# Build
/target/

# Environment
.env
.env.*

# macOS
.DS_Store

# IDE / tooling
.vscode/
.idea/
.claude/
.mcp.json

# Release artifacts (dmg/app/ios output) stay out of git. The release scripts and
# Bento recipes are tracked: they carry no credentials -- the App Store Connect
# issuer/key id moved to ~/.tauri/passwords.env in 2026-07, so a build host gets
# the scripts by checkout instead of a hand-scp. Keep it that way; never inline a
# key id, issuer, or password here.
dist/*
!dist/recipes/
!dist/*.sh
# The release-signing public key is public by definition: README.md tells people
# to verify downloads against it, so it has to arrive with a checkout.
!dist/makecreative.pub

# Archive
_archive/

# Tauri iOS generated asset symlinks (encode ../ as _up_)
src-tauri/gen/apple/assets/_up_/

# Tauri Android project. This used to be ignored wholesale, on the reasoning that
# android was not a bento target and the tree could just be re-initialized when the
# work resumed. It resumed (2026-08-16), and the reasoning did not survive it: the
# tree is no longer purely generated. MainActivity.kt calls into src/android_tls.rs
# and app/build.gradle.kts locates the rustls-platform-verifier aar, and neither
# edit is reproducible by `cargo tauri android init`. Losing them does not fail the
# build, it ships an app that cannot complete a TLS handshake. So the source is
# tracked and only the generated output below is not.
src-tauri/gen/android/.gradle/
src-tauri/gen/android/build/
src-tauri/gen/android/app/build/
src-tauri/gen/android/buildSrc/build/
src-tauri/gen/android/buildSrc/.gradle/
src-tauri/gen/android/.cxx/
src-tauri/gen/android/local.properties
# Built by the rust gradle plugin from target/<triple>/, not by hand.
src-tauri/gen/android/app/src/main/jniLibs/
# Copied in at build time from src-tauri/themes/, which build.rs generates out of
# makeover and which is itself ignored above. Same file, one copy further along.
src-tauri/gen/android/app/src/main/assets/themes/
# Signing. Holds the upload keystore's passwords in plaintext and must never be
# committed; the keystore it names is not in this repo either.
src-tauri/gen/android/key.properties

# Claude Code instructions (project-local; not for the public repo)
CLAUDE.md

# Private working files — live in _private/, synced via Syncthing
todo.md

# Generated by src-tauri/build.rs from makeover's embedded theme set
/src-tauri/themes/

# Generated by src-tauri/build.rs from makeover-geometry's scale
/src-tauri/frontend/css/geometry.css
/src-tauri/frontend/css/timing.css
/src-tauri/frontend/css/layout.css
/src-tauri/frontend/css/tables.css
/src-tauri/frontend/css/typography.css

# Cut by src-tauri/build.rs with quasi-type. Named file by file rather than as
# a directory, unlike Balanced Breakfast's: Reglo lives here too and it is
# upstream's face, committed rather than cut.
/src-tauri/frontend/fonts/QuasiMono.woff2
/src-tauri/frontend/fonts/QuasiBody.woff2
/src-tauri/frontend/fonts/OFL-QuasiMono.txt
/src-tauri/frontend/fonts/OFL-QuasiBody.txt

# Generated by src-tauri/build.rs from the column descriptions. The JSON is read
# off disk by the node tests, the JS by the running frontend; both are the same
# bytes out of one function.
/src-tauri/frontend/tables.columns.json
/src-tauri/frontend/js/tables.generated.js

# Written by src-tauri/build.rs out of quasi-webview, every build: the loop in
# main() names all eight and nothing gates it. Not committed for the reason
# none of the above are: it is a copy of somebody else's source, and a copy
# that can go stale against the markup it reads is the one failure mode it has.
# Seven of the eight were tracked until 2026-08-27, which is that failure mode
# sitting in the tree waiting to happen; the MNW server had the same split the
# other way round and was fixed in the same pass.
/src-tauri/frontend/js/quasi-selection.js
/src-tauri/frontend/js/quasi-clock.js
/src-tauri/frontend/js/quasi-download.js
/src-tauri/frontend/js/quasi-fill.js
/src-tauri/frontend/js/quasi-reveal.js
/src-tauri/frontend/js/quasi-copy.js
/src-tauri/frontend/js/quasi-repeat.js
/src-tauri/frontend/js/quasi-awaiting.js

# Secrets and credentials. The baseline every repo under ~/Code carries, kept
# identical so no repo is the one that forgot. Suffix-matched rather than
# `*.env`, which would also catch committed environment files that hold no
# secrets (sweep systemd/sweep.env). `.env.example` is a tracked template and
# is negated back in.
!.env.example
*.pem
*.key
*.p8
*.p12
*.pfx
credentials.json