# --- Reports ---
reports/

# --- Secrets (MUST be first) ---
Docs/
docs/*
!docs/user_journeys/
!docs/user_journeys/**
!docs/runbooks/
!docs/runbooks/preview-load-soak.md
*.pem
*.key
.env
.env.*
!.env.example
.dev.vars
.dev.vars.*

# --- Node / tooling ---
node_modules
node_modules/
.pnpm-store/
.npm/
.yarn/
coverage/
playwright-report/
test-results/
.lighthouseci/

# --- Build output ---
.claude/
dist/
.astro/
.wrangler/
.vercel/
.cloudflare/
build/

# --- Editor / OS ---
.DS_Store
.vscode/*
!.vscode/extensions.json
!.vscode/settings.json.example
.idea/
*.swp
*.swo

# --- Logs ---
*.log
npm-debug.log*
pnpm-debug.log*
tmp/
.tmpjail-work/

# Telegram bot (standalone local tool - not deployed to Cloudflare Workers)
tgbot/
data/

# --- Live E2E / load / a11y suites (local only) ---
# Committed suite = vitest unit/component/integration/api-migration under apps/web/tests/.
# Everything below is live-playwright / k6 / baseline-binaries with secret-bearing
# fixtures (real creds, .auth-state.json) and stays LOCAL. The old `tests/admin/`
# patterns were root-anchored and did NOT match apps/web/tests/ — re-anchored 2026-06-17.
apps/web/tests/admin/
apps/web/tests/vendor/
apps/web/tests/customer/
apps/web/tests/security/
apps/web/tests/loadtest/
apps/web/tests/a11y/
apps/web/tests/baseline-2026-05-17/
# root-level live playwright specs + probe scripts + live email helper
apps/web/tests/*.spec.ts
apps/web/tests/_*.mjs
apps/web/tests/helpers/verify-email.ts
apps/web/tests/test-logo.*
playwright-report-admin/
playwright-report-vendor/
playwright-report-customer/
.auth/
CLAUDE.original.md
SKILL.original.md

