.web
*.db
assets/external/
.states
# Pixi
.pixi/

# Python
__pycache__/
*.py[cod]
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage
htmlcov/
dist/
build/

# Terraform
# Note: .terraform.lock.hcl IS committed — it pins provider versions.
# Note: terraform.tfvars IS committed — values are tenant / subscription
# identifiers and feature flags, not secrets. GHA reads them directly.
# Patterns cover both the old flat layout (pre-2026-04-13) and the
# split roots (infra/azure/, infra/entra/).
infra/**/.terraform/
infra/**/*.tfstate
infra/**/*.tfstate.*
infra/**/*.tfplan
infra/**/plan.out
infra/**/plan.txt
infra/**/plan_trunc.txt

# IDE
.vscode/
.idea/

# OS
.DS_Store
Thumbs.db

# Local secrets / dev overrides
.env
*.env.local
sanoptis_auth_msal_cache.bin
.hypothesis/
