# ─────────────────────────────────────────────────────────────────────────────
#  authoxi — .gitignore
# ─────────────────────────────────────────────────────────────────────────────

# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

# C extensions
*.so

# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
# ANCHORED to the repo root, deliberately. These come from the stock Python .gitignore, where
# `lib/` means "the Python build output". Unanchored, it matches ANY directory called lib at
# any depth — which silently swallowed the console's entire src/lib/ (the API client, the
# Ed25519 signer, the store). Everything still built locally, because Docker copies the working
# tree rather than what git tracks; only a clean clone revealed it. Keep these anchored.
/lib/
/lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# Virtual environments
.venv*
venv/
ENV/
env/

# PyInstaller
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/
cover/

# Translations
*.mo
*.pot

# Sphinx documentation
docs/_build/

# PyBuilder
.pybuilder/
target/

# Jupyter Notebook
.ipynb_checkpoints

# IPython
profile_default/
ipython_config.py

# pyenv
.python-version

# Environments / secrets (never commit)
.env
.env.local
*.env
credentials.json
*.pem
*.key
secrets/

# Node
node_modules/
*node_modules*
.npm
.pnp.*
.yarn/

# IDE / editor
.idea/
.vscode/
*.swp
*.swo
*~

# macOS
.DS_Store
.AppleDouble
.LSOverride

# Logs & local data
*.log
*.sqlite
*.sqlite3

# Telemetry spool (runtime trace output)
*_spool*.jsonl
.telemetry_spool.jsonl

# Linter cache
.ruff*
.mypy*

# Local agent settings
.claude/settings.local.json

# Backup files (caveman-compress etc.)
*.original

# Temporary files
tmp/
temp/
*.tmp

# The loss-event pump / SDK spool signed evidence to disk when the sink is
# unreachable — real amounts, real vendors, real approver signatures. The rule
# above only catches `*_spool*` (underscore); the pump writes
# `authoxi-loss-events.spool.jsonl` (dot), which slipped straight through.
*.spool.jsonl
*.spool

# `*.sqlite` was covered; `*.db` was not — and a local memory-backend DB lands here.
*.db
