@typesol/cli 0.23.0 → 0.24.1

package/CHANGELOG.md

@@ -1,10 +1,85 @@
 # Changelog
 
-TypeSOL follows [semantic versioning](https://semver.org/) with the 0.x rules described in CONTRIBUTING.md:
-until 1.0, a minor version may change the language, the IDL layout or error codes, and says so here.
+TypeSOL follows the organization's [versioning policy](https://github.com/typesol/.github/blob/main/VERSIONING.md)
+(compiler specifics in CONTRIBUTING.md): until 1.0, a minor version may change the language, the IDL layout or error
+codes, and says so here.
 
 ## Unreleased
 
+## 0.24.1 — 2026-10-28
+
+Smaller programs and fewer compute units, with the same results; no change to the language, IDLs or error codes. Also
+new contributor docs (repository layout, a guide to the C runtime). Not externally audited (see SECURITY.md).
+
+### Performance
+- Smaller programs, same results: the rent calculation no longer links soft-float (an exact integer equivalent,
+  checked against IEEE doubles), and every failure logs through one shared call. The benchmarked programs are 11.6%
+  smaller in total (counter 13.1 → 11.0 KB, escrow 23.9 → 21.3 KB). A failing instruction costs 2 more compute units;
+  successful ones are unchanged.
+- An identical signer-seed list in the same scope reuses the array declared for the first CPI (escrow `take_offer`
+  7058 → 7044, `refund_offer` 4287 → 4271).
+
+## 0.24.0 — 2026-10-28
+
+Functions as values, closures for any helper, stored `map` to structs and text, Metaplex Core external plugins, and
+the fixes and identical-result compute-unit savings from a full code review: expanded helpers see only their own
+scope, generated clients read only their program's events, and IDLs from the chain are read with limits. Not externally
+audited (see SECURITY.md).
+
+### Added
+- Functions as values: `const h = g`, and functions that return functions (`function adder(n: u64): (x: u64) => u64
+  { return (x) => x + n; }`), which make a closure where they are called (`const add5 = adder(5n)`, `adder(5n)(x)`).
+- Closures given to helpers with type parameters or accounts: the helper is expanded where it is called, its type
+  parameters bound from the call and its accounts the caller's.
+- A stored `map` to structs or text: `const ps: FixedVec<Pair, 8> = xs.map((o) => ({ qty: o.qty, doubled: o.qty * 2n }))`,
+  `const names: FixedVec<FixedString<8>, 4> = xs.map(…)`.
+- A struct argument holding a FixedVec, when the struct is only an argument: read as Anchor sends it (the FixedVec a
+  Borsh Vec), as a `@layout borsh` struct is.
+- Metaplex Core external plugin adapters: `addExternalPlugin`, `removeExternalPlugin`, `writeExternalPluginData` and
+  their Collection forms, for AppData, Oracle and LifecycleHook (and the Linked forms), checked against the Core program
+  (Core itself answers lifecycle hooks with NotAvailable for now).
+
+### Changed
+- Fewer compute units, same results: the PDA bump search builds its seed list once, a growing account reads the rent
+  sysvar once, integers become text two digits at a time, a lone `${n}` template is not copied again, and
+  `list = fixedVec([])` clears the list in place. For example escrow `make` 3638 → 3605, `take_offer` 7117 → 7058,
+  `transfer_tokens` 8467 → 8367 CU.
+- `eventsOf` takes the transaction with its account keys (`transaction.message.accountKeys`, as getTransaction returns
+  it); without them it reads log events only. `errorCode` / `isError` also read the RPC's JSON error
+  (`{ InstructionError: [0, { Custom: 6000 }] }`).
+- `svmConnection`: `accountNotifications` yields after each later transaction that names the account (no snapshot of
+  it as it is), `logsNotifications` honors `{ mentions }` and includes failed transactions (with `err`), simulation
+  errors are in the RPC's JSON shape, and `getTransaction` returns the account keys and each inner instruction's
+  program index.
+- Compiler messages about accounts with a growable Vec say "has a growable Vec" instead of "ends in a Vec", and the
+  field-type list no longer says `Vec<T> (last)`, since a Vec can be any field (0.23.0).
+
+### Fixed
+- A helper expanded where it is called (given a closure), and a function a helper made, read a module constant as
+  the instruction argument of the same name; they now see only their parameters and the module.
+- A struct parameter of a closure or expanded helper could be used after a push, pop or clear moved the Vec it points
+  into (a stale pointer); that is refused like any other reference across the move.
+- A closure parameter named like an account read the account; it is refused.
+- A helper from another file, expanded here or typed from an arrow passed to it, resolved its types with this file's
+  imports (an aliased or unimported type failed to compile, or an annotation was dropped); its own file's imports are
+  used, and `applyT<u64>((v) => …)` takes the type given at the call.
+- A struct with a FixedVec held in a data enum variant was read as Borsh when also an argument; that conflict is refused.
+- Generated clients read only this program's events: `parseEvents` follows the invoke stack and reads a `Program data:`
+  line only while the program is the innermost one running, and `eventsOf` reads only `emitCpi` inner instructions that
+  call the program. Another program can no longer forge them.
+- `watchEvents` skips failed transactions.
+- `typesol client` refuses malformed generic arguments, array lengths that are not whole numbers and `repr` alignments
+  that are not powers of two, and caps generic instantiation (256 types, 16 levels): a ClientIdlError instead of a crash
+  or a hang. Sizing deeply nested structs no longer takes exponential time.
+- Accounts named like `Object.prototype` properties (`constructor`, `toString`, …) are read as given, not inherited.
+- `resolve.<ix>` derives a has_one source that is a PDA (a `config` PDA) before reading it, and names the account to
+  pass when a source is missing.
+- Notes and errors escape control characters from the IDL.
+- Reading an IDL from the chain caps inflation at 16 MiB, checks Anchor's IdlAccount discriminator, and refuses a
+  Program Metadata IDL that links to a URL or another account instead of following it.
+- `typesol/testing`'s `returned()` decodes string, bytes, f32 and f64 return values, and throws for types it cannot
+  decode instead of misreading them.
+
 ## 0.23.0 — 2026-10-28
 
