# Environment
.env
.env.*
!.env.example
!.env.test.example

# Python
__pycache__/
*.pyc
*.pyo
.pytest_cache/
*.egg-info/
.venv/
venv/
.ruff_cache/
.mypy_cache/

# Node
node_modules/

# OS
.DS_Store
Thumbs.db

# IDE
.idea/
.vscode/
*.swp
*.swo
*.code-workspace

# Coverage reports
htmlcov/
coverage.xml
.coverage
coverage/

# Build output
build/
dist/

# Database dumps. `scripts/upgrade.sh` writes its pre-upgrade dump to
# backups/pre-upgrade/, and RUNBOOK section 6 stages a dump in ./restore before
# a major-version upgrade — both land inside the operator's checkout, and a
# dump carries the full contents of their database.
backups/
restore/
*.dump

# Playwright
playwright/.auth/
playwright-report/
test-results/
blob-report/
.playwright-mcp/
.ux-audit/

# Load test results
tests/load/results/*.csv
tests/load/results/*.txt

# Internal development / assistant state (not for public release)
.planning/
graphify-out/
.gsd
.gsd-id
.mcp.json
.bg-shell/
skills-lock.json
.claude/
.agents/
.codex/
docker-compose.enterprise.yml
plans/
artifacts/
data/
prd.md
todo.md
smoke-check.md
cache/
!backend/app/platform/cache/

# Internal docs (not for public release)
docs-internal/

# Product docs live in the getgeolens.com repo.
docs/

# Images: ignore stray screenshots, keep curated assets
*.png
!.github/assets/*.png
!frontend/public/*.png
!frontend/src/assets/**/*.png

# Logs / temp
*.log
*~
tmp/
.cache/

# Local scratch / working dir for data-generation scripts
# (raw downloads, mosaicked COGs, etc.) — never committed.
.scratch/

# License signing keys — NEVER commit the private key
license-keys/
*license_private_key.pem
*.license-key

# SAML test fixture private key — self-generated on demand by
# generate_fixtures.py (SEC-015); only the public cert and the signed
# .xml.b64.template fallbacks are committed.
backend/tests/fixtures/saml/idp_key.pem
