@typesol/cli 0.12.1 → 0.13.0

package/CHANGELOG.md

@@ -5,6 +5,53 @@ until 1.0, a minor version may change the language, the IDL layout or error code
 
 ## Unreleased
 
+## 0.13.0 — 2026-10-27
+
+Every program in solana-developers/program-examples now ports to TypeSOL: PDA seeds from account fields, remaining
+accounts passed on in CPIs, transfer hooks with extra accounts, `findProgramAddress` and marker accounts. Not externally
+audited (see SECURITY.md).
+
+### Added
+- Transfer hooks with extra accounts: `initExtraAccountMetas(payer, account, mint, systemProgram, extraAccounts)` writes
+  an ExtraAccountMetaList (fixed addresses, PDAs of this program or of another program's account index, with literal,
+  account-key, account-data and instruction-data seeds), byte for byte what spl-tlv-account-resolution writes; Token-2022
+  checks the extra accounts against it on every transfer. `updateExtraAccountMetas(...)` rewrites and resizes a list.
+- Remaining accounts in a CPI: spread them into `invoke`'s account list with the flags they were passed with
+  (`...remainingAccounts()`, Rust's `extend_from_slice`) or all with one role (`...readonly(rest)`,
+  `...writable(rest)`), and take part of them with `rest.slice(a, b)`. A CPI lists at most 32 accounts (5113); a slice
+  out of range fails with 5104.
+- `findProgramAddress(seeds, program)`: the canonical PDA of another program at runtime.
+- PDA seeds from account fields: `Seeds<…, ["@pool.amm", "@mintA", "authority"]>` takes a Pubkey, integer or unit
+  enum field of a struct account parameter, including the account's own (`Seeds<Mut<Offer>, ["offer", "@maker",
+  "@offer.id"], "bump">`), like Anchor's `seeds = [pool.amm.as_ref(), …]`. Recorded in the IDL as account paths
+  (`pool.amm`).
+- Structs with no fields, for marker accounts that are only a discriminator (Anchor `#[account] pub struct
+  NftAuthority {}`).
+
+### Fixed
+- An associated token account created in the instruction (`Ata<Init|InitIfNeeded<TokenAccount>>`) refuses optional
+  TokenProgram / AssociatedTokenProgram / SystemProgram parameters at compile time (they used to fail at runtime with an
+  access violation when left out), and refuses `Owner<…>` / `Executable<…>` (which could never hold).
+- Unit enum values work as seeds in `create`, `signer([...])`, `findProgramAddress` and the other seed lists, one byte
+  each, as they already did in `Seeds<…>`.
+- `rest.slice(a, b)` is typed as something to spread into a CPI only (`RemainingSlice`), with a clear message elsewhere.
+
+### Tooling
+- Ports: the five transfer-hook examples with extra accounts (account-data-as-seed, allow-block-list-token, counter,
+  transfer-cost, transfer-switch) are ported; their tests transfer through Token-2022, which checks the extra accounts.
+  All 46 program-examples are ported now: 9 PORTED, 37 PARTIAL, 0 BLOCKED. The blocked-construct probes
+  (test/ports-blocked.test.ts) are gone with the last blocker.
+- Ports: compression/cnft-burn, cnft-vault, cutils and token-2022/transfer-fee, blocked until now, are ported (PARTIAL;
+  test/ports/README.md). The compression ports run against Bubblegum, SPL Account Compression and Token Metadata, with
+  the leaf hashes, roots and proofs computed in the tests.
+- Ports: the eight remaining program-examples that had not been attempted are ported: basics/repository-layout and
+  token-2022 cpi-guard, group, immutable-owner, interest-bearing, memo-transfer, metadata and nft-meta-data-pointer
+  (all PARTIAL; test/ports/README.md lists the differences). Every one of the 46 programs is now ported or blocked
+  by a named construct.
+- Ports: token-swap is now PORTED (its `amm`, `pool`, authority and liquidity-mint PDAs are all checked
+  declaratively, with no bump arguments); escrow and token-fundraiser check their PDAs declaratively instead of with
+  `requirePda` in the body.
+
 ## 0.12.1 — 2026-10-27
 
 No change to the compiler, the runtime or the generated code.

package/README.md

@@ -183,13 +183,13 @@ Runtime failures point back to your source: `Error 6000 Unauthorized (counter.ts
 | | |
 | --- | --- |
 | **Accounts** | `Signer`, `Account<T>`, `Mut<T>`, `Init<T>`, `InitIfNeeded<T>` (PDAs and associated token accounts), `Zeroed<T>` (up to 10 MiB), optional accounts (`A \| null`), token accounts and mints, programs, sysvars |
-| **Constraints** | `HasOne`, `Seeds` (also under another program; `pdaBump` like `ctx.bumps`), `CloseTo`, `Ata`, `Address`, `Owner`, `Executable`. They are checked before the body runs and recorded in the IDL |
+| **Constraints** | `HasOne`, `Seeds` (also from account fields and under another program; `pdaBump` like `ctx.bumps`), `CloseTo`, `Ata`, `Address`, `Owner`, `Executable`. They are checked before the body runs and recorded in the IDL |
 | **Data** | `u8`…`u128`, `i8`…`i128`, `boolean`, `Pubkey`, `Hash`, nested structs, `FixedArray`, `FixedString`, `Option`, unit enums, data enums (discriminated unions), `Vec` that resizes its account |
 | **Control flow** | `if`, `for`, `while`, `switch` (with narrowing on data enums), ternaries, helper functions across multiple files |
 | **CPIs** | System, SPL Token, Token-2022 (including extension reads and metadata), ATA, Metaplex Token Metadata, Core, Bubblegum. Generic `invoke` with PDA signing, return data, and typed bindings generated from any Anchor IDL (`typesol cpi`) |
 | **Events** | `emit` (log-based) and `emitCpi` (Anchor `emit_cpi!`, through a self-CPI) |
 | **Crypto & oracles** | `sha256`, `keccak256`, Merkle proofs, Ed25519 and secp256k1 signature checks, Pyth pull oracle, Switchboard |
-| **Interfaces** | custom discriminators (`@discriminator`), so a TypeSOL program can be a Token-2022 transfer hook |
+| **Interfaces** | custom discriminators (`@discriminator`), so a TypeSOL program can be a Token-2022 transfer hook, with extra accounts (ExtraAccountMetaList) |
 
 The full reference, with every type, check and built-in, is in [docs/language.md](docs/language.md).
 
@@ -275,7 +275,7 @@ Details are in [docs/testing.md](docs/testing.md).
 
