# Python
__pycache__/
*.pyc
*.pyo
venv/
.publish-venv/
.pytest_cache/
db.sqlite3

# Node
node_modules/
dist/
bun.lock

# Secrets
.env
*.key
*.pem
secrets/
.ssh/

# Claude Code
.claude/
.mcp.json

# Deploy artifacts & large files
*.tar.gz
*.tar
*.mo

# Backups
*.bak.*
*.bak-*

# OS
.DS_Store
*.swp
*~

# ── SECRETS MUST NOT LAND HERE ───────────────────────────────────────────────
# These repos push to GitHub, and a key committed once is a key to rotate even
# after it is deleted — the object survives in history and in every clone.
# Added 2026-08-23 after a stripekey.txt appeared briefly in auth-vault/ while a
# LIVE rk_live_ key was being installed. Nothing was committed; this makes the
# near miss structural rather than a thing that was noticed in time.
*stripekey*
*.key
*.secret
*secrets.env
*payment.env
stripe-*.txt
*-readonly.key

# Vendored at build time by cli/hatch_build.py from skills/
cli/borealhost_cli/skill_data/
