Function apply_deny_adapter 

pub fn apply_deny_adapter(
    source: &[u8],
    inherits: InheritConfiguration,
) -> Result<Vec<u8>>

Composes a deny adapter into a Wasm component to block host capabilities that are not explicitly inherited.

Given the raw bytes of a Wasm component (source) and an InheritConfiguration describing which capability sets should remain accessible, this function uses wac-graph to wire a bundled deny-all adapter into the component’s imports. Interfaces on the same semver track as an entry in the allow set (derived from inherits) are left untouched so the host can satisfy them at runtime. All other matching imports are fulfilled by the deny adapter, which refuses every call (typically with an access-denied error).

Imports are matched on the interface they implement, so a named import such as primary (implements spin:key-value/key-value@3.0.0) is treated the same as a plain import of that interface; the label itself is irrelevant.

If the deny adapter has no exports that match the component’s imports (i.e. no plugging is needed), the original source bytes are returned unchanged.