# Build outputs
bin/
obj/
publish/
publish_temp/

# IDE
.vs/
.idea/
*.user
*.suo

# Logs
logs/

# OS
Thumbs.db
desktop.ini
.DS_Store

# NuGet
packages/
*.nupkg
# … but DO track repo-local feed for mxaccessgw client (not yet on public nuget.org).
!nuget-packages/*.nupkg

# Certificates
*.pfx
*.pem

# Claude Code (per-developer settings, runtime lock files, agent transcripts)
.claude/

.local/

# LiteDB local config cache (Phase 6.1 Stream D — runtime artifact, not source)
src/ZB.MOM.WW.OtOpcUa.Server/config_cache.db

# E2E sidecar config — NodeIds are specific to each dev's local seed (see scripts/e2e/README.md)
scripts/e2e/e2e-config.json
config_cache*.db

# Client CLI/UI runtime scratch (last-connected endpoint cache)
session.dat

# Secrets / local credentials — never commit
sql_login.txt

# OPC UA certificate store (runtime PKI: own/trusted/issued/rejected certs + keys)
src/Server/ZB.MOM.WW.OtOpcUa.Host/pki/

# Documentation audit scratch dir (untracked worktree)
.docs-audit/

# Vendor binaries — never commit (license risk; see R2-12/U-5)
lib/

# Session working notes — never stage (pending.md's own hard rule; R2-12/U-4)
/pending.md
/current.md
