Module vetted 

Record types that cannot exist unvetted.

This is its own module because of the private field. A private field is private to the MODULE, and repo.rs is where every record write is assembled — so a type declared there could be constructed beside its own constructor, and the guarantee would be a convention again. safe_link.rs exists for exactly this reason, after a review demonstrated five separate ways to rebuild the hole it was meant to close.

The guarantee here is narrow and worth stating precisely: holding one of these means the vet ran. It does not mean the value is safe to render, and it says nothing about records read back from the PDS — that is the read-side guard on lexicon::Subscription::site_url.

Structs

VettedSaved

A Saved record whose url has been scheme-checked.

VettedSubscription

A Subscription whose siteUrl has been scheme-checked.

Traits

WritableRecord

What a record-write primitive will accept.