# dependencies (bun install)
node_modules
node_modules/.pnpm

# output
out
dist
dist-ssr
*.tgz

# generated files
packages/**/*.js
packages/**/*.js.map
packages/**/*.d.ts
packages/**/*.d.ts.map

logs/

# code coverage
coverage
*.lcov

# logs
logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*

# dotenv environment variable files
.env
.env.*
!.env.example
.env.local
.env.development.local
.env.test.local
.env.production.local

# === Secrets (sec-no-secrets: critical) ===
*.key
*.pem
*.p12
*.pfx
credentials.*
secrets.*
**/service-account*.json
.gcp-credentials.json

# caches
.eslintcache
.cache
*.tsbuildinfo

# IntelliJ based IDEs
.idea
**/.idea

# Finder (MacOS) folder config
.DS_Store

# Screenshot/capture files at repo root (session evidence, not source)
/*.png
/*.jpg
/*.jpeg

# Environment variables
.env
.env.local
.env.development
.env.test
.env.production

# Build outputs
dist/
# Exclude only VitePress cache and build directories
apps/docs/.vitepress/cache/
apps/docs/.vitepress/dist/

# Editor settings
.vscode/*
!.vscode/extensions.json
!.vscode/settings.json
*.iml

# macOS
.DS_Store

# Log files
*.log

# Build files
.turbo
.output
.vercel
.netlify
.next

# VitePress temporary directory
**/.temp

# Markdown files in apps directory (except docs/)
apps/**/README.md
!apps/**/docs/README.md

# Package README files are now preserved and committed to git
# packages/*/README.md  # REMOVED - README.md files should be included in packages

.pnpm*

.local-assets
.dag-storage/
apps/api-server/.local-assets/
apps/api-server/.dag-storage/

# dag-cli runtime working directory (catalog/nodes/runs.db/run-history) — never commit local run state
.dag/
# FLOW-007 workspace layout: local workflow catalog + code nodes (test/dev working dir) — never commit
.workflows/

# Lock files from other package managers
bun.lock

# Runtime/backup directories
.backup/
.robota/

# Audit script output (local-only, not committed)
scripts/audit/output/
.playwright-mcp/

# Local eval metrics (auto-generated per agent session)
.agents/evals/local-metrics/
.agents/evals/harness-log/

# One-off analysis reports (local-only, regenerated on demand)
.agents/reports/

# INFRA-042 mutation testing (Stryker): sandbox + generated reports (regenerated per run, uploaded
# as a CI artifact — never committed).
.stryker-tmp/
reports/mutation/
stryker.log

.worktrees/
.claude/worktrees/
.gstack/

# Fixture roots for tests that must live inside the invocation directory (SEC-007 containment).
# `afterAll` removes them; this is the net for a SIGKILL/timeout that skips the hook.
.tmp-dag-tool-run-*/
# Its CONTENTS, not the directory: git cannot re-include a file whose parent directory is excluded,
# so `.agents/local-reviews/` followed by a negation silently keeps ignoring the README.
.agents/local-reviews/*
# …except that README. HARNESS-066: this directory is a LOCAL note cache and not gate evidence, and
# the only place that can say so is a file the next reader will actually see. Ignoring the
# explanation along with the data is how a demoted artefact keeps looking authoritative.
!.agents/local-reviews/README.md

# HARNESS-109: per-clone agent-harness configuration, written by the tool and never committed.
# Not merely noise: `verification-receipt.mjs` refuses to stand behind a receipt while the tree is
# dirty, so an untracked file present in EVERY agent clone made `readVerificationReceipt()` return
# null for whole sessions and every push re-ran the full gate — the same regression its header
# records for the lessons churn.
#
# A CLASS, not a filename. The first fix named `settings.local.json` alone, which is how the lessons
# churn was closed too — and naming files one at a time is what let a second instance happen. The
# `*.local.json` suffix is the tool's own convention for a per-clone file; the shared
# `.claude/settings.json` stays tracked.
.claude/*.local.json
