# Dependencies
node_modules
.pnpm-store

# Next.js
.next
out

# Build
dist
build

# Environment
.env
.env.local
.env.*.local
# scripts/local-stack.sh backs up an existing .env.local here on its first run,
# so the copy needs the same guard as the original.
.env.local.bak

# Local stack state (scripts/local-stack.sh): ops org id, JWT secret, logs
.local-stack/
# Legacy state dir from the pre-rename script; migrated to .local-stack on `up`.
# Kept ignored so its JWT secret is never swept into a commit before migration.
.local-toolbox/

# IDE
.idea
.vscode
*.swp
*.swo
.DS_Store

# Claude Code per-developer state (MCP server enablement, permission approvals):
# differs per machine, never commit
.claude/settings.local.json
# Agent-local state: worktrees (`git add -A` would commit each one as a gitlink),
# task lists and caches
.claude/worktrees/
.claude/tasks/
.claude/cache/

# A saved terraform plan holds sensitive values in cleartext and must never be
# committed. infra/terraform/scripts/tf-run.sh writes its plans outside the
# worktree entirely; this catches one run by hand with -out= inside it.
*.tfplan

# Logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# TypeScript
*.tsbuildinfo

# Vercel
.vercel

.env.prod-local

# Secrets
secrets/
infra/.secrets/
**/.secrets/
*-key.pem
# age private decryption key: NEVER commit (only the encrypted .env.claude.* files + the public .age-recipients are)
.env.keys
# local Stripe API keys (holds sk_live/pk_live): NEVER commit
.stripe.keys
# local Cerebras API key (csk-... bearer token; lives in SSM in beta/prod). NEVER commit
.cerebras.key

# Python SDK
sdks/python/.venv/
sdks/python/dist/
sdks/python/*.egg-info/
sdks/python/dev.py
__pycache__/
*.pyc
.pytest_cache/

# Test results
e2e/test-results/

# Schemathesis local example database, generated config, and reports
# (created by `st run` / `schemathesis run`; schemathesis.toml is written
# fresh by .github/workflows/schemathesis.yml on every run, never committed)
.schemathesis/
schemathesis.toml
schemathesis-report/

# Compiled binaries
infra/nomad-plugins/vm-templates/vm-templates

# Cloudflare
.wrangler/

# Google service-account keys (never commit)
scripts/.google-sheets-key.json
*.google-sheets-key.json

# Outreach recipient lists (PII: never commit)
**/recipients*.txt
*.recipients.txt
# local GLM-5.2 provider API keys (never commit)
.glm52.keys

# Lead lists / customer data (never commit)
gpu_customers_over_100.csv
email_flags.csv
customers_segmented.csv
campaign_exclusions.csv
attio_import.csv

# Terraform (never commit state or real tfvars)
**/.terraform/*
*.tfstate
*.tfstate.*
*.tfvars
!*.tfvars.example
# Module test fixtures (fake values), loaded by terraform test.
!infra/terraform/modules/*/tests/terraform.tfvars
crash.log

# Cloudflare Worker local dev secrets
**/.dev.vars
.nebius
# Lambda Cloud API key (both spellings; never commit)
.lambda
.lamda

# built Go binaries (never commit)
/services/fabric/fabric-nodeagent
/tools/brownout/brownout

# patch/merge backups (never commit)
*.orig
*.rej

# Generated by `next dev` (node_modules/next/dist/server/lib/generate-agent-files.js).
apps/dashboard/AGENTS.md
apps/dashboard/CLAUDE.md
apps/toolbox/AGENTS.md
apps/toolbox/CLAUDE.md
apps/linkedin-outreach/AGENTS.md
apps/linkedin-outreach/CLAUDE.md

# Regenerated by `next typegen` (which every app's `typecheck` runs first), `next build` and `next dev`, with import paths that follow the dist dir of whichever ran last.
apps/*/next-env.d.ts

# Generated from services/control-plane-go/openapi.yaml by `pnpm --filter <app> openapi:gen`, which each app's typecheck, dev and build all run first.
apps/toolbox/src/lib/api-types.gen.d.ts
apps/dashboard/src/lib/api-types.gen.d.ts

# Local Google OAuth client creds (never commit)
.google.creds
.eve
.output

# Lean build output (formal/)
.lake/
.abuse-harness/
e2e/abuse/artifacts/
