# ============================================================================
# Secrets — NEVER commit. Tokens live in .secrets/ (untracked).
# These are git-level only; npm publish is separately locked by files:["dist"].
# ============================================================================
.secrets/
.env
.env.*
!.env.example
*.token
*.pem
*.key
*.p12
*.pfx
id_rsa*
credentials.json

# Cloudflare Workers local secrets (wrangler)
.dev.vars
.dev.vars.*
.wrangler/

# npm auth: keep ONLY the committed root scope-routing .npmrc (no token in it).
# Any nested/stray .npmrc is ignored so a token can never sneak in via one.
.npmrc
!/.npmrc

# ============================================================================
# Dependencies
# ============================================================================
node_modules/
.pnpm-store/

# ============================================================================
# Build output — built on demand / in CI, never committed (published from dist)
# ============================================================================
dist/
*.tsbuildinfo
*.tgz

# ============================================================================
# Caches & coverage
# ============================================================================
.turbo/
coverage/
.vitest/

# ============================================================================
# Logs
# ============================================================================
*.log
npm-debug.log*
pnpm-debug.log*
yarn-debug.log*

# ============================================================================
# Temp
# ============================================================================
tmp/
tmp-*.mjs
*.tmp

# ============================================================================
# OS / editor junk (git = runtime only, no editor configs)
# ============================================================================
.DS_Store
Thumbs.db
*.swp
.idea/
.vscode/
.worktrees/

# living WP feature mining reference — deliberately untracked working doc
docs/catalog/cms-features.md

# ============================================================================
# Private provenance — owner-PRIVATE, NEVER in github.
# Source-attribution + disposition metadata (and the split-config that drives
# the registry cleaner) lives under .provenance/, gitignored. The tracked
# registry/docs are the clean, public-bound surface; this is the owner's
# private mirror. Backup is the owner's responsibility (local-only by design).
# ============================================================================
.provenance/

# docs/viz/ — product visualization (CF Pages platform-preview); owner-local WIP, deploy via wrangler, not version-controlled here
docs/viz/

# slopgate runtime telemetry
.slopgate/stats.jsonl