+ This runs the real engine in your browser against an in-memory relay, so
+ nothing is published and nothing is fetched. Change the evidence on the
+ right and watch every surface re-decide.
+
+
+
+
+
+
+
+
The listing
+
Wrapped in a real <bitgate-veil>, using the marketplace preset.
+
+
+
+
Refurbished widget
+
+
Refurbished widget
+
12,000 sats · sold by d4d4…d4d4
+
+
+
+
+
Every surface, right now
+
One snapshot, evaluated four ways.
+
+
+
Surface
Visibility
Transaction
Rank
+
+
+
+
+
+
+
+
+
Evidence
+
Everything here is signed state the engine reduces.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Signed in as
+
Capability checks are enforced in the command layer, not the UI.
+
+
+
+
+
+
+
+
+
+
+
+ Note the seller's view. However strong the evidence, the
+ seller dashboard never hides the listing from its own seller — hiding it
+ would leave no route to appeal.
+
+
+
+
+
The markup behind this
+
+ In production the provider takes relay URLs. Here it is handed an in-memory
+ runtime so the page works offline and publishes nothing.
+
+ No bundler required. Build the widget once, self-host it, and configure
+ everything in markup. Then replace the preset with thresholds that fit
+ your own community.
+
+
+
+
+
+
+
+
Build the widget from source
+
+ Clone the repository and build. The output is a single self-contained
+ file with no runtime dependencies.
+
+ The bundle is deliberately not committed. A moderation
+ widget decides what people can see; build it from source you have read
+ rather than trusting a prebuilt minified blob. Copy the result onto your
+ own origin — do not hot-link this site's copy.
+
+
+
+
+
Include the script and the provider
+
+ <bitgate-provider> builds the runtime, loads
+ administrative state from your relays, and shares both with every
+ element inside it.
+
+
<script type="module" src="/vendor/bitgate/bitgate.js"></script>
+
+<bitgate-provider
+ relays="wss://relay-one.example,wss://relay-two.example"
+ root="<your-root-pubkey>"
+ policy="social">
+ <!-- everything governed goes in here -->
+</bitgate-provider>
+
+ root is your deployment's administrator pubkey — the key
+ that publishes the moderator roster. It is configuration, not something
+ discovered at runtime.
+
+
+
+
+
Wrap what should be governed
+
+ Elements read their target from attributes, so a server-rendered page
+ needs no JavaScript at all.
+
+ The veil applies the decision: blur on restrict, a
+ disclosure with a "show anyway" control on hide, a warning
+ line on warn. Assigning .target in JavaScript
+ still works and wins over the attribute.
+
+
+
+
+
Connect a signer
+
+ BitGate needs to know who is looking, both to build the trust graph and
+ to check what they may do. BitLogin's provider fits without an adapter.
+
+
const provider = document.querySelector("bitgate-provider");
+await provider.ready;
+await provider.useSigner(window.nostr);
+
+// BitGate reads the follow graph from your app — it has no opinion
+// about how you fetch kind:3.
+provider.runtime.trust.setContacts(followList);
+
+ Await ready, don't listen for it. The
+ bitgate:ready event fires during element upgrade, which for a
+ page that defines elements after parsing is before a listener could be
+ attached. The promise never has that race.
+
+
+
+
+
Replace the preset
+
+ Presets exist so the first run works, not because the engine has an
+ opinion. Every number in them is a starting point.
+
+ Ask BitGate what to do with a post, an account, or a listing. Get back an
+ answer built from who the viewer trusts and who you authorized — then
+ apply it. No thresholds to hand-roll, no ban logic scattered through
+ your views.
+
+
+ Checkoutthe moment it matters
+ sale blocked
+
+
+
+ Seller's own viewwith the evidence
+ visible
+
+
+
One snapshot. Four surfaces. Four different answers.
+
+
+
+
+
+
A decision is not a boolean
+
+ Most moderation code collapses everything into hidden: true, then
+ discovers it needs "visible but unbuyable", or "shown but ranked last", and
+ grows a second system to say so. BitGate answers four questions at once, each
+ on its own ladder.
+
+ Downranking is a sort input, not a filter. A downranked item
+ still appears and can still be acted on. Conflating the two is what makes
+ moderation feel like censorship to the people on the receiving end.
+
+
+
+
+
Where the answer comes from
+
+ Two independent sources, deliberately kept apart. Being allowed to publish
+ grants no trust; being trusted grants no authority.
+
+
+
+
+
People the viewer follows
+
+ Reports and mutes count only when they come from the viewer's own trust
+ graph. The same content can be hidden for one person and fine for
+ another — because it genuinely is.
+
+
+
+
Moderators you authorized
+
+ A root key publishes the roster; each moderator publishes under their
+ own key. Revoke a role and their entries stop counting immediately, with
+ nothing to rewrite.
+
+
+
+
Community curators
+
+ Subscribe to someone else's deny list without handing them moderator
+ powers. A curator can contribute names and nothing more.
