# dependencies
node_modules/
.pnp
.pnp.js

# builds
dist/
.next/
# The desktop build's own output directory, so it cannot collide with a dev server.
.next-desktop/
out/
build/
*.tsbuildinfo

# --- secrets ---------------------------------------------------------------
#
# One folder for everything credential-shaped that has to live in the checkout:
# `.env.migration`, `.env.oci`, and any key a cloud console downloaded here.
# See secrets/README.md.
#
# `.env.local` cannot move — Next.js only reads it from the app directory — and
# neither can ~/.oci or ~/.ssh, so the patterns below stay as a second layer.
# A single directory rule is one edit away from being wrong.
#
# Contents rather than the directory itself (`/secrets/*`, not `/secrets/`), so
# the README can be un-ignored: git does not descend into an excluded directory,
# and a negation inside one never matches.
/secrets/*
!/secrets/README.md

.env
.env.local
.env*.local
.env.migration
.env.oci
oci-launch-retry.log

# Private keys. Cloud consoles download these straight to whatever directory the
# browser last used, which is often a checkout — and an OCI API key or SSH key
# committed to a public repo is a full account compromise, not a near miss.
*.pem
*.key
*_rsa
*_ed25519
id_*
# Public halves are not secret — they exist to be published — but they still do
# not belong in a checkout, and an un-ignore rule for them re-included a key
# from secrets/ that the directory rule had correctly excluded.
*.pub
local-dev/

# demo captures (regenerate locally; README embeds added later)
docs/demo/

# graphify build artifacts
graphify-out/

# playwright
apps/web/test-results/
apps/web/e2e/.auth/

# Serwist (generated at next build)
apps/web/public/sw.js

# Pitch site assets (copied from apps/web/public at build)
apps/pitch/public/
apps/web/public/sw.js.map
apps/web/public/swe-worker*

# pdf.js worker (copied from pdfjs-dist by scripts/copy-pdf-worker.mjs)
apps/web/public/pdf.worker.min.mjs

# python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.pytest_cache/

# os / editor
.DS_Store
.idea/
.vscode/
*.log

# supabase
supabase/.branches
supabase/.temp
.conda-plugin-tools
# Phase-5 E2EE pre-drop backups (contain key material — never commit)
backups/

# Android TWA signing keys — never commit
*.jks
*.keystore
apps/web/twa/android-keystore.jks
# TWA local Gradle / Bubblewrap outputs
apps/web/twa/.gradle/
apps/web/twa/app/
apps/web/twa/*.apk
apps/web/twa/*.apk.idsig
apps/web/twa/gradle/
apps/web/twa/gradlew
apps/web/twa/gradlew.bat
apps/web/twa/build.gradle
apps/web/twa/settings.gradle
apps/web/twa/gradle.properties
apps/web/twa/manifest-checksum.txt
apps/web/twa/store_icon.png

# playwright (root)
test-results/
.design-sync

# OS junk
desktop.ini
Thumbs.db
.DS_Store
.vercel

# W&B offline runs land beside whatever started them.
wandb/
