# Python
__pycache__/
*.py[cod]
*.so
.venv/
venv/
*.egg-info/
dist/
build/

# Node (packages/sdk)
node_modules/

# Rust / Ruby / Python package placeholders
packages/rust/target/
packages/rust/Cargo.lock
packages/ruby/*.gem
packages/ruby/*.gemspec.local
packages/python/dist/
packages/python/*.egg-info/
packages/python/src/*.egg-info/

# Terraform (commit infra/.terraform.lock.hcl; never commit tfvars with secrets)
.terraform/
*.tfstate
*.tfstate.backup
*.tfvars
!*.tfvars.example

# OS/IDE
.DS_Store
.vscode/
.idea/

# Environment / secrets
.env
.env.*
!.env.example
profiles.json
**/profiles.json

# GCP and other downloaded credentials (never commit)
certs/**/*.json
*-invoker.json
vercel-seal-invoker.json

# Certificates and private key material (public trust anchors under certs/trust/ are ok)
certs/*
!certs/trust/
!certs/trust/**
!certs/rentell/
!certs/rentell/**
!certs/testca/
!certs/testca/**

# Test CA root private key — offline ceremony material, never commit
scripts/testca/private/
ssl_attestation/
request.csr

# PDFs (generated seals, demos, perf dumps — not fixtures)
*.pdf
!Sample Report - Declined.pdf

seal_api_perf_results.json
/seal_perf_saved/

# Generated SDK repos live outside this repo's history for now.
/sdks/
