node_modules/
dist/
build/
.env
.env.local
.env.developer.override
.env.test.*
!.env.test.*.example
# Local rollback snapshots of .env (contain secrets) — never commit.
.env.*-backup
.env.*.bak
package-lock.json
yarn.lock
.DS_Store
coverage/
coverage-e2e/
.tmp/
tmp/
.env.production
.env.development
logs/**
*.log
# A rotated log is not a *.log: services/auth-audit.ts renames the refusal log to `<path>.1` when it
# passes AIMEAT_AUTH_LOG_MAX_BYTES, and the E2E server points that path at test/.auth-failures.log,
# so a local sweep eventually drops a multi-megabyte `.log.1` that nothing here matched.
*.log.[0-9]*

# Removed 2026-07-28: the enterprise edition is gone (one edition, no ee/ seam). Kept ignored so a
# leftover local checkout of the old private module can never be committed here by accident.
/ee/

# Git worktrees
.worktrees/

# Claude Code (skills under .claude/skills/ ARE tracked)
.claude/worktrees/
.claude/settings.local.json

# Generated artifacts
**/generated/

# Prevent compiled .js/.jsx files in source directories
**/src/**/*.js
**/src/**/*.jsx
!**/src/**/*.test.js
!**/src/**/*.spec.js
!**/src/static/**/*.js

# Playwright (match in any subdirectory)
**/test-results/
**/playwright-report/
**/blob-report/
**/playwright/.cache/
**/playwright/.auth/

# Playwright MCP logs
.playwright-mcp/

# Superpowers brainstorm artifacts
.superpowers/

# SQLite test databases
*.db
*.db-shm
*.db-wal

# `pnpm sandbox` — the session's own node: its state file holds real tokens and private keys for
# the sandbox accounts, and the log is a running node's output. Both are per-machine, neither is
# source. The database itself is already covered by *.db above.
aimeat/.sandbox.json
aimeat/.sandbox.log

# OS files
Thumbs.db
Desktop.ini

# IDE
.idea/
*.swp
*.swo
*~

# OpenMemory - IDE/Assistant specific rules
.github\instructions\openmemory.instructions.md
AGENTS.md

# Development artifacts (never commit)
*.development.json
aimeat/data/debug/
generator_phase*.txt
debug_*.md
debug_*.txt
generatorrest.txt
generatorinterview.txt
jounis_ideas.md
github_optics.md

# One-off browser probes written to answer a single question during a session. The demo-video
# harness itself IS source (record/watch/cut/wait/selfcheck); these underscore-prefixed scripts
# are the throwaway half: they hardcode board ids, prod URLs and a local storageState path.
# The demo-video harness is LOCAL tooling. Its scene manifests carry an absolute path to a
# signed-in browser state on THIS machine, and this repo is public. Kept on disk, out of git.
aimeat/scripts/demo-video/

# Test output files
*-results.txt
test-output.txt
test-results-*.txt

# Site verification tokens
BingSiteAuth.xml
google*.html

# Certificates and keys (never commit)
*.pem
*.key
*.cert
*.crt
*.p12
*.pfx

# Backup files
*.bak
*.backup
*.old

# Data exports
*.sql
*.dump
# …but the Kysely provider's schema migrations ARE source (checked in), not a data export.
!aimeat/src/storage/providers/*/migrations/*.sql

# Binary docs (use .md instead)
*.docx
# …but the ones the file readers are tested against ARE source. They come from a real producer
# (python-docx) on purpose: a reader proved only against XML this repo wrote proves nothing.
!aimeat/test/fixtures/file-text/*.docx

# Business strategy (private)
docs/businessfinland/

# Press / behind-the-scenes diaries + screenshots (local only, never commit)
press/

# Python (added 2026-05-29 with python/aimeat-crewai/ package)
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
*.egg
.pytest_cache/
.ruff_cache/
.mypy_cache/
.venv/
venv/
docs/internal/
# Local dev-server log (from PowerShell pnpm dev redirect)
.devlog.txt
.devlog.err.txt
.devlog/

