# Secrets / local env — never commit
.env
.env.*
!.env.example

# Local SQLite dev DB (Postgres/Supabase in prod)
*.db
*.sqlite3

# Python
.venv/
__pycache__/
*.py[cod]
.pytest_cache/
.mypy_cache/
.ruff_cache/

# OS / editor
.DS_Store

# Local Claude / preview config
.claude/

# Local wallet/secret material — never commit
.secrets/

# graphify code-graph output (local build artifact)
graphify-out/

# Brand-asset build inputs: TTF instances derived from app/static/fonts/*.woff2
# by scripts/gen_brand.py. Regenerate rather than commit (the woff2 originals
# and PressStart2P.ttf are the sources of truth).
scripts/inter-*.ttf
scripts/space-grotesk-*.ttf

# Static marketing site, rendered from app/templates by scripts/build_site.py.
# Generated artifact — build it in the static host's deploy step.
site/

# Foundry build artifacts (forge build --skip "*.t.sol" "*.s.sol")
contracts/base/out/
contracts/base/cache/

# Copy-paste deploy blocks. These carry REAL secrets — relayer private keys,
# DB password, session/encryption secrets. Never committed.
deploy/web-service.env
deploy/static-site.env
deploy/

# Buyer package build artifacts. `pay402.py` here is COPIED from clients/ by
# `make pay402-dist`; the canonical module is clients/pay402.py.
packages/pay402/dist/
packages/pay402/pay402.py
