# Secrets: never commit
.env
.env.*
!.env.example
env.txt
githubapp.txt
*.pem
*.key

# Node
node_modules/
out/
dist/
build/
# The Heavy-mode harness ships a deliberate bundle-artifact fixture whose path
# must look like real build output, so it is re-included past dist/ above.
!backend/apps/api/tests/fixtures/heavy/**/dist/
!backend/apps/api/tests/fixtures/heavy/**/dist/**
.turbo/
npm-debug.log*
yarn-error.log*

# Python
__pycache__/
*.pyc
.venv/
venv/
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.uv-cache/

# OS / editor
.DS_Store
.vscode/*
!.vscode/extensions.json
*.swp

# Playwright
test-results/
playwright-report/
blob-report/
.playwright-mcp/

# The npm wrapper's postinstall builds its Python environment here. Local
# artifact, ~20MB, never committed.
backend/apps/cli-npm/.aevrin-python/

# A capability's private material: the security engine's skill bundle and its
# scenario routing. This repository is public; these exist only on the machine
# that builds the image and inside the image on the host. Never commit them.
backend/capabilities/*/private/

# Misc
*.log
.cache/
.claude/
.aws-keys
.github-keys
.supabase-keys
.cloudflare-keys
.npmjs-key
.prompts
.sarvam-keys
.pypi-keys

