.gitignore

node_modules
dist
dist-lib
dist-artifact
.cache
.vercel
.DS_Store
npm-debug.log*
api/errors-*.md
.env
.env.local
.env.*.local

.env*.local

# CharacterStudio — vendored fork
character-studio/node_modules
character-studio/build

# rider/build — tracked so Vercel skips the webpack rebuild
character-studio/public/loot-assets
.mcp.json
.claude/worktrees/
# Auto-created symlinks → .agents/skills/* by scripts/setup-claude-skills.mjs
.claude/skills/

# Local env files
.env.xspace

# Scratch draft
tester.md

# Demo/scratch scripts (contain credentials)
xspace-agent/demo-join.ts
xspace-agent/join-space.js
xspace-agent/start-demo.sh

# Chat build artifacts
public/chat/assets/
public/chat/index.html
public/chat/index.html.gz

# Generated news permalink pages (rebuilt from data/rss/items.json by scripts/build-news.mjs)
public/news/
# A bare "data/_generated/" directory pattern would block re-including any file
# inside it below (git cannot un-ignore a file whose parent directory is itself
# excluded) — glob the contents instead so the exception under it works.
data/_generated/*
# Exception: the fact-check accuracy benchmark is a manually-run, checked-in
# report (real chain + real cost/time per run), not a deterministic prebuild
# artifact like its _generated/ siblings — commit it so /fact-check always has
# real, versioned numbers instead of needing a live re-run on every deploy.
!data/_generated/fact-check-benchmark.json

# Animation build cache
public/animations/clips/.input-hashes.json

# Draco + KTX2 decoder binaries — copied from node_modules/three by
# scripts/copy-three-decoders.mjs (postinstall). Recreated every install;
# do not commit so the lockfile-pinned three.js version stays authoritative.
public/three/
Handshake

# Sandbox clones — see experiments/README.md
experiments/*/node_modules
experiments/*/.next
experiments/*/dist
experiments/*/build

# Reference repo clones (read-only)
forks/*/
.env.production
.env.preview
.env.development

# Solana keypair files — NEVER commit
*-vanity.json
*vanity*.json
*-mint.json
test-mint.json
www-vanity.json
test-coin-metadata.json
scripts/x402-genwallets.mjs
scripts/pump-usdc-race.mjs

# Production log exports — contain sensitive data, never commit
*-prod-log-export-*.json
*-log-export-*.json

# Wallet / private-key material — NEVER commit
*.privkey.txt
*.b58.txt
*keypair*.json
solana-wallets-backup.zip
*wallets-backup*.zip
*wallet-backup*.zip
*-pump-wallet.json
.fresh-pump-wallet.json
.coin-keypair-*.json
.coin-metadata-*.json
.x402-test-wallet.json
# Generic keypair / secret-key / throwaway wallet files (Solana CLI format etc.)
*keypair*.json
*-secret.json
*secret-key*
*throwaway*
.solana-*.json
id.json
# id.json above targets Solana CLI keypairs; the Indonesian locale catalog is
# a plain translation file and must stay tracked.
!public/locales/id.json
scripts/x402-test-endpoints.mjs
wallets/
.wallets/
x402-test-wallets/
3dagent-log-export-*
pump-sdk-case-study.html
.claude/scheduled_tasks.lock
threews-launch-week-case-study.html
# Hidden one-off verification/debug scripts agents drop in the repo root. They
# hardcode a single session's scratchpad path, so they are dead the moment that
# session ends, and a `git add -A` sweep commits them permanently. A check that
# is worth keeping belongs in scripts/ with a name and no session-local paths.
# Matches the whole family (.verify-x.mjs, .probe-verify.mjs, .reel-probe4.mjs,
# .atlas-dbg.mjs): a dotfile .mjs in the root is always one of these, never
# config, so the pattern stays broad on purpose.
/.*.mjs

# Temp working directories
.tmp/

# Editor/tool temp copies (e.g. activities.js.tmp.4033808.adac1fce2562)
*.tmp.[0-9]*

# Throwaway inspection scripts (e.g. scripts/.tmp-home-defer-check.mjs).
# The undotted variants slipped into history once; keep them out for good.
.tmp-*
scripts/tmp-*
scripts/scratch-*
# Dot-prefixed harnesses under scripts/ are the same thing wearing a hidden
# name, and the hidden name is why they slipped the net: nine of them
# (.dw-*, .a11y-*, .verify-chat-tmp) had accumulated in the tree by
# 2026-07-30, none referenced by anything. Each hardcodes an ephemeral dev
# port and a per-session scratchpad path, so it is dead on arrival for anyone
# else. No committed script in scripts/ starts with a dot.
scripts/.*.mjs
# Any *.tmp.mjs, anywhere (matches the scratch/walk-*.tmp.mjs convention).
*.tmp.mjs

