# ─────────────────────────────────────────────────────────────────────────────
#  authoxi — .gitignore
#
#  Policy: commit SOURCE and nothing else. Anything a tool, a test run, an
#  editor, a container or the OS writes is ignored by default. If a real file
#  is caught by a rule, add a narrow `!negation` beside that rule and say why —
#  do not widen the rule. For a genuine one-off, `git add -f <path>`.
#
#  Two standing hazards, both learned here the hard way:
#    1. An UNANCHORED rule (`lib/`) matches at EVERY depth and can silently
#       swallow a source directory. Tracked-and-ignored is invisible in both
#       directions: `git add` does nothing and `git status` stays clean. So any
#       rule whose name could plausibly be source is anchored to the repo root
#       (`/lib/`, `/logs/`, `/secrets/`, `/cover/`).
#    2. A committed runtime artifact — a spool, a local DB, a `.env` — can be an
#       unrecoverable disclosure. Deleting it in a later commit does not remove
#       it from history.
#
#  Invariants asserted by authoxi's app/tests/test_repo_integrity.py, and worth
#  checking in any repo after editing this file:
#    git ls-files --cached --ignored --exclude-standard   # must print nothing
#    git status --porcelain --untracked-files=all         # no stray artifacts
# ─────────────────────────────────────────────────────────────────────────────

# ── Python bytecode / extensions ─────────────────────────────────────────────
__pycache__/
*.py[cod]
*$py.class
*.so
*.pyd
.Python
cython_debug/

# ── Packaging / build output ─────────────────────────────────────────────────
# Anchored where the name is plausibly source (`/lib/` once ate the console's
# entire `src/lib/`), unanchored where it never is (`build/`, `dist/`).
build/
dist/
dist-ssr/
sdist/
develop-eggs/
downloads/
eggs/
.eggs/
wheels/
/lib/
/lib64/
/parts/
/var/
/out/
/output/
/target/
/share/python-wheels/
*.egg-info/
*.egg
.installed.cfg
MANIFEST
pip-wheel-metadata/
pip-log.txt
pip-delete-this-directory.txt
.pybuilder/
*.manifest
*.spec

# ── Virtualenvs & interpreter state ──────────────────────────────────────────
.venv/
.venv*/
venv/
virtualenv/
/env/
/ENV/
.python-version
.tool-versions
.direnv/
.envrc

# ── Test / type / lint / profiling caches and reports ────────────────────────
.pytest_cache/
.ruff_cache/
.mypy_cache/
.dmypy.json
dmypy.json
.pytype/
.pyre/
.pyright/
.tox/
.nox/
.hypothesis/
.cache
.coverage
.coverage.*
coverage/
coverage.xml
htmlcov/
lcov.info
nosetests.xml
*.cover
*.py,cover
/cover/
.nyc_output/
.benchmarks/
.pylint.d/
junit*.xml
test-report*.xml
*.prof
*.lprof
*.pstats
perf.data*
core.[0-9]*

# ── Node / frontend toolchain ────────────────────────────────────────────────
node_modules/
*node_modules*
.npm/
.yarn/
.pnp.*
.pnpm-store/
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
.eslintcache
.stylelintcache
*.tsbuildinfo
.vite/
.turbo/
.next/
.nuxt/
.svelte-kit/
.astro/
.parcel-cache/
storybook-static/
# Browser-test output. Playwright writes its run marker at the WORKSPACE root,
# not under an app — which is how one got committed while a per-app rule looked
# like it covered it. These are unanchored on purpose.
test-results/
playwright-report/
blob-report/
playwright/.cache/
.lighthouseci/

# ── Secrets & credentials — never commit ─────────────────────────────────────
.env
.env.*
*.env
!.env.example
!.env.*.example
!*.env.example
/secrets/
credentials.json
client_secret*.json
service-account*.json
gha-creds-*.json
gitleaks-report*.json
*.pem
*.key
*.p12
*.pfx
*.jks
*.keystore
id_rsa*
id_ed25519*
*.ppk
.netrc
.npmrc
.pypirc
.aws/
.gnupg/

# ── Infrastructure state ─────────────────────────────────────────────────────
# `.terraform.lock.hcl` is deliberately COMMITTED — provider pinning is source.
.terraform/
*.tfstate
*.tfstate.*
*.tfplan
*.tfvars
*.auto.tfvars
!*.tfvars.example
override.tf
override.tf.json
*_override.tf
*_override.tf.json
crash.log
crash.*.log

# ── Runtime artifacts: logs, databases, spools ───────────────────────────────
*.log
# `memory/notes/logs/` and `docs/logs/` are written source — anchor to the root.
/logs/
*.pid
*.seed
*.sqlite
*.sqlite3
*.sqlite3-journal
*.db
*.db-journal
*.db-shm
*.db-wal
# Signed evidence, written to disk when the sink is unreachable: real amounts,
# real vendors, real approver signatures. Both spellings — the pump writes
# `<name>.spool.jsonl` (dot) while the SDK writes `<name>_spool.jsonl`.
*.spool
*.spool.jsonl
*_spool*.jsonl
.telemetry_spool.jsonl
*_traces.jsonl

