# secrets / env
.env
backend/.env
# Per-node app configs (secrets; not committed). The two committed templates
# must stay free of real credentials.
backend/configs/*.config.yaml
!backend/configs/example.config.yaml
!backend/configs/example.media.config.yaml
# Deployment: the templates, compose files and scripts are tracked; what the
# operator ships (each node's .env and *.config.yaml, ignored above and here),
# what bootstrap.sh renders, and database dumps are not (deployment/prod/{core,media}/bootstrap.sh).
/deployment/**/*.config.yaml
/deployment/**/.env.*
!/deployment/**/.env.example
/deployment/**/rendered/
/deployment/backups/
/public-launch-tracker
# The session-signing Ed25519 key, kept beside the config that carries it
# inline. Losing the private half means nobody can ever sign in again; committing
# it means anyone can sign in as anyone.
*.pem
*.local
client_secret_*.json

# python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# node / next
node_modules/
.next/
out/
clients/typescript/packages/*/dist/
mcp/dist/

# The docs site build. `documentation/build.sh` regenerates it; Cloudflare Pages
# builds it in CI, so a checked-in copy would only ever be stale.
documentation/dist/
documentation/export.zip
npm-debug.log*
.pnpm-debug.log*
*.tsbuildinfo

# data / volumes
pgdata*/
*.log
.tmp-*.json

# os / editor
.DS_Store
.idea/
.vscode/

reviews/*

roadmap/*

marketing/

# Local working files: scratch server, notes, spec drafts and research reading.
/TESTING.md
/RELEASING.md
/documentation/_research/
tools-test-server.py
TODOs.md
product.md
dev.patch
research-kb/*

scripts/*
