# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.

# git filter-branch / rewrite temp
.git-rewrite/

#environment files
/env
.env
.env.local
cypress.env.json
settings.local.json
.claude/settings.local.json

# Cross-tool agent-CLI mirrors — redundant with .claude/; do not commit
.agents/
.codex/
# Flutter web env files are generated at build time from environment variables
# (scripts/vercel/gen-env.sh) — never commit them. Use .env.example as the
# committed source of keys + dev defaults.
.env.development
.env.test
.env.production

**/snippets/

# dependencies
node_modules
.pnp
.pnp.js

# testing
coverage
screenshots

# Re-include intentional marketing screenshots that live under web apps' public dirs
# Pattern matches both pre-restructure (products/<app>/public/...) and post-restructure
# (products/<product>/<app>/public/...) layouts.
!products/*/public/images/screenshots/
!products/*/public/images/screenshots/**
!products/*/*/public/images/screenshots/
!products/*/*/public/images/screenshots/**

# Re-include fastlane screenshot driver scripts (Dart source, not generated image files).
!**/fastlane/screenshots/
!**/fastlane/screenshots/*.dart
!**/fastlane/screenshots/*.txt

# Fastlane supply / deliver – generated screenshots (regenerate with screengrab / your pipeline)
**/fastlane/metadata/**/images/

# next.js
.next/
.next.stale*/
out/
build
dist

# dart
.dart_tool/
.flutter-plugins
.flutter-plugins-dependencies
.packages
.pub-cache/
.pub/
/build/
**/android/local.properties

# python — 48 of these were committed under the prodantix Python SDK and every
# test run re-dirtied them. .venv and .pytest_cache need no rule: both write a
# self-ignoring .gitignore into their own directory.
__pycache__/
*.pyc

# misc
.DS_Store
*.pem

# JetBrains IDE
.idea/

# superpowers session-scoped working state
.superpowers/

# debug
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# local env files
.env.local
.env.development.local
.env.test.local
.env.production.local

#storybook
storybook-static

# Flutter
*.ipa
*.dSYM.zip

# typescript
*.tsbuildinfo

# turbo
.turbo

# Melos
.melos_tool
.melos_cache

# AuthKey
AuthKey_*.p8

.vercel
.gstack/

# GraphQL auto-generated schemas
products/clepit-server/products/*/src/schema.gql

# Railway CLI link state (project IDs are kept in project.json instead)
infra/railway/*/.railway/

# SOPS — never commit unencrypted age private keys
*.age.key
*.age
!*.age.pub

# Tofu — workspaces use GCS state (gs://bomdisoft-tofu-state/<workspace>/).
# Only tofu-state-bootstrap keeps state local (chicken-and-egg — it creates
# the bucket). All other workspaces have backend "gcs" in versions.tf so their
# tfstate never lands on disk.
#
# .terraform.lock.hcl is deliberately NOT ignored. CI runs a bare `tofu init`,
# so without a committed lockfile every apply re-resolves the version
# constraints against the registry and can pick up a new provider release
# mid-flight, unreviewed, against live infrastructure. The lockfiles carry
# hashes for every published platform (CI is linux_amd64, laptops are darwin),
# so regenerate with `tofu providers lock -platform=...` for ALL platforms.
# A bare `tofu init -upgrade` records only the current one and breaks CI.
infra/iac/projects/tofu-state-bootstrap/terraform.tfstate
infra/iac/projects/tofu-state-bootstrap/terraform.tfstate.backup
infra/iac/projects/*/.terraform/
infra/iac/projects/*/*.tfplan
infra/iac/projects/*/terraform.tfvars

# Local dev stacks (infra/iac/local/*) deliberately keep LOCAL state — they
# manage per-machine throwaway containers, so state never leaves the laptop.
infra/iac/local/*/.terraform/
infra/iac/local/*/terraform.tfstate
infra/iac/local/*/terraform.tfstate.backup
infra/iac/local/*/*.tfplan
products/prodantix/.env.local

CLAUDE.local.md

/target

# Tor hidden-service key material. Tor GENERATES these into HiddenServiceDir on
# first start; they are per-deployment secrets and must never be committed —
# anyone holding hs_ed25519_secret_key can impersonate the .onion address.
# (Three were committed in f392aa205 on 2026-08-03 and have been rotated.)
**/tor/hidden_service/
**/dark-web/tor/

# Shell artifact: an unexpanded $LOG once captured a turbo lint run and was
# committed (74a65bc6c, removed same week). Literal $ names are never source.
/$LOG
.claude/context/

# Lane addresses are machine state, not repository state (scripts/lane.ts).
.claude/lane-registry.json
