# What must never reach the build context.
#
# Two entries here are load-bearing rather than housekeeping, and both are about
# the bind mounts (PLAN.md §6, §7).
#
#   brand/  is the OPERATOR's override. If a developer's local mount were copied
#           in, the image would ship somebody's test logo as if it were stock —
#           and, worse, it would win over brand-default/ on every deployment that
#           does not mount its own. The mount is the only way brand/ is allowed
#           to exist inside a container.
#
#   data/   holds beta.sqlite: real addresses, given under a consent notice that
#           says where they are stored. A published image is world-readable to
#           anyone who can pull it. This line is the reason that cannot happen by
#           accident.
#
# brand-default/ is deliberately NOT here. It is baked in and must always be
# complete; §7's whole per-file fallback rests on it.

node_modules
dist
.astro
.output

brand
data

.git
.gitea
.gitignore
.dockerignore

.env
.env.*
!.env.example

# Authoring inputs and working notes, none of which the running site reads.
PLAN.md
*.log
npm-debug.log*
.DS_Store
Thumbs.db