/.bundle/
/pkg/
/tmp/
Gemfile.lock
.idea/
.DS_Store

# Local credentials (e.g. an Okta admin API token for e2e teardown). Never commit.
.env
.env.*
!.env.example

# E2E: never commit terraform state, plans, or provider binaries
**/.terraform/
*.tfstate
*.tfstate.*
*.tfplan

# E2E: tfvars name real projects, orgs, and principals. Only the .example
# template, which carries placeholders, is committed.
*.tfvars
!*.tfvars.example

# E2E: scratch Okta credentials (client secret, test user password)
/e2e/okta/secrets.json
/e2e/**/secrets.json
*.secrets.json
/e2e/okta/*.token


# E2E Okta capture: local deps and debug artifacts
/e2e/okta/node_modules/
/e2e/okta/capture-failure.png

# E2E capture artifact: a live IAP assertion (~10 min) plus the signed-in
# identity. Shared between the four language e2e suites; never committed.
/e2e/okta/capture.json

# TypeScript package: build output and local deps. dist/ is built by the
# `prepare` script on install, including for `npm i github:CruGlobal/cru-iap`,
# so it is never committed.
/node_modules/
/dist/
*.tsbuildinfo

# Python package: local venv, bytecode, and test/build caches. uv.lock IS
# committed — it pins the dev toolchain, and the runtime dependency range lives
# in pyproject.toml, so a consumer resolving `pip install git+…` is unaffected.
/.venv/
__pycache__/
*.py[cod]
/.pytest_cache/
/.coverage
/build/
/*.egg-info/
# `uv build --out-dir dist-python`, as the release workflow runs it. Not the
# default dist/, which is the TypeScript build output.
/dist-python/
