# ── macOS ──
.DS_Store
**/.DS_Store

# ── Python ──
__pycache__/
*.py[cod]

# ── Secrets & env (CLAUDE.md guardrail #7 — never commit secrets) ──
.env
.env.*
!.env.example
!.env.beta.example
data/secrets/

# ── Claude Code (deny by default, allow-list shared wiring — see standards/portability.md) ──
.claude/*
!.claude/rules/
!.claude/agents/
!.claude/commands/
!.claude/skills/
!.claude/settings.json
# launch.json is a deliberate, secret-free debug config CRM commits
!.claude/launch.json

# ── Local databases & SQLite sidecars ──
# CRM is canonical and lives on the Start9 /data volume; never commit live LP
# data into git (guardrail #1). Dev/synthetic DBs are local-only.
data/*.db
data/*.db-wal
data/*.db-shm
data/crm_dev.db*

# ── FUSE / build temp ──
*.fuse_hidden*
start9/**/javascript.tmp.*
node_modules/

# Real CRM data bundled in packaging seed dirs — never commit (guardrail #1)
**/seed/data/
**/crm.db
**/crm.db-wal
**/crm.db-shm
**/fundraising_state_auto_*.json

# Local fundraising-state backups (real data) — never commit
data/backups/