# --- Secrets (NEVER commit) -------------------------------------------------
.env
.env.*
!.env.example
*.pem
*.key
*.crt
*.p12
secrets/
.secrets.baseline
# Fly.io deploy tokens (live credentials). The real file is kept OUTSIDE the repo
# in ~/.fly-tokens/; these patterns are a backstop so a token can never be committed.
.fly-token
*.fly-token
.fly-tokens/

# --- Python ----------------------------------------------------------------
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
.venv/
venv/
env/
ENV/
.pytest_cache/
.ruff_cache/
.mypy_cache/
.coverage
.coverage.*
htmlcov/
.tox/
*.egg-info/
build/
dist/
pip-wheel-metadata/

# --- Node / TypeScript -----------------------------------------------------
node_modules/
.next/
.turbo/
.parcel-cache/
.npm/
.yarn/
.pnpm-store/
*.tsbuildinfo
.eslintcache

# --- Playwright / browser automation ---------------------------------------
playwright-report/
test-results/
.playwright-cache/
ms-playwright/

# --- Docker ----------------------------------------------------------------
.docker/
*.local.yml
docker-compose.override.yml

# --- Databases (local volumes) ---------------------------------------------
postgres-data/
clickhouse-data/
valkey-data/
*.sqlite
*.sqlite3
*.db

# --- IDE / editors ---------------------------------------------------------
.vscode/
.idea/
*.swp
*.swo
*~
.project
.classpath

# --- OS --------------------------------------------------------------------
.DS_Store
Thumbs.db
desktop.ini

# --- Logs ------------------------------------------------------------------
*.log
logs/
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# --- Build artifacts -------------------------------------------------------
*.tar.gz
*.zip
out/
target/
# Extension build outputs. `dist/` (above) matches apps/extension/dist (Chrome),
# but NOT these — the Firefox dual-target output dir and the store-zip output dir
# need their own entries so a CI build doesn't leave untracked files (which would
# trip the generated-files drift guard / any cleanliness gate).
dist-firefox/
dist-packages/

# --- Local agent/tooling config (NOT committed) ----------------------------
# Machine-local Claude Code config + skills. The CLAUDE.md project rulebooks ARE
# tracked (team docs); only this local tooling directory is ignored.
.claude/

# --- Android app lives in its OWN repo (privacyfixed-android) ---------------
# The Kotlin app was split out (mobile kept separate from web/backend, ahead of
# an iOS app). The folder stays on disk here for local convenience + the blocklist
# gen script, but it is its own git repo and NOT tracked by this one.
apps/android/

# --- Misc ------------------------------------------------------------------
.cache/
tmp/
temp/

# Local pre-edit file backups (kept on disk, never committed)
.backups/
