node_modules/
.pnpm-store/
.turbo/
.next/
dist/
coverage/
artifacts/
.data/
**/.data/
*.tsbuildinfo

# Cloud credentials — never commit
aws.rootkey.csv
*.rootkey.csv

# Private key material — NEVER commit, anywhere in the tree. A leaked signing key
# can forge Decision Dossiers. Provision keys on the server via a secrets manager;
# do not keep them in the repo. (No .pem/.key is tracked today; if you ever need a
# legitimate key fixture, add it with `git add -f`.)
*.pem
*.key
*.p8
*.pkcs8
__pycache__/
*.py[cod]
.pytest_cache/
*.egg-info/
target/
bin/
obj/

# macOS Finder files
.DS_Store
**/.DS_Store

# Terraform local backend config (non-secret but environment-specific)
infra/terraform/backend.hcl

# Terraform generated artifacts / local state
infra/terraform/.terraform/
infra/terraform/.terraform.lock.hcl
infra/terraform/tfplan
infra/terraform/terraform.tfvars
infra/terraform/bootstrap/.terraform/
infra/terraform/bootstrap/.terraform.lock.hcl
infra/terraform/bootstrap/terraform.tfstate
infra/terraform/bootstrap/terraform.tfstate.backup

# General Terraform state
*.tfstate
*.tfstate.*
.env
.env.*
!.env.example
secret.*.env
secrets.*.env
*.secrets.env
sap.secrets.env
sap.submission.env
# Untracked 2026-06-17 (were committed by mistake; rotate creds after live tests).
# webex.secrets.env is already covered by *.secrets.env above.
servicenow.studio.env
webex.secrets.env 23-55-30-496.env

# GCP Terraform
infra/gcp/terraform/.terraform/
infra/gcp/terraform/tfplan
infra/gcp/terraform/terraform.tfvars
infra/gcp/terraform/bootstrap/.terraform/
infra/gcp/terraform/bootstrap/terraform.tfstate
infra/gcp/terraform/bootstrap/terraform.tfstate.backup

# AWS Terraform (commit .terraform.lock.hcl; ignore the provider cache + local state)
infra/aws/terraform/.terraform/
infra/aws/terraform/tfplan
infra/aws/terraform/terraform.tfvars
build/
.pnpm-*
codex-*/
.dotnet10/
.nuget-local/
.tools/

# Shopify local dev state
apps/shopify/.shopify/
apps/shopify/.env*
apps/shopify/extensions/**/dist/
apps/shopify/extensions/**/generated/

# SAP CAP generated build output
apps/sap/gen/
apps/sap/db.sqlite
apps/sap/db.sqlite-*
