# build output
dist/
# generated types
.astro/

# dependencies
node_modules/

# logs
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*


# secrets — never commit (belt-and-suspenders; real creds live outside the repo)
.env*
!.env.example
*.pem
*.key
*.crt
*.p12
*.pfx
*.token
*.tfvars
*credentials*
.git-credentials
.netrc
id_rsa*
id_ed25519*
*.kubeconfig
kubeconfig
*.secret
secrets.*

# macOS-specific files
.DS_Store

# jetbrains setting folder
.idea/

# CI artifact
sbom.json

# Blog drafts are PRIVATE staging - this repo is public and anonymously readable.
# Nothing under drafts/ may ever be committed; a draft becomes public only by
# being moved into src/content/blog/ at publish time.
drafts/

# Publish-workflow archives stay local for the same reason.
published/

# Local blog-workshop tooling stays off the public repo.
scripts/make-ledger.py
scripts/sync-nas-blog.sh