v0.3.5: harden against credential leaks in sdist

Security: PyPI 0.3.4 sdist included an untracked .claude/settings.json
file that contained API tokens accumulated in Claude Code's permission
allow-rules (responsibly disclosed by an external researcher). The wheel
was unaffected; only the sdist tarball was contaminated. Affected
credentials have been revoked and rotated.

Root cause: hatchling's default sdist builder included every file in the
working directory, including untracked tooling/secrets files that should
never be packaged.

This commit:

- Adds .claude/, CLAUDE.md, .env, and .env.* to .gitignore so they can't
  enter the git tree by accident.
- Adds an explicit [tool.hatch.build.targets.sdist] block with an
  allowlist (src/, tests/, README, LICENSE, pyproject.toml) and an
  explicit deny-list, so untracked files in the working directory are
  never included regardless of git status.
- Bumps version to 0.3.5. PyPI 0.3.4 will be yanked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tdobrowolski1

.gitignore

@@ -1,3 +1,9 @@
+# Local tooling / secrets — never commit
+.claude/
+CLAUDE.md
+.env
+.env.*
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[codz]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "flashalpha"
-version = "0.3.4"
+version = "0.3.5"
 description = "Python SDK for the FlashAlpha options analytics API — live options screener, gamma exposure (GEX), VRP, delta, vanna, charm, greeks, 0DTE analytics, volatility surfaces, and more."
 readme = "README.md"
 license = "MIT"
@@ -71,6 +71,26 @@ dev = ["pytest>=7.0", "pytest-cov", "responses>=0.23"]
 [tool.hatch.build.targets.wheel]
 packages = ["src/flashalpha"]
 
+[tool.hatch.build.targets.sdist]
+# Explicit allowlist — only ship source, README, LICENSE, pyproject. Anything
+# else in the working dir (e.g. .claude/, CLAUDE.md, .env*, dist/) is excluded.
+include = [
+  "/src/flashalpha",
+  "/tests",
+  "/README.md",
+  "/LICENSE",
+  "/pyproject.toml",
+]
+exclude = [
+  ".claude",
+  "CLAUDE.md",
+  ".env",
+  ".env.*",
+  ".vscode",
+  ".idea",
+  "*.local",
+]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 markers = ["integration: hits the live FlashAlpha API (deselect with -m 'not integration')"]

src/flashalpha/__init__.py

@@ -27,7 +27,7 @@
     ZeroDteVolContext,
 )
 
-__version__ = "0.3.4"
+__version__ = "0.3.5"
 __all__ = [
     "FlashAlpha",
     "FlashAlphaError",