# Dependencies
node_modules/

# Build output
dist/
.dist/

# Environment — NEVER commit secrets at rest (DB passwords, OIDC secrets, encryption key,
# Fastmail app passwords). Ignore .env and every .env.* variant, but keep the example template.
.env
.env.*
!.env.example

# Editor
.vscode/
.idea/
*.swp
*.swo

# OS
.DS_Store
Thumbs.db

# Logs
*.log
npm-debug.log*
pnpm-debug.log*

# TypeScript
*.tsbuildinfo

# Drizzle migrations (generated — not secrets, but keep clean)
# apps/api/src/db/migrations/

# Test coverage
coverage/
.nyc_output/

# Playwright CLI artifacts + ad-hoc screenshots (local verification only)
.playwright-cli/
gate2-*.png

# Operator-only credential seed (run out-of-band; never tracked)
apps/api/scripts/seed-credential.mjs