ditto.site/CHANGELOG.md

Changelog

All notable changes to this project are documented here. The format is based on Keep a Changelog; this project is pre-1.0, so minor/patch semantics are not yet guaranteed.

[Unreleased]

Changed — Local CLI success output and orientation

• The clone-static CLI now prints a copy-paste-safe success summary to stderr: a single quoted cd "<app>" && npm install && npm run dev line (survives terminal wrapping — no more broken cd from a wrapped timestamped path) plus the key AGENTS.md safe-to-edit pointers (src/app/content.ts, src/app/components/). The machine-readable { "event": "done", ... } JSON line on stdout is unchanged (now also carrying stableApp).
• Added --serve (run npm install + npm run dev in the generated app) and --open (also launch the browser at the dev URL) so "see it locally" is one flag.
• In the default runs layout, each clone now refreshes a runs/<site>/latest symlink pointing at the newest run, giving a stable, timestamp-free path for cd and scripts.

Added — Docs hub and terminology/secret-hygiene clarifications

• Added docs/README.md as a central documentation index.
• Clarified prominently that ditto.site "cloning" means generating a codebase from a live URL, not git clone (no source repo required), in the README and docs hub.
• Added an explicit "API keys are secrets — use $DITTO_API_KEY, never inline/commit, rotate anytime" note beside the key/auth examples in the README and docs/SERVICE.md.

Added — ditto unpack CLI

• packages/cli — a zero-dependency ditto command-line helper. npm run unpack -- <clone.json|-> <out-dir> turns the files map returned by POST /v1/clones (or GET /v1/clones/:id/result) into a real project tree on disk: text files written inline, binary assets materialized from inline base64 or fetched from their reference URL ($DITTO_API_URL / $DITTO_API_KEY), with path-traversal guards and pre-write sha256 integrity checks. Reads from stdin so a curl response can be piped straight in. Documented next to the REST examples in the README and docs/SERVICE.md.

Added — Open-source readiness

• Added support, release, responsible-use, CODEOWNERS, and gitattributes files.
• Made workspace package metadata explicit for license and repository scanners.
• Tightened contributor and PR checklists around runtime audit, documentation, responsible use, and committed artifacts.

Changed — Generated app dependency templates

• Updated generated Next apps to the current Next 15 line with React 19.
• Updated generated Vite apps to Vite 6.4 with React 19, keeping the generated app Node floor compatible with the repo's >=20 engine policy.

Added — Service layer (REST + MCP API)

A hosted service around the deterministic compiler, as an npm-workspaces monorepo (packages/*). The compiler's clone behavior is unchanged — only a library boundary was added.

• packages/core — the sole compiler adapter: runCloneJob (temp-dir lifecycle, optional verify), collectFileMap, cacheKey.
• packages/db — Drizzle schema + migrations (jobs/clones/cache/apiKeys), repo, and a pg-boss queue.
• packages/storage — ArtifactStore (local disk or S3/R2 via presigned URLs), deterministic tgz/zip bundles.
• packages/api — Hono app: REST routes + MCP (Streamable-HTTP), API-key auth, rate limiting, and SSRF protection.
• packages/worker — queue consumer with isolated per-worker verify build harness; supports multi-page (clone_site) jobs.
• Freshness-bounded caching (CACHE_STALE_AFTER, noCache), Docker images + docker-compose (Postgres + MinIO), CI, and Railway/Neon/R2 deploy docs.
• Root CLI passthrough scripts so the compiler CLI runs from the repo root too.

See docs/SERVICE.md and README.md.

Changed — Component extraction keeps styling out of the content model

• Extracted components no longer pull per-instance className strings into the editable content model (content.ts). When a node's class varies across instances, the tokens common to all instances are baked into the component skeleton and only the per-instance diff is emitted — to a separate _styles.ts plumbing module (alongside _cids.ts), merged back at render time with a generated cn() helper. content.ts now holds only semantic fields (text, href, src, alt, …). Render-identical (token order doesn't affect computed style); gates 0–6 and site/determinism unaffected. Swap cn for tailwind-merge if you want conflict-aware merging when hand-editing the overrides.

Notes

• The deterministic compiler predates this changelog; the current architecture is summarized in README.md, with operational service details in docs/SERVICE.md.