# RelayShield — Git Ignore Rules
# Prevents sensitive files from being accidentally committed

# ── Secrets and credentials ──────────────────────────────────
.env
.env.*
*.pem
*.key
*.p12
*.pfx
secrets.json
credentials.json
config.local.*

# ── Python ───────────────────────────────────────────────────
__pycache__/
*.py[cod]
*.pyo
*.pyd
.Python
*.egg-info/
dist/
!n8n-nodes-relayshield/dist/
build/
venv/
.venv/
.venv-*/
env/

# ── AWS ──────────────────────────────────────────────────────
.aws/
aws-exports.js
samconfig.toml

# ── macOS ────────────────────────────────────────────────────
.DS_Store
.AppleDouble
.LSOverride
Thumbs.db

# ── VS Code ──────────────────────────────────────────────────
.vscode/settings.json
.vscode/launch.json

# ── Node (if used later) ─────────────────────────────────────
node_modules/
npm-debug.log
yarn-error.log

# ── Logs ─────────────────────────────────────────────────────
*.log
logs/

# ── Test output ──────────────────────────────────────────────
.pytest_cache/
coverage/
.coverage

# ── Claude Code local settings ─────────────────────────────────────
.claude/

# ── Lambda deployment packages (build artifacts — not source) ────────
*.zip

# ── Large binary and media assets ────────────────────────────────────
*.png
*.jpg
*.jpeg
*.pdf

# EAS build needs these tracked to bundle the mobile app icon/splash
!crypto-shield-app/assets/*.png
.telethon_venv
zapier_partner_test_key.txt

# ── Mobile signing material ──────────────────────────────────
# *.key does NOT match these; a release keystore leaking on a public repo lets
# anyone sign a fake Crypto Shield build.
*.keystore
*.jks

# ── Mobile build outputs ─────────────────────────────────────
*.apk
*.aab

# ── Firebase client config (contains a Google API key) ───────
google-services.json
GoogleService-Info.plist

# ── Wrangler local state and cache ───────────────────────────
.wrangler/

# ── Local backups ────────────────────────────────────────────
backups/

# ── Embedded git repos with their own remotes ────────────────
# These are separate published repos, each already backed up upstream. Adding
# them here would record a bare gitlink SHA with no .gitmodules entry, which is
# a dead reference for anyone cloning. agentcore-payer-proof is a fork of an
# AWS sample repo and is not ours at all.
/agentcore-payer-proof/
/ai-sdk-relayshield/
/langchain-relayshield/
/llamaindex-relayshield/
/openai-agents-relayshield/
/plugin-relayshield/

# ── Sibling repos that live in this working tree but are NOT part of it ──────
# relayshield-mcp is its own repository and its own release
# (github.com/relayshield/relayshield-mcp, published to PyPI as relayshield-mcp).
# On 2026-08-05 the bulk "track 305 production sources" commit ran git add over a
# working tree where that directory already had its own .git, so git recorded a
# GITLINK -- commit 70f36dc -- instead of the files. With no .gitmodules to go
# with it, that gitlink is inert: git submodule sees nothing, actions/checkout
# never populates it, and the directory is empty in every CI run and every fresh
# clone. It only ever produced noise in git status.
#
# Ignoring the path is what keeps it quiet, because the directory is still there
# on the Mac. Work on the MCP server in its own clone and release it from there.
/relayshield-mcp/

# Generated test shims. test_checkemail_reply.mjs and test_checkemail_verdict.mjs
# each write a copy of cloudflare_worker_checkemail.js with "cloudflare:email"
# stubbed out, import it, then delete it. A run that fails part-way leaves one
# behind, and it is a byte-for-byte copy of a source file -- committing one
# creates a second, silently stale copy of the Worker, which is the DRIFT RULE
# in miniature. Added 2026-09-02 after an ad-hoc debug script left mm_shim.mjs
# in the repo root.
*_shim.mjs
.checkemail_shim.mjs
.checkemail_verdict_shim.mjs
