# Build artifacts
/target
**/target

# Frontend (regenerable — tsc output + installed deps; rebuilt by build.rs)
server/static/dist/
server/frontend/node_modules/
multithreaded/static/dist/
multithreaded/frontend/node_modules/

# Generated stylesheets and scripts (makeover-build and quasi-webview emit
# these; the crates are the source, a checked-in copy would drift). Every
# script quasi-webview ships is named here, not some of them: three of the
# eight were tracked until 2026-08-27, which is the drift this rule exists to
# prevent sitting in the tree waiting to happen.
server/static/quasi-selection.js
server/static/quasi-clock.js
server/static/quasi-download.js
server/static/quasi-fill.js
server/static/quasi-copy.js
server/static/quasi-reveal.js
server/static/quasi-repeat.js
server/static/quasi-awaiting.js
server/static/geometry.css
server/static/timing.css
server/static/layout.css
server/static/embed-geometry.css
server/static/typography.css
server/static/embed-typography.css

# The house faces, cut by quasi-type in build.rs. Same rule as the stylesheets
# above and the same rule shop and the Alloy image follow: the pipeline is the
# source, and a committed face is a second one that nothing rebuilds.
server/static/fonts/QuasiMono.woff2
server/static/fonts/QuasiBody.woff2
server/static/fonts/OFL-QuasiMono.txt
server/static/fonts/OFL-QuasiBody.txt

# Environment files (contain secrets)
server/.env
server/.env.local
server/.env.*.local
**/env.production

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# Secrets and credentials
*.pem
*.key
*.p8
*.p12
*.pfx
credentials.json
service-account.json

# OS files
.DS_Store
Thumbs.db

# SQLx offline mode cache
.sqlx/

# Generated template partials (build.rs output)
server/templates/_island.html
server/templates/_sheet.html

# Generated rustdoc output
server/rustdoc-out/

# Mutation testing output
mutants.out*
**/mutants.out*

# Claude Code agent worktrees
.claude/worktrees/

# Claude Code instructions (project-local; not for the public repo)
CLAUDE.md

# Private working files — live in _private/, synced via Syncthing
todo.md
# Glob, not the literal name: audit reports drifted to dated files
# (audit_doubledown_2026-07-01.md, etc.) that a literal `audit_review.md` rule
# left unignored — one `git add docs/` from leaking internal findings into the
# public repo (audit Run 17).
audit_review.md
audit_*.md
docs/audit_*.md
# Same intent for the risk-lens reports: /fuzz writes dated fuzz-*.md (and
# fuzz-doubledown-*.md) full of concrete attack paths and PoCs — never public.
fuzz-*.md
docs/fuzz-*.md

# sandod local state (regenerable)
sando/daemon/sando.db
sando/daemon/sando.db-*
sando/daemon/work/
sando/daemon/releases/
sando/daemon/cargo-target/

# mt-db and the server use sqlx compile-time macros; their offline query cache
# must be committed so build hosts (and the Sando gate) compile without a live DB.
!multithreaded/.sqlx/
!server/.sqlx/