v0 Clone

v0-clone

Vercel's v0 clone — the v0 SDK's example app: a v0-style chat that builds apps through the v0 Platform API, with a live preview served from an isolated origin, Design Mode, file, ZIP and GitHub imports, version restore and one-click deploys — running as two Cloudflare Workers built by @opennextjs/cloudflare: the host app and its preview proxy, each on its own origin and each told the other's at build, deployed per environment through Orun, and packaged as an Orun baseline: one command takes a new app builder from nothing to live on stage and prod, in its own repository, under its own name — in ONE landing.

It keeps no store of its own — chats, files and previews are the v0 API's — and it goes live with no key: each visitor connects their own v0 key in the browser, and an owner who wants one key for everyone stores it afterwards as an optional secret. Upstream dropped its database and accounts on 2026-07-30, so there is no data plane to provision: one provider (Cloudflare) and one brokered token deploy both Workers. What the baseline adds is everything needed to make a copy of it somebody else's, built the way cirrus-baseline is since its one-landing bootstrap. See specs/epics/v0-clone for the design, the milestones and the as-built status.

Security warning — upstream's, read for Cloudflare. The example has no user accounts. With V0_API_KEY stored, everyone who can reach the Workers shares that key's v0 workspace: they can read, create, change and delete chats, run generations at its expense and deploy with the Vercel token the key carries. Every server route passes through authorizeProxyRequest (apps/web/lib/proxy.ts, apps/preview/lib/authorize.ts), a same-origin check only — the seam where real session auth goes. Until it does, leave V0_API_KEY unset (each visitor then uses their own key, through the app's dialog) or put Cloudflare Access in front of both Workers before you store one.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/v0-clone
cd v0-clone
orun new --blueprint repo-blueprint.yaml --out ~/sites/acme-builder --run-hooks --resume \
  --set reponame=acme-builder --set productname="Acme Builder" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → v0-clone → Build). Two phases: 01-product creates the repository and lands the whole product as ONE pull request — intent, CI, tooling, both apps and their tests — and one convergence deploys, in each environment, the preview origin and then the host app built with its origin, stage and prod side by side; 02-docs records the live deployment from probed facts. BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase. About nine minutes, an estimate until a bootstrap measures it.

The new repository receives the product only — both apps, their tests, its CI, its tooling, a README and an AGENTS.md of its own and its operating contract — renamed throughout to the product's name, repository and Worker names. Upstream's credit and its own V0_CLONE_ORIGIN variable keep upstream's name. None of this repository's machinery ships.

What is here (the product)

Getting started

pnpm install
pnpm typecheck
pnpm lint
pnpm test
pnpm build          # next build + opennextjs-cloudflare build, for both apps

pnpm dev            # both apps: the host on http://localhost:3000, the proxy on http://localhost:3001

Open the host app and save a v0 API key through its dialog (v0.app → Settings → API keys; it needs write access and generation credits). The key is validated, kept in an HTTP-only cookie on the host's origin, and handed by your browser straight to the preview proxy, which keeps its own copy in its own cookie. To serve the built Workers instead: pnpm --filter @app/preview preview and pnpm --filter @app/web preview (wrangler dev; .dev.vars.example in each app).

Connecting v0

Each app resolves its credential in this order: V0_API_KEY, then its own cookie. Upstream's third, Vercel OIDC, has no Cloudflare equivalent.

• Bring your own key (the default). Leave V0_API_KEY unset. Every visitor saves their own key through the dialog and spends their own credits.
• One shared key. Store it per environment as the Orun secret V0_API_KEY and redeploy: both Workers' deploys push it as a Worker secret (it never reaches a bundle), and the dialog turns read-only. Read the security warning above first.

How it maps to Vercel

Deploying

A merge to main deploys, per environment, <repo>-preview-<env> and then <repo>-web-<env> (the host waits for its proxy), each checked by its smokeCommand: the proxy's /api/health, then the host's page, its /api/health and the proxy origin it was built with. Neither needs a v0 key to pass.

Deploy by hand: Orunbase's Deploy button, or Actions → CI → Run workflow on main with a component (web, preview, or empty for both) and an environment, deploys exactly as a merge does.

Custom domains

Attach a domain to each Worker in Cloudflare, then set the two origins under the environment's env: in intent.yaml and redeploy both apps:

env:
  V0_PREVIEW_PROXY_URL: https://acme-previews.net   # the host's iframe points here
  V0_CLONE_ORIGIN: https://app.acme.com            # the only origin the proxy lets provision its key

Both Workers' workers.dev hostnames share one registrable domain (<subdomain>.workers.dev), so the preview is cross-origin to the host but same-site with it. For production, give the preview proxy a domain on a different registrable domain from the host's, as upstream recommends.

Trusted preview hosts

The preview proxy registers its own hostname in the v0 team's trusted preview hosts (at most five) the first time it is provisioned with a key or serves a preview. Stage and prod take two; remove stale ones in v0's settings.

CI

The v0 SDK and its example are © Vercel, Inc., under the Apache License 2.0 (apps/web/LICENSE, apps/preview/LICENSE).