feat: add ./browser export — supported browser-safe generation boundary (0.3.2)

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aestheticfunction/dspack-gen",
-  "version": "0.3.1",
-  "description": "Generation + governance pipeline for dspack contracts: prompt/context compiler, surface gates S1\u2013S3, bounded repair, protocol emission, audit reports.",
+  "version": "0.3.2",
+  "description": "Generation + governance pipeline for dspack contracts: prompt/context compiler, surface gates S1–S3, bounded repair, protocol emission, audit reports.",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
@@ -38,6 +38,10 @@
     "./adapter-types": {
       "types": "./dist/adapters/types.d.ts",
       "import": "./dist/adapters/types.js"
+    },
+    "./browser": {
+      "types": "./dist/browser.d.ts",
+      "import": "./dist/browser.js"
     }
   },
   "files": [

src/browser.ts

@@ -0,0 +1,19 @@
+/**
+ * Browser-safe generation surface.
+ *
+ * The package index (`.`) re-exports the WHOLE library, including the Node-only
+ * provider adapters (`@anthropic-ai/sdk`, `undici` via Ollama) and the eval/serve
+ * helpers (`node:fs`, `node:path`). None of that can be bundled for the browser.
+ *
+ * This entry exposes only what an in-browser (or edge) host needs to RUN the
+ * governed pipeline: `runPipeline` plus the deterministic `ScriptedAdapter`. The
+ * host brings its own adapter for real providers (e.g. a fetch-based gateway
+ * adapter) — the pipeline is provider-agnostic by design (ADR-9). The reachable
+ * subgraph is browser-safe except for `node:crypto` in the audit report's
+ * provenance hash, which the host aliases to a synchronous SHA-256 shim.
+ *
+ * Consumers that want the real Anthropic/Ollama adapters must import them from
+ * the package root in a Node/edge runtime that permits their dependencies.
+ */
+export { runPipeline, type RunOptions, type RunResult, type PipelineEvent } from "./run/orchestrator.js";
+export { ScriptedAdapter, type ScriptEntry } from "./adapters/fake.js";