 ## Status
 
-**TypeSOL is pre-1.0 (0.12).** Releases follow the organization's
+**TypeSOL is pre-1.0 (0.13).** Releases follow the organization's
 [versioning policy](https://github.com/typesol/.github/blob/main/VERSIONING.md); [CHANGELOG.md](CHANGELOG.md) lists every
 change.
 - The compiler, runtime and tooling have been through internal security reviews and are covered by the tests above.

package/dist/compiler/analyze.js

@@ -657,8 +657,6 @@ function analyzeStructs(items, aliases, dataEnums, reporter, scopeFor, fstrings)
                     reporter.fail(m, "a Vec<T> field must be the last field of the struct (its length changes the account size)");
                 fields.push({ name, type });
             }
-            if (fields.length === 0)
-                reporter.fail(decl, "structs need at least one field");
             checkSnakeDuplicates(decl.members.map((m) => ({ name: m.name.text, node: m })), "fields", reporter);
             const name = decl.name.text;
             structs.set(name, {
@@ -923,8 +921,8 @@ function analyzeInstruction(fn, reporter, scope, structs) {
         const c = a.constraints;
         if (a.kind.kind === "token" && a.kind.init && !c.ata)
             reporter.fail(a.node, 'Init<TokenAccount> / InitIfNeeded<TokenAccount> create associated token accounts: wrap them in Ata<…, "owner", "mint">');
-        if (a.kind.kind === "token" && a.kind.init && (c.hasOne.length || c.seeds || c.address))
-            reporter.fail(a.node, "an associated token account created here is checked against Ata<…>'s owner and mint; drop HasOne/Seeds/Address");
+        if (a.kind.kind === "token" && a.kind.init && (c.hasOne.length || c.seeds || c.address || c.owner || c.executable))
+            reporter.fail(a.node, "an associated token account created here is checked against Ata<…>'s owner and mint; drop HasOne/Seeds/Address/Owner/Executable");
         if (!c.hasOne.length && !c.seeds && !c.closeTo && !c.ata)
             continue;
         const struct = a.kind.kind === "account" || a.kind.kind === "init" || a.kind.kind === "initIfNeeded" || a.kind.kind === "zeroed" ? a.kind.struct : undefined;
@@ -981,7 +979,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
         const c = a.constraints;
         const refs = [
             ...c.hasOne,
-            ...(c.seeds?.names ?? []).filter((n) => n.startsWith("@")).map((n) => n.slice(1)),
+            ...(c.seeds?.names ?? []).filter((n) => n.startsWith("@")).map((n) => n.slice(1).split(".")[0]),
             ...(c.seeds?.program?.startsWith("@") ? [c.seeds.program.slice(1)] : []),
             ...(c.closeTo ? [c.closeTo] : []),
             ...(c.ata

package/dist/compiler/emit/calls.d.ts

@@ -10,6 +10,16 @@ export declare abstract class CallEmitter extends ExpressionEmitter {
     protected vecMethod(node: ts.CallExpression, method: string, v: Ref): Value | undefined;
     /** sha256(...) / keccak256(...) over strings, Pubkeys, Hashes, integers (LE) and booleans. */
     protected hashCall(node: ts.CallExpression, fn: "sha256" | "keccak256"): Value;
+    /**
+     * The extra accounts of a transfer hook, as ExtraAccountMeta records (35 bytes each): `{ address, isSigner?, isWritable? }`
+     * for a fixed address, `{ seeds: [...], program?, isSigner?, isWritable? }` for a PDA of this program (or, with
+     * `program: index`, of the program at that account index). Seeds: string literals, seedAccountKey(i),
+     * seedAccountData(i, offset, length), seedInstructionData(offset, length); packed into 32 bytes.
+     */
+    protected extraAccountMetas(node: ts.Expression): {
+        name: string;
+        count: number;
+    };
     /** `remainingAccounts()` or a const bound to it. */
     protected isRemaining(node: ts.Expression): boolean;
     /** C pointer (`TsAccount *`) for an expression naming a remaining account, or undefined. */

