# Dependencies
vendor/
node_modules/
# …but the vendored front-end lib we ship on purpose (xterm.js for the SFTP
# terminal) must be committed — it's served as a static asset, not installed.
!packages/core/assets/vendor/
!packages/core/assets/vendor/**

# Environment
.env
# Adapter-e2e .env backup (global-setup restores the real one in teardown)
packages/core/.env.adapter-e2e.bak

# Storage
storage/uploads/
storage/rate_limit.json

# Core package storage (runtime/test artifacts)
packages/core/storage/uploads/
packages/core/storage/rate_limit.json
packages/core/storage/demo_ip.json

# Build output
packages/react/dist/
packages/vue/dist/
packages/node/dist/
build/

# Python (packages/python)
packages/python/.venv/
packages/python/dist/
packages/python/*.egg-info/
**/__pycache__/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# Test playground scaffolds (source committed, deps not)
packages/core/tests/apps/**/node_modules/
packages/core/tests/apps/node_modules/
# Generated Laravel proxy e2e app (regenerate: laravel-e2e/setup.sh; source in laravel-e2e/)
packages/core/tests/apps/laravel-app/

# Playwright runtime artifacts
.playwright-mcp/
test-results/
playwright-report/
# Ad-hoc QA screenshots taken at the repo root during manual browser testing
# (never part of the source — they slipped in once; keep them out for good).
/*.png

# OS files
.DS_Store
Thumbs.db

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# Testing
coverage/
.phpunit.result.cache
.phpunit.cache/

# Logs
*.log

# Project docs (private)
docs/FLUXFILES-ROADMAP.md
docs/ROADMAP.md
# Wrapper lockfiles aren't needed for published libs and break cross-platform
# npm optional-dep resolution (npm/cli#4828). CI does a fresh install.
packages/sdk/package-lock.json
packages/ckeditor4/package-lock.json
packages/tinymce/package-lock.json
docs/PHASE2-OPTIMIZATION-PLAN.md
docs/COMMERCIAL-STRATEGY.md
docs/LICENSING-PLAN.md
docs/*.SECRET.txt
docs/license-signing-key*
docs/release-signing-key*
docs/*.key

# Proprietary paid modules (private — not part of the MIT core; each lives in its
# own private repo for distribution). NEVER commit these to the public monorepo.
packages/optimize/
packages/share/
packages/intake/
packages/versioning/
packages/webhooks/
packages/ai/
packages/ocr/
packages/virus/
packages/backup/
packages/c2pa/
packages/audit-export/
packages/sso/
packages/dlp/
packages/legal-hold/

# License server runtime DB (customer records — never commit)
services/license-server/data/
*.sqlite
*.sqlite-*

# Claude subagent working artifacts (plans, review findings)
.claude/work/
