Initial commit

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Report a problem with ditto.site CLI or service behavior
+title: ""
+labels: bug
+---
+
+**What happened**
+<!-- A clear description of the bug. -->
+
+**To reproduce**
+- Surface: <!-- CLI / REST / MCP -->
+- URL cloned (if applicable):
+- Command or API/MCP call:
+- Options (interactions/components/motion/multiPage/verify, …):
+
+**Expected behavior**
+<!-- What you expected instead. -->
+
+**Environment**
+- OS + Node version (`node -v`):
+- Commit / version:
+- Chromium installed (`npx playwright install chromium`)? 
+
+**Logs / artifacts**
+<!-- Relevant output, the validation report, or a run dir. For a "perfect score",
+     check it isn't a blocked/degenerate capture (capture.pollution / capture.blocked). -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/ion-design/ditto.site/security/advisories/new
+    about: Please report security issues privately — do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest an improvement to ditto.site
+title: ""
+labels: enhancement
+---
+
+**Problem / motivation**
+<!-- What are you trying to do that's hard or impossible today? -->
+
+**Proposed solution**
+<!-- What you'd like to see. -->
+
+**Alternatives considered**
+<!-- Other approaches you thought about. -->
+
+**Scope notes**
+<!-- Does this touch the deterministic compiler (clone fidelity/gates) or only the
+     service layer? Anything that affects clone output should stay deterministic. -->

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # npm workspaces (single root lockfile).
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      production-dependencies:
+        dependency-type: "production"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Changes
+
+-
+
+## Testing
+
+- [ ] `npm run typecheck` passes
+- [ ] `npm test` passes
+- [ ] Added/updated tests for the change
+
+## Compiler determinism
+
+- [ ] No change to the compiler's deterministic clone semantics, **or** the change
+      is intentional and validated against the benchmarks (`npm run bench`) with
+      results noted above.
+
+## Notes
+
+<!-- Anything reviewers should know: trade-offs, follow-ups, screenshots. -->

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: ditto_site
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      # DB/queue tests use this instead of an ephemeral instance.
+      TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ditto_site
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Install Chromium (for capture/browser-gated tests)
+        run: npx playwright install --with-deps chromium
+      - run: npm run typecheck
+      - run: npm test