id       = "joplin"
name     = "Joplin"
homepage = "https://joplinapp.org"
description = "The privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS."
icon     = "SimpleIcons:joplin"

# The desktop app ships no command-line tool, so `detect` carries its bundle
# identifier, net.cozic.joplin-desktop — the domain the Homebrew cask
# (https://formulae.brew.sh/api/cask/joplin.json) zaps, and the one present on a
# Mac with Joplin installed. The separate `joplin` terminal application is a
# different program with its own profile at ~/.config/joplin and is not this
# entry.
executables = []

[installation]
macos_bundle_ids = ["net.cozic.joplin-desktop"]

[dotfiles]

# https://joplinapp.org/help/dev/spec/user_profile — the profile directory is
# "~/.config/joplin-desktop" on Linux and macOS and
# "%UserProfile%\.config\joplin-desktop" on Windows. Windows keeping the dotted
# spelling under the profile root rather than %APPDATA% is the tell that Joplin
# joins the home directory itself, so the path is written literally rather than
# with a base-directory root.
#
# The same page splits that directory into user data and runtime files. Only the
# three configuration files are listed here: settings.json ("JSON configuration
# file containing all user preferences"), keymap-desktop.json (custom keyboard
# shortcuts) and userchrome.css (the optional interface stylesheet). The notes
# themselves are database.sqlite and resources/, which are Joplin's own storage,
# binary and already carried by Joplin's own sync; plugins/ holds installed
# plugin packages; and plugin-data/, cache/, lock, flags.txt and
# ipc_secret_key.txt are the runtime files the same page says need no backup.
# Naming the three files keeps all of that out without an exclude for each.
paths = [
  "~/.config/joplin-desktop/settings.json",
  "~/.config/joplin-desktop/keymap-desktop.json",
  "~/.config/joplin-desktop/userchrome.css",
]

exclude = []

# No whole file above is a credential. Sync passwords are not in settings.json
# either: packages/lib/models/Setting.ts marks them `secure` and stores them
# through the keychain service, falling back to the database rather than to this
# file when no keychain is available ("Always check in the database first,
# including for secure settings, because that's where they would be if the
# keychain is not enabled").
secret = []

# No secret_paths, and it is a schema limit rather than a clean bill of health.
# settings.json does hold one credential — `api.token`, the Web Clipper
# authorisation token for Joplin's local data API, verified in a settings.json on
# a Mac with Joplin installed, sitting beside ordinary preferences (locale,
# theme, editor.codeView, markdown.plugin.*, spellChecker.languages). It cannot
# be written as a rule: Joplin uses literal dotted key names at the top level of
# that file — "api.token" is one key, not `api` containing `token` — and `.` is
# this schema's key-path separator with no escape, so no key_path can address
# it. A consumer that scans content should redact that key.
#
# The same limit rules out a machine_lines rule for "ui.layout", the pane
# arrangement Joplin rewrites as the user drags panels around.