# Dependencies
node_modules/
.pnpm-store/

# Build output
dist/
build/
.next/
.turbo/
*.tsbuildinfo

# Python bytecode. The analytics collector and the pointcloud worker
# both get run in place on the server, so their caches land in the
# checkout and otherwise show up as a dirty tree there.
__pycache__/
*.pyc

# Env
.env
.env.local
.env.*.local
.env.prod
.env.staging
# Timestamped copies an operator makes before editing the real file.
# Same secrets, same rule.
.env.prod.bak*
.env.staging.bak*

# MaxMind account credentials for the analytics GeoLite2 download
# (see infra/analytics/geoip-update.sh). Never commit a license key.
GeoIP.conf

# Playwright run artifacts (traces, screenshots, reports).
e2e/test-results/
e2e/playwright-report/
!.env.example
!.env.prod.example

# Materialized realm import (deploy.sh writes this from the .tmpl).
# Contains substituted secrets, so never commit.
infra/keycloak/import/

# Logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*

# OS
.DS_Store
Thumbs.db

# Editor
.idea/
.vscode/*
!.vscode/extensions.json
!.vscode/settings.json.example

# Coverage
coverage/

# Docker data (mounted volumes if any)
infra/data/

# Temp
*.tmp
tmp/

# Backup archives (BACKUP_DIR default; production should point
# BACKUP_DIR at an on-host volume outside the repo).
backups/

# Local dev helpers (launching detached dev servers from inside an SSH session)
run-api.bat
run-web.bat
run-dev.bat

# Claude session handoff notes. Local only; these are for Claude
# continuity across sessions, not for the public repo.
CLAUDE.md
HANDOFF.md
DECISIONS.md
docs/handoff/
.git-commit-msg

# Release-notes scratch files pasted into gh release create; the
# published release body is the source of truth once the tag is up.
.release-notes-*.md
# Stray temp files left behind by some Windows tools (#42 followup)
_tmp_*

# Internal-only material that lives in this working tree but is
# not for the public repo.  Marketing drafts (Reddit posts, outreach
# copy) and the scripts/ folder (load-test rigs, one-off text-cleanup
# utilities) are Matt's local workflow, not the published codebase.
docs/marketing/
# Leading slash matters: this is meant to hide the REPO-ROOT scripts/
# folder only. Unanchored, gitignore matches a directory of that name
# at any depth, which silently swallowed apps/portal-api/src/scripts
# when the script-item module (#221) landed there. The failure is
# quiet and nasty: `git add` refuses, `git commit` succeeds without
# the files, and the build breaks for everyone else.
/scripts/

# Internal security review documents.  These contain exploitable
# vulnerability details and MUST NOT be committed.  The committable
# disclosure surface is SECURITY.md (separate file).
SECURITY-REVIEW-*.md
SECURITY-FINDINGS-*.md
outputs/security/

# Commit-message scratch files. Various tools / editors / Claude
# sessions write commit-message drafts to the repo root; they're
# transient and should never land in history.
COMMIT_MSG.txt
COMMIT_MSG
COMMIT_EDITMSG
commit-msg-*.txt
commit-msg-*.md

# PR body / create-script scratch files (from `gh pr create -F`),
# typecheck-output captures, and detached dev-server log captures.
# All transient.
pr-body-*.md
pr-create-*.cmd
pr-*.txt
pr61-*.txt
tc-*.txt
diff-*.txt
dev-api-bg.bat
dev-web-bg.bat
dev.out
api.out
web.out
install.txt
lint.txt
test.txt
schema-head.prisma
items-service-head.ts
page-head.tsx

# Test data sets dropped in the repo root for local upload testing.
# Real-world parcel layers etc. -- big files we don't want in git.
*.geojson
*.zip
!apps/**/*.geojson
!apps/**/*.zip
!packages/**/*.geojson
!packages/**/*.zip
!infra/**/*.zip
!docs/**/*.geojson
!docs/**/*.zip
