# Dependencies
node_modules/
.pnpm-store/
pnpm-lock.yaml

# NPM workspace subpackage lockfiles (root package-lock.json is authoritative)
controller/package-lock.json
sdk/package-lock.json
cli/package-lock.json

# Build outputs
dist/
build/
*.tsbuildinfo
target/

# Next.js build output
.next/
out/

# Environment files
.env
.env.*
!.env.example

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# OS files
.DS_Store
Thumbs.db

# Logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Test coverage
coverage/
.nyc_output/
test-results.xml

# Generated A+ evidence may contain sensitive audit material. Retain it in the
# CI artifact store, not Git; keep only the redacted attestation template.
evidence/*

# Kubernetes secrets (should use sealed-secrets or external secrets)
*-secret.yaml
secrets/

# Docker
.docker/

# Temporary files
tmp/
.tmp/
*.tmp

# Local vendored Node.js distribution (dev convenience; not for git)
.node/

# Local build output used by sandbox builds
target-local/

# Claude Code local settings (may contain API keys)
.claude/

# Python bytecode
__pycache__/
*.pyc
*.pyo

# Python virtual environments
.venv/
venv/

# Rust build artifacts
stateset-sandbox-controller/target/

# Go build artifacts — execd is produced by `go build` in docker/execd; never commit the binary.
docker/execd/execd
docker/execd/execd-*
k8s/operator/manager
k8s/operator/bin/

# Storybook
storybook-static/

# Sentry
.sentryclirc
