# --- secrets / credentials (NEVER commit) ---
.env
.env.*
# the template IS committed (no real secrets in it) — keep this negation on its own line;
# git does NOT support inline comments, so a trailing `# ...` here would break the un-ignore.
!.env.example
*.pem
*.key
*_secret*
**/secrets/**
.mcp.json               # contains per-user OAuth; keep a .mcp.json.example instead
aws-credentials*
okta-token*
servicenow-creds*

# --- python ---
__pycache__/
*.py[cod]
.venv/
venv/
.pytest_cache/
*.egg-info/

# --- node / react ---
node_modules/
dist/
build/
.vite/
*.tsbuildinfo

# --- terraform (not used, but ignore if anyone adds it) ---
*.tfstate
*.tfstate.*
.terraform/

# --- os / editor ---
.DS_Store
.idea/
.vscode/*
!.vscode/extensions.json
*.log

# --- local dev harness (dev-only; see local/README.md) ---
local/identity/keys/
local/*.pid
local/*.log
local/.signoz_state.json

# --- local data / scratch (synthetic seed IS committed; local dumps are not) ---
/tmp/
*.local.json
seed/**/local-*
# large binaries — track via LFS or attach separately, not inline
docs/design/*.docx
