.dockerignore

# Keep the build context lean — deps are installed fresh (npm ci) and the bundle is built in the image.
node_modules
**/node_modules
dist/*
!dist/server.mjs
dist-ssr
.output
.nitro
.tanstack
.wrangler
.playwright-cli
coverage
.git
.claude
# The self-host bundle's only entry point is src/server.ts (scripts/build-selfhost.ts) and `npm ci`
# only ever sees the root package*.json (copied before the rest of the tree) — the loopover-ui
# workspace app and the test suite are never read during the image build, so keep both out of the
# build context entirely (measured: ~11MB of this repo's ~22MB tracked-file footprint).
apps
test
# Runtime-only private review config and subscription CLI auth must never enter image layers.
loopover-config
**/loopover-config
**/.codex
auth.json
**/auth.json
# The review-enrichment service (REES) is a separate Railway service with its own Dockerfile — keep it out of
# the engine image. EXCEPT analyzer-metadata.json: the main engine's own code (src/review/enrichment-analyzers-
# taxonomy.ts) imports it directly, so excluding it wholesale breaks `scripts/build-selfhost.ts`'s esbuild
# bundle (module resolution failure at build time, not a runtime gap -- caught by the "build + boot smoke test"
# workflow, which is path-gated and doesn't run on every PR).
review-enrichment
!review-enrichment/analyzer-metadata.json
.DS_Store
*.tsbuildinfo
# Never ship secrets into the build context
# Compose secret files live under ./secrets for local self-host deploys; keep raw
# token values out of Docker build contexts/layers/cache just like .env files.
secrets
secrets/**
.env
.env.*
.dev.vars
.npmrc
**/.npmrc
*.pem
**/*.pem
*private*key*
**/*private*key*
!.env.example