# ── Temporary / scratch / local-only working dirs ────────────────────────────
tmp/
temp/
.tmp/
.temp/
scratch/
.scratch/
.scratchpad/
.local/
.local-dev/
.e2e-tmp*/
.e2e-logs/
*.tmp
*.temp
*.bak
*.backup
*.old
*.save
*.orig
*.original
*.rej
*~
.#*
\#*\#

# ── Editors / IDE ────────────────────────────────────────────────────────────
.idea/
.vscode/
.fleet/
.zed/
.cursor/
.continue/
.history/
*.sublime-workspace
*.sublime-project
*.swp
*.swo
*.swn
.*.sw[a-p]
Session.vim
.netrwhist
/tags

# ── Agent / assistant local state ────────────────────────────────────────────
# `.claude/agents/`, `.claude/commands/` and `.claude/settings.json` ARE source
# (the operating model of this repo). Everything the CLI writes per-machine is not.
.claude/settings.local.json
.claude/*.local.json
.claude/local/
.claude/todos/
.claude/shell-snapshots/
.claude/statsig/
.claude/projects/
.claude/history.jsonl
.superpowers*
.aider*
.serena/

# ── Notebooks ────────────────────────────────────────────────────────────────
.ipynb_checkpoints/
*-checkpoint.ipynb
profile_default/
ipython_config.py

# ── Translations ─────────────────────────────────────────────────────────────
*.mo
*.pot

# ── Archives & disk images — build them, don't commit them ───────────────────
# `vendor/*.whl` is the deliberate exception (core / aeternm-evidence ship as a
# committed wheel; there is no PyPI release yet), which is why `*.whl` is absent.
*.zip
*.tar
*.tar.*
*.tgz
*.7z
*.rar
*.dmg
*.iso

# ── OS junk ──────────────────────────────────────────────────────────────────
.DS_Store
.DS_Store?
._*
.AppleDouble
.LSOverride
.Spotlight-V100
.Trashes
.TemporaryItems
.DocumentRevisions-V100
.fseventsd
.VolumeIcon.icns
.com.apple.timemachine.donotpresent
Thumbs.db
ehthumbs.db
Desktop.ini
$RECYCLE.BIN/
.directory
.Trash-*
.nfs*

# ─────────────────────────────────────────────────────────────────────────────
#  authoxi-specific
# ─────────────────────────────────────────────────────────────────────────────

# `app/module/secrets/` is a SOURCE MODULE, not a box of secrets. The `/secrets/`
# rule above is anchored so it can no longer reach it; this negation stays as the
# tripwire, because the unanchored version tracked all three files AND made them
# invisible to `git add` — every edit silently did nothing.
!app/module/secrets/

# ── The console workspace (ui/) ──────────────────────────────────────────────
# Build output and installs are covered by the base rules; these anchored ones
# stay because they name the exact paths that regressed when `ui-2/` was renamed
# to `ui/` and the old rules kept matching a directory that no longer existed.
/ui/*/dist/
/ui/*/dist-ssr/
/ui/*/node_modules/
/ui/node_modules/
/ui/*/test-results/
/ui/test-results/
/ui/playwright-report/
# Seeder output. `.e2e-tenant.json` holds a LIVE SECRET KEY; `.e2e-gtm.json` is a
# fixture manifest that nothing reads back. Neither is a build input.
/ui/.e2e-gtm.json
/ui/*/.e2e-tenant.json
/ui/*/.e2e-gtm.json

# ── demos/ui — the browser journeys ──────────────────────────────────────────
/demos/ui/node_modules/
/demos/ui/test-results/
/demos/ui/playwright-report/
/demos/ui/.fixture.json
# The e2e route-coverage recording (demos/route_coverage.py) — a build artifact.
/demos/.e2e-routes.log

# ── Local stacks ─────────────────────────────────────────────────────────────
# Scratch databases, fresh every run (`.e2e-tmp*/` and `.local-dev/` are in the
# base block; named here so the intent is findable from this section).
/.e2e-tmp/
/.e2e-tmp-ui/
/.local-dev/

# ── Published docs site ──────────────────────────────────────────────────────
/docs/dist/
/docs/node_modules/

# ── GENERATED BUT COMMITTED, deliberately ────────────────────────────────────
#
# ui/shared/brand/ is written by `npm run brand` from logo/mark.svg, and it is TRACKED. That
# looks like a build artifact in the tree and the reflex is to ignore it — do not. The generator
# rasterizes through Playwright chromium, so ignoring these would make a favicon a dependency of
# a browser download in every CI job and every fresh clone, to reproduce bytes that only change
# when somebody edits the mark. logo/mark.svg is the source; these are the eleven outputs.
#
# The two invariants this file exists to keep, worth re-running after editing it:
#   git ls-files --cached --ignored --exclude-standard   # must print nothing
#   git status --porcelain --untracked-files=all         # no stray artifacts