 Language limits lifted: `map` and `filter`, any number of growable Vecs per account, closures and arrow functions as

package/README.md

@@ -7,7 +7,7 @@
 <p align="center">
   <a href="https://github.com/typesol/typesol/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/typesol/typesol/actions/workflows/ci.yml/badge.svg?branch=main"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-3178C6"></a>
-  <a href="CHANGELOG.md"><img alt="Version 0.10.0 release candidate" src="https://img.shields.io/badge/version-0.10.0--rc-9945FF"></a>
+  <a href="https://www.npmjs.com/package/@typesol/cli"><img alt="npm version" src="https://img.shields.io/npm/v/@typesol/cli"></a>
   <img alt="Target: Solana SBF" src="https://img.shields.io/badge/target-Solana%20SBF-14F195">
 </p>
 
@@ -31,9 +31,9 @@ clients read TypeSOL programs unchanged.
   - Every arithmetic operation is checked.
   - Account owner, discriminator, signer, writability and aliasing checks are generated from your parameter types.
   - Constraints follow Anchor's rules and use Anchor's error codes.
-- **Small and fast.** On the same programs, TypeSOL uses 5–46% of Anchor's compute units, with binaries about 10×
-  smaller. It also uses fewer compute units than native Rust and than hand-tuned Pinocchio on every benchmarked
-  instruction.
+- **Small and fast.** In the LiteSVM benchmarks below, TypeSOL uses 5–32% of Anchor's compute units, with binaries
+  about 10× smaller, and fewer compute units than native Rust and hand-tuned Pinocchio on every instruction. On
+  mainnet the results differ by instruction; see [the mainnet table](#on-mainnet).
 - **Reproducible.** The same sources and toolchain produce the same bytes. `typesol verify` reads a deployed program
   from the cluster and checks it, and the IDL published on chain, against its source.
 
@@ -175,14 +175,14 @@ counter.ts ─▶ tsc typecheck ─▶ subset check ─▶ C + typesol_rt.h ─
 
 1. **Typecheck.** The TypeScript compiler checks your code against [`lib/typesol.d.ts`](lib/typesol.d.ts), which
    declares every TypeSOL type and built-in.
-2. **Subset check.** TypeSOL rejects anything outside the language (floats, closures, classes, `any`, foreign imports)
+2. **Subset check.** TypeSOL rejects anything outside the language (floats, classes, `any`, foreign imports)
    with a `file:line:col` diagnostic. Nothing is half-supported.
 3. **Lower.** Instruction bodies become C. Account validation, checked arithmetic, Borsh encoding and CPI plumbing
    come from [`runtime/typesol_rt.h`](runtime/typesol_rt.h).
 4. **Build.** The Agave platform-tools `clang` and `ld.lld` produce the `.so` (SBPF v0 by default; v1 and v2 with
    `--sbpf`).
 
