script-src 'self' with no 'unsafe-inline' blocks inline module scripts, so the
demo initialized nothing on the deployed site while working perfectly locally —
the dev server sends no CSP, so only the real deployment showed it.
Extracted to assets/demo.js rather than relaxing the policy. Loosening CSP for
a page that renders moderation decisions would be the wrong trade.
A sibling of the BitLogin design system rather than a twin: the same
ink/paper/brass foundation and serif display, with verdigris — the patina brass
takes as it ages — where BitLogin uses its violet seal.
- index: the signature visual is the product's whole argument, one listing
reaching four surfaces and getting four different verdicts
- docs: five-step integration, elements table, presets, common mistakes
- demo: the real engine running in the browser against an in-memory transport,
so nothing is fetched or published. Add reports, restrict the seller, switch
moderator identities, and watch every surface re-decide.
The widget bundle now re-exports the runtime and core entry points, because a
static page has no package manager — anything it might need has to be reachable
from the one file it loads.
Also fixes the site build reusing a stale widget bundle. It only rebuilt when
the file was missing, which is precisely how a broken demo ships: the page
loads, the module resolves, and an export added since the last build is
silently absent. Caught by running it.
vercel.json mirrors BitLogin's security headers, with connect-src widened to
wss: for relay traffic.
Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and
BitRoad reference commits, add Node types, and make the reference-import check
scan package graphs and source for forbidden bitvid/bitroad imports.