# Backup files (never commit backups)
*.bak

# Debug screenshot output from automation scripts (any directory)
debug-screenshots/

# GLB optimization backups (see scripts/optimize-glb.mjs)
# Note: GLBs themselves are committed in compressed form — the served avatar/
# animation assets are meshopt-compressed in place by scripts/compress-glbs.mjs.
*.glb.bak
.secrets/
.env.vercel
scripts/pump-vanity-grind.mjs
scripts/pump-usdc-status.mjs

# Scratch screenshot output (see scratch/walk-*.tmp.mjs)
scratch/screenshots/

# Playwright run artifacts
test-results/
# Captured probe/harness stdout under roadmap work-evidence dirs
prompts/roadmap/_generated/**/*.log

# page-audit harness (scripts/page-audit.mjs)
reports/
.auth/
.env*
docs/internal/COINMARKETCAP_ARTICLE.md
docs/internal/PRESS_RELEASE_SHORT.md
scripts/load-test.mjs
scripts/load-test-fleet.sh

# CDK synth output (build artifact)
infra/cdk.out

# SoundCloud backup — local only, never commit
sc/

# Debug screenshots from scripts — scratch output, never commit
scripts/*.png
scripts/**/*.png

# Scratch/diagnostic scripts and screenshots
scripts/_*
scratch/showcase-before.png

# Local scratch: throwaway scripts, screenshots, verification snippets
scratch/
docs/3d-generation-api/animation/pre-rig-check-v2-0-20250506.md
docs/3d-generation-api/animation/retarget.md
docs/3d-generation-api/animation/rig-v1-0-20240301.md
docs/3d-generation-api/animation/rig-v2-5-20260210.md
docs/3d-generation-api/export/conversion.md
docs/3d-generation-api/file-upload/quick-upload-directly.md
docs/3d-generation-api/file-upload/upload-in-sts.md
docs/3d-generation-api/get-started/changelog.md
docs/3d-generation-api/get-started/errors-and-error-handling.md
docs/3d-generation-api/get-started/introduction.md
docs/3d-generation-api/get-started/overview.md
docs/3d-generation-api/get-started/pricing.md
docs/3d-generation-api/get-started/quick-start.md
docs/3d-generation-api/get-started/rate-limits.md
docs/3d-generation-api/image-generation/advanced-image-generation.md
docs/3d-generation-api/image-generation/basic-text-to-image.md
docs/3d-generation-api/image-generation/multiview-image.md
docs/3d-generation-api/mesh-editing/mesh-completion-v1-0-20250506.md
docs/3d-generation-api/mesh-editing/mesh-segmentation-v1-0-20250506.md
docs/3d-generation-api/mesh-editing/smart-low-poly-p-v2-0-20251225.md
docs/3d-generation-api/model-generation/image-to-model-p1-20260311.md
docs/3d-generation-api/model-generation/image-to-model-turbo-v1-0-20250506.md
docs/3d-generation-api/model-generation/image-to-model-v1-4-20240625.md
docs/3d-generation-api/model-generation/image-to-model-v2-0-v2-5.md
docs/3d-generation-api/model-generation/image-to-model-v3-0-v3-1.md
docs/3d-generation-api/model-generation/import-model.md
docs/3d-generation-api/model-generation/multiview-to-model-p1-20260311.md
docs/3d-generation-api/model-generation/multiview-to-model-v2-0-v2-5.md
docs/3d-generation-api/model-generation/multiview-to-model-v3-0-v3-1.md
docs/3d-generation-api/model-generation/text-to-model-p1-20260311.md
docs/3d-generation-api/model-generation/text-to-model-turbo-v1-0-20250506.md
docs/3d-generation-api/model-generation/text-to-model-v1-4-20240625.md
docs/3d-generation-api/model-generation/text-to-model-v2-0-v2-5.md
docs/3d-generation-api/model-generation/text-to-model-v3-0-v3-1.md
docs/3d-generation-api/other/support-faq.md
docs/3d-generation-api/task-query/get-your-task-result.md
docs/3d-generation-api/texture/texture-model-v2-5-20250123.md
docs/3d-generation-api/texture/texture-model-v3-0-20250812.md

