node_modules/
.env
*.log

# Never commit wallet keys
.github/burner-key
agent-key
agent-address.txt

# Runtime databases (sales ledger, memory tools) — created at runtime and may
# hold payer wallet addresses + settle tx hashes. Never commit; a public fork
# must not inherit anyone's payment data.
*.db
*.db-journal
*.db-wal
*.db-shm
*.sqlite
*.sqlite3

# Private, machine-local Claude Code memory (never committed)
CLAUDE.local.md

# Local Claude Code per-project settings — never committed, EXCEPT
# .claude/skills/ (shared project skills, e.g. /tweet). A parent-dir
# exclude would block re-including children, hence the /* form.
.claude/*
!.claude/skills/
*.traineddata

# Python build artifacts
__pycache__/
*.pyc
dist/
build/
*.egg-info/

# Session handoff notes — machine-local, keep strategy out of the public repo
.remember/
.algorand-burner.env
# Brainstorming visual-companion mockups (superpowers) — machine-local scratch
.superpowers/

# Secret-shaped files, by pattern (leak audit 2026-08-18): the list above names
# every sensitive path individually, which only holds until the next one is
# created under a new name. Catch-alls for the usual shapes; a false positive
# is a `git add -f` away, a false negative is a rotated credential.
*.pem
*.key
*.p12
*.pfx
*.secret
*.token
*.mnemonic
*secret*.json
*token*.json
*mnemonic*.txt
.env.*
!.env.example
service-account*.json

# The Solana token brief sample is a public report fixture, not a token secret (the *token*.json rule above guards those).
!assets/samples/token-brief.json
