My current thinking here is that you could do CSL-JSON pre-processing in Lua, using the tiny json.lua. That would be better in many ways than distributing a binary wrapper around Text.Pandoc which would still probably weigh 20MB like pandoc-citeproc does. I tried it out here.