.gitignore

# Local environment and secrets
.env
.env.*
!.env.example
**/application-local.yml
**/application-local.yaml
**/application-dev.yml
**/application-dev.yaml
**/application-prod.yml
**/application-prod.yaml
**/application-*.properties
**/credentials.json
**/secrets.yml
**/secrets.yaml
**/config.local.*
*.pem
*.key
*.p12
*.pfx
*.jks
*.jceks
backend/certs/*
!backend/certs/.gitkeep

# Java / Maven / Spring Boot
target/
*.class
*.jar
*.war
*.ear
*.nar
hs_err_pid*
replay_pid*
.mvn/wrapper/maven-wrapper.jar

# Node / Vite / frontend tooling
node_modules/
dist/
coverage/
*.lcov
.nyc_output/
.vite/
# TanStack Router plugin scratch dir. Its tmp/ children are already caught by the blanket `tmp/`
# rule below; this entry is explicit so anything else the plugin writes here stays untracked too.
.tanstack/
# Route tree generated by the same plugin on `vite dev` / `vite build` (see vite.config.ts). Tracking
# it produced pure churn — every regeneration rewrote the file. NOTE: nothing regenerates it before
# `vite` runs, so a fresh clone has no route tree until the first dev/build. Lint, format:check and
# the vitest suites all pass without it (vitest.config.ts carries no router plugin and already
# excludes it from coverage), but a bare `tsc --noEmit` or a freshly-opened IDE will flag the
# `./routeTree.gen` import in src/main.tsx until you run the app or build once.
frontend/src/routeTree.gen.ts
# Transpiled twins of the Vite config. tsconfig.node.json is `composite`, which implies emit, so a
# `tsc -b` drops these beside vite.config.ts; both were committed once (8d82b70) before anyone
# noticed. tsconfig.node.json now sets noEmit, and these are belt-and-braces in case a tool bypasses
# it — vite always loads the .ts, so a tracked .js twin can only ever be a stale decoy.
frontend/vite.config.js
frontend/vite.config.d.ts
.cache/
*.tsbuildinfo
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*

# Test and generated reports
playwright-report/
test-results/
frontend/playwright-report/
frontend/test-results/
frontend/coverage/
frontend/dist/
.trivycache/
.scannerwork/
backend/.scannerwork/
frontend/.scannerwork/
backend/target/

# OS/editor noise
.DS_Store
Thumbs.db
.idea/
.vscode/*
!.vscode/settings.json
!.vscode/extensions.json

# Python helpers occasionally used for data/setup scripts
__pycache__/
*.py[cod]
.pytest_cache/
.venv/
venv/

# Local output
.run/
output/
tmp/
.tmp/

# AI/workspace scratch
.workspaces/
.copilot-memory
# Codex/agent scratch dir (dev-server logs etc.) — never committed. Anchored to the repo root; broader
# personal agent scratch belongs in a global gitignore / .git/info/exclude, not this shared file.
/.codex-tmp/

.claude/*