# See https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files for more about ignoring files.

# compiled output
dist
tmp
out-tsc

# dependencies
node_modules

# IDEs and editors
/.idea
.project
.classpath
.c9/
*.launch
.settings/
*.sublime-workspace

# IDE - VSCode
.vscode/*
!.vscode/settings.json
!.vscode/tasks.json
!.vscode/launch.json
!.vscode/extensions.json

# misc
/.sass-cache
/connect.lock
/coverage
/libpeerconnection.log
npm-debug.log
yarn-error.log
testem.log
/typings

# System Files
.DS_Store
Thumbs.db

.nx/cache
.nx/workspace-data
.cursor/rules/nx-rules.mdc
.github/instructions/nx.instructions.md

.claude/worktrees
.claude/settings.local.json
.nx/polygraph

# Next.js
.next
out
# Terraform
infra/.terraform/
infra/*.tfstate
infra/*.tfstate.backup
# Terraform writes rollback copies as terraform.tfstate.<epoch>.backup, which
# the pattern above does not match — the timestamp sits before `.backup`. One
# such file was sitting untracked on 2026-08-09 holding 68 plaintext
# secret_data values (Surreal password, JWT secret, vault key, Stripe live key,
# GitHub App private key), fully stageable by `git add -A`.
infra/*.tfstate.*.backup
infra/terraform.tfvars
# Any sibling of the real tfvars — .bak, .orig, .save, dated copies. The exact
# path above does not match them, so an editor backup or a hand-rolled copy of
# a file holding every production secret lands in `git status` as untracked and
# would be staged by `git add -A`. Nearly happened on 2026-08-09.
infra/terraform.tfvars.*
!infra/terraform.tfvars.example
infra/.terraform.lock.hcl

# Environment files — never commit; contain live credentials
.env
.env.local

# Untracked 2026-08-07: this working copy accumulates real credential values as
# the remediation gates are worked through, so it cannot be a tracked file.
# The sanitised instructions live in docs/GATE-2-CREDENTIALS.md, which stays
# tracked and must never carry a real value.
docs/PRODUCTION-FIX-PLAN.md
.env.*.local
apps/*/.env
apps/*/.env.local

# Python bytecode caches
__pycache__/
*.pyc

# Nx/TS incremental build info
apps/evolve-backend/tsconfig.tsbuildinfo

# Test output (nx python targets write here)
reports/

# Terraform plan files embed sensitive variable values — never commit them.
# `-out=` takes an arbitrary name, so the two patterns below only catch plans a
# person happened to call "tfplan". Files named tfdom/tfgh/tfpost were found
# untracked on 2026-08-09. Plans are zip archives, so a name-based rule is the
# only defence — hence the explicit directory below for anything ad hoc.
infra/tfplan
infra/*.tfplan
infra/tf-plans/

# Playwright MCP writes browser console logs, traces and screenshots here when
# an agent drives the app. Session artefacts, not source — and they capture
# whatever the logged-in page happened to print, so they do not belong in git.
.playwright-mcp/

# Coverage artefacts — rewritten by every test run, never useful in a diff.
apps/evolve-ai/.coverage
test-output

# E2E build/output artefacts
apps/*-e2e/out-tsc/
apps/*-e2e/test-output/
playwright-report/
test-results/

# Memtrace (local code index — machine-local, never committed)
.memdb/
.memtrace/
.memtrace-workspace

# Local MCP server config — holds a Memtrace licence key.
.mcp.json

# Written by the Firebase Auth emulator that docs/E2E-TESTING.md tells you to start.
firebase-debug.log
firestore-debug.log
ui-debug.log

# TypeScript incremental build state (packages/logs-js writes one at its root).
*.tsbuildinfo
.logs-keys.json
.logs-keys-mspeed.json

# Recording rig: a saved production session, equivalent to a password.
tools/record/.auth/

# Recording rig: raw .webm captures and crop manifests. Only the rendered
# mp4/jpg under public/media/tour is kept.
tools/record/out/

# Recording rig scratch probes.
tools/record/*.tmp.ts

# Launch film renders. The rig is source; the output is 30MB of mp4 that is
# rebuilt by `node tools/film/build.mjs` in about three minutes.
tools/film/out/
# Score stems are committed as FLAC; the wavs are working copies and the
# mastered score.wav is rebuilt by `node tools/film/master-audio.mjs`.
tools/film/audio/*.wav
# Waveform and spectrogram plots — analysis output, regenerated on demand.
tools/film/audio/*.png
# Locally installed toolchains (e.g. a Go distribution fetched for SDK work).
# Never committed; keeps nx project-graph discovery away from them.
.tools/

# Flutter build output (regenerated by flutter test/build).
packages/logs-flutter/**/build/
# Dart/Flutter tool state (regenerated by pub/flutter tooling).
packages/logs-flutter/**/.dart_tool/
# Library lockfiles: Dart convention for published packages is not to commit
# them; example apps keep theirs.
packages/logs-flutter/**/pubspec.lock
!packages/logs-flutter/**/example/pubspec.lock