# Snapshot day-exports — recoverable from git history, never commit
snapshots/exported/

# Vanity keypair files — contain private keys, never commit
.keys/

# Python bytecode (workers/)
__pycache__/
*.pyc

# three.ws presence sweep — regenerate with `npm run presence`
three-ws-presence.json
three-ws-presence.md

# Exported custodial wallet backups — never commit
agent-wallets.*
# …but this pattern is unanchored, so it also swallowed the PUBLIC docs page of
# the same name. That page must ship: /docs/agent-wallets is in the docs nav and
# five other docs link to it. Negate just that one file; every real export
# (agent-wallets.json/.csv/.txt, anywhere) stays ignored.
!docs/agent-wallets.md
blog/3d-ai-crypto-convergence.md
# One-off genesis deploy scripts/output — contain a live RPC key + scratch results
scripts/test-deploy-one.mjs
scripts/genesis-deploy.mjs
scripts/genesis-photos.mjs
scripts/genesis-results.json

# local test wallet (never commit)
.wallet-test.json
docs/three-ws-feature-article.md
# Motion sources are build-time inputs, never committed; the README documents the directory.
animation-sources/*
!animation-sources/README.md
scripts/mixamo-dl/
demo.html
demo2.html
demo1.html
demo3.html
demo5.html
scripts/demo1.mjs

bvefj.txt
bvefj.csv
bvefj.json
demo6.html
example.html
scripts/test-corr.mjs
*_tweets_*.json
scripts/.corr-*

# Raw /club entrance source exports (repo root only). The compressed runtime
# copies under public/club/venue/ are the committed source of truth — rebuild
# with scripts/build-club-entrance-venue.mjs. Anchored with a leading slash so
# the public/club/venue/alleyway.glb runtime asset is NOT ignored.
/space_smugglers_club_house_-_dark_version.glb
/im-in-love-wit-a-stripper-fast.mp3
/club.mp3
/alleyway.glb
/tour.glb

# Root-level scratch/debug artifacts (one-off agent probe scripts + screenshots).
# Anchored to root so legitimate underscore-prefixed files elsewhere are unaffected.
/_*.mjs
/_*.png

# Scratch: IBM × three.ws partnership page experiment (duplicate of x402-demo, not for commit)
/pages/ibm/partnership.html
pages/ibm/test.html

# Raw smart-money scrapes (distilled into api/_lib/copy/smart-wallets.json — never commit the 30MB sources)
/solwallets.json
/bscwallets.json
three.ws-log-export-*.json

# Local prompt working set (not shared)
prompts/nvidia/

# Embodiment / digital-human work — kept local, never shared to the mirrors.
# Exception: emotion.js is a pure emotion/gesture descriptor that committed,
# deployed MCP routes (api/mcp-3d.js → _mcp3d/tools/studio.js) and the embodiment
# stage import, so it MUST be in the tree or the Vercel bundle fails to resolve it.
api/_lib/embodiment.js
api/embodiment/
src/embodiment/*
!src/embodiment/emotion.js
!src/embodiment/controller.js
!src/embodiment/face-expression.js
!src/embodiment/rig-mode.js
!src/embodiment/text-visemes.js
src/embody.js
pages/embody.html
api/_lib/migrations/20260623170000_agent_bodies.sql

# MCP registry publisher auth token (never commit)
.mcp_publisher_token

# NVIDIA TRELLIS demo outputs (local only)
demo/
three-ws-prod-log-export-2026-06-24T04-15-25.json
pages/ibm/hello.html
three-ws-prod-log-export-2026-06-24T13-33-58.json
three-ws-prod-log-export-2026-06-25T07-22-45.json
three-ws-prod-log-export-2026-06-25T19-38-22.json
three-ws-prod-log-export-2026-06-26T03-40-50.json
three-ws-prod-log-export-2026-06-26T07-25-42.json

# Transient build/test scratch output and log exports — never commit
*.tmp
.vitest-out*
three-ws-*-log-export-*.json

# Pump.fun launch wallets — 112 throwaway keypairs + master, one per repo coin.
# Private keys + downloadable bundle. NEVER commit. Created under this dir only.
.pump-launch-wallets/
pump-launch-wallets*.zip
.preview/
launch-studio-catalog.png
launch-studio-preview.png

# x402 ring wallet secrets (never commit)
.x402-ring-secrets.json
docs/nvidia-inception/three-ws-nvidia-deck.pdf
docs/nvidia-inception/assets/avatar-hero.png
docs/nvidia-inception/deck.html
Screenshot 2026-07-02 at 3.18.08 PM.png

.verify-tmp.mjs
.verify-runner.sh
docs/content/social/x-article-backlog-leak.md
.old-account-kms-envelopes.json

# Bulk Mixamo library (multi-GB, fetched via npm run mixamo:download) —
# mx-*.fbx are build-time retarget sources, never committed or deployed.
animation-sources/mx-*.fbx
animation-sources/.library-clips/
scripts/mixamo-progress.json
scripts/mixamo-library.config.json
scripts/mixamo-upload-state.json

