standalone: ship the headless engine as one bundleable ESM file

A no-build static site couldn't vendor BitGate the way it vendors a single
dependency: bare @bitgate/* specifiers don't resolve in a browser, and the
headless path spans two packages (the evaluator in core, the kind-1985 label
codec in nostr). The widget bundle solved this for the DOM path only.

Add @bitgate/standalone (packages/standalone): an entry re-exporting core +
nostr, esbuilt into a single self-contained dist/bitgate.js (~44 KB). It's
the same canonical code the npm packages ship, with specifiers inlined, and
dependency-free -- @bitgate/verify's @noble deps are intentionally not pulled
in, so the bundle carries no third-party code. Wired into `npm run build` via
build:standalone.

Verified: no bare imports in the output (self-contained), and a smoke test
composes a full label -> decision flow from the single entry. README Packages
table and headless section document it.

Addresses the "standalone ESM single-file" item of the Tessera integration
feedback (docs/TODO.md).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BXQCvJPA6sVSQ5j8uBd9bB

packages/standalone/build.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Bundle the headless engine + Nostr codecs into a single self-contained ESM
+ * file for no-build static sites.
+ *
+ * The output (`dist/bitgate.js`) is the same canonical code the npm packages
+ * ship — not a second implementation — with the bare `@bitgate/*` specifiers
+ * resolved and inlined. Consumers copy it onto their own origin and import it
+ * with a single relative path; they never fetch it from someone else's
+ * deployment.
+ *
+ * Usage: node packages/standalone/build.mjs [--watch]
+ */
+import { build, context } from "esbuild";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+/** @type {import("esbuild").BuildOptions} */
+const options = {
+  entryPoints: [join(HERE, "src", "index.js")],
+  outfile: join(HERE, "dist", "bitgate.js"),
+  bundle: true,
+  format: "esm",
+  platform: "browser",
+  target: ["es2022"],
+  sourcemap: true,
+  minify: true,
+  legalComments: "inline",
+  banner: {
+    js: "/*! BitGate (headless standalone) — GPL-3.0-or-later — https://github.com/PR0M3TH3AN/Nostr-Governance */",
+  },
+};
+
+const watch = process.argv.includes("--watch");
+
+if (watch) {
+  const ctx = await context(options);
+  await ctx.watch();
+  console.log("bitgate standalone: watching…");
+} else {
+  const result = await build(options);
+  if (result.errors.length) {
+    process.exit(1);
+  }
+  console.log(`✓ Built ${options.outfile}`);
+}

packages/standalone/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@bitgate/standalone",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "license": "GPL-3.0-or-later",
+  "description": "Headless BitGate engine + Nostr codecs bundled into a single self-contained ESM file for no-build static sites.",
+  "main": "src/index.js",
+  "scripts": {
+    "build": "node build.mjs"
+  },
+  "dependencies": {
+    "@bitgate/core": "*",
+    "@bitgate/nostr": "*"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.2"
+  }
+}

packages/standalone/src/index.js

@@ -0,0 +1,15 @@
+// @bitgate/standalone — the headless engine and the Nostr codecs it consumes,
+// as one bundleable entry.
+//
+// Bare specifiers (`@bitgate/core`) don't resolve in a browser, and the headless
+// path needs two packages (the evaluator in core, the kind-1985 label codec in
+// nostr). build.mjs esbuilds this entry into a single self-contained ESM file a
+// no-build static site can vendor the way it would vendor any one dependency —
+// the requirement the widget bundle already meets for the DOM path, met here for
+// the headless path.
+//
+// Both re-exported packages are dependency-free (@bitgate/verify, the only
+// package with third-party deps, is intentionally not pulled in), so the bundle
+// carries no external code.
+export * from "@bitgate/core";
+export * from "@bitgate/nostr";

packages/standalone/test/standalone.test.js

@@ -0,0 +1,70 @@
+// The standalone entry must surface the whole headless path from one import —
+// engine (core) + label codec (nostr) — so a no-build site gets everything from
+// the single bundled file. Tests the entry, not the built artifact (dist is
+// gitignored); the build itself is exercised by `npm run build:standalone`.
+import { describe, expect, it } from "vitest";
+
+import * as bitgate from "../src/index.js";
+
+describe("standalone entry surface", () => {
+  it("re-exports the core engine and the Nostr label codec together", () => {
+    for (const name of [
+      // core engine
+      "evaluateTarget",
+      "createSnapshot",
+      "reduceAdminState",
+      "createAuthorityState",
+      "createPolicyDefinition",
+      "createEventTarget",
+      "ALLOWLIST_POLICY",
+      // nostr label codec
+      "decodeLabels",
+      "encodeLabel",
+      "labelsToContributions",
+      "LABEL_KIND",
+    ]) {
+      expect(bitgate[name], name).toBeDefined();
+    }
+  });
+
+  it("composes a headless decision end to end from the single entry", () => {
+    const ROOT = "a1".repeat(32);
+    const MOD = "b2".repeat(32);
+    const PLUGIN = "e5".repeat(32);
+    const NOW = 1_750_000_000;
+
+    const target = bitgate.createEventTarget(PLUGIN);
+    expect(target).not.toBeNull();
+
+    const labelEvent = {
+      ...bitgate.encodeLabel({ value: "deny", namespace: "ns", targets: [/** @type {any} */ (target)] }),
+      pubkey: MOD,
+      created_at: NOW,
+      id: "0".repeat(64),
+      sig: "",
+    };
+
+    const contributions = bitgate.labelsToContributions(bitgate.decodeLabels(labelEvent), {
+      namespace: "ns",
+      denyValues: ["deny"],
+    });
+    const authority = bitgate.createAuthorityState({ root: ROOT, actors: { [MOD]: ["moderator"] } });
+    const snapshot = bitgate.createSnapshot({ authority, admin: bitgate.reduceAdminState(contributions, authority) });
+
+    const policy = bitgate.createPolicyDefinition({
+      id: "p",
+      version: "1.0.0",
+      defaultProfile: "d",
+      profiles: { d: { name: "d", administrativeDeny: { visibility: "warn", transaction: "deny" }, reports: {}, mutes: {} } },
+    });
+
+    const decision = bitgate.evaluateTarget(/** @type {any} */ (target), snapshot, {
+      surface: "d",
+      policyProfile: "d",
+      policy,
+      now: NOW,
+    });
+
+    expect(decision.transaction?.effect).toBe("deny");
+  });
+});