@typesol/cli 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -5,6 +5,88 @@ until 1.0, a minor version may change the language, the IDL layout or error code
 
 ## Unreleased
 
+## 0.24.0 — 2026-10-28
+
+Functions as values, closures for any helper, stored `map` to structs and text, Metaplex Core external plugins, and
+the fixes and identical-result compute-unit savings from a full code review: expanded helpers see only their own
+scope, generated clients read only their program's events, and IDLs from the chain are read with limits. Not externally
+audited (see SECURITY.md).
+
+### Added
+- Functions as values: `const h = g`, and functions that return functions (`function adder(n: u64): (x: u64) => u64
+  { return (x) => x + n; }`), which make a closure where they are called (`const add5 = adder(5n)`, `adder(5n)(x)`).
+- Closures given to helpers with type parameters or accounts: the helper is expanded where it is called, its type
+  parameters bound from the call and its accounts the caller's.
+- A stored `map` to structs or text: `const ps: FixedVec<Pair, 8> = xs.map((o) => ({ qty: o.qty, doubled: o.qty * 2n }))`,
+  `const names: FixedVec<FixedString<8>, 4> = xs.map(…)`.
+- A struct argument holding a FixedVec, when the struct is only an argument: read as Anchor sends it (the FixedVec a
+  Borsh Vec), as a `@layout borsh` struct is.
+- Metaplex Core external plugin adapters: `addExternalPlugin`, `removeExternalPlugin`, `writeExternalPluginData` and
+  their Collection forms, for AppData, Oracle and LifecycleHook (and the Linked forms), checked against the Core program
+  (Core itself answers lifecycle hooks with NotAvailable for now).
+
+### Changed
+- Fewer compute units, same results: the PDA bump search builds its seed list once, a growing account reads the rent
+  sysvar once, integers become text two digits at a time, a lone `${n}` template is not copied again, and
+  `list = fixedVec([])` clears the list in place. For example escrow `make` 3638 → 3605, `take_offer` 7117 → 7058,
+  `transfer_tokens` 8467 → 8367 CU.
+- `eventsOf` takes the transaction with its account keys (`transaction.message.accountKeys`, as getTransaction returns
+  it); without them it reads log events only. `errorCode` / `isError` also read the RPC's JSON error
+  (`{ InstructionError: [0, { Custom: 6000 }] }`).
+- `svmConnection`: `accountNotifications` yields after each later transaction that names the account (no snapshot of
+  it as it is), `logsNotifications` honors `{ mentions }` and includes failed transactions (with `err`), simulation
+  errors are in the RPC's JSON shape, and `getTransaction` returns the account keys and each inner instruction's
+  program index.
+- Compiler messages about accounts with a growable Vec say "has a growable Vec" instead of "ends in a Vec", and the
+  field-type list no longer says `Vec<T> (last)`, since a Vec can be any field (0.23.0).
+
+### Fixed
+- A helper expanded where it is called (given a closure), and a function a helper made, read a module constant as
+  the instruction argument of the same name; they now see only their parameters and the module.
+- A struct parameter of a closure or expanded helper could be used after a push, pop or clear moved the Vec it points
+  into (a stale pointer); that is refused like any other reference across the move.
+- A closure parameter named like an account read the account; it is refused.
+- A helper from another file, expanded here or typed from an arrow passed to it, resolved its types with this file's
+  imports (an aliased or unimported type failed to compile, or an annotation was dropped); its own file's imports are
+  used, and `applyT<u64>((v) => …)` takes the type given at the call.
+- A struct with a FixedVec held in a data enum variant was read as Borsh when also an argument; that conflict is refused.
+- Generated clients read only this program's events: `parseEvents` follows the invoke stack and reads a `Program data:`
+  line only while the program is the innermost one running, and `eventsOf` reads only `emitCpi` inner instructions that
+  call the program. Another program can no longer forge them.
+- `watchEvents` skips failed transactions.
+- `typesol client` refuses malformed generic arguments, array lengths that are not whole numbers and `repr` alignments
+  that are not powers of two, and caps generic instantiation (256 types, 16 levels): a ClientIdlError instead of a crash
+  or a hang. Sizing deeply nested structs no longer takes exponential time.
+- Accounts named like `Object.prototype` properties (`constructor`, `toString`, …) are read as given, not inherited.
+- `resolve.<ix>` derives a has_one source that is a PDA (a `config` PDA) before reading it, and names the account to
+  pass when a source is missing.
+- Notes and errors escape control characters from the IDL.
+- Reading an IDL from the chain caps inflation at 16 MiB, checks Anchor's IdlAccount discriminator, and refuses a
+  Program Metadata IDL that links to a URL or another account instead of following it.
+- `typesol/testing`'s `returned()` decodes string, bytes, f32 and f64 return values, and throws for types it cannot
+  decode instead of misreading them.
+
+## 0.23.0 — 2026-10-28
+
+Language limits lifted: `map` and `filter`, any number of growable Vecs per account, closures and arrow functions as
+helper arguments, FixedVec arguments and list fields in events. Existing programs compile to the same bytes. Not
+externally audited (see SECURITY.md).
+
+### Added
+- `map` and `filter` on Vecs, FixedArrays, FixedVecs and Vec arguments. A chain used right away
+  (`xs.filter(f).map(g).reduce(h, 0n)`, `.length`, `for … of`, any list method) is one loop that builds no list;
+  callbacks after a filter get the index among the elements it let through, as in JS. Stored (`const ys = xs.map(f)`),
+  it is a FixedVec on the stack as big as the list it starts from, or as annotated (`const ys: FixedVec<u64, 16> = …`,
+  needed for a `Vec`); a list one element too small aborts with 5104.
+- Arrow functions written as helper arguments (`applyTwice((x) => x * 3n, v)`), typed from the helper's parameter when
+  left unannotated. Given a closure (one that reads the caller's variables), the helper is expanded where it is called,
+  so the closure runs where it can.
+- Any number of growable `Vec<T>` fields in an account, declared anywhere. They are stored after the fixed-size fields,
+  in the order declared (every other field keeps a fixed offset; the IDL lists the stored order), and a push, pop or
+  clear moves the Vecs after it. An account with one Vec is laid out as before.
+- `FixedVec<T, N>` arguments (a Borsh Vec of at most N elements; more fail with 102), and `FixedVec` and `Vec` fields
+  in events.
+
 ## 0.22.0 — 2026-10-28
 
