node_modules/
dist/
build/
# Portable bundle output (scripts/build-portable.mjs) — built on demand, never committed.
dist-portable/
# Community storefront output (packages/web/scripts/build-site.mjs) — the static
# landing page + template gallery + leaderboard, built on demand from the
# validated template corpus, deployed to a free static host. Never committed
# (same stance as dist-portable/).
site/
*.tsbuildinfo
.DS_Store
*.log

# `bun build --compile` writes hidden cache files next to the working
# directory (filenames like `.18b05b9e3dff7a7d-00000000.bun-build`).
# Safe to delete between runs.
.*.bun-build

# Claude Code local harness settings — not part of the open-source repo
.claude/
.env
.env.local

# Local provider credentials — raw API keys live here ONLY, never in a
# tracked file. e.g. secrets/mimo.local.env (Xiaomi MiMo chat-agent key).
# A non-secret pointer (file path + endpoints + model) may live in
# CLAUDE.md; the key itself must never be committed or echoed.
secrets/
coverage/
.turbo/

# Vitest JUnit reports — CI emits one per package when running with
# `--reporter=junit --outputFile=junit.xml`; the workflow uploads them
# as artefacts. Local devs running the same args see the file too.
junit.xml
packages/*/junit.xml
data/
gotong-data/
**/gotong-data/

# Gotong v2.0 spaces — per-workspace directories with state files. Each
# example creates its own; they should not be committed.
.gotong/
.gotong-*/
**/.gotong/
**/.gotong-*/
*.sqlite
*.sqlite-journal
*.db
*.db-wal
*.db-shm

# Python — local virtualenvs, build artefacts, caches
.venv/
__pycache__/
*.pyc
*.egg-info/
.pytest_cache/

# Agent scratchpads — local planning notes that must never enter the repo.
# Working files for Claude/Codex sessions, not project documentation. Listed
# here so an accidental `git add -A` can't sweep them into a commit.
codex-next-work.md
docs/zh/V4-PHASE19-PLAN.md
docs/zh/V5-ROADMAP.md
docs/zh/V6-ROUTE-B-PLAN.md

# 凭证类文件永不入库(2026-07-05 事故:npm 恢复码被 git add -A 扫进过本地 commit)
npm_recovery_codes.txt
*recovery_codes*
