# Keep the build context lean and secrets out of the image.
# The build stage runs npm ci + vite build itself, so host-side
# installs and artifacts must not leak in via COPY.
# (Unlike .gitignore, patterns here only recurse with a **/ prefix.)

.git/
.venv/
**/__pycache__/
**/*.pyc
**/.pytest_cache/
**/.ruff_cache/

**/node_modules/
frontend/dist/

# Secrets — never in an image layer
.env*
*.env

# Diff-harness output
harness/out/