node_modules/
.expo/
dist/
web-build/

# Android is a MANAGED Expo workflow: `android/` is generated by `expo prebuild`
# and must stay untracked. Committing it flips Android to the bare workflow, which
# changes how expo-updates resolves runtimeVersion and diverges the native config
# from app.json. iOS is deliberately the opposite: `ios/` IS tracked.
/android/
*.jks
*.p8
*.p12
*.key
*.mobileprovision
*.orig.*
.env.local

# macOS
.DS_Store

# Temporary files created by Metro
.metro-health-check*

# Maestro E2E tests
.maestro/env/test.env
# Fixture ids written by .maestro/scripts/seed-e2e.sh
.maestro/env/e2e*.env
.maestro/results/
.claude/

# Maestro screenshot artifacts. `takeScreenshot: <name>` writes <name>.png to
# the app root (the CWD maestro runs from), so ignore root-level PNGs too —
# legitimate image assets live under assets/ / ios/ / android/, not here.
*.screenshot.png
/*.png

# @generated expo-cli sync-2b81b286409207a5da26e14c78851eb30d8ccbdb
# The following patterns were generated by expo-cli

expo-env.d.ts
# @end expo-cli
# Android Play service account key (secret — never commit)
google-service-account*.json

# EAS Update code-signing PRIVATE key material — must NEVER be committed. Only
# the PUBLIC certificate under certs/ is committed (embedded in the app). The
# private key signs updates and must live in a secrets manager / CI secret; a
# local copy used for signing is fine only while it stays untracked here. If a
# private key is ever committed or exposed, rotate it (new pair + new build).
keys/
