# =============================================================================
# Azure Support Agent — .gitignore
# =============================================================================

# --- Secrets & environment ---------------------------------------------------
.env
.env.*
!.env.example
*.local
*.key
secret.key
*.pem
*.pfx
*.p12
*.crt

# --- Runtime data / state volumes --------------------------------------------
# Backend JSON registries, SQLite DB, caches, OAuth profiles, evidence, etc.
.data/
**/.data/
*.db
*.db-shm
*.db-wal
*.sqlite
*.sqlite3

# --- Deployment / infra scratch (machine-specific identifiers) ---------------
.acrname
.stgname
.imgdigest
uvicorn.out.log
uvicorn.err.log

# Postgres throw-away resource gorup admin credential + server identifiers (never commit these).
.pgpass
**/.pgpass
*.pgpass
.pgname
**/.pgname
.pgloc
**/.pgloc

# --- Internal / non-distributable assets -------------------------------------
sap.txt

# Personal build/deploy runbook (operational notes, invoked as a skill — not product code).
DEPLOY_RUNBOOK.md

# Internal UI test plan (QA working notes — not product documentation).
docs/UI_TEST_PLAN.md
docs/BUG_HUNTING_PLAN.md
docs/ARCHITECTURES_TEST_PLAN.md
docs/GRAPH_TEST_PLAN.md
docs/INVENTORY_TEST_PLAN.md

# Full-suite test findings (QA working notes / bug documentation — not distributable).
docs/test-findings/
backend/scripts/_insights_e2e.ps1
backend/scripts/_insights_probe.ps1
backend/scripts/_fullsuite_*.ps1
# Scratch test harnesses (underscore-prefixed, QA working scripts — not distributable).
backend/scripts/_*.py
backend/scripts/_*.txt
# One-shot api.ts codemods. api.ts cannot be edited by the string-replace tooling, so each
# block was inserted by a generator script. The GENERATED OUTPUT is what ships (it is committed
# inside api.ts); the generators themselves are historical build steps, not product code, and
# re-running one would rewrite api.ts. Durable frontend tooling (find_conditional_hooks.py,
# sync_entra_api_types.py) stays tracked.
frontend/scripts/add_*.py
frontend/scripts/fix_*.py
frontend/scripts/rename_*.py

# Internal data-retention engineering plan (design working notes — not product docs).
docs/DATA_RETENTION_PLAN.md

# Internal UX engineering plan (design working notes — not product docs).
docs/UX_ADVANCED_PLAN.md

# Throwaway UX audit screenshots (Playwright captures — not distributable).
.uxshots/

# Spreadsheets (workbooks, exports, scratch) — not distributable.
*.xlsx

# --- Presentation / deck working files (non-distributable) -------------------
# The pitch deck, its product screenshots, and its build scripts are internal.
docs/deck-assets/
docs/_build_deck.py
docs/_validate.py

# --- Python ------------------------------------------------------------------
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
*.egg
.eggs/
build/
develop-eggs/
.venv/
venv/
env/
ENV/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage
.coverage.*
htmlcov/
.tox/

# --- Node / frontend ---------------------------------------------------------
node_modules/
dist/
dist-ssr/
.vite/
*.tsbuildinfo
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*

# --- Playwright / browsers ---------------------------------------------------
playwright-report/
test-results/
.playwright/

# --- Local security scan reports (gitleaks/trivy/zap/etc.) --------------------
.security/

# --- Local-only E2E test suite  -------
/e2e/

# --- Editors / OS ------------------------------------------------------------
.vscode/
.vs/
.idea/
.DS_Store
Thumbs.db
*.swp
*.swo

# --- Logs --------------------------------------------------------------------
*.log
logs/

# --- Misc temp ---------------------------------------------------------------
*.tmp
*.bak
*.pptx
# --- Throwaway deck-inspection + render scratch (not app code) ---------------
backend/_deck_*.py
docs/_build_usecases.py
docs/_uc_helpers.py
docs/_usecases_build.py
docs/_render.py
docs/usecase-assets/
docs/usecase-render/
docs/_build_journey_slides.py
docs/_journey_render/

# --- Per-section performance/UX improvement plans (review scratch, not shipped) ---
docs/improvement-plans/

# --- Workspace agent customization (local-only, not shipped) -----------------
# Most of .github stays local: it holds the workspace custom agents
# (.github/agents/documentation-regenerator.agent.md, .github/agents/ui-test-pilot.agent.md)
# and their design notes (.github/UITestAgent.md) — internal tooling, not product code.
# Public documentation under docs/ remains tracked.
#
# EXCEPTION: CI configuration MUST ship, or it can never run. A blanket `.github/`
# ignore silently prevents any workflow from existing. Note the `/*` form: git cannot
# re-include a child once its parent DIRECTORY is excluded, so `.github/` + `!...` would
# silently not work. `.github/*` excludes the contents while allowing negation.
.github/*
!.github/workflows/
!.github/dependabot.yml
.docs-work/
docs/.jekyll-cache/
docs/.sass-cache/
docs/_site/
docs/.bundle/

# --- UI Test Pilot run artifacts (screenshots + run reports) -----------------
.uxshots/ui-test/

# Scratch scripts written while investigating (diagnostics, one-off scans). These are
# working notes, not product code, and they routinely quote live tenant/connection names
# while hunting for them -- exactly what must never reach a public repo. The deploy flow
# uses `git add -A`, so leaving this untracked-but-not-ignored was one command away from
# publishing them.
state/
