# ── Secrets — NEVER commit these ───────────────────────────────────────────
# Losing/leaking ENCRYPTION_KEY (Fernet) makes all stored customer cloud
# credentials undecryptable; a leaked GCP service account or Firebase key is a
# full account compromise. Keep this list strict.
.env
.env.*
!.env.example
*.key
secret.key
*service_account*.json
gcp_service_account.json
firebase*.json
serviceAccount*.json
*.pem
credentials.json

# ── Databases / local state ────────────────────────────────────────────────
*.db
*.sqlite
*.sqlite3
instance/
.runtime/

# ── Terraform plan artifacts (may embed resource values) ──────────────────
*.tfplan
*.tfstate
*.tfstate.*
.terraform/

# ── Python ─────────────────────────────────────────────────────────────────
__pycache__/
*.pyc
.venv/
venv/
.pytest_cache/

# ── Node / frontend ──────────────────────────────────────────────────────────
node_modules/
frontend/build/
frontend/build-check*/
frontend/public/screenshots/

# ── Misc ───────────────────────────────────────────────────────────────────
.DS_Store

.vercel

# ── Outreach data (scraped contact emails + send history — never public) ───
marketing/outreach/lead_messages_generated.csv
marketing/outreach/send_queue.csv
# The timestamped backups refresh_queue.py writes hold the same scraped
# addresses as send_queue.csv itself, so they need the same rule — an ignored
# file whose backups are committed is not ignored.
marketing/outreach/send_queue.*.csv
marketing/outreach/sent_log.csv
# Agent output: proposed actions with lead names, addresses and draft bodies.
marketing/outreach/approval_queue.json
marketing/outreach/followup_log.csv

# ── MCP server: generated engine copy ──────────────────────────────────────
# scripts/vendor_engine.py copies the backend's IaC engine modules here at
# build time. Committing them would put a second copy of the rule logic in git,
# which is exactly the drift the vendoring design exists to prevent.
integrations/mcp-server/sovereign_mcp/_vendor/
integrations/mcp-server/dist/
integrations/mcp-server/build/
integrations/mcp-server/*.egg-info/
