# Binaries
/bin/
*.exe
*.exe~
*.dll
*.so
*.dylib
/trqsh
/trqshd

# Test & coverage
*.test
*.out
coverage.*

# Go
/vendor/
go.work.sum

# Env & secrets — never commit
.env
.env.*
!.env.example
!.env.prod.example
!.env.staging.example
*.pem
*.key
*.p12
*.pfx
*.dec.yaml
*credentials*.json
kubeconfig*.yaml
# NOTE: real secret files are ignored by pattern above + deploy/.gitignore.
# We deliberately do NOT blanket-ignore `secrets/` so committed *.example.yaml
# templates (e.g. deploy/secrets/) stay in the repo.
secrets/*.dec.yaml
secrets/*.secret.yaml

# Terraform state & vars (belt-and-suspenders; see deploy/.gitignore)
*.tfstate
*.tfstate.*
*.tfvars
!*.tfvars.example
.terraform/
*.tfplan

# Node / frontend
node_modules/
.next/
dist/
.turbo/
pnpm-debug.log*

# Local data (compose volumes, sqlite, etc.)
/data/
*.db

# OS & editor
.DS_Store
Thumbs.db

# Claude Code local config
.claude/
*.swp

# Python bytecode
__pycache__/
*.pyc

# npm wrapper downloads the binary at install time
packaging/npm/vendor/
