node_modules/
.pnpm-store/
dist/
build/
.next/
out/
coverage/
*.tsbuildinfo
CHANGELOG-SECURITY.md
CHANGELOG-SECURITY-OLD.md
apps/web/.next.stale-backup/
strix_runs/

.env
.env.local
.env.*.local

# AWS deployment state and machine-specific approval inputs
**/.terraform/
**/*.tfstate
**/*.tfstate.*
**/*.tfplan
**/crash.log
infra/aws/**/*.auto.tfvars
infra/aws/**/*.backend.hcl
infra/aws/bootstrap/backend.tf
deploy/aws/runtime/
deploy/aws/__pycache__/

# Prisma generated
packages/db/src/generated/

# Logs
*.log
npm-debug.log*
pnpm-debug.log*
yarn-debug.log*
yarn-error.log*

# OS
.DS_Store
Thumbs.db

# Editors
.idea/
.vscode/
!.vscode/extensions.json
!.vscode/settings.json.example

# Docker local data
.docker/
data/

# Private project artifacts — never publish
Build_Plan/
DECISIONS.md
.claude/
docs/PHASE_*.md
docs/PHASE_*_NOTE.md
docs/permissions.md
/Website/
.cursor/plans/
.cursor/
.cursor/rules/
.zed
.zed/rules/
.design

# Mobile PWA build output, published into apps/web by
# apps/mobile/scripts/emit-to-web.mjs. All three are generated:
# public/m holds the hashed assets, mobile-shell holds the per-accent
# HTML variants + build marker, and .mobile-stage is the atomic-swap
# staging area (cleared on every publish, but ignored so an interrupted
# build can never be committed or swept into a Docker context).
apps/web/public/m/
apps/web/mobile-shell/
apps/web/.mobile-stage/

# Reviewed source archives are generated from committed trees during image builds.
apps/web/public/source/
