/target
**/*.rs.bk
.env
.env.local
*.log
.DS_Store
__pycache__/
*.pyc

# benchmark runs are evidence, not source: commit deliberately with git add -f
bench/results/
bench.key

# downloaded corpus for `make dataset` (CSV), never source
bench/firecrawl/

# readfetch CLI screenshots are output, not source
screenshot-*.png

# buyer key stays out of the repo
.readfetch-buyer.key

# `cargo xtask dist` output is a build artifact; release binaries are published, not committed
dist/

# Origin TLS material never enters the repo or an image: certificates are installed on the box
# (Caddy reads /etc/caddy). A committed private key is a rotated key.
ssl/

# The only directory mounted into the API container. The real .env lives here on the box (the
# project-root .env is a symlink to it); only .env.example is versioned.
deploy/conf/

# wallet notes must never be committed or rsynced (deploy.sh copies the repo root)
sepolia.md
node_modules
*.tgz