# AI index files (local only)
**/CLAUDE.md
**/CLAUDE.original.md

# Dev tooling scripts (local only — not consumed by CF build)
scripts/*
# Exception: merge guard is imported by the CI contract test + `pnpm merge`
!scripts/safe-merge.mjs
# Exception: credential rotation must survive a fresh clone
!scripts/mint-cloudflare-rotator.mjs
!scripts/rotate-cloudflare-token.mjs
!scripts/setup-pnpm-install.sh
!scripts/setup-pnpm-install-harness.sh
!scripts/setup-pnpm-action.sh
# Exception: canonical quality gate runners consumed by pre-push + contract tests
!scripts/git-local-env.mjs
!scripts/lint-changed.mjs
!scripts/pre-push.mjs
!scripts/land.sh
!scripts/slopgate-gate.mjs
!scripts/green-baseline.mjs
!scripts/green-baseline.schema.json
!scripts/green-baseline.test.mjs
# Exception: deploy workflow fail-closed Worker config and SchedulerDO gates
!scripts/audit-prod-test-surface.mjs
!scripts/verify-worker-config.mjs
!scripts/verify-scheduler-armed.mjs
!scripts/verify-scheduler-armed.test.mjs
!scripts/workflow-contract.mjs
# Exception: GOLIVE scoreboard runner, its judgement prompt, and its daily lander
!scripts/golive-probes.mjs
!scripts/golive-probes.test.mjs
!scripts/golive-sweep.mjs
!scripts/golive-sweep.test.mjs
!scripts/golive-sweep.prompt.md
!scripts/golive-daily.sh
# Exception: commit-msg hook strips forbidden attribution trailers
!scripts/strip-agent-trailers.mjs
!scripts/strip-agent-trailers.test.mjs
# Exception: build-info writer is consumed by `pnpm build` (prebuild hook)
!apps/web/scripts/
apps/web/scripts/*
# Exception: CPU-containment wrapper is invoked by every CI heavy step
!apps/web/scripts/cpu-limit.sh
!apps/web/scripts/playwright-install.sh
!apps/web/scripts/audit-guest-reservation-contacts.ts
!apps/web/scripts/write-build-info.mjs
!apps/web/scripts/strip-session-kv.mjs
!apps/web/scripts/minify-server-chunks.mjs
!apps/web/scripts/verify-deploy-dist.mjs
!apps/web/scripts/verify-deploy-dist.test.mjs
!apps/web/scripts/verify-sentry-client-init.mjs
!apps/web/scripts/deploy-smoke.mjs
!apps/web/scripts/deploy-smoke.test.mjs
!apps/web/scripts/preview-load-soak.mjs
!apps/web/scripts/preview-load-soak.test.mjs
!apps/web/scripts/compute-bootstrap-hash.mjs
!apps/web/scripts/api-worklist.mjs
!apps/web/scripts/db-cli-gate.mjs
!apps/web/scripts/run-migrations.ts
!apps/web/scripts/db-url-safety.mjs
!apps/web/scripts/db-test-ci-parity.sh
!apps/web/scripts/backfill-tag-slugs.ts
!apps/web/scripts/backfill-stripe-fees.ts
!apps/web/scripts/seed-promotions.ts
!apps/web/scripts/tag-slug-helpers.ts
!apps/web/scripts/verify-resolve-coverage.sh
!apps/web/scripts/fetch-journey-durations.sh
!apps/web/scripts/merge-journey-durations.mjs
!apps/web/scripts/journey-spec-path.mjs
!apps/web/scripts/journey-receipt-log.mjs
!apps/web/scripts/typecheck-incremental.mjs
!apps/web/scripts/ci-gate-provenance.mjs
!apps/web/scripts/verify-image-moderation-backfill.ts
!apps/web/scripts/sweep-baseline.mjs
!apps/web/scripts/sweep-findings.mjs
!apps/web/scripts/sweep-webserver.mjs
!apps/web/scripts/sweep-seed.mjs
# Exception: consumed by tracked tests/unit/sweep-scripts.test.ts (test:unit gate dependency)
!apps/web/scripts/lib/
!apps/web/scripts/lib/sweep-changed-routes.mjs
!apps/web/scripts/lib/sweep-fold.mjs
!apps/web/scripts/sweep-ratchet.mjs
!apps/web/scripts/sweep-changed.mjs
!apps/web/scripts/sweep-nav-consistency.mjs
!apps/web/scripts/ci-neon-branch.ts
!apps/web/scripts/ci-ensure-factory-schema.ts
!apps/web/scripts/ci-with-disposable-pg.sh
!apps/web/scripts/ci-with-disposable-locale-pg.sh
!apps/web/scripts/ci-locale-pair-seed.ts
!apps/web/scripts/ci-assert-disposable-branch.ts
!apps/web/scripts/ci-disposable-locale-cleanup.sh
!apps/web/scripts/ci-disposable-locale-traps.sh
!apps/web/scripts/ci-disposable-locale-signal-harness.sh
!apps/web/scripts/ci-oracle-database.ts
# Exception: md-prod-env Task 5 production secrets manifest + bootstrap (no values)
!apps/web/scripts/production-secrets-manifest.json
!apps/web/scripts/put-production-secrets.mjs
!apps/web/scripts/production-worker-bootstrap.mjs
!apps/web/scripts/lib/production-secrets-manifest.mjs
!apps/web/scripts/e2e-main-factory-journeys.mjs
!apps/web/scripts/run-main-factory-journeys.mjs
!apps/web/scripts/e2e-run-receipt-reporter.mjs
!apps/web/scripts/seed-deal-reviews.mjs
.worktrees/
.wt-*-int/
pics_processing/
INDEX.md

# Full-flow E2E specs + reports (generated locally, not committed)
apps/web/tests/e2e/all-*.spec.ts
tests/FULL_FLOW_TEST_REPORT.md