package/dist/compiler/emit/calls.js

@@ -352,6 +352,18 @@ export class CallEmitter extends ExpressionEmitter {
                 this.line(`TS_TRY(ts_ata_address(${o.c}, ${m.c}, ${tp.c}, &${t}));`);
                 return { c: `(&${t})`, type: PUBKEY };
             }
+            case "findProgramAddress": {
+                // Pubkey::find_program_address(seeds, program).0: the canonical PDA of any program.
+                if (args.length !== 2)
+                    this.fail(node, "findProgramAddress(seeds, program) takes the seeds and the program's address");
+                const seeds = this.seeds(args[0], 0);
+                const program = this.expect(this.expr(args[1], PUBKEY), PUBKEY, args[1]);
+                const t = this.tmp("pda");
+                const b = this.tmp("bump");
+                this.line(`SolPubkey ${t}; uint8_t ${b};`);
+                this.line(`if (sol_try_find_program_address(${seeds.name}, ${seeds.count}, ${program.c}, &${t}, &${b}) != SUCCESS) TS_FAIL(TS_ERR_SEEDS, "TypeSOL: no program address for these seeds");`);
+                return { c: `(&${t})`, type: PUBKEY };
+            }
             case "metadataAddress": {
                 if (args.length !== 1)
                     this.fail(node, "metadataAddress(mint) takes the mint");
@@ -361,9 +373,10 @@ export class CallEmitter extends ExpressionEmitter {
                 this.line(`TS_TRY(ts_metadata_address(${m.c}, &${t}));`);
                 return { c: `(&${t})`, type: PUBKEY };
             }
-            case "initExtraAccountMetas": {
-                if (args.length !== 4)
-                    this.fail(node, "initExtraAccountMetas(payer, account, mint, systemProgram) takes four accounts");
+            case "initExtraAccountMetas":
+            case "updateExtraAccountMetas": {
+                if (args.length !== 4 && args.length !== 5)
+                    this.fail(node, `${builtin}(payer, account, mint, systemProgram, extraAccounts?)`);
                 const payer = this.accountParam(args[0], "the payer");
                 if (payer.kind.kind !== "signer" || !payer.kind.mut)
                     this.fail(args[0], "the payer must be a Mut<Signer>");
@@ -374,7 +387,9 @@ export class CallEmitter extends ExpressionEmitter {
                 const sys = this.accountParam(args[3], "the system program");
                 if (sys.kind.kind !== "system")
                     this.fail(args[3], "pass the SystemProgram parameter");
-                this.line(`TS_TRY(ts_init_extra_metas(params, a_${payer.name}, a_${acct.name}, &a_${mint.name}->key));`);
+                const { name: entries, count } = args[4] ? this.extraAccountMetas(args[4]) : { name: "NULL", count: 0 };
+                const fn = builtin === "initExtraAccountMetas" ? "ts_init_extra_metas" : "ts_update_extra_metas";
+                this.line(`TS_TRY(${fn}(params, a_${payer.name}, a_${acct.name}, &a_${mint.name}->key, ${entries}, ${count}));`);
                 return undefined;
             }
             case "remainingAccounts":
@@ -513,6 +528,8 @@ export class CallEmitter extends ExpressionEmitter {
         }
         if (ts.isPropertyAccessExpression(callee) && ts.isCallExpression(callee.expression) && this.exportName(callee.expression.expression) === "fixedArray")
             this.fail(callee.expression, "fixedArray<T, N>(fill) is only allowed as a local declaration: const xs = fixedArray<u64, 4>(0n)");
+        if (ts.isPropertyAccessExpression(callee) && callee.name.text === "slice" && this.isRemaining(callee.expression))
+            this.fail(node, "rest.slice(a, b) is only for spreading into a CPI's accounts: invoke(p, [..., ...readonly(rest.slice(a, b))], data)");
         this.fail(node, "unsupported call");
     }
     vecMethod(node, method, v) {
@@ -658,6 +675,97 @@ export class CallEmitter extends ExpressionEmitter {
         this.line(`sol_${fn}(${arr}, ${parts.length}, (uint8_t *)&${out});`);
         return { c: `(&${out})`, type: HASH };
     }
+    /**
+     * The extra accounts of a transfer hook, as ExtraAccountMeta records (35 bytes each): `{ address, isSigner?, isWritable? }`
+     * for a fixed address, `{ seeds: [...], program?, isSigner?, isWritable? }` for a PDA of this program (or, with
+     * `program: index`, of the program at that account index). Seeds: string literals, seedAccountKey(i),
+     * seedAccountData(i, offset, length), seedInstructionData(offset, length); packed into 32 bytes.
+     */
+    extraAccountMetas(node) {
+        if (!ts.isArrayLiteralExpression(node))
+            this.fail(node, "the extra accounts must be an array literal of { address } / { seeds } objects");
+        const bytes = [];
+        const fixups = [];
+        const small = (e, what, max = 255) => {
+            if (!ts.isBigIntLiteral(e))
+                this.fail(e, `${what} must be a bigint literal`);
+            const v = Number(BigInt(e.text.replace(/n$/, "")));
+            if (v < 0 || v > max)
+                this.fail(e, `${what} must be 0..${max}`);
+            return v;
+        };
+        for (const el of node.elements) {
+            if (!ts.isObjectLiteralExpression(el))
+                this.fail(el, "each extra account is { address, … } or { seeds: [...], … }");
+            const props = new Map();
+            for (const p of el.properties) {
+                if (!ts.isPropertyAssignment(p) || !ts.isIdentifier(p.name))
+                    this.fail(p, "use plain properties: address, seeds, program, isSigner, isWritable");
+                if (!["address", "seeds", "program", "isSigner", "isWritable"].includes(p.name.text))
+                    this.fail(p.name, `unknown property "${p.name.text}"`);
+                props.set(p.name.text, p.initializer);
+            }
+            const flag = (k) => {
+                const v = props.get(k);
+                if (!v)
+                    return 0;
+                if (v.kind === ts.SyntaxKind.TrueKeyword)
+                    return 1;
+                if (v.kind === ts.SyntaxKind.FalseKeyword)
+                    return 0;
+                this.fail(v, `${k} must be true or false`);
+            };
+            const start = bytes.length;
+            const address = props.get("address");
+            const seeds = props.get("seeds");
+            if (!!address === !!seeds)
+                this.fail(el, "give either address or seeds");
+            if (address) {
+                if (props.has("program"))
+                    this.fail(props.get("program"), "program goes with seeds, not with address");
+                const v = this.expect(this.expr(address, PUBKEY), PUBKEY, address);
+                bytes.push(0, ...new Array(32).fill(0));
+                fixups.push({ offset: start + 1, c: v.c });
+            }
+            else {
+                if (!ts.isArrayLiteralExpression(seeds))
+                    this.fail(seeds, "seeds must be an array literal");
+                const packed = [];
+                for (const s of seeds.elements) {
+                    if (ts.isStringLiteral(s)) {
+                        const b = [...Buffer.from(s.text, "utf8")];
+                        if (b.length > 32)
+                            this.fail(s, "a literal seed can be at most 32 bytes");
+                        packed.push(1, b.length, ...b);
+                        continue;
+                    }
+                    const fn = ts.isCallExpression(s) ? this.exportName(s.expression) : undefined;
+                    const a = ts.isCallExpression(s) ? s.arguments : [];
+                    if (fn === "seedInstructionData" && a.length === 2)
+                        packed.push(2, small(a[0], "the data index"), small(a[1], "the length"));
+                    else if (fn === "seedAccountKey" && a.length === 1)
+                        packed.push(3, small(a[0], "the account index"));
+                    else if (fn === "seedAccountData" && a.length === 3)
+                        packed.push(4, small(a[0], "the account index"), small(a[1], "the data index"), small(a[2], "the length"));
+                    else
+                        this.fail(s, "a seed is a string literal, seedAccountKey(i), seedAccountData(i, offset, length) or seedInstructionData(offset, length)");
+                }
+                if (packed.length > 32)
+                    this.fail(seeds, `the packed seeds take ${packed.length} bytes; at most 32 fit`);
+                const program = props.get("program");
+                bytes.push(program ? 128 + small(program, "program (an account index)", 127) : 1, ...packed, ...new Array(32 - packed.length).fill(0));
+            }
+            bytes.push(flag("isSigner"), flag("isWritable"));
+        }
+        const count = node.elements.length;
+        if (!count)
+            return { name: "NULL", count: 0 };
+        const name = this.tmp("extra_metas");
+        this.line(`${fixups.length ? "" : "static const "}uint8_t ${name}[${bytes.length}] = ${cBytes(bytes)};`);
+        for (const f of fixups)
+            this.line(`ts_memcpy(${name} + ${f.offset}, ${f.c}, 32);`);
+        return { name, count };
+    }
     /** `remainingAccounts()` or a const bound to it. */
     isRemaining(node) {
         if (ts.isIdentifier(node))

package/dist/compiler/emit/cpi.d.ts

@@ -66,6 +66,14 @@ export declare abstract class CpiEmitter extends CallEmitter {
     protected coreOp(node: ts.CallExpression, core: AccountParam, method: string): undefined;
     /** Bubblegum (compressed NFTs on SPL account compression): createTree, mint (MintV1, no collection, no creators). */
     protected bubblegumOp(node: ts.CallExpression, bg: AccountParam, method: string): undefined;
+    /**
+     * `remainingAccounts()` (or a const bound to it): every remaining account; `rest.slice(a, b?)`: indexes a..b of them
+     * (both checked against the count, 5104). C expressions for the range, relative to the first remaining account.
+     */
+    protected remainingRange(node: ts.Expression): {
+        from: string;
+        to: string;
+    } | undefined;
     protected invoke(node: ts.CallExpression): undefined;
     /**
      * A byte buffer written front to back. Its C declaration is patched in afterwards so it is

