feat: expose reusable Functions core

[shrey150]

BLUF

Expose the canonical Functions implementation as @browserbasehq/sdk-functions/core and make bb functions a thin CLI adapter over it. This removes the need for Browse or any future host CLI to copy the Functions API/archive/runtime logic.

Root cause and design

The Functions HTTP API did not make a breaking change. The SDK/CLI implementation evolved—scaffold metadata/dependencies, project inference, archive validation, local runtime behavior, invocation/build polling—and Browse retained an older parallel copy.

This PR creates a headless core boundary:

• core owns Functions API requests, polling, archives, scaffolding, local runtime protocol, and typed failures
• Commander adapters own prompts/flags, human output, signals, and process exit behavior
• consumers import @browserbasehq/sdk-functions/core; importing it does not execute the bundled bb CLI

Public core operations include createFunctionProject, createFunctionArchive, publishFunction, invokeFunction, getBuildStatus, getInvocationStatus, and startDevServer, plus their typed results/errors.

Compatibility and package shape

• @browserbasehq/sdk-functions/core ships ESM, CommonJS, and declarations from the existing package.
• The current @browserbasehq/sdk-functions root export and bb binary remain intact.
• This is a subpath export, not a physically separate npm package. Consumers avoid executing CLI code, but still install the package's Commander/Chalk/CLI dependency footprint. If install footprint becomes material, a later release can split a physical functions-core package without reintroducing duplicate implementations.

E2E test matrix

Command / flow	Observed output	Confidence / sufficiency
pnpm lint && pnpm build	Formatting, ESLint, typecheck, ESM/CJS bundles, and declarations passed	Proves the source and published entrypoints compile; does not exercise the cloud service
pnpm test	63/63 tests passed	Covers core and Commander adapter contracts; mocks do not replace live validation
pnpm test:integration against the packed tarball	58/58 tests passed, including a real TypeScript consumer compile	Proves packed ESM, CommonJS, declarations, CLI/dev/scaffold/manifest behavior; does not prove npm-registry publication
pnpm test:e2e with real Functions credentials	4/4 templates scaffolded, installed, published, built, and invoked successfully	Exercises the real Functions service across every starter template; limited to public starter behavior and the tested account
Cross-host Browse/bb flows using the exact SDK commit	Browse scaffold published by bb; bb scaffold published by Browse; local dev, sync invoke, async invoke, and status polling passed	Proves both CLI adapters interoperate with the same core; the final semver dependency swap still requires a post-release rerun

Live validation used public starter behavior. Secrets, account identifiers, resource IDs, and connection URLs are intentionally omitted.

Release and rollout

This repository has CI but no automated npm release workflow. Because ./core is a new public API, the recommended release is 1.1.0:

1. Merge this PR.
2. Open and merge a dedicated version-bump PR updating package.json and pnpm-lock.yaml to 1.1.0.
3. From a clean trusted checkout of main, run pnpm install --frozen-lockfile, pnpm lint, pnpm test, pnpm test:integration, pnpm build, and pnpm pack --json.
4. Publish from the trusted npm release environment with pnpm publish --access public (including the registry's normal authentication/OTP requirements).
5. Verify npm view @browserbasehq/sdk-functions@1.1.0 exports --json includes ./core and smoke-import both module formats.
6. Replace the exact commit pin in the downstream Browse draft with ^1.1.0, remove its temporary build allowance, regenerate the lockfile, rerun tests, then merge/release Browse.

The downstream Browse proof is browserbase/stagehand#2701. It is intentionally draft and must not be published while it references the GitHub commit.