Module context 

Shared evaluator context: host policy + sandbox state.

Context is the carrier of all backend-agnostic configuration: the root AST node, decorator and native-fn registries, module resolvers, capability grants, and the per-run caches a backend uses to thread state across eval_root / run_main invocations.

Most fields are pub so that any backend implementing crate::Evaluator in a different crate can read and update them. Sandbox-relevant state (capabilities, module_resolvers, analyzed) is private: reads go through the &-returning getters and writes through the construction-time with_* / controlled *_module_resolver entry points, so a host cannot silently widen a sandbox after handing the context to an evaluator.

Structs

Capabilities

Context-wide sandbox policy the host hands the evaluator. The per-bit booleans are the capabilities the host grants; per-function requirements live on NativeFnGate. A call goes through iff every bit declared on the fn’s gate is also set here — there is no per-name allowlist or global short-circuit, so a successful call proves that every bit on its gate was granted.

Context

Shared execution environment for one or more evaluations.

GatedNativeFn

Internal helper: a registered native function with its capability gate. pub so backend crates can read both the underlying func and the declared gate when dispatching a call.

LoadingModuleGuard

NativeFnGate

Capability requirements declared per native function at registration time. The gate compares these against the context-wide Capabilities grant when the function is invoked under sandbox.

ResourceBudget

Evaluator-side resource budget.

Enums

CapabilityBit

Canonical assignment of capability bits to stable bit positions.

ResourceBudgetProfile

Evaluator-side resource-budget presets.