node_modules
dist
.eslintcache

# Local env: .env holds only non-secret config and IS committed.
# .env.local holds secrets (DATABASE_URL, OAuth keys, etc.) and is NOT committed.
.env.local
.env.*.local
# Docker overlay: may hold remote database/Redis URLs and passwords.
.env.docker

# SQLite data files (user rows, password hashes). `file:./dev.db` lands in the
# project root (drizzle/mikro-orm) or in prisma/ (Prisma resolves it there).
*.db
*.db-journal
*.db-wal
*.db-shm

# @luckystack/secret-manager shared bearer token (single-line file, never commit).
.secret-manager-token

# Generated artifacts.
src/_sockets/apiTypes.generated.ts
src/_sockets/apiInputSchemas.generated.ts
src/docs/apiDocs.generated.json
src/docs/apiTypeDiagnostics.generated.json
server/prod/generatedApis*.ts
# Catch-all so no future *.generated.* artifact leaks into git.
*.generated.*

# `luckystack check-env` / `check-i18n` scan reports.
dump/

# AI browser-testing artifacts (agent-browser / Playwright / Chrome DevTools MCP).
.agent-browser/
.playwright-mcp/
test-results/
playwright-report/
.claude/settings.local.json
AGENTS.local.md
CLAUDE.local.md
.agents/settings.local.json
.agents/local/

# AI-context artifacts — a LOCAL CACHE, deliberately not committed.
# Every one of these is derived from the code, so a committed copy is a second
# answer to a question the code already answers: the one that drifts. Nothing in
# git means nothing to drift from — no drift gate, no hook staging generated
# output, no index diff on every commit. Rebuild: `npm run ai:refresh`
# (also run by `postinstall`, so a fresh clone and CI have working MCP lookups).
# Sources stay committed: docs/decisions/, docs/lessons/, docs/PRODUCT.md and
# the hand-written docs/*.md.
docs/AI_CAPABILITIES.md
docs/AI_PROJECT_INDEX.md
docs/AI_DECISIONS_INDEX.md
docs/AI_LESSONS_INDEX.md
docs/AI_PRODUCT_OVERVIEW.md
docs/ai-graph.json