 Generated clients fill in the accounts Anchor's client still asked you to pass (signers from a default signer, PDAs

package/README.md

@@ -7,7 +7,7 @@
 <p align="center">
   <a href="https://github.com/typesol/typesol/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/typesol/typesol/actions/workflows/ci.yml/badge.svg?branch=main"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-3178C6"></a>
-  <a href="CHANGELOG.md"><img alt="Version 0.10.0 release candidate" src="https://img.shields.io/badge/version-0.10.0--rc-9945FF"></a>
+  <a href="https://www.npmjs.com/package/@typesol/cli"><img alt="npm version" src="https://img.shields.io/npm/v/@typesol/cli"></a>
   <img alt="Target: Solana SBF" src="https://img.shields.io/badge/target-Solana%20SBF-14F195">
 </p>
 
@@ -31,9 +31,9 @@ clients read TypeSOL programs unchanged.
   - Every arithmetic operation is checked.
   - Account owner, discriminator, signer, writability and aliasing checks are generated from your parameter types.
   - Constraints follow Anchor's rules and use Anchor's error codes.
-- **Small and fast.** On the same programs, TypeSOL uses 5–46% of Anchor's compute units, with binaries about 10×
-  smaller. It also uses fewer compute units than native Rust and than hand-tuned Pinocchio on every benchmarked
-  instruction.
+- **Small and fast.** In the LiteSVM benchmarks below, TypeSOL uses 5–32% of Anchor's compute units, with binaries
+  about 10× smaller, and fewer compute units than native Rust and hand-tuned Pinocchio on every instruction. On
+  mainnet the results differ by instruction; see [the mainnet table](#on-mainnet).
 - **Reproducible.** The same sources and toolchain produce the same bytes. `typesol verify` reads a deployed program
   from the cluster and checks it, and the IDL published on chain, against its source.
 
