# Rust build artifacts
/target/
**/*.rs.bk
.env

# IDE files
.idea/
.vscode/
*.swp
*.swo
*~

# OS files
.DS_Store
Thumbs.db

# Coverage
lcov.info
*.profraw

# Fuzz artifacts
fuzz/artifacts/
fuzz/corpus/
# `/target/` above is anchored to the repo root, so the fuzz crate's own build
# directory was never ignored: a local `cargo fuzz run` left multiple GB of
# untracked files that a `git add -A` would happily stage.
fuzz/target/
# The same for the Miri / AddressSanitizer harness (`make miri`, `make asan`).
unsafe-check/target/

# Proptest regressions
**/proptest-regressions/

node_modules/
.reflex/

# The repo root installs with npm (package-lock.json is the release tooling's
# real lockfile; semantic-release.yml runs `npm install`). pnpm-workspace.yaml
# exists only as a package-discovery manifest for multi-semantic-release, so a
# local `pnpm install` writes a second, unused lockfile — the committed one went
# stale for three months and carried 2 critical + 21 high advisories that no
# install ever used (GA audit supply-chain finding). Never commit it.
/pnpm-lock.yaml

# Tailwind standalone CLI (binary, not committed — install via `make tailwind-install`)
ui/tailwindcss

# Generated protobuf code (produced by build.rs on every build)
/src/protocol/generated/

# Binary symlink at repo root (not the helm chart subdirectory)
/hearth
*.wal

# Local runtime data (compose named volume + `cargo run` default path)
/data/

*.jpg
*.jpeg
*.png
*.log

.playwright-mcp/

/hearth.yaml
/hearth.yml

# Integration-suite run credentials (written by demo.sh after first bootstrap;
# contains a live admin token — must never be committed).
examples/full-stack-demo/.hearth-run-env

.codex

# Backup files
*.bak

# UI test artifacts (generated by make ui-test-smoke)
tests/ui/.auth/
tests/ui/reports/
tests/ui/node_modules/

# Load-test harness reports + seed handles (HEA-1789). The seed handle holds
# LIVE bearer tokens — it must never be committed.
# Use /* (not /) so the published/ exception below can take effect — git cannot
# un-ignore a file inside a directory-level ignore pattern (HEA-1880).
loadtest/reports/*
# Exception: committed subset backing cited figures in the performance report.
# Seed handles, raw HTML, and log files are still ignored; only report JSONs
# and the README in published/ are tracked.
!loadtest/reports/published
loadtest/target/

*.tsbuildinfo
**/.phpunit.cache

**/.next/*
.next

go-gin

**/php/vendor
*.cache

.claude/scheduled_tasks.lock

build
**/.gradle/*
__pycache__

nextest-*

# Local compose overrides for deploy/docker-compose.yml (audit §4.8#17).
deploy/hearth.env
