# Dependencies
node_modules/

# Test scripts (not for repo)
scripts/generate-test-messages.sh
scripts/routing-experiments.sh
scripts/experiment-results.json
scripts/qa-test-workspace.sh

# QA test scripts and evidence (never committed) — use qa/* so the
# directory itself stays traversable and we can re-include specific
# subdirs below.
qa/*
# Exception: routing regression suite is the permanent flagship corpus
# tracked under qa/routing-regression/ per docs/03-architecture/
# semantic-router-flagship-plan.md §10.
!qa/routing-regression/

# Build output
dist/
dist-tsgo/
build/
.next/
out/
*.log

# Prisma generated client (regenerated from schema)
**/src/generated/

# Installer progress — records which steps finished and which questions were
# answered so a re-run resumes instead of restarting the interview. Per-machine
# state, never shared. Holds no secrets (those stay in .env).
.claw-install.state

# Host-owned deployment state (SHA, lock, history, and safe status projection).
.deploy/

# Environment (secrets)
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
# Leftover local secrets from the retired Vercel deployment path — never
# committed even though the automation that read it is gone.
.env.vercel*

# IDE
.vscode/
.idea/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# Debug logs
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Test coverage
coverage/
.nyc_output/

# Docker volumes (local data)
postgres-data/
redis-data/
ollama-data/
mongo-data/
rabbitmq-data/
file-storage-data/

# Reference zip files
*.zip

# TLS / SSL — local mkcert-issued certs and CA private key.
# The leaf cert + root CA are per-developer; rerunning scripts/install-tls.sh
# regenerates them. Never commit private keys.
certs/
*.pem
*.crt
*.key
!apps/claw-frontend/public/**/*.key

# Generated public-domain nginx server blocks (Let's Encrypt). Written by
# scripts/install-letsencrypt.sh, one per domain, and specific to the host that
# holds the certificate — committing one would point every other install at a
# /etc/letsencrypt path that does not exist there and break nginx startup.
infra/nginx/public-tls/*.conf

# Misc
*.tsbuildinfo
.turbo/

.claude/
plan-prompts/
tmp/
tmp/qa-run.log
qa-run.log

apps/claw-frontend/scripts/*
!apps/claw-frontend/scripts/run-vitest.cjs
!apps/claw-frontend/scripts/clear-cache.mjs
!apps/claw-frontend/scripts/typecheck-ts7.mjs
# ESLint cache
.eslintcache

# Local runtime probe dumps (operator diagnostics; never committed).
# Populated by scripts/local-runtime-probes/probe-*.mjs.
.local-runtime-probes/

# --- AI-native engineering OS ---
# Generated .ai knowledge layer is COMMITTED except the per-developer local
# context bundle, which is machine-specific and regenerated on demand.
.ai/local/
.worktrees/
# Audit working copy (the committed snapshot lives under docs/features/).
.audit/

# Lighthouse CI reports
.lighthouseci/

# Playwright run artifacts (traces, screenshots, HTML report)
test-results/
playwright-report/

.playwright-mcp/