# local prompt-pack workspace (never commit)
_prompts/

# persona-store's local/dev/test fallback (used whenever DATABASE_URL is
# unset — writes real records to disk so "reload the same persona id" works
# on a laptop with zero cloud config). Production uses Postgres, not this;
# these files are transient local test data and must never be committed.
.data/

# Throwaway QA harness pages and the esbuild bundles they load. A probe run
# scaffolds these and is meant to delete them afterwards; a committed bundle
# ships megabytes of dead JS to every visitor, since public/ is served as-is.
pages/_qa-probe-*.html
public/_qa-probe-*.js


# Solana Mobile (Seeker) build artifacts — the Android project is regenerated
# from solana-mobile/twa/twa-manifest.json on every build, and keystores are
# secrets that must never land in git.
solana-mobile/build/
*.keystore
main.zip
.x402-directory-credentials.json
robinhood-chain-prompts.zip
prompts/robinhood-chain/13-threews-play.md
prompts/robinhood-chain/12-threews-markets.md
prompts/robinhood-chain/10-tutorials.md
prompts/robinhood-chain/11-toolkit-cli.md

# archives at repo root are never committed
/*.zip
# except the OpenAI Select Partner tier assets (owner-provided brand kit)
!/OAI Select Tier Assets-20260716T190344Z-1-001.zip
tests/openai-comarketing-language.test.js

# scratch OTP relay file used by scripts/get-mixamo-token.mjs
.mixamo-otp

# local research datasets (large, regenerable; see datasets/*/README.md)
/datasets/
SECURITY-AUDIT.md

# avatar fidelity evaluation: reference faces are real people / licensed stock and
# never belong in git; reports and rendered GLBs are regenerable outputs.
# Mirror the reference set via gs://three-ws-avatar-reconstructions/eval-refs/
# (see workers/avatar-reconstruction/eval/README.md).
/workers/avatar-reconstruction/eval/refs/
/workers/avatar-reconstruction/eval/reports/
# local Python venv for the eval harness — thousands of files, always regenerable
/workers/avatar-reconstruction/.venv-eval/

# Scratch harnesses for local 3D/pose debugging — never committed.
scripts/.scratch/
/workers/avatar-reconstruction/eval/adversarial/

# Scratch copies of the built changelog feed (regenerate with npm run build:pages)
old_changelog.json
new_changelog.json

# Root-level scratch screenshot/debug harnesses. The repo-hygiene rule keeps
# throwaway scripts out of the root; ignoring them means an agent's in-flight
# harness can never be swept into a commit by a `git add -A` from another
# session. Put anything you intend to keep in scripts/.
/scratch-*.mjs

# Documentation search index: generated from docs/**/*.md by
# scripts/build-docs-search-index.mjs (prebuild + postinstall). It is ~1.4 MB
# and rewritten by every docs edit, so committing it would grow the repo by a
# fresh copy per docs change while adding nothing a build cannot reproduce.
public/docs-search-index.json
.namecheap-backups/

# Author-local scratch runners (the `.local.` infix marks them as never-commit).
# They carry absolute machine paths and drive real devnet writes.
*.local.mjs

# Session scratch that has landed in the repo root before. .gauth/ holds the
# gcloud reauth fifo and its log (which quotes verification URLs and codes);
# the others are audit/load-test output. None of it belongs in history, and a
# concurrent `git add -A` sweep would otherwise commit it.
.gauth/
.capacity-*.json
.play-profile-check.mjs
.failover-report.json
.meetup-audit/
.souvenir-ui/

# IBM Partner Plus marketplace onboarding notes (business ops, not platform code)
ibm-partner/

# garment-forge bakes its reference body into the image at build time by copying
# public/avatars/parametric-base.glb (see workers/garment-forge/cloudbuild.yaml),
# so the staged copy is a 4 MB duplicate of a file already in the repo.
workers/garment-forge/assets/

# wrangler's local dev cache for workers/pump-fun-mcp (bundled worker builds,
# state and tmp). Regenerated by `npx wrangler dev`, never an input to a deploy.
.wrangler/

# Local scratch query/smoke scripts (same family as .play-profile-check.mjs above):
# ad-hoc runners an agent drops in the root, never part of a build or a deploy.
.forge-q.mjs
.mcp-forge-free-smoke.mjs
.monetization-proof/

# Rust build output for the on-chain program tests (contracts/program-tests).
# cargo writes 1.4 GB here; the sources next to it are what we keep.
contracts/program-tests/target/
# Scratch output from scripts/retention-metric-proof.mjs.
.retention-proof/

# Downloaded ONNX weights cached by the node-operator self-test (23 MB+, fetched on demand)
packages/node-operator/models/

# Dev-server logs from `npm run dev` on an alternate port (.vite<port>.log).
.vite*.log

# Scratch capture of an `npm test` run (.npmtest-<label>.log).
.npmtest-*.log