chore: remove the React surface from the SDK (core-only, module settings unchanged)

[orveth]

What

DELETE the React surface from OpenSecret-SDK entirely — the React provider/hooks/contexts and the React dev-playground — so the default (and only) package entry is react-free. Supersedes the earlier "split behind ./react subpath" approach (PR #6), which the team rejected.

Deleting the React files makes src/lib/index.ts core-only, so master's existing single-entry build naturally yields a react-free package — no module-settings change.

Deleted

React library surface (5 files):

• src/lib/main.tsx — OpenSecretProvider / OpenSecretContext
• src/lib/developer.tsx — OpenSecretDeveloper / OpenSecretDeveloperContext
• src/lib/context.ts — useOpenSecret
• src/lib/developerContext.ts — useOpenSecretDeveloper
• src/lib/util.ts — orphan (useOnMount/sleep); grep-confirmed nothing imported ./util

React dev-playground:

• index.html, src/main.tsx, src/App.tsx, src/AI.tsx, src/App.css, src/index.css (the css are playground-only; grep-confirmed src/lib does not import them). src/global.d.ts (the *.der declaration) and src/assets/aws_root.der are KEPT — load-bearing for the core attestation code.

Changed

• src/lib/index.ts — removed the React re-exports (provider/contexts/hooks + their React types). KEPT all core exports incl. the adjacent core types (AttestationDocument, ParsedAttestationView, PcrConfig/Pcr0ValidationResult, generateSecureSecret/hashSecret). No reference to the deleted modules remains.
• package.json — removed react/react-dom peers + the 5 React devDeps (@types/react, @types/react-dom, @vitejs/plugin-react, eslint-plugin-react-hooks, eslint-plugin-react-refresh); bumped 0.1.0 → 0.2.0. main/module/exports/type are UNCHANGED — single-entry settings preserved (artifact stays named opensecret-react.*).
• vite.config.ts — removed ONLY the @vitejs/plugin-react import + the react() plugin entry (no JSX left). Single entry, derPlugin, dts, and the rollup react externals are untouched.
• eslint.config.js — dropped the now-removed eslint-plugin-react-hooks/-refresh imports + their plugin/rules block so the config doesn't crash.

Module settings: UNCHANGED

main/module/exports/type are exactly master's single-entry config. No multi-entry, no es+cjs, no ./react subpath. dist/ stays master-shaped: opensecret-react.umd.js, opensecret-react.es.js, index.d.ts.

Gate proof (repo has no test script)

1. bun install + bun run build  → exit 0 (✓ green; 234 modules transformed, both bundles + index.d.ts emitted)

2. dist shape: opensecret-react.umd.js, opensecret-react.es.js, index.d.ts  (no react.d.ts, no cjs split)

3. INVARIANT — react in bundle:
   grep -nE 'from[ "]*react|require\(["]react' dist/opensecret-react.*.js
   dist/opensecret-react.umd.js:0
   dist/opensecret-react.es.js:0          → 0 matches  ✓
   INVARIANT — react across src/:
   grep -rnE "from ['\"]react|require\(['\"]react" src/   → 0 matches  ✓

4. Bun import smoke:
   bun -e 'const m = await import("./dist/opensecret-react.es.js"); console.log(typeof m.configure, m.OpenSecretProvider)'
   → function undefined          (core present, React surface gone)  ✓

5. dist/index.d.ts — all 19 core fns present (configure, fetchUser, signIn, signInGuest, signOut,
   signUp, signUpGuest, convertGuestToUserAccount, confirmPasswordReset, requestPasswordReset,
   requestNewVerificationCode, verifyEmail, initiateGoogleAuth, handleGoogleCallback,
   generateThirdPartyToken, getPrivateKey, getPrivateKeyBytes, getPublicKey, signMessage)
   + types LoginResponse, UserResponse; React symbols (OpenSecretProvider, OpenSecretDeveloper,
   useOpenSecret, useOpenSecretDeveloper, OpenSecret*Context*) ABSENT  ✓

Breaking change (0.2.0)

Removes the React provider/hooks/contexts. agicash needs no change — it imports only core symbols (configure, fetchUser, signing/crypto, etc.), not the React surface.

Merge / publish

Ready for review and mergeable (verified above) — there is no reason to hold the merge itself. Merge + npm publish are a human call (gudnuf's trigger, per the team's convention for landing + shipping outward changes); the bot just won't merge or publish autonomously. Note: merging does NOT auto-publish — there's no publish CI (only test.yml/rust.yml, no NPM_TOKEN). Publishing is a separate, deliberate bun run build && npm publish after merge, whenever the team wants it on npm.

🤖 Generated with Claude Code