node_modules/
dist/
.env
.env.local
.env.staging
.env.production
*.pyc
__pycache__/
.turbo/
.next/
.firecrawl/
.vercel/
.fly/
.source/
coverage/
.husky/_
packages/cli/target/
.venv

# Doppler-generated secrets file (never commit)
.env.secrets
# Monitoring bearer-token files materialized from the secrets manager at deploy (never commit)
infra/secrets/

# Claude Code local settings — contains personal OAuth/auth tokens (never commit)
.claude/settings.local.json

# Bundled GitHub Action (committed so the action runs without node_modules on the runner)
!packages/action/dist/
!packages/action/dist/**

# OS junk + TS incremental build artifacts (never commit — keep them out of the cutover commit)
.DS_Store
**/.DS_Store
*.tsbuildinfo
*.pem
# The CLI release PUBLIC key is source: the CLI embeds it (update.rs), CI verifies signatures against
# it and install.sh pins the same value. It is a public key, never a private one.
!packages/cli/release-signing-key.pub.pem

# foglamp: the edit token is a secret — ignore the lock file, but KEEP scan.json tracked
.foglamp/scan.lock.json

# Stryker mutation-testing artifacts (Increment M pilot) — never commit run output
**/.stryker-tmp/
**/reports/mutation/
