.gitignore

node_modules
nbproject/*
.idea/*
src/vendor/*
.netbeans.xml
/composer.lock
node_modules/*
web/public/*
out/*
config.txt
php/tmp/*
php/logs/*
db/logs/*
php/php.ini
dist
builds/api-runtime/
# Generated by the frontend build, same as api-runtime above
builds/cdn-frontend/

# MongoDB runtime files
mongodb/data/
mongodb/log/
mongodb/bin/*.mdmp

# MongoDB credentials (auto-generated during installation)
.mongodb-credentials.json
.mongodb-credentials.json.backup
api/.mongodb-credentials.json
.env
api/.env

# The key that decrypts the database password, and the token file older builds
# wrote. Both normally live in the user data folder rather than here - but
# "normally" is doing a lot of work in that sentence. A developer who points
# POSNIC_USER_DATA at the checkout, or copies a folder in to reproduce a bug,
# is one `git add -A` away from committing the key that unlocks the database.
# Ignoring them costs nothing and removes the possibility.
.credential-key.json
update-credentials.json

# Update packages (large zip files - distribute separately)
update-packages/

# Proprietary cloud components (live in posnic-cloud, never commit here)
sync-gateway/
sync-agent/

# Never commit runtime/session data
.wwebjs_auth/
.wwebjs_cache/
.env

# White-label branding is not built here.
#
# brand-build.js, the brands/ packs and the build-desktop workflow moved to the
# private build repository. That is where a customer installer is produced: it
# checks this repository out at a tag, applies the brand on top and publishes
# the exe. Keeping the pipeline out of a public repository keeps how it is done
# out of it as well.
#
# A brand still reaches a shop two ways at runtime - a seed the build repo drops
# into resources/brand-seed, and refreshBrand() fetching one from the gateway -
# and both are read by main.js. Neither explains how a brand is made.
brands/
builds/.brand-backup/

# Local development database, created by mongod for testing. Never committed.
.devdb/

# MongoDB's server binaries, and the Microsoft runtime it needs to start.
#
# Required to build an installer - electron-builder copies them into
# resources/mongodb - but not kept in git. They are 60MB of somebody else's
# software under the SSPL; carrying them made every clone 130MB and made this
# repository a redistributor of a licence that is not its own.
#
# Run download-mongodb.bat once after cloning. scripts/check-mongodb-binaries.js
# runs before every build and says exactly this if they are missing.
mongodb/bin/

# Electron supplies its own Node, and the API runs in-process on it. Nothing
# packaged ever used this copy.
nodejs/

# White-label build output, not source.
#
# scripts/brand-build.js deletes and recreates builds/brand-seed on every run,
# so whatever is tracked here is only ever the last brand that happened to be
# built - and a customer's name and artwork did land in this repository that
# way. A missing seed is the stock build, which is what a clone should produce.
builds/brand-seed/

# Debug captures. One of these reached the repository holding a real customer's
# branch names and a third party's logo, and would have been published with it.
# A screenshot taken to diagnose a bug is never something to commit.
*-debug.png
*-debug.jpg
screenshot-*.png
asset-signing-key.private.pem
.demo-review/

# a dev till pointed at the wrong anchor once wrote its database here
src/mongodb/

# Translator worksheets (tests/tools/i18n-coverage.js --worksheet). A working
# file on its way to a person and back; the translations belong in
# frontend/languages/<code>.json once merged, not in a half-filled sheet.
*-to-translate.json

# Database snapshots pulled down for comparison or recovery work. These are
# raw copies of a production database - every shop, every customer - and the
# only thing standing between one and a public repository is that nobody ran
# "git add -A" while a 1.1GB Atlas snapshot happened to be sitting here. Name
# them by their cluster and timestamp, as the Atlas download already does.
Main-[0-9]*T[0-9]*Z/
Main-[0-9]*T[0-9]*Z.tgz
*.mongodump/
dump/
src/receipt-logs/

# Journey frames are regenerated by scripts/dev/shoot.cjs; the tool is the
# artefact, not 2MB of screenshots that are stale the next time it runs.
docs/journey/

docs/journey-after/
docs/journey-audit.html

# Scratch patch scripts and commit messages never belong in the tree.
cmsg.tmp
*-patch.py
*.py
!scripts/**/*.py
!api/scripts/provision-ask-posnic-bedrock.py