# Dependencies
node_modules/
.pnpm-store/

# Build output
dist/
build/
*.tsbuildinfo

# Python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# Test / coverage
coverage/
.coverage
htmlcov/
.nyc_output/

# Secrets — never commit keys, tokens, or manifest signing material
.env
.env.*
!.env.example
*.pem
*.key
.pypirc
secrets/

# Manifest signing keys. Public halves (*.pub.json) ARE committed — the SDKs trust
# compiled-in keys and CI verifies against these. Private halves never are.
core-spec/manifests/keys/*.private.*

# Editor / OS
.DS_Store
.idea/
.vscode/
*.swp

# Local scratch
tmp/
.tmp/

# Generated by tools/supply-chain. Emitted in CI and attached to the release, never
# committed — a committed SBOM drifts from the lockfile that produced it.
sbom/
