Add --bitgate-* theme tokens and a build-injected VERSION.

Widget styles now prefer --bitgate-* custom properties, falling back to the
deprecated --gov-* names and then the existing defaults so current pages and
overrides keep working. Browser bundles and ESM entry points expose VERSION
(and window.bitgate.version) from package.json. Document allowlist on the
widget policy preset list. Sync the lockfile so npm ci sees @bitgate/standalone.

Co-authored-by: thePR0M3TH3AN <[email protected]>

packages/standalone/src/expose-version.js

@@ -0,0 +1,29 @@
+import { VERSION } from "@bitgate/core";
+
+/**
+ * Publish `window.bitgate.version` for script-tag integrators.
+ *
+ * Additive: creates `window.bitgate` when missing, otherwise writes `version`
+ * onto the existing object so a host-provided namespace is not replaced.
+ * No-op in Node (no `window`).
+ *
+ * @param {Record<string, any>} [target] - Defaults to `globalThis.window`
+ * @returns {Record<string, any>|null} The namespace that received `version`
+ */
+export function exposeBitGateVersion(target) {
+  const root =
+    target ??
+    (typeof globalThis.window !== "undefined"
+      ? /** @type {Record<string, any>} */ (globalThis.window)
+      : null);
+  if (!root || typeof root !== "object") {
+    return null;
+  }
+
+  const existing = root.bitgate;
+  const ns =
+    existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+  ns.version = VERSION;
+  root.bitgate = ns;
+  return ns;
+}

packages/standalone/src/index.js

@@ -11,5 +11,10 @@
 // Both re-exported packages are dependency-free (@bitgate/verify, the only
 // package with third-party deps, is intentionally not pulled in), so the bundle
 // carries no external code.
+import { exposeBitGateVersion } from "./expose-version.js";
+
 export * from "@bitgate/core";
 export * from "@bitgate/nostr";
+export { exposeBitGateVersion };
+
+exposeBitGateVersion();