package/dist/compiler/emit/cpi.js

@@ -63,8 +63,14 @@ export class CpiEmitter extends CallEmitter {
                 this.line(`${info.c} ${t} = ${typed.c};`);
                 parts.push(`{(const uint8_t *)&${t}, ${info.bytes}}`);
             }
+            else if (v.type.kind === "enum") {
+                // A unit enum value is its variant index, one byte (as in Seeds<…> and Borsh).
+                const t = this.tmp("seed");
+                this.line(`uint8_t ${t} = (uint8_t)(${v.c});`);
+                parts.push(`{(const uint8_t *)&${t}, 1}`);
+            }
             else
-                this.fail(el, "seeds can be strings, Pubkeys or integers");
+                this.fail(el, "seeds can be strings, Pubkeys, integers or unit enum values");
         }
         const name = this.tmp("seeds");
         const slots = parts.length + extra;
@@ -168,6 +174,8 @@ export class CpiEmitter extends CallEmitter {
             const p = this.ix.accounts.find((o) => o.kind.kind === kind);
             if (!p)
                 this.fail(node, `${call}(...) needs ${what} parameter`);
+            if (p.optional)
+                this.fail(p.node, `${call}(...) needs "${p.name}": it cannot be optional`);
             return p;
         };
         const ataProgram = need("ataProgram", "an AssociatedTokenProgram");
@@ -647,6 +655,27 @@ export class CpiEmitter extends CallEmitter {
         }
         this.fail(node.expression, `Bubblegum supports createTree and mint, not ${method}`);
     }
+    /**
+     * `remainingAccounts()` (or a const bound to it): every remaining account; `rest.slice(a, b?)`: indexes a..b of them
+     * (both checked against the count, 5104). C expressions for the range, relative to the first remaining account.
+     */
+    remainingRange(node) {
+        const n = this.ix.accounts.length;
+        const count = `(params->ka_num - ${n})`;
+        if (this.isRemaining(node))
+            return { from: "0", to: count };
+        if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression) || node.expression.name.text !== "slice")
+            return undefined;
+        if (!this.isRemaining(node.expression.expression))
+            return undefined;
+        if (node.arguments.length < 1 || node.arguments.length > 2)
+            this.fail(node, "slice(start, end?) takes one or two indexes");
+        // Both ends may equal the count (an empty slice at the end).
+        const from = this.index(node.arguments[0], `${count} + 1`);
+        const to = node.arguments[1] ? this.index(node.arguments[1], `${count} + 1`) : count;
+        this.line(`if (${from} > ${to}) TS_FAIL(TS_ERR_INDEX, "TypeSOL: remaining accounts slice out of range");`);
+        return { from, to };
+    }
     invoke(node) {
         const a = node.arguments;
         if (a.length !== 3 && a.length !== 4)
@@ -665,11 +694,26 @@ export class CpiEmitter extends CallEmitter {
             programKey = `&a_${program.name}->key`;
         }
         const hasSeeds = a.length === 4;
-        // Accounts: readonly(x) / writable(x) / readonlySigner(x) / writableSigner(x)
+        // Accounts: readonly(x) / writable(x) / readonlySigner(x) / writableSigner(x), and the remaining accounts spread in:
+        // `...remainingAccounts()` (each with the flags it was passed with, Rust's `extend_from_slice`) or
+        // `...readonly(rest)` / `...writable(rest)` (all with that role).
         if (!ts.isArrayLiteralExpression(a[1]))
             this.fail(a[1], "accounts must be an array literal");
         const metas = [];
+        const parts = [];
         for (const el of a[1].elements) {
+            if (ts.isSpreadElement(el)) {
+                if (!this.ix)
+                    this.fail(el, "remainingAccounts() is only available in instructions");
+                const inner = el.expression;
+                const fnName = ts.isCallExpression(inner) ? this.exportName(inner.expression) : undefined;
+                const wrapped = ts.isCallExpression(inner) && (fnName === "readonly" || fnName === "writable") && inner.arguments.length === 1;
+                const range = this.remainingRange(wrapped ? inner.arguments[0] : inner);
+                if (!range)
+                    this.fail(el, "spread the remaining accounts: ...remainingAccounts(), ...readonly(rest), ...writable(rest) or rest.slice(a, b)");
+                parts.push({ kind: "spread", mode: wrapped ? fnName : "asPassed", ...range });
+                continue;
+            }
             const fn = ts.isCallExpression(el) ? this.exportName(el.expression) : undefined;
             if (!ts.isCallExpression(el) || !fn || !["readonly", "writable", "readonlySigner", "writableSigner"].includes(fn) || el.arguments.length !== 1)
                 this.fail(el, "each account must be readonly(x), writable(x), readonlySigner(x) or writableSigner(x)");
@@ -683,6 +727,7 @@ export class CpiEmitter extends CallEmitter {
                 if (isS && !hasSeeds)
                     this.line(`TS_TRY(ts_check_signer(${h}));`);
                 metas.push(`{&${h}->key, ${isW}, ${isS}}`);
+                parts.push({ kind: "meta", c: metas[metas.length - 1] });
                 continue;
             }
             const acct = this.accountParam(el.arguments[0], `${fn}()'s argument`);
@@ -691,6 +736,7 @@ export class CpiEmitter extends CallEmitter {
             if (isS && acct.kind.kind !== "signer" && !hasSeeds)
                 this.fail(el, `"${acct.name}" did not sign; pass signerSeeds to sign for a PDA, or declare it Signer`);
             metas.push(`{&a_${acct.name}->key, ${isW}, ${isS}}`);
+            parts.push({ kind: "meta", c: metas[metas.length - 1] });
         }
         // The CPI's account list is built in a buffer with room for one entry per instruction account.
         if (metas.length > MAX_ACCOUNTS)
@@ -746,9 +792,38 @@ export class CpiEmitter extends CallEmitter {
         finish(a[2]);
         const seeds = hasSeeds ? this.signingSeeds(a[3]) : { name: "NULL", count: 0 };
         const metasName = this.tmp("metas");
-        this.line(`SolAccountMeta ${metasName}[${Math.max(metas.length, 1)}] = {${metas.join(", ")}};`);
+        let count = String(metas.length);
+        if (parts.some((p) => p.kind === "spread")) {
+            // Room for every account of the instruction (ts_invoke's scratch holds TS_MAX_ACCOUNTS records).
+            const n = this.ix.accounts.length;
+            const cnt = this.tmp("nmetas");
+            this.line(`SolAccountMeta ${metasName}[TS_MAX_ACCOUNTS];`);
+            this.line(`uint64_t ${cnt} = 0;`);
+            const spreads = parts.filter((p) => p.kind === "spread");
+            const total = [String(metas.length), ...spreads.map((p) => `(${p.to} - ${p.from})`)].join(" + ");
+            this.line(`if (${total} > TS_MAX_ACCOUNTS) TS_FAIL(TS_ERR_TOO_MANY_ACCOUNTS, "TypeSOL: the CPI lists more than ${MAX_ACCOUNTS} accounts");`);
+            for (const p of parts) {
+                if (p.kind === "meta") {
+                    this.line(`${metasName}[${cnt}++] = (SolAccountMeta)${p.c};`);
+                    continue;
+                }
+                const i = this.tmp("ri");
+                const r = this.tmp("racct");
+                this.line(`for (uint64_t ${i} = ${n} + ${p.from}; ${i} < ${n} + ${p.to}; ${i}++) {`);
+                this.line(`  TsAccount *${r} = params->ka[${i}];`);
+                if (p.mode === "writable")
+                    this.line(`  TS_TRY(ts_check_writable(${r}));`);
+                const w = p.mode === "asPassed" ? `${r}->is_writable` : p.mode === "writable" ? "1" : "0";
+                const sg = p.mode === "asPassed" ? `${r}->is_signer` : "0";
+                this.line(`  ${metasName}[${cnt}++] = (SolAccountMeta){&${r}->key, ${w}, ${sg}};`);
+                this.line(`}`);
+            }
+            count = cnt;
+        }
+        else
+            this.line(`SolAccountMeta ${metasName}[${Math.max(metas.length, 1)}] = {${metas.join(", ")}};`);
         const ixName = this.tmp("cpi");
-        this.line(`SolInstruction ${ixName} = {${programKey}, ${metasName}, ${metas.length}, ${buf}, ${len}};`);
+        this.line(`SolInstruction ${ixName} = {${programKey}, ${metasName}, ${count}, ${buf}, ${len}};`);
         if (hasSeeds) {
             const signer = this.tmp("signer");
             this.line(`SolSignerSeeds ${signer} = {${seeds.name}, ${seeds.count}};`);

