feat: publish browser build separately

[DecimalTurn]

Summary

• Keep the browser bundle out of the normal latest package.
• Publish a browser-only package under the browser dist-tag.
• Use separate npm publish operations so both releases can authenticate with npm trusted publishing and no NPM_TOKEN.
• Add browser build smoke coverage and update the unpkg example.

[Copilot]

🟡 Changes recommended

Browser publishing must remain retryable when the stable publish step has already completed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Separates the minified browser bundle from the standard npm package and publishes it under the browser dist-tag.

Changes:

• Adds separate main and browser builds.
• Stages and publishes a browser-only package.
• Adds browser smoke tests and updates documentation and dependencies.

File summaries

File	Summary
tsdown.config.ts	Configures main and minified browser builds.
scripts/prepare-browser-package.mjs	Creates the browser package staging directory.
README.md	Updates the browser CDN example.
pnpm-lock.yaml	Removes the unused dependency.
package.json	Updates build scripts and package inclusion.
CHANGELOG.md	Documents the browser distribution.
browser-tests/browser-build-smoke.spec.ts	Adds browser bundle smoke tests.
.github/workflows/publish.yml	Publishes the browser package separately; moderate issue (3 votes): reruns may skip browser publishing after stable publication succeeds.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

.github/workflows/publish.yml:59

• A failure in this new publish step also prevents the existing JSR release from running: the later if: success() || steps.pnpm-publish.outcome == 'failure' is false when this step fails after pnpm-publish succeeded. That means a transient browser/npm error leaves npm's main package published but skips JSR; update the JSR condition or otherwise make this release failure path preserve the previously independent JSR publication.

        run: npm publish ./dist/browser-package --tag browser --provenance --ignore-scripts

README.md:39

• The checked-in production demo still imports https://unpkg.com/@decimalturn/toml-patch/dist/toml-patch.js, and scripts/build-demo.mjs does not emit the new @browser URL, so the CDN demo does not exercise the minified browser package introduced here. Please update the demo source/generator and regenerate the artifact so the CDN example consistently uses the browser dist-tag.

  import * as TOML from 'https://unpkg.com/@decimalturn/toml-patch@browser/dist/browser/toml-patch.js';

package.json:99

• This allowlist is the core guarantee that the normal package omits dist/browser, but the existing pack check only verifies that a tarball exists and the new tests inspect the build tree directly. Add a CI assertion over the packed file list that dist/browser/toml-patch.js is absent while dist/toml-patch.js remains present, otherwise this publish-safety behavior can regress unnoticed.

    "dist/toml-patch.*"

• Files reviewed: 7/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.