Function apply_deny_adapter 

pub fn apply_deny_adapter(
    source: &[u8],
    inherits: InheritConfiguration,
) -> Result<Vec<u8>>

Composes a deny adapter into a Wasm component to block host capabilities that are not explicitly inherited.

Given the raw bytes of a Wasm component (source) and an InheritConfiguration describing which capability sets should remain accessible, this function uses wac-graph to wire a bundled deny-all adapter into the component’s imports. Interfaces listed in the allow set (derived from inherits) are left untouched so the host can satisfy them at runtime; all other matching imports are fulfilled by the deny adapter, which traps on any call.

If the deny adapter has no exports that match the component’s imports (i.e. no plugging is needed), the original source bytes are returned unchanged.