# Python
__pycache__/
*.py[cod]

venv/
.pytest_cache/
.mypy_cache/
.ruff_cache/
dist/
build/
*.egg-info/

# Node / web
node_modules/
web/dist/

# CDK
cdk.out/
.cdk.staging/

# Secrets & keys — never commit signing keys
*.pem
*.key
.env
.env.*

# OS
.DS_Store

# npm lockfile is kept; build output is not. `crypto/dist` and `client-ts/dist`
# are covered by the `dist/` rule above; the tarballs are what `npm pack` leaves
# at the repository root when somebody follows client-ts/README.md step 1.
*.tgz
crypto/test-results/
crypto/playwright-report/

.venv/

# uv-managed environment
infra/cdk.out/

# IDE
.idea/
.vscode/
*.swp

# The first-backup runbook has the operator save a scratch push_backup.py in
# client/. It carries their client id, key id and the path to a signing key, so
# it must not be committed -- and it is reproduced in the runbook itself, so
# there is nothing to preserve.
client/push_backup.py
