Prepare repo for open source

2026-06-29 16:14:44 -07:00
parent 66dfdcc58d
commit 3f7c9ed227
28 changed files with 1461 additions and 574 deletions
@@ -0,0 +1,30 @@
+# Releasing
+
+ditto.site is pre-1.0. The repository is MIT-licensed, but the npm workspaces are
+marked `private` until the package boundaries and distribution story are ready
+for public npm publishing.
+
+## Release Checklist
+
+1. Start from a clean `main` checkout.
+2. Run `npm ci` and `npx playwright install chromium`.
+3. Run `npm run typecheck` and `npm test`.
+4. Run `npm audit --omit=dev --audit-level=moderate` for runtime dependencies.
+5. For compiler-output changes, run focused fixtures or benchmarks and record
+   the result in the pull request.
+6. Update [CHANGELOG.md](../CHANGELOG.md), moving relevant entries out of
+   `Unreleased`.
+7. Update package versions if a source release is being tagged.
+8. Create an annotated Git tag and GitHub release.
+
+## Versioning
+
+Until `1.0.0`, minor and patch versions may include breaking changes. Document
+user-facing breakage in the changelog and prefer migration notes when the change
+affects generated output, API shape, database schema, or deployment settings.
+
+## Publishing
+
+Do not remove `private: true` from workspaces as part of a routine source
+release. Publishing to npm needs a separate review of package names, build
+artifacts, export maps, provenance, and long-term API compatibility.
@@ -0,0 +1,46 @@
+# Responsible Use
+
+ditto.site compiles observed public web pages into self-contained application
+code. That capability is useful for migration, testing, research, preservation,
+accessibility review, and design-system analysis, but it can also be misused.
+
+Use this project only where you have the right to inspect, copy, transform, and
+operate on the target content.
+
+## Acceptable Use
+
+- Clone sites you own, maintain, or have permission to analyze.
+- Use public examples for research, benchmarking, compatibility tests, or bug
+  reports when the output is not represented as the original publisher's
+  official site.
+- Respect robots, rate limits, terms of service, trademarks, and copyright.
+- Keep generated output clearly separated from the original brand or publisher
+  unless you are authorized to represent them.
+- Remove private data, credentials, customer information, and internal URLs from
+  captures, artifacts, logs, and issues before sharing them.
+
+## Prohibited Use
+
+- Do not use ditto.site for phishing, impersonation, credential capture, fraud,
+  malware delivery, or brand confusion.
+- Do not bypass authentication, paywalls, access controls, bot protections, or
+  technical restrictions.
+- Do not clone private, confidential, or personal data without authorization.
+- Do not run high-volume capture jobs against third-party sites without
+  permission.
+- Do not use generated output to infringe copyrights, trademarks, or licenses.
+
+## Public Service Deployments
+
+A hosted clone endpoint is a fetch-any-URL system. Keep the protections described
+in [SECURITY.md](../SECURITY.md) enabled:
+
+- SSRF protection stays on in production.
+- API keys and rate limits are configured.
+- Worker concurrency is sized so capture jobs do not overload targets or your
+  own infrastructure.
+- Artifacts have an expiration, access policy, or deletion path appropriate for
+  the data they may contain.
+
+Maintainers may close issues, remove examples, or decline changes that would
+make misuse materially easier.