clears on co
   await expect(page.getByTestId("patch")).toHaveText("null"); // nothing left to save
 });
 
-test("an unrelated server change never disturbs the field you are editing", async ({ page }) => {
+test("an unrelated server change never disturbs the field you are editing", async ({ page, visit }) => {
   // R-THREEWAY. The server bumps `replicas`; nobody touched `log-level`. Compare the incoming object
   // to the DRAFT instead of to the previous SERVER object and this false-conflicts on every heartbeat.
-  await page.goto("/?fixture=edit-vs-unrelated-change&pace=700ms");
+  await visit("fixture=edit-vs-unrelated-change&pace=700ms");
 
   const logLevel = page.getByTestId(`input:${path("data", "log-level")}`);
   await expect(logLevel).toHaveValue("info");
@@ -96,11 +96,11 @@ test("an unrelated server change never disturbs the field you are editing", asyn
   await expect(page.getByTestId("patch")).toHaveText(JSON.stringify({ data: { "log-level": "debug" } }, null, 2));
 });
 
-test("a redacted Secret value is not in the page at all — the mask is drawn, not received", async ({ page }) => {
+test("a redacted Secret value is not in the page at all — the mask is drawn, not received", async ({ page, visit }) => {
   // The rule that makes a Secret safe to display: a value you never RECEIVED cannot round-trip over
   // the real one. The mask is something this page DRAWS from `redacted` — it is not a value the
   // wire carried, and there is therefore nothing to save back (proposal 0003).
-  await page.goto("/?fixture=secret-redaction&pace=0ms");
+  await visit("fixture=secret-redaction&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
 
   // Keys-only disclosure: you can see THAT `token` exists…
@@ -118,10 +118,10 @@ test("a redacted Secret value is not in the page at all — the mask is drawn, n
   await expect(page.getByTestId("patch")).toHaveText("null");
 });
 
-test("a named object that does not exist renders as empty, not as a ghost and not as an error", async ({ page }) => {
+test("a named object that does not exist renders as empty, not as a ghost and not as an error", async ({ page, visit }) => {
   // reset, synced — and nothing else. The fixture that kills the "named scopes may skip the snapshot"
   // optimization: skip it, and a delete-while-disconnected leaves the object on screen forever.
-  await page.goto("/?fixture=named-object-absent&pace=0ms");
+  await visit("fixture=named-object-absent&pace=0ms");
   await expect(page.locator("#status-line")).toHaveText(/synced/);
   await expect(page.getByTestId("editable-body")).toBeEmpty();
   await expect(page.getByTestId("patch")).toHaveText("null");
diff --git a/packages/krm-stream/README.md b/packages/krm-stream/README.md
index 231c832..04ab390 100644
--- a/packages/krm-stream/README.md
+++ b/packages/krm-stream/README.md
@@ -21,6 +21,30 @@ connectWithEventSource(
 );
 ```
 
-The unscoped `krm-stream` package is a compatibility forwarder. This project is pre-1.0 and has not
-been published to npm yet. See the repository [README](../../README.md),
+## Vendoring it without a bundler
+
+The default entry point is the per-module build: `dist/index.js` imports `./store.js`, which imports
+`./merge.js`, and so on. A bundler resolves that graph and tree-shakes it, and a browser resolves it
+at runtime, so every file has to be there.
+
+If you have no bundler and no `node_modules` — you copy the library in and serve it yourself — import
+the flattened build instead. Same public API, one file, no relative imports left to resolve:
+
+```ts
+import { LiveResourceStore } from "@configbutler/krm-stream/bundle";
+```
+
+Vendored, that is one file to copy (`dist/krm-stream.js`) and one path to serve:
+
+```js
+import { LiveResourceStore, connectWithEventSource } from "/krm-stream/krm-stream.js";
+```
+
+Both entry points are built from the same source and are exercised by the same browser test suite
+against a real `EventSource`. Neither has a runtime dependency.
+
+## Status
+
+The unscoped `krm-stream` package is a compatibility forwarder. This project is pre-1.0: the protocol
+and the API may still change before 1.0. See the repository [README](../../README.md),
 [client state model](../../docs/client-state-model.md), and [release guide](../../docs/releasing.md).
diff --git a/packages/krm-stream/package-lock.json b/packages/krm-stream/package-lock.json
index a4a5cf5..96b9ee5 100644
--- a/packages/krm-stream/package-lock.json
+++ b/packages/krm-stream/package-lock.json
@@ -11,6 +11,7 @@
       "devDependencies": {
         "@biomejs/biome": "^2.5.3",
         "@types/node": "^26.1.1",
+        "esbuild": "^0.25.0",
         "typescript": "^5.9.0"
       },
       "engines": {
@@ -180,6 +181,448 @@
         "node": ">=14.21.3"
       }
     },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@types/node": {
       "version": "26.1.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
@@ -190,6 +633,48 @@
         "undici-types": "~8.3.0"
       }
     },
+    "node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
     "node_modules/typescript": {
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
diff --git a/packages/krm-stream/package.json b/packages/krm-stream/package.json
index 84e7037..b807866 100644
--- a/packages/krm-stream/package.json
+++ b/packages/krm-stream/package.json
@@ -25,6 +25,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./bundle": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/krm-stream.js"
     }
   },
   "files": [
@@ -35,16 +39,19 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && npm run build:bundle",
+    "//build:bundle": "Flatten the emitted module graph into ONE file for hosts with no bundler and no node_modules — the ones that vendor the library by copying it and serving it. Bundling dist/index.js (not src/) keeps a single source of truth: the file a bundler-based consumer imports is the file this flattens. --target=es2022 pins it to the same output tsconfig emits, so a bundle can never quietly acquire a polyfill the per-module build does not have. No sourcemap: a host serving this publicly should not have to also serve a .map, or field a console warning for not doing so.",
+    "build:bundle": "esbuild dist/index.js --bundle --format=esm --target=es2022 --legal-comments=none --outfile=dist/krm-stream.js",
     "test": "node --test",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "lint": "biome check",
     "format": "biome check --write"
   },
-  "//": "ZERO dependencies, and that one is absolute: the engine emits plain ESM a browser imports with no bundler, and gitops-api has no bundler and is not getting one. devDependencies ship NOTHING and are kept to the three that pay for themselves: typescript (the compiler), @types/node (without it `tsc` cannot see test/ at all, because the tests import node:test — and `node --test` STRIPS types rather than checking them, so the suite that IS the contract check would be the one unverified file in the repo), and biome (lint + format in one binary, the TypeScript half of what gofmt/go vet/golangci-lint do for the gateway).",
+  "//": "ZERO dependencies, and that one is absolute: the engine emits plain ESM a browser imports with no bundler, and gitops-api has no bundler and is not getting one. devDependencies ship NOTHING and are kept to the four that pay for themselves: typescript (the compiler), @types/node (without it `tsc` cannot see test/ at all, because the tests import node:test — and `node --test` STRIPS types rather than checking them, so the suite that IS the contract check would be the one unverified file in the repo), biome (lint + format in one binary, the TypeScript half of what gofmt/go vet/golangci-lint do for the gateway), and esbuild (flattens dist/ into the single-file ./bundle — it runs ONCE per release here, so that every no-bundler consumer does not each reinvent it, and it is the reason a host can vendor ONE file instead of eleven; it emits no polyfill and no runtime dependency, and if it ever needs to, the bundle is wrong).",
   "devDependencies": {
     "@biomejs/biome": "^2.5.3",
     "@types/node": "^26.1.1",
+    "esbuild": "^0.25.0",
     "typescript": "^5.9.0"
   }
 }