Struct FsLoader 

pub struct FsLoader { /* private fields */ }

Loader that reads files from the filesystem with std::fs::read_to_string.

This is the production loader used by the CLI; the LSP wraps it with a file-watch invalidation layer in PR 8. lex-core’s resolver code does not reference std::fs — FsLoader is the one place where it does, isolated behind the Loader trait so the rest of the crate stays sandbox- and WASM-friendly.

FsLoader is constructed with the resolution root and rechecks every load against it post-fs::canonicalize, so a symlink pointing outside the root is rejected even though the lexical-only check in [resolve_path] cannot see it. Also rejects non-regular files (devices, FIFOs, directories) before reading, so the loader can’t be tricked into blocking on /dev/zero or allocating against an open device.

Errors map:

• canonicalization fails (file missing, permission denied at a parent, broken symlink, …) → LoadError::NotFound
• canonical path doesn’t sit under canonical root → LoadError::OutsideRoot
• target is not a regular file → LoadError::Io with a clear message
• any other I/O error during read → LoadError::Io

Implementations

impl FsLoader

pub const DEFAULT_MAX_FILE_SIZE: u64

Default per-file size cap: 10 MiB. Generous for realistic Lex source documents (text only) and tight enough to bound memory allocation per include against an adversarial 1 GB file.

pub fn new(root: PathBuf) -> Self

Construct a loader rooted at root with default size limits. The loader stores root’s fs-canonical form (with symlinks resolved); subsequent loads validate that the requested path’s canonical form lives under it.

pub fn with_max_file_size(self, max_file_size: u64) -> Self

Override the default per-file size cap (bytes). Use to widen the limit for projects with genuinely large source files, or tighten it for stricter sandboxes (e.g., LSPs serving untrusted content).

Trait Implementations

impl Loader for FsLoader

fn load(&self, path: &Path) -> Result<LoadedFile, LoadError>

Load the source text for path and return both the contents and a canonical identity for the loaded resource. The path is what the resolver decided on after applying the rules in §4 of the proposal.