# Python
__pycache__/
*.py[cod]
*.egg-info/
.venv/
dist/
build/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage

# Example / template build output
examples/**/build/
examples/**/reports/
src/dbml_sharepoint/solutions/**/build/
src/dbml_sharepoint/solutions/**/reports/

# A consumer's build defaults, which can carry their tenant's
# enterprise-reader UPN. Not ours to commit.
dbml-sharepoint.env

# Generated fixture data for the threshold index probe.
test/manual/rows/

# Probe run transcripts. A probe is pasted into a LIVE tenant, so its console
# output carries the site URL, the operator's UPN and real item ids. Keep them
# on disk, quote findings into code comments, never commit the raw output.
# test_probes.py::test_no_tracked_file_under_manual_names_a_tenant enforces the
# same rule against anything that gets past this.
#
# The whole directory's .txt, not a `transcript-*` prefix: an operator names the
# file after the run, not after the ignore rule. No .txt here is tracked.
test/manual/*.txt

# Captured network traffic, which is a different order of hazard from a console
# transcript. A HAR records REQUEST HEADERS: the auth cookie and bearer token
# for a live tenant, plus every URL and response body. Committing one hands over
# a working session, not just a site name. Nothing here is ever tracked, and
# these should be deleted once whatever they were captured for is answered.
test/manual/*.har
test/manual/*.log
test/manual/*.json
!test/manual/probe-catalog.json
test/manual/captures/

# Manual extraction runs. extract.js.txt is pasted into a LIVE tenant, so the
# browser log and the JSON it downloads carry the site URL and the operator's
# UPN. The script itself is a local build artifact (extract-script writes it
# by default). Zone.Identifier is the Windows mark a browser leaves on every
# download; WSL materialises it as `<file>:Zone.Identifier`, and git's `*`
# will not cross the colon, so the colon is in the pattern. Nothing here is
# tracked.
extract.js.txt

# Manual identification runs, ignored for the same reason and with the same
# defaults. `identify-script` writes identify.js.txt into the current
# directory, and the script downloads sharepoint-identify.json, whose payload
# carries the site URL it read and the operator's UPN. A browser saving a
# second copy names it identify-1.txt, sharepoint-identify (1).json and so on,
# so the patterns allow for the suffix.
identify.js.txt
identify-*.txt
sharepoint-identify*.json

*:Zone.Identifier
human-run/

# Editors / OS
.vscode/
.idea/
.DS_Store
Thumbs.db

# Local process artifacts: specs and plans from the superpowers workflow.
# Deliberately untracked: they are working notes, not part of the shipped
# repository, and they dominated PR diffs (9,062 lines across 8 files).
# Kept on disk so the reasoning survives; `git clean -x` WOULD delete them.
docs/superpowers/

# Worktrees created for parallel agent work.
.claude/worktrees/

# Hypothesis example database (machine-local; not shared).
.hypothesis/

# Pickles are never source. A stray empty sites.pkl was once committed by accident.
*.pkl
