Module rules 

Classification rules: which file names are secrets, which directories are caches, and which of those the operator wants carried anyway.

The built-in lists are the floor, not the ceiling. Secret file names are open-ended — every ecosystem invents its own (credentials.toml, terraform.tfvars, service-account.json), and a project can always have one nobody has heard of (my-app-keys.json). A fixed list is therefore guaranteed to be incomplete, so operators can extend it via ~/.config/lds/config.toml:

[pack]
secret_globs = ["my-app-keys.json", "*.vault"]
cache_dirs   = ["dist"]
keep         = [".npmrc"]

Extensions add to the built-ins rather than replacing them, so declaring one project-specific name cannot silently disable the rest of the protection. keep is the only subtractive list: it names files a built-in rule would exclude but that this project wants packed.

Structs

PackRules

Compiled classification rules used by the scan.

RuleOverrides

Operator-supplied additions read from [pack] in config.toml.

Constants

DEFAULT_CACHE_DIRS

Directory names treated as regenerable caches.

DEFAULT_KEEP

File-name globs packed despite matching a secret rule.

DEFAULT_SECRET_GLOBS

File-name globs treated as secrets.