# Local verification artifacts (Playwright MCP browser-drive output + screenshots)
.playwright-mcp/
# Any PNG dropped in the repo ROOT is a local verification screenshot — never commit it.
# Leading slash = root only, so real assets in subdirs (aimeat-desktop/.../icons, public/) stay tracked.
/*.png
/*.jpg
/*.jpeg

# Local temp/scratch files (e.g. saved web pages, snapshot dumps) — never commit.
.tmp_*
# ANY html at the repo root. This used to read `/*.tmp.html`, which matches `foo.tmp.html` and
# NOT `noste-tmp.html` — so a 100 kB scratch copy of an app was committed and pushed to GitHub.
# No .html belongs at the root of this repo: app sources live in aimeat-apps/<app>/, served
# pages under aimeat/public/ or aimeat/src/static/. A blanket root rule is the honest guard.
/*.html
# App/cortex publish-verification response dumps written to the repo root during a build
# session (e.g. cadence-app.json, cadence-cortex-lib.json). The real app/cortex live in the
# node store, not the repo — these are throwaway fetch snapshots.
/cadence-*.json
# Package build artifacts — packages/ holds app SOURCE; built .zip bundles are outputs.
packages/*.zip

# AEB proof scaffolder output (pnpm aeb:prove)
aimeat/tools/aeb/runs/

# AI-generated imagery (scripts/gen_image.py). Local only — copy the ones you want into the
# project, or --upload them to AIMEAT storage. The generator's config holds secrets.
genimages/
scripts/.env


# SDK-libs migration: the served IIFE bundles under src/static/sdk-libs/dist/ ARE committed
# (same model as the committed src/static/app-catalog.html), kept fresh by `pnpm check:sdk` in the
# pre-commit hook + CI. Re-include them from the blanket `dist/` rule above.
!aimeat/src/static/sdk-libs/dist/
!aimeat/src/static/sdk-libs/dist/**

# Vendored WebAssembly binaries are fetched, not committed: @ffmpeg/core alone is 32 MB and a
# repo carries every version it ever held. `pnpm vendor:libs` (postinstall, dev and build all run
# it) downloads them from the pinned URL in aimeat/public/lib/vendored-assets.json and verifies
# the sha256; `pnpm check:vendored` says whether they are in place.
aimeat/public/lib/**/*.wasm

# The ffmpeg emscripten loaders are excluded for a DIFFERENT reason: licence, not size. They are
# the compiler's output of the same GPL ffmpeg build as the .wasm, so committing them put GPL code
# in an MIT repository and, through `files: ["dist/"]`, inside the published npm package. They are
# fetched with the wasm and are in no AIMEAT distribution. Everything else under public/lib/ IS
# committed; licenses.json says what licence each served file carries.
aimeat/public/lib/ffmpeg-core@*/*.js

# locale:extract working files — a slice being translated, never committed
aimeat/locales/.todo-*.json

# Start-time self-heal (autoHealAssets in src/index-start.ts) scaffolds the package's static
# assets into the working directory so an installed `aimeat start` works in an empty dir. In a
# repo checkout that lands as a generated copy of src/static/ at aimeat/static/ plus the
# scaffold's own hash manifest — runtime state, not source. The manifest was tracked by accident
# since v1.2.0 and is untracked as of this rule.
aimeat/static/
aimeat/.aimeat-manifest.json

# The connector's OWN home when it runs from inside the repo. `getConfigDir()` is
# `AIMEAT_HOME ?? cwd/.aimeat`, so a `pnpm dev` or an `aimeat connect` started from the tree writes
# here: agent tokens, Ed25519 private keys, and the install id identifying this machine. None of it
# is source and none of it may be committed by accident.
.aimeat/

# Machine-generated security audit reports (pnpm audit:report)
secaudit/

# CycloneDX SBOM (pnpm sbom). Generated on demand for whoever asks — a procurement team, a
# security review — from the tree that is installed at that moment. Committing one would freeze a
# snapshot that stops being true on the next dependency bump, and THIRD-PARTY-NOTICES.md is the
# copy that IS committed and does travel with releases.
sbom.cdx.json
security-report.md
security-report.json
/pnpm-lock.yaml

# Connector tarballs from scripts/pack-connector.sh: the artifact npm would publish, built
# locally so a fix can be proven on the real fleet before a version number is spent on it.
dist-pack/
