# Dependencies
node_modules/
.pnp
.pnp.js

# Build outputs
dist/
build/
.next/
out/

# Environment files - NEVER commit secrets (SEC-02)
.env
.env.local
.env.test
.env.production
.env.staging
.env.development.local
.env.test.local
.env.production.local
.env*.local
!.env.example

# Logs
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# Testing
coverage/
.nyc_output/

# Supabase
supabase/.branches/
supabase/.temp/

# TypeScript
*.tsbuildinfo

# Generated docs
docs/stories/docx/

# Sentry
.sentryclirc

# Generated artifacts
.generated-machines/
.playwright-mcp/
.auth/

# HyperFrames video demo projects (scratch output, not repo code)
arkova-product-demo/

# Design mockups and screenshots (root level)
/arkova-*.png
/redesign-*.png
/journey*.png

# Test files at root
/test_*.pdf

# Claude agent skills — per-user / per-machine state ignored, project-level
# config tracked. settings.json + hooks/ are checked in so the team-wide
# enforcement (e.g. staging-evidence pre-merge hook) ships with the repo.
.agents/
.claude/*
!.claude/settings.json
!.claude/hooks
!.claude/hooks/**
skills-lock.json

# Other AI tool configs (may contain pre-approved commands with tokens — see Anthropic 2026-04 source-map leak)
.cursor/
.aider*
.continue/
.cody/
.codex/

# Private keys / certs (never commit — none currently tracked, this is preventative)
*.pem
*.key
*.p12
*.pfx
*.crt
*.cer

# Cloud / infra credentials (developer-local; treasury & service-account JSONs must never land in git)
.aws/
.azure/
.gcloud/
.ssh/
.kube/
.docker/config.json
credentials.json
service-account*.json
gcp-key*.json

# Terraform state (plaintext secrets — preventative; deployment/self-hosted/terraform/ uses tf)
.terraform/
*.tfstate
*.tfstate.*
*.tfvars
!*.tfvars.example

# Nested repos (separate git projects)
arkova-marketing/
arkova-demo/

# Demo assets and loose screenshots
demo-assets/
/prod-*.png
/swagger-*.png
/app-*.png
/search-*.png

# macOS duplicate files (Finder "name N.ext" pattern)
*\ 2.*
*\ 2/
*\ 3.*
*\ 3/

# Binary artifacts
*.sym
*.ptau
*.zkey
*.r1cs
*.wasm

# ZK circuit compiled artifacts (rebuild from .circom source)
services/worker/circuits/artifacts/

# Strategy docs (binary .docx)
docs/strategy/*.docx

# Env backups
.env.local.bak
.env.bak

# Bug report artifacts (screenshots)
docs/bugs/*.png
docs/bugs/*.pdf

# Eval data (large JSON — keep .md summaries only)
docs/eval/*.json
services/worker/docs/eval/*.json

# Training data (large JSONL files) — exclude contents but allow committed fixture set.
# Git can't re-include files under a fully-ignored directory, so use `dir/*` pattern
# with negations rather than `dir/`. See SCRUM-1549.
services/worker/training-data/*
!services/worker/training-data/fixtures/
!services/worker/training-data/.gitkeep

# Playwright reports
playwright-report/
/output/

# UAT screenshots
/uat-*.png

# Test files at root
/test-*.csv
/test-*.txt

# Self-hosted NER PII model weights (S1.4 / WEBEXT-CSP / SCRUM-2503).
# Vendored on-device by `npx tsx scripts/fetch-ner-model.ts` into the served
# app origin. These are large binaries (~130 MB q8 weights) — never committed;
# the build/deploy pipeline re-fetches them. The runtime bundle in
# public/vendor/ stays tracked; only the downloaded model weights are ignored.
public/models/

# WEBEXT-01 F-2: onnxruntime WASM artifacts, vendored on-device by
# `npx tsx scripts/vendor-ner-runtime.ts` (npm run prebuild) from the exact
# npm-pinned onnxruntime-web package, SHA-256-verified against
# scripts/ner-runtime.lock.json. ~24 MB binaries — never committed; the
# build/deploy pipeline re-vendors them. The transformers.js runtime bundle
# (public/vendor/transformers.bundle.min.js) stays tracked.
public/vendor/ort/

# Misc
.cache/
.parcel-cache/
.vercel

# Python bytecode
__pycache__/
*.pyc
