# Dependencies
node_modules/

# Environment & secrets
.env
.env.*
!.env.example
.dev.vars

# Local secrets — never commit
.api-key.local.txt
*.local.txt

# Build tools (binaries)
mcp-publisher.exe
mcp-publisher

# MCP Registry credentials
.mcpregistry_*
.mcp_publisher_token

# Database backups (local snapshots only)
backup.sql
backup-*.sql
*.sqlite
*.db

# Build artefacts
dist/
*.js.map
.wrangler/

# OS junk
.DS_Store
Thumbs.db

# IDE
.vscode/
.idea/

# Internal audit / report material — NEVER commit. Standing rule, 2026-09-02.
# These name still-open findings and internal strategy; the repo is public.
AUDIT*.md
*_AUDIT_*.md
*_AUDIT.md
EVIDENCE_PASS_*.md
*_FIXLIST*.md
CURRENT_STATE_MAP*.md
*_REVIEW.md
docs/SECURITY_AUDIT_*.md
docs/FRESHCONTEXT_*_AUDIT_*.md
docs/FRESHCONTEXT_MATH_SPINE_REVIEW.md

# Internal / strategic notes — not for public repo
# These contain session continuity, strategy, financial context, etc.
CLAUDE.md
HANDOFF.md
ROADMAP.md
docs/TRUST_ROADMAP.md
TIME_CHECK_README.md
SESSION_SAVE_*.md
_archive/
.claude/
FreshContext-Private-Data-Room/
Private-Data-Room/
private-data-room/

# Local logs and package artifacts
logs/
tmp/
*.log
npm-debug.log*
*.tgz
