# The build stage does `COPY . .`, so anything not excluded here ends up in an
# image layer — and a layer is readable by anyone who can pull the image, even
# if a later stage deletes the file.

# ---- Secrets. Non-negotiable. ----
# The platform injects the environment; a baked .env would ship live database
# and Spaces credentials inside the image.
.env
.env.*
!.env.example

# ---- Build inputs that must be produced inside the image ----
# A host node_modules is the wrong platform (linux/musl vs win32/darwin) and
# would silently shadow the one `pnpm install` builds in the deps stage.
node_modules
**/node_modules
.next
**/.next
.turbo
**/.turbo
dist
**/dist
out
**/out

# ---- Never needed at runtime ----
.git
.gitignore
.github
.vscode
.idea
**/test
**/tests
**/*.test.ts
**/*.test.tsx
**/vitest.config.ts
playwright-report
test-results
coverage
**/*.log
.DS_Store
Thumbs.db

# Docs and local tooling. Keeping them out is about layer size and churn: a
# README edit should not invalidate the build cache.
*.md
!README.md
docker-compose.yml
docker-compose.*.yml
Dockerfile
.dockerignore

# NOTE: ca-certificate.crt is deliberately NOT ignored. DATABASE_CA_CERT may
# point at it, and it is a public certificate — no private key. See db/client.ts.