Without a bundler

The same import { BitskiffHost } from '@bitskiff/host' resolves in a browser with no build step at all, off an import map. This is the whole page:

<script type="importmap">
{
  "imports": {
    "@bitskiff/host": "https://docs.dev.bitskiff.com/sdk/host@0.1.0.js"
  },
  "integrity": {
    "https://docs.dev.bitskiff.com/sdk/host@0.1.0.js": "sha384-75p6LX7v2xvHg8sjsitJAqKyaKenTkwft38fFEsvtA8YNRnG5EJmPfIugKhdDMVm"
  }
}
</script>

<script type="module">
  import { BitskiffHost, qrSvg } from '@bitskiff/host';

  const session = await new BitskiffHost({ key: 'mrc_pk_...' }).open();
  document.body.innerHTML = qrSvg(session.joinCode.url);

  session.channel('press').on('message', (m) => console.log(m.from.id, m.data));
</script>

Which environment that module is

A served module is built per environment and carries the api it was built for, because there is no endpoint option to pass one. The URL above is this site's own: it was built for dev and talks to https://api.dev.bitskiff.com. Take the module from the docs site of the environment you are shipping against, and put that URL and that hash in the map you ship.

The two things to keep

• The exact version. That URL is immutable and is never republished under that name, so a fix is a new version at a new name. A URL carrying only the major version is a redirect: a convenience for a scratch page, never for something you ship.
• The integrity hash. It is what makes a module served from somebody else's origin safe to put a key beside. A bare import from a URL takes no integrity attribute, which is why the map carries one, and a hash that does not match is a module the browser refuses to run.