pub struct Address(/* private fields */);Expand description
Canonical relative path; invariants enforced at the sole constructor.
Implementations§
Source§impl Address
impl Address
Sourcepub fn parse(raw: &str) -> Result<Self, AxError>
pub fn parse(raw: &str) -> Result<Self, AxError>
Sole constructor; crate::schema restates this grammar as one
pattern for clients. Rejects: empty input, absolute paths,
backslash, : (drive letters and NTFS streams alike), control
characters, empty segments, ./.., and a segment ending in a
dot or whitespace. Fail-closed: not canonical is E_INVALID_ARGS.
Sourcepub fn is_within(&self, prefix: &Address) -> bool
pub fn is_within(&self, prefix: &Address) -> bool
WriteDomain primitive: true iff self equals prefix or lies under
it on a segment boundary. Byte-wise, reflexive, transitive.
Sourcepub fn is_reserved(&self) -> bool
pub fn is_reserved(&self) -> bool
C17 primitive: true iff any segment names protected metadata
(PROTECTED_METADATA), compared without ASCII case, because
Windows resolves .SPRAWLING to the same directory and this
predicate guards the directory rather than the string. ASCII
folding is the whole of it: the names are ASCII, so a Unicode
case table would add a second, version-dependent authority on
the same question.
Any segment rather than the first: a building’s own rules sit at
<building>/.sprawling/, and a run whose write domain is its
building must not reach them. Widening this predicate can only
refuse more, which is the direction a fail-closed check may move
in without a second authority to check it against (crates/kernel/spec/Address.lean
§8-73).