.gitignore

# =========================================================================
# SECRETS — nothing matching these may ever be committed
# =========================================================================
.env
.env.*
!.env.example
*.session
*.session-journal

# Every service-account filename this repo has actually used. The original rule
# covered only `serviceAccountsKey.json`, which is why `service_account.json`
# leaked into the public history.
service_account.json
serviceAccount*.json
serviceAccountsKey.json
*-service-account*.json

# Self-hosted install state — holds the user's Telegram bot token, Cloudflare
# token and encryption key.
.daemonclient-selfhost.json
.daemonclient-selfhost.json.corrupt-*

# Operator one-off force-deploy configs (real account and database ids).
immich-api-shim/wrangler-dc-*.toml
immich-api-shim/wrangler-ozkv3fuz.toml

# Production `wrangler tail` captures — full request logs.
immich-api-shim/tail_logs*.json

# Wrangler local state and dev secrets.
.wrangler
.dev.vars*
!.dev.vars.example


# =========================================================================
# DEPENDENCIES AND BUILD OUTPUT
# =========================================================================
node_modules/
.pnpm-store/
__pycache__/
*.py[cod]
venv/
.venv/
env/
ENV/
*.egg-info/

build/
dist/
# ...but `immich/web/src/lib` is application SOURCE, not build output. The bare
# `lib/` rule below would otherwise swallow ~160 real source files (managers,
# components, utils) and make them untrackable.
lib/
lib-es6/
!immich/web/src/lib/
!immich/web/src/lib/**
# ...and the Flutter fork's lib/ trees are source too: the app, the generated
# openapi client it imports, and the workspace UI packages. Without these
# negations the entire Dart codebase was untracked — CI checked out a skeleton
# and a fresh clone could not build the mobile app at all.
!immich/mobile/**/lib/
!immich/mobile/**/lib/**
# ...and these two are checked-in assets that happen to sit under a dist/ path.
!drive/dist/
!drive/dist/**

immich/web/build/
accounts-portal/dist/
deployment-service/src/shim-bundle.ts
deployment-service/scripts/
processor/.venv*/
.vercel

# Generated by `daemonclient web` (self-host Firebase Hosting config).
firebase.selfhost.json

npm-debug.log*
yarn-debug.log*
yarn-error.log*
lerna-debug.log*
firebase-debug.log*
.firebase/


# =========================================================================
# LOCAL SCRATCH — agent transcripts, session dumps, superseded root files
# =========================================================================
# Note: this deliberately does NOT use a bare `*.txt`. That rule was here, and
# it silently ignored every `robots.txt` and `requirements.txt` in the repo —
# they only survived because they were committed before the rule landed.
/*.txt
/memory/
scratch/
docs/photos/
docs/superpowers/
docs/v2.0.0-COMPLETION-REPORT.md
.claude/
.playwright-mcp/

# Dated fix/deploy reports left on disk by past sessions. They are notes, not
# project documentation — the real history is in git log.
/BUG_FIXES_*.md
/CRITICAL_FIXES_DEPLOYED.md
/DEPLOYMENT_FINAL_*.md
/PRIORITY_QUEUE_DEPLOYED.md
/PROJECT_ROADMAP.md

# An abandoned local Immich Docker instance, including real photos.
immich-docker-backup/

# Superseded root files — each real project has its own package.json.
About.md
wrangler.jsonc.backup
/package.json
/package-lock.json
/.python-version


# =========================================================================
# OS AND EDITOR
# =========================================================================
.DS_Store
Thumbs.db
.vscode/
.idea/