# Node (Nuxt.js)
node_modules/

# Side-lambda build artifacts — deploy_side_lambdas() builds in a temp dir
# (mktemp), but legacy in-place runs left these behind; never commit them.
lambdas/*/package-lock.json
lambdas/*/deployment.zip

# Claude Code local backups (contains secrets — never commit)
.claude/backups/
test-results/
frontend/playwright-report
scheduled_tasks.lock
playwright-report
.playwright-mcp/
.npm/
yarn.lock
pnpm-lock.yaml
dist/
.nuxt/
output/
.env
.env.*
.DS_Store
aider
api/build/
.lambda-builds/
api/debug_logs_json/
api/seeds/shadcn-source/
bi_test_datasets/
build/cron/
api/debug_logs/

# Python (FastAPI)
__pycache__/
*.py[cod]
*.pyo
*.pyd
*.pyc
*.pyo
*.pyd
.Python
env/
venv/
ENV/
.venv/
*.egg-info/
.eggs/
*.egg
pip-log.txt
pip-delete-this-directory.txt

# Tauri
/src-tauri/target/
/src-tauri/.cargo/
/src-tauri/Cargo.lock
/src-tauri/Cargo.toml.orig
/src-tauri/.tauri-build
/src-tauri/.tauri

# VSCode
.vscode/

# Terraform
.terraform/
*.tfstate
*.tfstate.*
crash.log
# Allow environment-specific tfvars in infra/
!infra/*.tfvars
!infra/**/*.tfvars
override.tf
override.tf.json
*_override.tf
*_override.tf.json
.terraformrc
terraform.rc

# OS
Thumbs.db
.DS_Store

# Logs
*.log

# Misc
.idea/
*.swp
*.swo

# Local DBs
*.db

# Test/coverage
coverage/
*.cover
*.pyc
*.pyo
*.pyd
.cache/

# Lambda/Serverless
.serverless/

# Docker
*.pid
*.pid.lock

# Others
*.bak
*.tmp

# Ignore local secrets
secrets.*
api/*.local.env

# SSL certificates (never commit private keys!)
nginx/ssl/*.pem
nginx/ssl/*.key
nginx/ssl/*.crt

# Production build outputs
dist/

# On-premise configuration (contains secrets)
.env
config/*.env
!config/*.env.example

.agents
skills
_bmad
.envrc
.vercel
HARDENING/screenshots/s3b-session.har
HARDENING/screenshots/*.har

# i18n_sync.py dispatch manifest — regenerated on demand, not source
i18n-delta.json

# `skills` above swallows api/seeds/skills/** — those are lambda-bundled seed assets and MUST be tracked
!api/seeds/skills/
!api/seeds/skills/**

# Local publish credentials (temporary — see security cleanup before go-live)
NPM_TOKEN.txt
PYPI.txt

# --- QA / probe debris at the repo ROOT (2026-08-09 sweep) -------------------
# Playwright runs, MCP probes and CloudWatch dives drop screenshots, response
# dumps and snapshot YAML straight into the repo root. 434 such files had
# accumulated. Tracked files are unaffected by these rules; this only stops NEW
# debris. Anything worth keeping belongs under GOLIVE_QA/ or HARDENING/.
/*.png
/*.jpg
/*.jpeg
/*.gif
/*.webp
/phase*.json
/phase*.yml
/phase*.txt
/viz*.json
/viz*.yml
/viz_*.json
/p11-*.json
/p11-*.txt
/sc*-verify-*.yml
/v6*.yml
/v7*-snap.md
/pubsnap*.yml
/snap-*.yml
/sqlbatch*.json
/i18n-report.md

# QA screenshots under GOLIVE_QA — probe pixels, not knowledge. The prose
# (investigations, closeouts, architecture notes) IS tracked; the PNGs are not.
GOLIVE_QA/**/*.png
GOLIVE_QA/*.png
GOLIVE_QA/**/*.jpeg
GOLIVE_QA/**/*.jpg
