.gitignore

# Build artifacts
/build/
*.iso
*.iso.sha256
*.iso.asc
*.deb
*.changes
*.buildinfo
*.dsc
*.tar.*
*.log

# live-build state (regenerable from config/)
/live-build/.build/
/live-build/binary
/live-build/binary.list
/live-build/binary.modified.timestamps
/live-build/binary.packages
/live-build/cache/
/live-build/chroot/
/live-build/chroot.files
/live-build/chroot.packages.*
/live-build/config/archives/shadowfetch.key.*
/live-build/shadowfetch-build.log

# reprepro state (regenerable)
/repo/db/
/repo/dists/
/repo/pool/

# Local secrets / scratch
.env
.env.local
*.bak

# wrangler cache
.wrangler/
**/.wrangler/
.worktrees/
/work/qa-2.1.4/

# --- SECRET GUARD, added 2026-07-24 -------------------------------------------
# A publication audit found a LIVE Cloudflare Worker write token and a 1.37 MB
# production D1 dump containing real subscriber email addresses sitting
# untracked but UNIGNORED in this tree — one `git add -A` from a public commit.
# These patterns are a backstop, not a substitute for keeping secrets out of the
# working tree entirely.
*.write-token.txt
.write-token.txt
**/.write-token.txt
*token*.txt
d1-migration-*/
*-full.sql
.wrangler/
**/.wrangler/
.dev.vars
*.env
!*.env.example

# ---- added 2026-07-26, ahead of the first off-machine backup -------------
# Everything below is REGENERATED by a build. None of it is worth restoring,
# and together it is most of what made `git status` show ~200 untracked files,
# which is how genuinely unversioned source (the whole AI stack) stayed
# invisible in the noise for months.

# debhelper staging trees -- rebuilt by dpkg-buildpackage every time.
# Generic rule (2026-08-02): the old enumerated list missed every package added
# since, and each miss meant compiled .pyc caches and full install-tree copies
# of every source file landing in git under packages/<pkg>/debian/<pkg>/.
packages/*/debian/*/DEBIAN/
packages/*/debian/shadowfetch-*/
packages/*/debian/grub-btrfs/
packages/*/debian/.debhelper/
packages/*/debian/files
packages/*/debian/*.substvars
packages/*/debian/debhelper-build-stamp
__pycache__/
*.pyc

# wrangler local state. This is why .git is 3 GB: a single cached R2 object
# of 2.9 GB sits in history, and GitHub refuses any blob over 100 MB.
.wrangler/
**/.wrangler/

# live-build working areas -- chroot is tens of gigabytes of unpacked Debian.
live-build/chroot/
live-build/cache/
live-build/binary/
live-build/binary.iso.zsync*
live-build/.build/

# node
**/node_modules/

# staging ROOTS (an earlier pass ignored only their DEBIAN/ subdir)

# an ISO that escaped *.iso by using a different suffix (3.2 GB)
*.iso.firstbuild
*.firstbuild
live-build/binary.iso.zsync*
packages/grub-btrfs/debian/grub-btrfs/
packages/shadowfetch-branding/debian/shadowfetch-branding/
packages/shadowfetch-defaults/debian/shadowfetch-defaults/
packages/shadowfetch-meta/debian/shadowfetch-creative-base/
packages/shadowfetch-meta/debian/shadowfetch-desktop/
packages/shadowfetch-meta/debian/shadowfetch-nvidia/
packages/shadowfetch-themes/debian/shadowfetch-themes/
packages/shadowfetch-welcome/debian/shadowfetch-welcome/

# QA evidence + release scratch (regenerable; matches the /work/qa-2.1.4 precedent)
/work/
/live-build/binary.contents