package/dist/compiler/emit/function.js

@@ -368,6 +368,27 @@ export class FunctionEmitter extends StatementEmitter {
                     // "@name" refers to an account parameter (its key) or an argument (its bytes); anything else is a literal.
                     const ref = raw.startsWith("@") ? raw.slice(1) : undefined;
                     const n = ref ?? raw;
+                    // "@acct.field": a field of a struct account parameter (its data was checked in the head), Anchor's
+                    // `seeds = [pool.amm.as_ref()]`. The account may be this one (`seeds = [offer.id.to_le_bytes()]`).
+                    if (ref?.includes(".")) {
+                        const [owner, field, ...rest] = ref.split(".");
+                        const o = ix.accounts.find((x) => x.name === owner);
+                        if (!o || o.kind.kind !== "account" || rest.length)
+                            this.reporter.fail(a.node, `Seeds: "@${ref}" must name a field of a struct account parameter ("@vault.owner")`);
+                        const st = o.kind.struct;
+                        const f = st.fields.find((x) => x.name === field);
+                        if (!f)
+                            this.reporter.fail(a.node, `Seeds: ${st.name} has no field "${field}"`);
+                        const t = f.type;
+                        if (t.kind === "pubkey")
+                            parts.push(`{(const uint8_t *)&d_${owner}->${field}, 32}`);
+                        else if (t.kind === "int" || t.kind === "enum")
+                            parts.push(`{(const uint8_t *)&d_${owner}->${field}, ${scalarSize(t)}}`);
+                        else
+                            this.reporter.fail(a.node, `Seeds: field "${ref}" of type ${typeName(t)} cannot be a seed (use a Pubkey, an integer or a unit enum)`);
+                        idl.push({ kind: "account", path: `${snakeCase(owner)}.${snakeCase(field)}`, account: st.name });
+                        continue;
+                    }
                     const acct = ref ? ix.accounts.find((o) => o.name === ref) : undefined;
                     const arg = ref ? ix.args.find((o) => o.name === ref) : undefined;
                     if (ref && !acct && !arg)

package/dist/compiler/emit/program.js

@@ -82,6 +82,8 @@ export function emitProgram(analysis, opts = {}) {
         out.push(`typedef struct __attribute__((packed)) {`);
         for (const f of s.fields)
             out.push(`  ${storageDecl(f.type, f.name)};`);
+        if (!s.fields.length)
+            out.push(`  uint8_t __empty[0];`); // a marker account (Anchor `pub struct NftAuthority {}`): discriminator only
         out.push(`} TSS_${s.name};`);
         out.push(`_Static_assert(sizeof(TSS_${s.name}) == ${s.size}, "TSS_${s.name} layout");`);
         if (s.vec)

