node_modules/
dist/
dist-chromium/
dist-firefox/
# Linux bundles from the container build (scripts/build-linux.ts).
dist-linux/
# Handoffs between release jobs (scripts/release.ts), written on a runner or by a local test.
release-out/

# Astro build cache
.astro/
website/.astro/

# Wrangler local state
.wrangler/
web-ext-artifacts/
bramble*.zip
bramble*.crx
bramble*.xpi
*.log
.DS_Store

# Rust / WASM
packages/core-rust/target/
# Cargo.lock IS committed: this crate ships compiled artifacts (jniLibs + wasm) in the
# released apps, so the dependency graph must be pinned. Without it a rebuild of a tag
# resolves newer patch releases and no longer matches the published binary.
packages/platform-extension/public/wasm/

# Signing keys must never be committed (see docs/release-signing.md)
*.pem
*.age
*.jks
*.keystore
# Google / Chrome Web Store service-account keys (secret JSON private keys)
*-service-account.json
*.iam.gserviceaccount.com.json
bramble-502002-*.json

# Pre-disclosure security notes. A writeup of an unfixed vulnerability in a released
# build is a public disclosure the moment it lands here, so it stays out of the tree
# until the fix ships (see SECURITY.md). The published writeup is docs/sec-audit-*.md,
# committed with the fix, as GHSA-x4f5 was.
docs/private/

# Local env (API keys, never tracked)
.env.local
.env*.local

# Playwright E2E artifacts (the browsers live in ~/.cache/ms-playwright, not the repo)
test-results/
playwright-report/
.playwright/

# iOS build output. Unanchored on purpose: the existing rules in
# packages/platform-mobile/ios/.gitignore are path-anchored (`App/App.ipa`), so anything
# gym writes elsewhere - e.g. the repo root, which is now fastlane's working directory -
# slipped through. The Fastfile also pins an output_directory so these shouldn't appear
# at the root at all; this is the backstop.
*.ipa
*.dSYM.zip

# macOS credential-provider build output and the profiles it embeds. `macos/build/` holds a
# compiled appex (binary + code signature) that is rebuilt every time, and the .provisionprofile
# files are per-machine signing material. Both got committed twice by a `git add -A packages`
# before this existed.
packages/platform-desktop/macos/build/
*.provisionprofile
