[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"

# user-level secrets (HF_TOKEN etc.)
[ -f "$HOME/.config/secrets/env.sh" ] && source "$HOME/.config/secrets/env.sh"

# fleet CLIs (booth, secret symlinks) reachable from non-interactive ssh too
export PATH="$HOME/.local/bin:$HOME/bin:$PATH"

# safe-rm (installed 2026-09-22, operator's call) — a wrapper that REFUSES to
# delete the ~25 protected system paths in /etc/safe-rm.conf: /, /bin, /etc,
# /home, /usr, /var and friends. Guards the rm -rf /usr class of mistake.
#
# ⚠ IT IS SET HERE AND NOT LEFT TO THE PACKAGE. safe-rm ships
# /etc/profile.d/safe-rm.sh, which /etc/profile walks correctly -- but Debian's
# /etc/zsh/zprofile is entirely commented out (0 non-comment lines), so a zsh
# LOGIN shell never sources /etc/profile and the hook never fires. Measured
# immediately after install: rm still resolved to /usr/bin/rm in this shell, in
# a fresh `zsh -l`, AND over ssh. Installed and inert.
#
# .zshenv is the right home because it is sourced for EVERY zsh invocation,
# including the non-interactive `ssh host '<cmd>'` form that is how most fleet
# work actually runs -- the same reason ~/.local/bin is set here.
#
# ⚠ AND IT DOES NOT COVER THE MISTAKE THAT PROMPTED IT. safe-rm is a path
# blacklist, not a heuristic. Measured: it refuses `rm -rf /home`, and it
# deletes a file whose path came from an unset variable without complaint. The
# variable-path habit is still guarded only by discipline and `set -u`.
[ -d /usr/share/safe-rm/bin ] && export PATH="/usr/share/safe-rm/bin:$PATH"