Struct NativeFnGate 

#[non_exhaustive]
pub struct NativeFnGate {
    pub reads_fs: bool,
    pub writes_fs: bool,
    pub network: bool,
    pub reads_clock: bool,
    pub reads_env: bool,
    pub uses_rng: bool,
}

Capability requirements declared per native function at registration time. The gate compares these against the context-wide Capabilities grant when the function is invoked under sandbox.

A pure function (no host capability needed) carries NativeFnGate::default() — every bit zero. The gate check is trivially satisfied by any Capabilities value, including a fully-sandboxed Capabilities::default.

#[non_exhaustive]: future capability bits are added here without a breaking semver bump. External callers should construct via NativeFnGate::default() and set the bits they need rather than relying on positional struct literals.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

reads_fs: bool

Function reads from the filesystem.

writes_fs: bool

Function writes to or mutates the filesystem.

network: bool

Function makes network requests.

reads_clock: bool

Function reads wall / monotonic clocks.

reads_env: bool

Function reads process environment.

uses_rng: bool

Function consumes randomness from a non-deterministic source.

Implementations

impl NativeFnGate

pub fn missing_bits(&self, caps: &Capabilities) -> Vec<&'static str>

Capability bits required by this gate that are not granted in caps. Iteration order is the field-declaration order; runtime uses the first entry as the failure reason, analyzer emits one diagnostic per entry. The returned strings are the canonical CapabilityBit::as_str labels ("reads_fs", "writes_fs", "network", "reads_clock", "reads_env", "uses_rng").

pub fn required_bit_indices(&self) -> Vec<u32>

Capability bit indices this gate requires, in field-declaration order, regardless of any grant. The IR lowering pass emits one CapabilityBit-tagged Op::CheckCap per entry ahead of the guarded Op::CallNative, so the runtime consult fires on every required bit (the grant is checked at dispatch time, not here). Mirrors Self::missing_bits’s ordering but drops the grant filter — lowering doesn’t know the host’s runtime posture, only the static requirement. Indices match CapabilityBit::bit_index (ReadsFs=0 … UsesRng=5).

Trait Implementations

impl Clone for NativeFnGate

fn clone(&self) -> NativeFnGate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NativeFnGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for NativeFnGate

fn default() -> NativeFnGate

Returns the “default value” for a type.