# Downloaded upstream sources and toolchains are reproduced by tools/sync-upstream.sh.
vendor/
node_modules/

# Operator retail data is never committed. Production exposes only the exact,
# config-gated SHA-addressed allowlist; never add a generic static/raw mount.
assets-src/
runtime/

# Intermediate browser and native builds. Final frozen browser artifacts in
# engine/ are tracked so a deploy does not depend on the Emscripten toolchain.
build/
build-*/
content/assets/
mods/dist/
public/source/*.tar.xz
public/source/*.tar.xz.sha256
public/source/.openq4-web-source.tar.xz.*
public/source/.openq4-web-source.tar.xz.sha256.*

# Runtime state.
logs/
replays/*
!replays/.gitkeep
.home/
.tmp/

# Test output is private and may include retail-derived browser profiles. Keep
# only the gateway regression sources that intentionally live in this tree.
.selfcheck/*
!.selfcheck/gateway*.test.mjs