package/docs/language.md

@@ -25,7 +25,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | Options | `best: Option<u64>` (or `u64 \| null`) — `null`, `=== null`, TypeScript narrowing; `===` between options or with a value follows JS (null equals null, empty never equals a value); empty use aborts (5108); `${opt}` prints the value or `null`. Borsh `option` in arguments/events, fixed `{ is_some, value }` in account data |
 | Vecs | `entries: Vec<Entry>` as the last account field — `get`, `set`, `push(v, payer)`, `pop()`, `clear()`, `.length`; the account is resized (realloc) and rent topped up by `payer`; `Vec<u64>` arguments are read-only views; `pop()` of a Vec of structs works as a statement |
 | Struct arguments | `order: Order`, `ids: FixedArray<u8, 4>`, `orders: Vec<Order>` — fixed layouts, Borsh-identical, validated on entry (bools, enums, option tags, string lengths, enum tags; 102) and read-only |
-| Remaining accounts | `remainingAccounts()` — `.length`, `.get(i)` → `key`, `owner`, `lamports` (writes check writability), `isSigner`, `isWritable`; `loadAccount<T>` / `loadAccountMut<T>` give checked struct views; pass them to `invoke` |
+| Remaining accounts | `remainingAccounts()` — `.length`, `.get(i)` → `key`, `owner`, `lamports` (writes check writability), `isSigner`, `isWritable`; `loadAccount<T>` / `loadAccountMut<T>` give checked struct views; pass them to `invoke`, one at a time or spread: `...remainingAccounts()` (each with the flags it was passed with), `...readonly(rest)` / `...writable(rest)` (all with that role), `rest.slice(a, b)` for part of them; a CPI lists at most 32 accounts (5113) |
 | Struct literals | `book.entries.push({ who: who.key, amount, status: Status.Pending, note }, who)` — every field required |
 | Struct references | `const o = side === Side.Bid ? book.bids.get(i) : book.asks.get(i)` — aliases account data like a JS object reference (no copy); replacing the referenced place (`book.bids.set(i, …)`, `pop()`, `clear()`, `acct.p = …`) while the reference is still used afterwards is a compile error, because JS would keep the old object |
 | Other programs' accounts | `const pool = loadForeign<Pool>(account, AMM_PROGRAM)` — owner, `account:Pool` discriminator and size checked (3007 / 3002 / 3003); `readData<u64>(account, offset)` for raw little-endian reads (bounds-checked, 3003) |
@@ -35,7 +35,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | Option of structs | `home: Option<Point>` in account data — `=== null`, `p.home.x` after narrowing, `p.home = null` / `{ x, y }` |
 | Strings at runtime | `"hello, " + name`, `` `#${n}` `` — built on the 32 KiB heap (5110 when full) |
 | `switch` | on integers (up to 64 bits), enums and data-enum `.kind`, with JS `break` / fallthrough; case labels are literals, constants or enum members |
-| Hashing & signatures | `sha256(...)`, `keccak256(...)` → `Hash`; `merkleVerify(leaf, proof: Vec<Hash>, root)` (sorted-pair keccak, OpenZeppelin convention); `verifyEd25519(instructionsSysvar, signer, message)` checks an Ed25519 precompile instruction in the same transaction; `verifySecp256k1(keccak256(...message) | ethMessageHash(message), recoveryId, r, s, ethAddress)` (the hash must be computed in the program; a passed-in hash could be forged) |
+| Hashing & signatures | `sha256(...)`, `keccak256(...)` → `Hash`; `findProgramAddress(seeds, program)` → the canonical PDA of any program (Rust `Pubkey::find_program_address(..).0`, e.g. a Bubblegum asset id); `merkleVerify(leaf, proof: Vec<Hash>, root)` (sorted-pair keccak, OpenZeppelin convention); `verifyEd25519(instructionsSysvar, signer, message)` checks an Ed25519 precompile instruction in the same transaction; `verifySecp256k1(keccak256(...message) | ethMessageHash(message), recoveryId, r, s, ethAddress)` (the hash must be computed in the program; a passed-in hash could be forged) |
 | Oracles | `pythPrice(update: PythPriceUpdate, feedId, maxAgeSeconds)` (fully verified, feed-matched, fresh); raw `update.price / conf / exponent / publishTime`; `switchboardValue(feed: SwitchboardFeed, expectedFeed, maxStaleSlots, decimals)` (the feed must be the expected one: anyone can create feeds) (mainnet program unless `SwitchboardFeed<"devnet">`) |
 | Multiple files | `import { Side, min } from "./math"` — structs, enums, constants and helpers can live in other files; only the entry file's exported functions are instructions; names are program-wide, so imports from TypeSOL files cannot be renamed; error codes number imported files first |
 | Loops | `for (let i = 0n; i < n; i++)`, `while`, `break`, `continue` — bounded by the compute budget |
@@ -59,7 +59,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | `Account<T>` / `Mut<T>` | owned by this program, 8-byte discriminator matches, data large enough (and writable) |
 | `Init<T>` | writable; `create(payer, seeds)` derives the PDA, verifies it, funds rent, writes the discriminator (up to 10 KiB) |
 | `InitIfNeeded<T>` | `const created = acct.createIfNeeded(payer, seeds)` — creates once; afterwards re-derives the PDA and checks owner, discriminator and size (Anchor `init_if_needed`); `acct.pdaBump` after create |
-| `HasOne<A, "owner">`, `Seeds<A, ["vault", "@owner"], "bump">`, `CloseTo<A, "owner">` | declarative constraints like Anchor's `has_one`, `seeds`/`bump` and `close`: checked before the body (2001 / 2006), close runs when the instruction succeeds; `"@name"` = account key or argument bytes, other strings are literals; recorded as `relations` / `pda` in the IDL. `acct.pdaBump` is the bump (Anchor `ctx.bumps.acct`): the stored field when one is named, else the canonical bump the check found — use it to sign as the PDA |
+| `HasOne<A, "owner">`, `Seeds<A, ["vault", "@owner"], "bump">`, `CloseTo<A, "owner">` | declarative constraints like Anchor's `has_one`, `seeds`/`bump` and `close`: checked before the body (2001 / 2006), close runs when the instruction succeeds; `"@name"` = account key or argument bytes, `"@acct.field"` = a Pubkey, integer or unit enum field of a struct account parameter (also the account's own: `["offer", "@maker", "@offer.id"]`), other strings are literals; recorded as `relations` / `pda` in the IDL. `acct.pdaBump` is the bump (Anchor `ctx.bumps.acct`): the stored field when one is named, else the canonical bump the check found — use it to sign as the PDA |
 | `HasOne<TokenAccount, "mint" \| "owner">`, `HasOne<Mint, "mintAuthority" \| "freezeAuthority">` | token constraints (2014 / 2015 / 2016 / 2017) against the parameter with that name |
 | `Ata<TokenAccount, "owner", "mint">` | the account is the associated token account of those parameters (2009; ATA `pda` in the IDL) |
 | `Ata<Init<TokenAccount>, "owner", "mint">`, `Ata<InitIfNeeded<TokenAccount>, "owner", "mint">` | Anchor `init` / `init_if_needed` with `associated_token::…`: `acct.create(payer)` creates the ATA (fails if it exists); `const created = acct.createIfNeeded(payer)` creates it only when missing, otherwise checks it is that ATA (2009). Then it is a `TokenAccount` of that mint and owner (2014 / 2015). Needs `AssociatedTokenProgram`, `SystemProgram` and a token program parameter; call it at the top level before using the account |
@@ -102,8 +102,14 @@ account written through `.lamports` or `loadAccountMut` is another account of th
 
 `/** @discriminator spl-transfer-hook-interface:execute */` above an instruction replaces its Anchor discriminator with
 sha256(preimage)[..8] (or `@discriminator 0x…` for raw bytes), so a TypeSOL program can be a Token-2022 transfer hook:
-`execute(source, mint, destination, owner, extraMetas, amount)` plus `initExtraAccountMetas(payer, account, mint, systemProgram)`
-for the validation account. See `test/fixtures/hook.ts`.
+`execute(source, mint, destination, owner, extraMetas, ...extraAccounts, amount)` plus
+`initExtraAccountMetas(payer, account, mint, systemProgram, extraAccounts?)` for the validation account (an
+ExtraAccountMetaList). Extra accounts are listed as `{ address, isSigner?, isWritable? }` (a fixed address) or
+`{ seeds: [...], program?, isSigner?, isWritable? }` (a PDA of this program, or with `program: i` of the program at account
+index i), with seeds from string literals, `seedAccountKey(i)`, `seedAccountData(i, offset, length)` and
+`seedInstructionData(offset, length)`; Token-2022 resolves and checks them on every transfer. The first extra account has
+index 5. `updateExtraAccountMetas(...)` rewrites and resizes an existing list. See `test/fixtures/hook.ts` and the
+transfer-hook ports.
 
