# Dependencies
node_modules
npm-debug.log*

# Build output
dist
.next
out

# Environment files (keep example)
.env
.env.local
.env.*.local
!.env.example

# IDE
.vscode
.idea
*.swp
*.swo
*.sublime-*

# Claude Code (keep agent definitions, exclude local config)
.claude/settings.local.json
.claude/agent-memory/

# OS
.DS_Store
Thumbs.db
*.pem

# Testing
coverage
.nyc_output

# Misc
*.log
*.tsbuildinfo

# Docker volumes (data persisted here)
volumes/db/data

# Supabase
.supabase

# Secrets path retired 2026-04-20: vibecarbon-secrets is no longer
# rendered into the repo at create-time. It's applied at deploy-time by
# the vibecarbon CLI (imperative path) or
# .github/workflows/deploy.yml (GitOps path, reads from GitHub
# Environments). See plans/gitops-refactor-2026-04-20.md.

# Generated by dev-init.js for local CLI development
volumes/db/super-admin.generated.sql
docker-compose.dev-init.yml

# `vibecarbon upgrade` writes these (src/upgrade.js): .upgrade-backup is
# your pre-upgrade copy of a file it replaced, .upgrade-new is the incoming
# template content for files it left in place for manual review. Diff
# against them and delete — neither belongs in project history.
*.upgrade-backup
*.upgrade-new

# Vibecarbon infra state — deploy keys, kubeconfig, terraform state, certs.
# Never commit any of these; several contain live credentials.
.vibecarbon/
# NOTE: .vibecarbon.license (the per-project license file, a sibling of
# .vibecarbon.json) is NOT matched by .vibecarbon/ above and is committed
# to git on purpose — it's shared by everyone working on the project.
*.key
*.tfstate
*.tfstate.*

# Common secret-bearing files — block by default; the vibecarbon scanner
# also gates `vibecarbon deploy` and `vibecarbon add` against these, but
# the gitignore is the first line of defense (a file ignored here never
# even reaches `git add`).
kubeconfig
kubeconfig-*
.kubeconfig
*.pem
*.p12
*.pfx
*.jks
*.keystore
id_rsa
id_rsa.pub
id_ed25519
id_ed25519.pub
id_ecdsa
id_ecdsa.pub
known_hosts_*
.netrc
.npmrc
service-account*.json
gcloud-service-account*.json
firebase-adminsdk*.json
credentials.json
secrets.json
secrets.yaml
secrets.yml
!**/k8s/overlays/*/secrets.yaml  # placeholder template only — values are non-secret