+
+
+
+
The viewer's own choices
+
+ Personal blocks always win, and "show it anyway" is available wherever
+ your policy permits it. Hidden content says why, instead of silently
+ vanishing.
+
+
+
+
+
+
+
Pairs with BitLogin
+
+ Two halves of the same question. Drop both in and a signed-in visitor gets
+ moderation shaped by their own follow graph.
+
+
+
+
+ BitLogin
+
Who are you?
+
A login name and password that unlock a portable Nostr identity, with no account server.
+
+
+
+
+ BitGate
+
What may you see, and do?
+
A decision per item, per surface, built from that identity's trust graph and your roster.
+ One script tag and one element. The provider builds the runtime, loads your
+ administrative state, and every element inside finds it — no wiring code.
+
+ The engine carries no thresholds of its own. Presets ship in the box so the
+ first run takes one attribute; every number in them is a starting point you
+ are meant to replace.
+
+
+
+
+
Headless core
+
Pure evaluation. No I/O, no browser globals, no dependencies. Runs the same in Node and a browser.
+
+
+
Bring your own relays
+
A WebSocket transport ships for convenience. Already have a relay pool? Pass an adapter instead.
+
+
+
Your objects, your targets
+
An adapter says what a product or post is in governance terms. Deny a seller and their whole catalogue goes with them.
+
+
+
Explains itself
+
Every decision carries stable reason identifiers and the evidence behind it — so appeals are possible.
+
+
+
+
+
+
+
+
diff --git a/packages/site/serve.mjs b/packages/site/serve.mjs
new file mode 100644
index 0000000..0b85f8f
--- /dev/null
+++ b/packages/site/serve.mjs
@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/** Serve the built site locally for review. */
+import { createServer } from "node:http";
+import { readFile } from "node:fs/promises";
+import { dirname, extname, join, normalize } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "dist");
+const port = Number(process.env.PORT ?? 4174);
+
+const TYPES = {
+ ".html": "text/html; charset=utf-8",
+ ".css": "text/css; charset=utf-8",
+ ".js": "text/javascript; charset=utf-8",
+ ".map": "application/json; charset=utf-8",
+ ".svg": "image/svg+xml",
+};
+
+createServer(async (request, response) => {
+ const url = new URL(request.url ?? "/", "http://localhost");
+ let path = normalize(decodeURIComponent(url.pathname));
+ if (path.endsWith("/")) path += "index.html";
+
+ try {
+ const body = await readFile(join(root, path));
+ response.writeHead(200, { "content-type": TYPES[extname(path)] ?? "application/octet-stream" });
+ response.end(body);
+ } catch {
+ response.writeHead(404, { "content-type": "text/plain" });
+ response.end("Not found");
+ }
+}).listen(port, () => console.log(`BitGate site → http://localhost:${port}`));
diff --git a/packages/widget/src/index.js b/packages/widget/src/index.js
index fe89e37..b21201c 100644
--- a/packages/widget/src/index.js
+++ b/packages/widget/src/index.js
@@ -8,6 +8,30 @@
// Elements receive a runtime rather than creating one, so a host application
// can share a single governance runtime across an entire page.
+// The bundle is the browser distribution of BitGate as a whole, not only its
+// elements: a static page has no package manager, so anything it might need
+// has to be reachable from this one file.
+export {
+ createBitGate,
+ createCommands,
+ createRelayTransport,
+ createMemoryTransport,
+ createMemoryStorage,
+ ERROR_CODES,
+} from "@bitgate/runtime";
+
+export {
+ SOCIAL_POLICY,
+ COMMERCE_POLICY,
+ ADMIN_ONLY_POLICY,
+ POLICY_PRESETS,
+ getPolicyPreset,
+ createPolicyDefinition,
+ createApplicationAdapter,
+ evaluateObject,
+ collectTargets,
+} from "@bitgate/core";
+
export {
BASE_STYLES,
GovernanceElement,
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..4be7b40
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,25 @@
+{
+ "buildCommand": "npm run build:widget && npm run build:site",
+ "outputDirectory": "packages/site/dist",
+ "cleanUrls": true,
+ "headers": [
+ {
+ "source": "/(.*)",
+ "headers": [
+ {
+ "key": "Content-Security-Policy",
+ "value": "default-src 'none'; script-src 'self'; connect-src 'self' wss:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests"
+ },
+ { "key": "X-Content-Type-Options", "value": "nosniff" },
+ { "key": "Referrer-Policy", "value": "no-referrer" },
+ {
+ "key": "Permissions-Policy",
+ "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+ },
+ { "key": "Cross-Origin-Opener-Policy", "value": "same-origin" },
+ { "key": "Cross-Origin-Resource-Policy", "value": "same-origin" },
+ { "key": "X-Frame-Options", "value": "DENY" }
+ ]
+ }
+ ]
+}