Struct HopperProgramPolicy 

pub struct HopperProgramPolicy {
    pub strict: bool,
    pub enforce_token_checks: bool,
    pub allow_unsafe: bool,
}

Program-level safety policy emitted by #[hopper::program(...)].

Each field is a compile-time lever. The const value ends up inlined at every call site the program evaluates it from, so the branches fold away when a lever is known to be on or off at compile time.

Fields

strict: bool

Program-level intent marker: handlers in this program run under Hopper’s full enforcement envelope.

The actual per-handler behaviour is controlled by the handler’s context parameter type. A handler typed as Ctx<MyAccounts> always runs MyAccounts::bind(ctx)? (which chains into validate(ctx)?) regardless of policy. A handler typed as &mut Context<'_> always receives the context raw. strict = true is the documentation contract that every handler in the module opts into the typed form; strict = false signals the author intends to use raw contexts and accepts the responsibility of calling validate() manually where needed.

The flag is read back by callers at compile time (HOPPER_PROGRAM_POLICY.strict) to specialize code paths that depend on whether the enforcement envelope is active.

enforce_token_checks: bool

Author-maintained token-check intent. The macro records this flag without inserting or removing checks from CPI calls. Explicit strict methods on TransferChecked, BurnChecked, and ApproveChecked check the token owner field; their direct variants also require signer privilege. Signed strict variants accept PDA seeds, whose signing authority is validated during CPI rather than requiring an incoming signer flag.

allow_unsafe: bool

Permit unsafe { ... } blocks inside handler bodies. When false the program macro wraps each handler in #[deny(unsafe_code)]. The lint covers that handler item, not called helpers or dependencies, and ordinary Rust lint override rules apply.

Implementations

impl HopperProgramPolicy

pub const STRICT: Self

Typed-validation and token-check intent enabled; unsafe code permitted. The shipping default. Handler types and helper calls determine checks.

pub const SEALED: Self

STRICT intent plus a default unsafe-code denial on handler items. This does not audit unsafe implementations in called helpers.

pub const RAW: Self

Typed-validation and token-check intent disabled; unsafe code permitted. Typed handlers still bind. Raw handlers own their explicit validation.

pub const fn default_policy() -> Self

The shipping default, identical to HopperProgramPolicy::STRICT.

Exposed as a const fn so downstream macro expansion can reach it from const context without an intermediate binding.

Trait Implementations

impl Clone for HopperProgramPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for HopperProgramPolicy

impl Debug for HopperProgramPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HopperProgramPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Eq for HopperProgramPolicy

impl PartialEq for HopperProgramPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for HopperProgramPolicy