# Credentials & secrets — never commit
.envrc
.env
.env.*
.token-cache
*.jwk
*.pem
*.key
*.har

# Rust build output
/target/
**/*.rs.bk
Cargo.lock.bak

# Script-sync workspace (created at runtime; per-tenant/realm trees + snapshots)
/workspace/
/local-config/

# Tool venvs / caches
/.venv-tools/
/.direnv/
/tmp/
__pycache__/

# Logs
*.log

# OS / editor
.DS_Store
.idea/
.vscode/
*.swp

# Claude Code local settings (per-developer allowlists, etc.)
.claude/settings.local.json

# Runtime project-local state (created by pingone-aic-manager at runtime)
.aic/
# Legacy runtime dir (pre-rename); keep ignored so old workspaces never get committed
.aic-edit/

# Managed-object backups (raw schema dumps for experimentation safety)
/.managed-backup/
.ai/
