# ---------------------------------------------------------------- secrets ---
# Never commit local credentials / API tokens.
.env
.env.*
!.env.example
*.pem
*.key

# ----------------------------------------------- deps, build & tooling ---
node_modules/
.next/
.next-stale*/
out/
dist/
build/
*.tsbuildinfo

# ------------------------------------------------- logs & runtime state ---
*.log
*.log.err
*.tmp
.runtime/
.dev-screenshots/
npm-debug.log*

# ------------------------------------------- local DBs & scratch working ---
*.sqlite
*.sqlite3
*.db
scratch-*/
_backups/

# --------------------------- CIPC report run state (generated) --------
# The report explorer writes its run folder, produced PDFs and sample
# page renders at runtime — none of that belongs in the repo.
Workflow/.cipc-report/
Workflow/reports/
Workflow/scripts/one-id.txt
Workflow/scripts/cipc-report/_sample*/
Workflow/scripts/cipc-report/sample-results*.json

# --------------------------------- debug captures & one-off probe output ---
# Ad-hoc dumps kept while debugging SARS / CIPC screens. Not project source.
_probe*.json
_junction_backup*.json
_*.log
_*.txt
*.preview-p*.png
.preview-p*.png
workpage*.png

# --------------------- CIPC / BizPortal live session state (cookies!) ---
# NOTE: patterns with a slash are anchored to the repo root, so the app
#       subtree needs its own Workflow/ prefix.
Workflow/scripts/storage_state.json

# ------------------------------- client documents & one-off scratch work ---
Workflow/scripts/_backup_ufc_docs/
Workflow/scripts/.scratch/
Workflow/scripts/_scratch/
scratch-*/

# ------------------------------------------ compiled python / stray bins ---
__pycache__/
*.py[cod]
*.bin

# ------------------------------------- debug screenshots & probe uploads ---
Workflow/scripts/_*.png
Workflow/scripts/sars_login_*.png
Workflow/scripts/_upload_probe.pdf

# ----------------------------------------------------------- OS / editor ---
desktop.ini
Thumbs.db
*.bak
*.bak.*