# Allowlist. The build context IS the AGPL corresponding source: saisit/Dockerfile tars it
# and serves it as /saisit-source-<sha256>.tar.gz. Only list what belongs in that source.
# Private context (.claude, .codex, .secrets, .git, env files) is excluded by the first rule.
*

!/.annotaterb.yml
!/.dockerignore
!/.erb_lint.yml
!/.eslintrc
!/.gitattributes
!/.gitignore
!/.rspec
!/.rubocop.yml
!/.version
!/Dockerfile
!/Gemfile
!/Gemfile.lock
!/LICENSE
!/LICENSE_ADDITIONAL_TERMS
!/Procfile
!/Procfile.dev
!/compose.*.yml
!/README.md
!/Rakefile
!/SECURITY.md
!/app
!/bin
!/config
!/config.ru
!/db
!/deploy
!/docs
!/lib
!/log/.keep
!/package.json
!/postcss.config.js
!/public
!/saisit
!/spec
!/tailwind.application.config.js
!/tailwind.config.js
!/tailwind.dynamic.config.js
!/tailwind.form.config.js
!/tmp/.keep
!/yarn.lock

# Build output and runtime data inside allowed paths.
/public/packs
/public/packs-test
/public/saisit-source-*.tar.gz
/db/*.sqlite3*
/saisit/proof
**/node_modules
**/__pycache__
**/*.py[cod]
**/*.log
**/.DS_Store

# Defence in depth: never ship credentials or env files, even untracked ones.
**/.env*
# ...except the names-only template at the root (no values; part of the AGPL source).
!/.env.example
**/*.key
**/*.pem
**/*credentials*
**/*.sqlite3*
**/*.db