# unit/component/integration tests ARE committed (versioned with source).
# Only e2e contents stay local: secret-bearing fixtures + live-flow specs (see 90-94 above).
!apps/web/tests/e2e/
apps/web/tests/e2e/*
# Exception: journey contract manifest consumed by deterministic green-baseline validation.
!apps/web/tests/e2e/checkout-fulfillment.spec.manifest.json
!apps/web/tests/e2e/visual-regression/
!apps/web/tests/e2e/visual-regression/**
# Exception: fixture consumed by tracked tests/unit/sweep-scripts.test.ts (test:unit gate dependency)
!apps/web/tests/e2e/sweep/
!apps/web/tests/e2e/sweep/route-manifest.json
!apps/web/tests/e2e/sweep/findings-baseline.json
!apps/web/tests/e2e/helpers/
!apps/web/tests/e2e/helpers/sweep-auth.ts
!apps/web/tests/e2e/helpers/actors.ts
!apps/web/tests/e2e/helpers/permission-matrix.ts
!apps/web/tests/e2e/helpers/sweep-fixtures.ts
!apps/web/tests/e2e/helpers/sweep-quality.ts
!apps/web/tests/e2e/sweep/sweep.spec.ts
!apps/web/tests/e2e/sweep/console-allowlist.json
!apps/web/tests/e2e/sweep/route-overrides.json
!apps/web/tests/e2e/sweep/snapshot-masks.ts
!apps/web/tests/e2e/sweep/sweep-run-reporter.ts
!apps/web/tests/e2e/ui-matrix/
!apps/web/tests/e2e/ui-matrix/ui-matrix.spec.ts
!apps/web/tests/e2e/ui-matrix/matrix.ts
!apps/web/tests/e2e/risk/
!apps/web/tests/e2e/risk/**
!apps/web/tests/unit/fixtures/sweep-findings.fixture.jsonl
# Journeys suite + its fixture/helper deps ARE committed (env-read only, no secret literals)
!apps/web/tests/e2e/journeys/
!apps/web/tests/e2e/journeys/**
!apps/web/tests/e2e/vendor-journey/
!apps/web/tests/e2e/vendor-journey/**
!apps/web/tests/e2e/_utils/
!apps/web/tests/e2e/_utils/checkout-deal.ts
!apps/web/tests/e2e/fixtures/
!apps/web/tests/e2e/fixtures/**
!apps/web/tests/e2e/factories/
!apps/web/tests/e2e/factories/**
!apps/web/tests/e2e/deal-variants/
!apps/web/tests/e2e/deal-variants/purchase-default.spec.ts
!apps/web/tests/e2e/deal-variants/purchase-variant.spec.ts
!apps/web/tests/e2e/purchase-flows/
apps/web/tests/e2e/purchase-flows/*
!apps/web/tests/e2e/purchase-flows/helpers/
!apps/web/tests/e2e/purchase-flows/helpers/**
# globalSetup chain for the committed playwright.config.ts (env-read only)
!apps/web/tests/e2e/purchase-flows/fixtures/
apps/web/tests/e2e/purchase-flows/fixtures/*
!apps/web/tests/e2e/purchase-flows/fixtures/purchase-seed.ts
!apps/web/tests/e2e/purchase-flows/fixtures/variant-seed.ts
!apps/web/tests/e2e/rma/
apps/web/tests/e2e/rma/*
!apps/web/tests/e2e/rma/_seed.ts
!apps/web/tests/e2e/_live-guard.mjs
!apps/web/tests/e2e/stripe-checkout-mock-email.live.spec.ts
apps/web/tests/e2e/sweep/sweep-run-complete.json
apps/web/tests/e2e/sweep/findings-log.jsonl
apps/web/tests/e2e/sweep/nav-fingerprints.jsonl
apps/web/tests/e2e/sweep/webserver.log
apps/web/tests/e2e/sweep/sweep-results.json
apps/web/tests/e2e/sweep/*.log
# src-colocated throwaway proof tests stay local; the committed suite lives in apps/web/tests/
apps/web/src/**/*.test.ts
apps/web/src/**/*.proof.test.ts

# Local tooling configs
.opencode/
opencode.json
.codex/sessions/
.codex/logs/
.codex/history/
.codex/cache/
.codex/*.local.toml
/tests/
logs/
# Added by code-review-graph
.code-review-graph/

# Plan C local-stack: hardlinked snapshot of apps/web/dist for wrangler dev isolation
apps/web/.dist-stack/

# --- Non-CF-runtime artifacts (dev tooling, docs, fixtures, tests) ---
# Editor / AI tool configs
.cursor/
.cursorrules
.kiro/
.opencode.json
.windsurfrules
.mcp.json
GEMINI.md
CLAUDE+skills.zip

# Dev quality / lint / format configs (not consumed by CF runtime)
.prettierignore
.lighthouserc.json
apps/web/eslint.config.js
apps/web/eslint-rules/

# Test runners + mocks (not deployed)
# playwright.config.ts tracked: runner config for the committed journeys suite
# live config tracked for visual-regression against dev.multi.deal
# apps/web/playwright.live.config.ts
apps/web/vitest.config.ts
apps/web/vitest.regression.config.ts
apps/web/vitest-mocks/
apps/web/regression/
apps/web/regression-baselines/

# Project docs (local-only; FAQ content under src/content stays tracked)
README.md
AUDIT-REPORT.md
VENDORS.md
apps/web/DEPLOY.md
apps/web/SECURITY.md
apps/web/multideal-FDS-v1.2-Final.md
apps/web/src/components/ui/primitives/_registry.md
apps/web/src/server/payments/sumit/PROBE_RESULTS.md

# Probe/debug scripts (dev tooling, not runtime)
apps/web/probe*.mjs
apps/web/probe-*.mjs

# Stray root-level probe/spec JSON + unused root assets
/logo.png
/acc_doc_create_req.json
/billing_process_req.json
/creditguy_billing_process.json
/creditguy_transaction.json
/mvc_req.json
/param_j_enum.json
/request_schema.json
/sumit_swagger.json
.archive/

# local secrets + session state — never commit
.secrets
runstate/
.green-baseline/
.tmp_ctx_persist_test

# render capture output
.shots/
.codex-read/