Module rules 

Classification rules: which file names are secrets, which directories are caches, and which of those the operator wants carried anyway.

The built-in lists are the floor, not the ceiling. Secret file names are open-ended — every ecosystem invents its own (credentials.toml, terraform.tfvars, service-account.json), and a project can always have one nobody has heard of (my-app-keys.json). A fixed list is therefore guaranteed to be incomplete, so operators can extend it via ~/.config/lds/config.toml:

[pack]
secret_globs = ["my-app-keys.json", "*.vault"]
cache_dirs   = ["frontend/dist"]
keep         = ["docs/samples/*.pem"]

Extensions add to the built-ins rather than replacing them, so declaring one project-specific name cannot silently disable the rest of the protection. keep is the only subtractive list: it names files a built-in rule would exclude but that this project wants packed.

Scoping

Every list here follows the convention .gitignore already established, so there is no second one to learn:

glob	matched against
no / (*.pem, .env)	the file name, at any depth
contains / (docs/samples/*.pem)	the path relative to the project root

Every built-in is a bare name, so all of them keep reaching the whole tree. Scoping exists for the operator’s own rules, where reaching the whole tree is the hazard: keep = ["*.pem"] written to carry one sample key carries every private key in the project, and cache_dirs = ["dist"] written for a build output drops any hand-written dist/ that happens to share the name. Anchoring the rule to a path confines it to the case it was written for.

Structs

PackRules

Compiled classification rules used by the scan.

RuleOverrides

Operator-supplied additions read from [pack] in config.toml.

Enums

FileVerdict

What the classification rules decided about one file name.

Constants

DEFAULT_CACHE_DIRS

Directory names treated as regenerable caches.

DEFAULT_KEEP

File-name globs packed despite matching a secret rule.

DEFAULT_SECRET_GLOBS

File-name globs treated as secrets.