Add --bitgate-* theme tokens and a build-injected VERSION.

Widget styles now prefer --bitgate-* custom properties, falling back to the
deprecated --gov-* names and then the existing defaults so current pages and
overrides keep working. Browser bundles and ESM entry points expose VERSION
(and window.bitgate.version) from package.json. Document allowlist on the
widget policy preset list. Sync the lockfile so npm ci sees @bitgate/standalone.

Co-authored-by: thePR0M3TH3AN <[email protected]>

packages/standalone/build.mjs

@@ -15,6 +15,8 @@ import { build, context } from "esbuild";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { bitgateVersionPlugin } from "../../scripts/esbuild-bitgate-version.mjs";
+
 const HERE = dirname(fileURLToPath(import.meta.url));
 
 /** @type {import("esbuild").BuildOptions} */
@@ -31,6 +33,7 @@ const options = {
   banner: {
     js: "/*! BitGate (headless standalone) — GPL-3.0-or-later — https://github.com/PR0M3TH3AN/Nostr-Governance */",
   },
+  plugins: [bitgateVersionPlugin()],
 };
 
 const watch = process.argv.includes("--watch");

packages/standalone/src/expose-version.js

@@ -0,0 +1,29 @@
+import { VERSION } from "@bitgate/core";
+
+/**
+ * Publish `window.bitgate.version` for script-tag integrators.
+ *
+ * Additive: creates `window.bitgate` when missing, otherwise writes `version`
+ * onto the existing object so a host-provided namespace is not replaced.
+ * No-op in Node (no `window`).
+ *
+ * @param {Record<string, any>} [target] - Defaults to `globalThis.window`
+ * @returns {Record<string, any>|null} The namespace that received `version`
+ */
+export function exposeBitGateVersion(target) {
+  const root =
+    target ??
+    (typeof globalThis.window !== "undefined"
+      ? /** @type {Record<string, any>} */ (globalThis.window)
+      : null);
+  if (!root || typeof root !== "object") {
+    return null;
+  }
+
+  const existing = root.bitgate;
+  const ns =
+    existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+  ns.version = VERSION;
+  root.bitgate = ns;
+  return ns;
+}

packages/standalone/src/index.js

@@ -11,5 +11,10 @@
 // Both re-exported packages are dependency-free (@bitgate/verify, the only
 // package with third-party deps, is intentionally not pulled in), so the bundle
 // carries no external code.
+import { exposeBitGateVersion } from "./expose-version.js";
+
 export * from "@bitgate/core";
 export * from "@bitgate/nostr";
+export { exposeBitGateVersion };
+
+exposeBitGateVersion();

packages/standalone/test/standalone.test.js

@@ -2,10 +2,16 @@
 // engine (core) + label codec (nostr) — so a no-build site gets everything from
 // the single bundled file. Tests the entry, not the built artifact (dist is
 // gitignored); the build itself is exercised by `npm run build:standalone`.
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
 import * as bitgate from "../src/index.js";
 
+const HERE = dirname(fileURLToPath(import.meta.url));
+const rootPkg = JSON.parse(readFileSync(join(HERE, "..", "..", "..", "package.json"), "utf8"));
+
 describe("standalone entry surface", () => {
   it("re-exports the core engine and the Nostr label codec together", () => {
     for (const name of [
@@ -17,6 +23,7 @@ describe("standalone entry surface", () => {
       "createPolicyDefinition",
       "createEventTarget",
       "ALLOWLIST_POLICY",
+      "VERSION",
       // nostr label codec
       "decodeLabels",
       "encodeLabel",
@@ -67,4 +74,15 @@ describe("standalone entry surface", () => {
 
     expect(decision.transaction?.effect).toBe("deny");
   });
+
+  it("exports VERSION matching package.json", () => {
+    expect(bitgate.VERSION).toBe(rootPkg.version);
+  });
+
+  it("publishes version onto a window-like global without replacing other keys", () => {
+    const target = { bitgate: { extra: true } };
+    bitgate.exposeBitGateVersion(target);
+    expect(target.bitgate.version).toBe(bitgate.VERSION);
+    expect(target.bitgate.extra).toBe(true);
+  });
 });