 ## Calling other programs
 
@@ -140,7 +146,7 @@ an integer literal, an argument, `acct.key` or a scalar field of an account, the
 
 Vecs anywhere but the last account field, growing an account by more than 10 KiB in one instruction, growing a Vec
 inside a helper, data-enum arguments carrying strings/structs, Pubkeys in templates, `?.` / `!` / `**`, `switch` on
-128-bit integers, `mulDiv` beyond u64, transfer hooks with extra accounts, Token Metadata creators/collections, Core plugins, Bubblegum v2 / collections /
+128-bit integers, `mulDiv` beyond u64, Token Metadata creators/collections, Core plugins, Bubblegum v2 / collections /
 transfers, floating point (by design), `do … while`.
 They are rejected at compile time rather than half-supported.
 

package/lib/typesol.d.ts

@@ -84,10 +84,20 @@ export interface RemainingAccount {
   readonly isWritable: boolean;
 }
 
-/** The accounts a client passed beyond the instruction's declared parameters. */
-export interface RemainingAccounts {
+/**
+ * The accounts a client passed beyond the instruction's declared parameters. Spread them into a CPI's account list:
+ * `...remainingAccounts()` passes each with the flags it was passed with (Rust's `extend_from_slice`),
+ * `...readonly(rest)` / `...writable(rest)` pass them all with that role (a cNFT proof, a harvest's sources).
+ */
+export interface RemainingAccounts extends Iterable<CpiAccount> {
   readonly length: u64;
   get(index: bigint): RemainingAccount;
+  /** Indexes start..end (end: all) of them, only to spread into a CPI: `...readonly(rest.slice(0n, proofLength))`. */
+  slice(start: bigint, end?: bigint): RemainingSlice;
+}
+/** Part of the remaining accounts (`rest.slice(a, b)`): spread it into a CPI's account list, directly or via readonly/writable. */
+export interface RemainingSlice extends Iterable<CpiAccount> {
+  readonly __remainingSlice: void;
 }
 export declare function remainingAccounts(): RemainingAccounts;
 
@@ -213,15 +223,53 @@ export interface TokenMetadataProgram extends AccountMeta {
     signerSeeds?: Seed[] | SignerSeeds,
   ): void;
 }
+/** The canonical program address of `seeds` under `program` (Rust `Pubkey::find_program_address(seeds, program).0`). */
+export declare function findProgramAddress(seeds: Seed[], program: Pubkey): Pubkey;
 /** The Metaplex metadata account address of a mint. */
 export declare function metadataAddress(mint: Pubkey): Pubkey;
 
 /**
- * Create the transfer-hook validation account (an empty ExtraAccountMetaList) at PDA ["extra-account-metas", mint].
- * Pair it with instructions tagged `@discriminator spl-transfer-hook-interface:execute` and
+ * Create the transfer-hook validation account (an ExtraAccountMetaList) at PDA ["extra-account-metas", mint], listing
+ * the extra accounts Token-2022 passes to the hook after the standard four and this account (so the first extra account
+ * has index 5). Pair it with instructions tagged `@discriminator spl-transfer-hook-interface:execute` and
  * `@discriminator spl-transfer-hook-interface:initialize-extra-account-metas`.
+ *
+ * Each extra account (a literal list; Rust `ExtraAccountMeta::new_with_pubkey` / `new_with_seeds` /
+ * `new_external_pda_with_seeds`):
+ *  - `{ address: WSOL_MINT, isSigner: false, isWritable: false }`: a fixed address;
+ *  - `{ seeds: ["counter", seedAccountKey(3n)], isWritable: true }`: a PDA of this program;
+ *  - `{ seeds: [...], program: 6n }`: a PDA of the program at account index 6.
+ */
+export declare function initExtraAccountMetas(
+  payer: Mut<Signer>,
+  account: AccountMeta,
+  mint: AccountMeta,
+  systemProgram: SystemProgram,
+  extraAccounts?: ExtraAccountMeta[],
+): void;
+/**
+ * Rewrite this program's existing ExtraAccountMetaList for `mint` (Rust `ExtraAccountMetaList::update`), resizing it to
+ * the new list; `payer` tops it up to the rent of the new size when needed.
  */
-export declare function initExtraAccountMetas(payer: Mut<Signer>, account: AccountMeta, mint: AccountMeta, systemProgram: SystemProgram): void;
+export declare function updateExtraAccountMetas(
+  payer: Mut<Signer>,
+  account: AccountMeta,
+  mint: AccountMeta,
+  systemProgram: SystemProgram,
+  extraAccounts?: ExtraAccountMeta[],
+): void;
+export type ExtraAccountMeta =
+  | { address: Pubkey; isSigner?: boolean; isWritable?: boolean }
+  | { seeds: (string | ExtraAccountSeed)[]; program?: bigint; isSigner?: boolean; isWritable?: boolean };
+export interface ExtraAccountSeed {
+  readonly __extraSeed: void;
+}
+/** Seed::AccountKey: the key of the account at this index of the execute instruction. */
+export declare function seedAccountKey(index: bigint): ExtraAccountSeed;
+/** Seed::AccountData: `length` bytes at `offset` of the data of the account at `index`. */
+export declare function seedAccountData(index: bigint, offset: bigint, length: bigint): ExtraAccountSeed;
+/** Seed::InstructionData: `length` bytes at `offset` of the execute instruction's data. */
+export declare function seedInstructionData(offset: bigint, length: bigint): ExtraAccountSeed;
 
 /** Fields every account parameter exposes. */
 export interface AccountMeta {
@@ -307,7 +355,8 @@ export type Account<T> = Readonly<T> & AccountMeta;
 /** Like `Account<T>` but writable. Also usable as `Mut<Signer>`, `Mut<AccountInfo>`, `Mut<TokenAccount>`. */
 export type Mut<T> = T & AccountMeta;
 
-export type Seed = string | Pubkey | bigint;
+/** A PDA seed: a string, a Pubkey, an integer (at its width) or a unit enum value (one byte). */
+export type Seed = string | Pubkey | bigint | number;
 
