Browser consumers can't tree-shake: browser export condition points at a monolithic webpack bundle

[0x3639]

Summary

package.json's exports["."] resolves the browser condition to
dist/browser/bundle.browser.mjs, a single pre-webpacked artifact
(__webpack_modules__ runtime inside). For a Vite/Rollup consumer this has
three consequences:

1. No tree-shaking. An app that imports only Zenon, Address, Hash,
   TokenStandard and HtlcContract still ships KeyStore/KeyFile/
   Encryptor — ~1.3 MB minified in the main chunk.
2. argon2 always ships. dist/wallet/keyFile.js's dynamic
   import("argon2-browser") is the only module boundary the bundler can see
   inside the blob, so a ~620 KB argon2 chunk is emitted even when no code
   path touches keystore encryption.
3. A direct-eval warning. vm-browserify
   (Script.prototype.runInThisContext = function () { return eval(this.code) })
   is vendored inside the bundle; consumers get a bundler security warning
   they cannot fix, and strict-CSP pages have to account for it.

The import condition already points at real per-module ESM
(dist/index.js → dist/zenon.js, dist/wallet/*.js), but the browser
condition wins in every browser bundler, and forcing resolve.conditions
past it means re-solving the Node polyfill story unsupported.

Ask

Publish the modular ESM for browsers too — either:

• point the browser condition at the modular build (with sideEffects
  declared) and let consumers' bundlers do the polyfilling, or
• add subpath exports (znn-typescript-sdk/client, .../wallet,
  .../embedded) so wallet-less dapps can avoid KeyStore/argon2 entirely.

Happy to test a canary against zwap.fun — our app is exactly the wallet-less
consumer case (signing is delegated to a browser extension, so the keystore
code is 100% dead weight in our bundle).

Environment

znn-typescript-sdk 1.0.5, Vite 7/Rolldown, consumer repo:
https://github.com/0x3639/zwap.fun