build: publish a self-contained single-file ESM bundle

[gjtorikian]

Summary

• Adds a build:bundle step that bundles src/index.ts into dist/bundle.js via bun build --target=bun --format=esm, inlining every npm dependency and leaving only node: builtins external.
• Wires the bundle into postbuild, so npm run build emits it alongside the tsc output; it ships in the tarball through the existing dist files entry plus a new ./bundle exports subpath.
• Motivation: the WorkOS CLI (a Bun-compiled standalone binary) can download the tarball at runtime and import() the bundle directly, with no node_modules needed beside it — while types keep coming from the package's main export as a build-time dependency.
• Installs Bun in the CI and release workflows so the build step can produce the bundle before pack/publish.

[greptile-apps]

Greptile Summary

This PR adds a self-contained ESM bundle (dist/bundle.js) built via bun build --target=bun, wired into postbuild so it's emitted alongside the tsc output. The bundle is exposed via a new ./bundle exports subpath and is intended for the WorkOS CLI to import() at runtime with no node_modules needed.

• Installs Bun (pinned to 1.3.11, action pinned to commit SHA) in both CI and release workflows before the build step runs.
• Adds a ./bundle subpath export with correct types pointing at ./dist/index.d.ts and import pointing at ./dist/bundle.js, consistent with other subpath exports.
• Documents Bun as a build-time prerequisite in the README Development section.

Confidence Score: 5/5

Safe to merge — the changes are additive build infrastructure with no modifications to runtime logic.

All three previously flagged issues (unpinned Bun version, missing types on the bundle export, undocumented Bun prerequisite) are fully addressed. The Bun action is pinned to both a commit SHA and a specific binary version, the ./bundle export correctly declares types pointing at the existing dist/index.d.ts, and the README now documents the Bun build dependency. No new correctness or security issues were found.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds a pinned oven-sh/setup-bun step (commit SHA + bun-version: '1.3.11') before npm ci; correctly placed so postbuild can invoke bun build.
.github/workflows/release.yml	Mirrors the same pinned Bun setup step from CI; Bun is available before npm run build runs in the publish job.
package.json	Adds build:bundle script, wires it into postbuild, and adds ./bundle export subpath with types and import conditions matching the rest of the exports map.
README.md	Adds a Development section documenting Bun as a build prerequisite and explaining what happens if bun: command not found.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[npm run build] --> B[prebuild: rm -rf dist]
    B --> C[tsc]
    C --> D[postbuild]
    D --> E[chmod +x dist/cli.js]
    D --> F[npm run build:bundle]
    F --> G["bun build --target=bun --format=esm\nsrc/index.ts --outfile dist/bundle.js"]
    G --> H[dist/bundle.js\nself-contained ESM]
    H --> I[npm tarball via files: dist]
    I --> J[WorkOS CLI downloads tarball\nimport dist/bundle.js at runtime]
    style H fill:#4ade80,color:#000
    style J fill:#60a5fa,color:#000

Loading

_{Reviews (2): Last reviewed commit: "fix(build): pin Bun version, add bundle ..." | Re-trigger Greptile}

[greptile-apps]

npm run build fails locally without Bun installed

postbuild unconditionally calls build:bundle, which invokes bun build. Any contributor who runs npm run build without Bun installed will get a hard failure after the TypeScript compile succeeds — the error message (bun: command not found) is not obvious about the cause. Consider documenting Bun as a dev prerequisite in the README, or making the bundle step opt-in (e.g., a separate build:full script) so standard npm run build continues to work in Node-only environments.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 67-68

Comment:
**`npm run build` fails locally without Bun installed**

`postbuild` unconditionally calls `build:bundle`, which invokes `bun build`. Any contributor who runs `npm run build` without Bun installed will get a hard failure after the TypeScript compile succeeds — the error message (`bun: command not found`) is not obvious about the cause. Consider documenting Bun as a dev prerequisite in the README, or making the bundle step opt-in (e.g., a separate `build:full` script) so standard `npm run build` continues to work in Node-only environments.

How can I resolve this? If you propose a fix, please make it concise.