 /**
  * The seeds (with the bump) of one PDA signature, for helpers that sign CPIs: declare a `seeds: SignerSeeds`
@@ -343,7 +392,8 @@ export type InitIfNeeded<T> = T extends TokenAccount
  * Declarative constraints, checked before your code runs (like Anchor's account attributes):
  *  - `HasOne<Mut<Vault>, "owner">`: vault.owner must be the key of the parameter named `owner` (union for several).
  *  - `Seeds<Mut<Vault>, ["vault", "@owner"], "bump">`: the account must be the PDA of these seeds; "@name" is an
- *    account parameter (its key) or an argument (its bytes), anything else a literal string; the bump is an optional u8 field.
+ *    account parameter (its key) or an argument (its bytes), "@acct.field" a Pubkey, integer or unit enum field of a struct
+ *    account parameter (this account's own fields too), anything else a literal string; the bump is an optional u8 field.
  *    A fourth argument derives the PDA under another program: `Seeds<AccountInfo, ["metadata", "@mint"], never, "@tokenMetadata">`
  *    ("@param" names a program parameter, or give a base58 address).
  *  - `CloseTo<Mut<Vault>, "owner">`: close the account into `owner` when the instruction succeeds.
@@ -610,7 +660,9 @@ export interface CpiAccount {
   readonly __cpi_account: void;
 }
 export declare function readonly(account: AccountMeta | RemainingAccount): CpiAccount;
+export declare function readonly(accounts: RemainingAccounts | RemainingSlice): Iterable<CpiAccount>;
 export declare function writable(account: AccountMeta | RemainingAccount): CpiAccount;
+export declare function writable(accounts: RemainingAccounts | RemainingSlice): Iterable<CpiAccount>;
 export declare function readonlySigner(account: AccountMeta | RemainingAccount): CpiAccount;
 export declare function writableSigner(account: AccountMeta | RemainingAccount): CpiAccount;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typesol/cli",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Compile a TypeScript-syntax language directly to Solana SBF programs.",
   "type": "module",
   "license": "MIT",

package/runtime/typesol_rt.h

@@ -1197,13 +1197,50 @@ static inline uint64_t ts_mpl_create_v3(TsParams *params, const TsAccount *progr
  * ["extra-account-metas", mint]: TLV = execute discriminator | u32 length 4 | u32 count 0.
  */
 static const uint8_t TS_TRANSFER_HOOK_EXECUTE_DISC[8] = {105, 37, 101, 197, 75, 251, 102, 26};
-static inline uint64_t ts_init_extra_metas(TsParams *params, TsAccount *payer, TsAccount *acct, const SolPubkey *mint) {
+/*
+ * The ExtraAccountMetaList (spl-tlv-account-resolution) at PDA ["extra-account-metas", mint]: the execute
+ * discriminator, a u32 length, then a PodSlice of `n` 35-byte ExtraAccountMeta records (discriminator, 32-byte address
+ * or packed seeds, is_signer, is_writable), which the compiler encodes into `entries`.
+ */
+static inline uint64_t ts_init_extra_metas(TsParams *params, TsAccount *payer, TsAccount *acct, const SolPubkey *mint, const uint8_t *entries,
+                                           uint32_t n) {
   SolSignerSeed seeds[3] = {{(const uint8_t *)"extra-account-metas", 19}, {(const uint8_t *)mint, 32}};
   uint8_t bump;
-  /* 16 bytes in total: the 8-byte discriminator slot holds the execute discriminator. */
-  TS_TRY(ts_create_pda(params, payer, acct, seeds, 2, TS_TRANSFER_HOOK_EXECUTE_DISC, 16, &bump));
-  uint32_t len = 4;
+  uint64_t space = 16 + 35 * (uint64_t)n;
+  TS_TRY(ts_create_pda(params, payer, acct, seeds, 2, TS_TRANSFER_HOOK_EXECUTE_DISC, space, &bump));
+  uint32_t len = 4 + 35 * n;
+  ts_memcpy(acct->data + 8, &len, 4);
+  ts_memcpy(acct->data + 12, &n, 4);
+  if (n) ts_memcpy(acct->data + 16, entries, 35 * (uint64_t)n);
+  return SUCCESS;
+}
+
+/*
+ * ExtraAccountMetaList::update: rewrite an existing list (this program's PDA ["extra-account-metas", mint], holding the
+ * execute discriminator), resizing it to `n` records. The payer tops it up to the rent of the new size when its
+ * lamports fall short, as the program-examples do before `resize`.
+ */
+static inline uint64_t ts_update_extra_metas(TsParams *params, TsAccount *payer, TsAccount *acct, const SolPubkey *mint, const uint8_t *entries,
+                                             uint32_t n) {
+  SolSignerSeed seeds[2] = {{(const uint8_t *)"extra-account-metas", 19}, {(const uint8_t *)mint, 32}};
+  SolPubkey pda;
+  uint8_t bump;
+  if (sol_try_find_program_address(seeds, 2, params->program_id, &pda, &bump) != SUCCESS || !ts_key_eq(&pda, &acct->key))
+    TS_FAIL(TS_ERR_SEEDS, "TypeSOL: not the mint's extra-account-metas PDA");
+  if (!ts_key_eq(&acct->owner, params->program_id)) TS_FAIL(TS_ERR_WRONG_OWNER, "TypeSOL: the extra-account-metas account is not this program's");
+  if (acct->data_len < 16 || ts_ld64(acct->data) != ts_ld64(TS_TRANSFER_HOOK_EXECUTE_DISC))
+    TS_FAIL(TS_ERR_DISCRIMINATOR, "TypeSOL: not an ExtraAccountMetaList");
+  uint64_t new_len = 16 + 35 * (uint64_t)n;
+  uint64_t rent;
+  TS_TRY(ts_minimum_balance(new_len, &rent));
+  if (rent > acct->lamports) TS_TRY(ts_system_transfer(params, payer, acct, rent - acct->lamports));
+  if (new_len > acct->data_len + MAX_PERMITTED_DATA_INCREASE) TS_FAIL(TS_ERR_REALLOC, "TypeSOL: account would grow more than 10 KiB in one instruction");
+  if (new_len > acct->data_len) ts_memzero(acct->data + acct->data_len, new_len - acct->data_len);
+  acct->data_len = new_len;
+  uint32_t len = 4 + 35 * n;
   ts_memcpy(acct->data + 8, &len, 4);
+  ts_memcpy(acct->data + 12, &n, 4);
+  if (n) ts_memcpy(acct->data + 16, entries, 35 * (uint64_t)n);
   return SUCCESS;
 }