# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
!frontend/app/api/collectors/downloads/
eggs/
.eggs/
/lib/
/lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
venv/
ENV/
env/
.env
.venv

# Node.js
node_modules
npm-debug.log*
yarn-debug.log*
yarn-error.log*
.pnpm-debug.log*
.next/
out/
dist/

# Frontend build artifacts
frontend/.source/
**/tsconfig.tsbuildinfo
**/next-env.d.ts
frontend/types/generated.ts

# IDEs
.vscode/
.idea/
*.swp
*.swo
*~
.DS_Store

# Database
*.db
*.sqlite3

# Logs
logs/
*.log

# Environment variables
.env
.env.local
.env.production.local
.env.development.local
.env.test.local

# Secrets - NEVER commit
.env.secrets
*.secret
secrets/
# `secrets/` above does NOT match a dot-prefixed `.secrets/` — keep both.
.secrets/
.claude.local.md
*-credentials.yaml
*-secret.yaml
!charts/parascope-platform/templates/*-secret.yaml
!charts/parascope-platform/templates/**/*-secret.yaml
# Same rationale, one level down: a vendored subchart's *template* that emits a
# Secret is chart source, not a rendered secret. Without this the ignore above
# silently drops it from the commit and the vendored copy forks from upstream.
!charts/parascope-platform/charts/**/templates/*-secret.yaml
*-local.yaml
keys.env

# Encrypted DR secret bundles (scripts/create-dr-bundle.sh) — never commit
parascope-dr-bundle-*.tar.gz.age

# OS
.DS_Store
Thumbs.db

# Docker volumes (local development)
postgres-data/
vault-data/

# Temporary files
*.tmp
*.temp
.cache/

# Coverage reports
htmlcov/
.coverage
.coverage.*
coverage.xml
*.cover
.pytest_cache/
.mypy_cache/

# Jupyter Notebook
.ipynb_checkpoints

# pyenv
.python-version
creds.txt
.playwright-mcp/

# Dev environment secrets
devenv/*-openrc.sh
devenv/kubeconfig
devenv/talosconfig
devenv/*.pem

# Git worktrees
.worktrees/
.claude/worktrees/

# Superpowers brainstorming artifacts
.superpowers/

# Serena AI tool config
.serena/

# MagicMock test artifacts (leaked NSC nsc.json files)
MagicMock/

# OpenNext build output
.open-next/

# Wrangler local state
.wrangler/

# Database backups
backups/

# Pipeline state dumps
docs/plans/pipeline.yaml
docs/plans/pipeline-archive.yaml

# Root-level scratch screenshots
/*.png

# Build distributable archives
browser-extension/chrome/*.zip

# Helm chart dependencies (downloaded via `helm dependency build`)
charts/*/charts/*.tgz
Chart.lock

# Packaged chart artifacts (output of `helm package`; not source)
/parascope-tenant-*.tgz

# Trivy scan output (belongs in CI artifacts, not the repo)
trivy-reports/

# OpenTofu / Terraform
.terraform/
*.tfstate
*.tfstate.*
.terraform.tfstate.lock.info
terraform.tfvars
crash.log

# Tofu backend config (holds the Cloudflare account ID; .example is tracked)
deploy/hetzner-production/tofu/r2.backend.hcl

# Tofu outputs (kubeconfig, talosconfig — contain cluster credentials)
deploy/hetzner-production/tofu/outputs/kubeconfig
deploy/hetzner-production/tofu/outputs/kubeconfig-tailscale
deploy/hetzner-production/tofu/outputs/talosconfig

# Production Helm values (contain plaintext passwords)
deploy/hetzner-production/values-production.yaml

# Plane deployment values (contain credentials)
deploy/plane/values-plane.yaml
deploy/plane/values-reference.yaml

# Load test results (large output files, Grafana snapshots)
load-tests/results/*
!load-tests/results/.gitkeep
docs/plans/pipeline.yaml.bak
.claude/scheduled_tasks.lock

# design-sync (claude.ai/design) — staged converter, build output, machine state
.ds-sync/
/ds-bundle/
.design-sync/.cache/
.design-sync/learnings/
.design-sync/node_modules
website/.dssync/styles.compiled.css
