# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg

# Virtual environments
venv/
ENV/
env/
.venv/

# IDE
.idea/
.vscode/*
# Share the team's launch/tasks/extensions; keep personal settings out.
!.vscode/launch.json
!.vscode/tasks.json
!.vscode/extensions.json
*.swp
*.swo
*~

# Flask
instance/
*.db
*.sqlite

# Testing
.coverage
htmlcov/
.pytest_cache/
.tox/

# Logs
logs/
*.log

# OS
.DS_Store
Thumbs.db

# Node/Frontend
node_modules/
frontend/dist/
*.local

# Secrets and credentials (defensive)
.env
.env.*
!.env.example
!.env.*.example
*.pem
*.key
id_rsa
id_rsa.*
*.ppk
*.p12
*.pfx

# Local/test TLS material for the dev HTTPS listener. Self-signed, per-host,
# never shipped. The container mounts these at runtime; a site provides its own.
certs/
secrets.json
secrets.yaml
secrets.yml
*_secret
*_secrets
credentials.json
scripts/site_imports/wjf/idmap.json

# work-PC publication clone: bundle drop folder for the transfer pipeline
_transfer/

# Local developer scratch notes and chat handoffs - never committed
devnotes/

# docs/ is generated/published to the wiki, not tracked in the product repo.
# A single tracked file here makes docs/ exist in the CI checkout, which
# defeats the intentional skip in the docs publish/version tests. Keep this
# local-only guide out of version control so those tests skip as designed.
docs/CSV-IMPORT-GUIDE.md

# Local-only authored docs (executive summaries, workflow/security writeups,
# planner exports, draft decks and diagrams). Same reasoning as above: keep
# personal docs out of version control. docs/openapi.json stays tracked and
# is intentionally NOT ignored here.
docs/EXECUTIVE-SUMMARY.md
docs/DESIGN-DECISIONS-agent.md
docs/OPERATOR-WORKFLOW.md
docs/SECURITY-RISK-ASSESSMENT.md
docs/ShopDB-Planner-Tasks.csv
docs/DRAFT--ShopDB-CSV-Import-Guide.pptx
docs/diagrams/
docs/media/

# Local-only working artifacts: DB dumps, sample/test datasets, scratch
# scripts, captured command output, generated maps/reports, vulnerability
# scan output, and staged agent publish trees. None of these are product
# source; they are developer scratch that should never enter version control.
# exports/ (merge kits, decks, catalog snapshots) stays on disk for reference
# but is not tracked.
backups/
exports/
testdata/
vuln/
agent/publish-wjf/
*.sql
shopmap.pdf
shopmap.png
agent_build.txt
agent_publish.txt
backend_out.txt
backend_out2.txt
docker_build.txt
docker_up.txt
gates_out.txt
pytest_targeted.txt
alandry.py
kendry.py

# Scratch tooling under scripts/ (catalog diff/merge helpers, docx generator).
# Not product source; developer-local utilities.
scripts/.temp/
scripts/docs/