.gitignore

node_modules/
.idea/
dist/
public/blog/
public/countries/
public/chokepoints/
public/crises/
public/tools/
public/reference/
public/research/
public/crawlable-corpus.json
.DS_Store
*.log
.env
.env.local
# Local plaintext env exports/backups (including tool-specific suffixes).
.env*.bak*
.env*-bak*
.env*.backup*
.env*-backup*
.env*.export*
.env*-export*
# Self-hosting secrets (SELF_HOSTING.md). Both of these are places the docs
# tell operators to put real API keys, so neither should ever be stageable:
#   - docker-compose.override.yml holds WORLDMONITOR_VALID_KEYS and the
#     upstream provider keys; SELF_HOSTING.md already states it is gitignored.
#   - secrets/ is the Docker-secrets layout documented in docker-compose.yml,
#     which instructs `echo "gsk_abc123" > secrets/groq_api_key.txt`.
docker-compose.override.yml
secrets/
.playwright-mcp/
*-network.txt
.vercel
api/\[domain\]/v1/\[rpc\].js
api/\[\[...path\]\].js
.claude/
.cursor/
CLAUDE.md
.env.vercel-backup
.env.vercel-export
.agent/
.factory/
.windsurf/
skills/
!api/skills/
ideas/
docs/internal/
docs/ideation/
internal/
# Exception: api/internal/ hosts Vercel edge endpoints that must be tracked
# (e.g. api/internal/brief-why-matters.ts — RELAY_SHARED_SECRET-auth'd
# endpoints for internal callers like the Railway digest cron).
# Scoped to SOURCE FILE TYPES ONLY so the parent `.env` / secrets ignore
# rules stay in effect inside this directory. Do NOT widen to `**`.
!api/internal/
!api/internal/*.ts
!api/internal/*.js
!api/internal/*.mjs
test-results/
src-tauri/sidecar/node/*
!src-tauri/sidecar/node/.gitkeep

# AI planning session state
.planning/

# Compiled sebuf gateway bundle (built by scripts/build-sidecar-sebuf.mjs)
api/[[][[].*.js

# Compiled sidecar domain handler bundles (built by scripts/build-sidecar-handlers.mjs)
api/*/v1/\[rpc\].js
.claudedocs/

# Large generated data files (reproduced by scripts/)
scripts/data/pizzint-processed.json
scripts/data/osm-military-processed.json
scripts/data/military-bases-final.json
scripts/data/dedup-dropped-pairs.json
scripts/data/pizzint-partial.json
scripts/data/gpsjam-latest.json
scripts/data/mirta-raw.geojson
scripts/data/osm-military-raw.json
scripts/data/forecast-replays/

# Iran events data (sensitive, not for public repo)
scripts/data/iran-events-latest.json

# Military bases rebuild script (references external Supabase URLs)
scripts/rebuild-military-bases.mjs
.wrangler

# Build artifacts (generated by esbuild/tsc, not source code)
api/data/city-coords.js
convex/_generated/**/*.js

# OpenAPI bundle copied at build time from docs/api/ for native Vercel serve
/public/openapi.yaml
# JSON mirror of the bundle (build:openapi → scripts/build-openapi-json.mjs);
# served at /openapi.json for scanners/agents that only parse JSON
/public/openapi.json

# Runtime artifacts (generated by sidecar/tools, not source code)
api-cache.json
verbose-mode.json
skills-lock.json
tmp/
.context/

# Local planning documents (not for public repo)
docs/plans/
docs/brainstorms/
playground-pricing.html