-Runtime failures point back to your source: `Error 6000 Unauthorized (counter.ts:21)`, or
+Runtime failures point back to your source: `Error 6000 Unauthorized (counter.ts:25)`, or
 `TypeSOL: arithmetic overflow (vault.ts:42)`.
 
 ## What you can write
@@ -225,27 +225,30 @@ import { build } from "typesol/compiler";
 const { soPath, idl } = build("programs/counter.ts", "target/counter", programAddress);
 ```
 
-Subpath exports: `typesol/compiler`, `typesol/workspace`, `typesol/cpi`, `typesol/idl`, `typesol/profile`.
+Subpath exports: `typesol/compiler`, `typesol/workspace`, `typesol/cpi`, `typesol/client`, `typesol/idl`,
+`typesol/profile`, `typesol/testing`, `typesol/ts-plugin`.
 
 ## Numbers
 
 The same counter, vault and escrow programs, written four ways. All four use the same instruction encoding, account
 layout and checks. They get identical transactions in LiteSVM and must end in identical account state. The table
-shows mean compute units per call (generated by `scripts/readme-bench.ts` from the benchmark run):
+shows mean compute units per call (generated by `scripts/readme-bench.ts` from the benchmark run). The programs,
+scenarios and harness are in [typesol/benchmarks](https://github.com/typesol/benchmarks), which pins the compiler and
+toolchain and records them with every result:
 
 <!-- bench:table -->
 | Instruction | TypeSOL | Pinocchio 0.10 | Native Rust | Anchor 1.0.2 |
 | --- | ---: | ---: | ---: | ---: |
-| counter.initialize | **1,872** | 3,186 | 4,601 | 6,573 |
+| counter.initialize | **1,866** | 3,186 | 4,601 | 6,573 |
 | counter.increment | **110** | 113 | 857 | 2,323 |
-| vault.open | **1,891** | 3,185 | 4,613 | 6,627 |
+| vault.open | **1,885** | 3,185 | 4,613 | 6,627 |
 | vault.deposit | **1,314** | 1,377 | 2,832 | 4,355 |
 | vault.withdraw | **315** | 370 | 1,176 | 3,628 |
 | vault.shut | **161** | 167 | 950 | 2,024 |
-| escrow.make | **3,638** | 6,179 | 9,240 | 13,304 |
-| escrow.take | **4,035** | 4,051 | 8,500 | 14,365 |
-| escrow.refund | **2,716** | 2,769 | 5,695 | 8,449 |
-| binary, counter / vault / escrow | 13.2 / 16.5 / 24.0 KB | 19.6 / 22.9 / 29.4 KB | 27.9 / 35.0 / 46.5 KB | 145.2 / 158.9 / 190.7 KB |
+| escrow.make | **3,605** | 6,179 | 9,240 | 13,304 |
+| escrow.take | **4,019** | 4,051 | 8,500 | 14,365 |
+| escrow.refund | **2,696** | 2,769 | 5,695 | 8,449 |
+| binary, counter / vault / escrow | 11.0 / 14.1 / 21.3 KB | 19.6 / 22.9 / 29.4 KB | 27.9 / 35.0 / 46.5 KB | 145.2 / 158.9 / 190.7 KB |
 <!-- /bench:table -->
 
 `initialize`, `open` and `make` include the PDA bump search. TypeSOL hashes PDA candidates with the sha256 and
@@ -306,7 +309,7 @@ Details are in [docs/testing.md](docs/testing.md).
 
 ## Status
 
-**TypeSOL is pre-1.0 (0.23).** Releases follow the organization's
+**TypeSOL is pre-1.0.** Releases follow the organization's
 [versioning policy](https://github.com/typesol/.github/blob/main/VERSIONING.md); [CHANGELOG.md](CHANGELOG.md) lists every
 change.
 - The compiler, runtime and tooling have been through internal security reviews and are covered by the tests above.

package/SECURITY.md

@@ -4,7 +4,7 @@ TypeSOL generates programs that hold funds. Treat it accordingly.
 
 ## Status
 
-- Version 0.10 was reviewed internally (runtime, code generation and tooling). Every release is covered by execution
+- The compiler, runtime and tooling have been through internal security reviews. Every release is covered by execution
   tests, differential tests against Anchor, and randomized tests. **TypeSOL has not been audited by an independent
   firm.** Do not put significant value behind programs built with it until an external audit of the compiler and
   runtime is published, and audit your own programs as you would any Solana program.