# Python
__pycache__/
*.py[cod]
*$py.class
*.so
*.egg
*.egg-info/
/ventra.egg-info/
.eggs/
build/
dist/
pip-wheel-metadata/
*.manifest
*.spec
.venv/
venv/
.mypy_cache/
.ruff_cache/
.pytest_cache/
.coverage
htmlcov/
.tox/
.nox/
uv.lock.bak

# Node / Next.js
node_modules/
.next/
out/
.turbo/
npm-debug.log*
yarn-error.log*
*.tsbuildinfo

# Ventra runtime data — never commit real evidence (root store only)
/cases/
.ventra-uploads/
*.tar.zst
*.tar.gz
!tests/fixtures/**/*.tar.zst
ventra-evidence/
*.duckdb
*.parquet
!tests/fixtures/**/*.parquet

# Ventra local state — connections store cloud credentials (AWS keys, GCP SA JSON, etc.)
**/.ventra-config/
**/.ventra-runs/

# Keys & secrets
*.pem
*.key
!docs/keys/*.pub
secrets/
credentials.json
*.credentials
*service-account*.json
*service_account*.json
kubeconfig
kubeconfig.*
.aws/

# IBM / customer account metadata (local IR notes — never commit)
docs/ibm-aws-permissions.md
docs/keys/ibm-policy-raw/

# Terraform state & local vars (any provider)
**/.terraform/
**/*.tfstate
**/*.tfstate.*
**/terraform.tfvars
!**/terraform.tfvars.example
**/assets/function.zip

# Environment (local only — never commit)
.env
.env.*
!.env.example

# Obsidian vault (local notes — visible in IDE via .cursorignore, not committed)
obsidian/
.obsidian/

# OS / editor
.DS_Store
.claude/
.cursor/
.idea/
.vscode/
*.swp
*.swo
*~

# Local logs & scratch
*.log
scratch/
tmp/

# Vendor icon packs at repo root (extracted subset lives in console/frontend/public/icons)
/icons/

# Agent / IDE skill dumps (local only — not product source)
.agents/
.agents*/

# Google Cloud local auth
**/application_default_credentials.json
**/adc.json
.gcloud/
*-service-account.json
*-sa.json
client_secret*.json

# Extra Terraform / cloud local artifacts
**/*.tfvars.json
crash.*.log
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# Local package metadata / OS junk already partly covered
*.egg-info/
.Python