@@ -175,14 +175,14 @@ counter.ts ─▶ tsc typecheck ─▶ subset check ─▶ C + typesol_rt.h ─
 
 1. **Typecheck.** The TypeScript compiler checks your code against [`lib/typesol.d.ts`](lib/typesol.d.ts), which
    declares every TypeSOL type and built-in.
-2. **Subset check.** TypeSOL rejects anything outside the language (floats, closures, classes, `any`, foreign imports)
+2. **Subset check.** TypeSOL rejects anything outside the language (floats, classes, `any`, foreign imports)
    with a `file:line:col` diagnostic. Nothing is half-supported.
 3. **Lower.** Instruction bodies become C. Account validation, checked arithmetic, Borsh encoding and CPI plumbing
    come from [`runtime/typesol_rt.h`](runtime/typesol_rt.h).
 4. **Build.** The Agave platform-tools `clang` and `ld.lld` produce the `.so` (SBPF v0 by default; v1 and v2 with
    `--sbpf`).
 
-Runtime failures point back to your source: `Error 6000 Unauthorized (counter.ts:21)`, or
+Runtime failures point back to your source: `Error 6000 Unauthorized (counter.ts:25)`, or
 `TypeSOL: arithmetic overflow (vault.ts:42)`.
 
 ## What you can write
@@ -225,7 +225,8 @@ import { build } from "typesol/compiler";
 const { soPath, idl } = build("programs/counter.ts", "target/counter", programAddress);
 ```
 
-Subpath exports: `typesol/compiler`, `typesol/workspace`, `typesol/cpi`, `typesol/idl`, `typesol/profile`.
+Subpath exports: `typesol/compiler`, `typesol/workspace`, `typesol/cpi`, `typesol/client`, `typesol/idl`,
+`typesol/profile`, `typesol/testing`, `typesol/ts-plugin`.
 
 ## Numbers
 
@@ -236,16 +237,16 @@ shows mean compute units per call (generated by `scripts/readme-bench.ts` from t
 <!-- bench:table -->
 | Instruction | TypeSOL | Pinocchio 0.10 | Native Rust | Anchor 1.0.2 |
 | --- | ---: | ---: | ---: | ---: |
-| counter.initialize | **1,872** | 3,186 | 4,601 | 6,573 |
+| counter.initialize | **1,866** | 3,186 | 4,601 | 6,573 |
 | counter.increment | **110** | 113 | 857 | 2,323 |
-| vault.open | **1,891** | 3,185 | 4,613 | 6,627 |
+| vault.open | **1,885** | 3,185 | 4,613 | 6,627 |
 | vault.deposit | **1,314** | 1,377 | 2,832 | 4,355 |
 | vault.withdraw | **315** | 370 | 1,176 | 3,628 |
 | vault.shut | **161** | 167 | 950 | 2,024 |
-| escrow.make | **3,638** | 6,179 | 9,240 | 13,304 |
+| escrow.make | **3,605** | 6,179 | 9,240 | 13,304 |
 | escrow.take | **4,035** | 4,051 | 8,500 | 14,365 |
 | escrow.refund | **2,716** | 2,769 | 5,695 | 8,449 |
-| binary, counter / vault / escrow | 13.2 / 16.5 / 24.0 KB | 19.6 / 22.9 / 29.4 KB | 27.9 / 35.0 / 46.5 KB | 145.2 / 158.9 / 190.7 KB |
+| binary, counter / vault / escrow | 13.1 / 16.5 / 23.9 KB | 19.6 / 22.9 / 29.4 KB | 27.9 / 35.0 / 46.5 KB | 145.2 / 158.9 / 190.7 KB |
 <!-- /bench:table -->
 
 `initialize`, `open` and `make` include the PDA bump search. TypeSOL hashes PDA candidates with the sha256 and
@@ -306,7 +307,7 @@ Details are in [docs/testing.md](docs/testing.md).
 
 ## Status
 
-**TypeSOL is pre-1.0 (0.22).** Releases follow the organization's
+**TypeSOL is pre-1.0 (0.24).** Releases follow the organization's
 [versioning policy](https://github.com/typesol/.github/blob/main/VERSIONING.md); [CHANGELOG.md](CHANGELOG.md) lists every
 change.
 - The compiler, runtime and tooling have been through internal security reviews and are covered by the tests above.

package/SECURITY.md

@@ -4,7 +4,7 @@ TypeSOL generates programs that hold funds. Treat it accordingly.
 
 ## Status
 
-- Version 0.10 was reviewed internally (runtime, code generation and tooling). Every release is covered by execution
+- The compiler, runtime and tooling have been through internal security reviews. Every release is covered by execution
   tests, differential tests against Anchor, and randomized tests. **TypeSOL has not been audited by an independent
   firm.** Do not put significant value behind programs built with it until an external audit of the compiler and
   runtime is published, and audit your own programs as you would any Solana program.