@typesol/cli 0.23.0 → 0.24.1

package/docs/migrate-from-anchor.md

@@ -65,21 +65,22 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `u8` … `u128`, `i8` … `i128`, `bool`, `Pubkey` | `u8` … `u128`, `i8` … `i128`, `boolean`, `Pubkey` |
 | `[T; N]` | `FixedArray<T, N>` |
 | `String` with `#[max_len(n)]` | `FixedString<N>`: a u32 length and N bytes, always N bytes long |
-| `Vec<T>` with `#[max_len(n)]` | `Vec<T>` as the account's last field (it grows with `push(v, payer)`), or `FixedVec<T, n>` anywhere: a u32 length and room for n, always 4 + n × size bytes |
+| `Vec<T>` with `#[max_len(n)]` | `Vec<T>` (any number, declared anywhere, stored after the fixed-size fields; it grows with `push(v, payer)`), or `FixedVec<T, n>`: a u32 length and room for n, always 4 + n × size bytes |
 | `Option<T>` | `Option<T>`: fixed size (1 + size of T) |
 | `#[derive(AnchorSerialize…)] enum` | `export enum` (unit variants) or a data enum `type A = { kind: "X"; … } \| …` |
 
 TypeSOL keeps account data at a fixed layout by default, so three Anchor layouts differ: a Borsh `String` is
 variable-length (TypeSOL uses `FixedString<N>`), a Borsh `Option` takes 1 byte when empty (TypeSOL always reserves the
-value), and a `Vec` can be anywhere in an Anchor struct (TypeSOL keeps a growable one last; a `FixedVec<T, N>` elsewhere
-always takes its full capacity, where Anchor packs the elements and moves the fields after them).
+value), and an Anchor `Vec` stays where it is declared (TypeSOL stores growable Vecs after the fixed-size fields; a
+`FixedVec<T, N>` keeps its place but always takes its full capacity, where Anchor packs the elements and moves the
+fields after them).
 
 To keep an Anchor program's existing accounts, mark the struct `/** @layout borsh */`: it is then stored exactly as
 Anchor stores it (`FixedString<N>` / `FixedVec<T, N>` / `Option<T>` become Borsh String / Vec / Option, N being the
 `#[max_len]`), its IDL type is Anchor's, and the upgraded program reads and writes the accounts in place. `typesol port`
 adds it for you. It costs some compute (the account is unpacked and packed in every instruction that uses it) but stays
-several times cheaper than Anchor. Accounts using them need a migration (or a new program) rather
-than an in-place upgrade, unless they use `@layout borsh`. Everything else, including instruction arguments (`String`, `Option`, `Vec` are Borsh there),
+several times cheaper than Anchor. Without it, accounts that use these types need a migration (or a new program) rather
+than an in-place upgrade. Everything else, including instruction arguments (`String`, `Option`, `Vec` are Borsh there),
 matches byte for byte. A `@layout borsh` struct passed as a whole argument, returned or emitted is Borsh too, so an
 Anchor instruction that takes or returns a struct with `String` / `Vec` / `Option` fields keeps its client bytes.
 
@@ -91,9 +92,8 @@ Anchor instruction that takes or returns a struct with `String` / `Vec` / `Optio
 | `-> Result<u64>` / a struct | `: u64` / a struct: sent as return data, listed in the IDL |
 | `#[error_code] enum MyError { #[msg("…")] X }` | `export enum MyError { X = "…" }` (codes from 6000, in order) |
 | `require!(c, MyError::X)`, `err!(MyError::X)` | `require(c, MyError.X)`, `require(false, MyError.X)` |
-| `require_keys_eq!(a, b)`, `err!(ErrorCode::AccountDidNotDeserialize)` (Anchor's own codes) | `require(a === b, AnchorError.RequireKeysEqViolated)`, `require(false, AnchorError.AccountDidNotDeserialize)` |
+| `require_keys_eq!(a, b)`, `err!(ErrorCode::AccountDidNotDeserialize)` (Anchor's own codes) | `require(a === b, AnchorError.RequireKeysEqViolated)` (or your own error), `require(false, AnchorError.AccountDidNotDeserialize)` |
 | `init_if_needed` + `extensions::…` on a mint | `mint.createIfNeeded(…, { metadataPointer: {…}, … })`: an existing mint is checked as Anchor checks it (2024–2039) |
-| `require_keys_eq!(a, b)` | `require(a === b, …)` |
 | `a.checked_add(b).ok_or(…)?` | `a + b` (every operation is checked; overflow aborts with 5100) |
 | `emit!(Ev { … })` / `emit_cpi!` | `emit<Ev>({ … })` / `emitCpi<Ev>({ … }, eventAuthority, self)` |
 | `msg!("…")` | `log("…")` |
@@ -105,10 +105,9 @@ Anchor instruction that takes or returns a struct with `String` / `Vec` / `Optio
 | `declare_program!(other)` / CPI to another Anchor program | `typesol cpi other.json` generates typed helpers |
 | `for x in v.iter()` | `for (const x of v)` |
 | `v.iter().any(\|x\| …)`, `.all`, `.position`, `.find`, `.fold(init, …)`, `.contains(&x)` | `v.some((x) => …)`, `every`, `findIndex`, `find`, `reduce((acc, x) => …, init)`, `includes(x)` |
-| a closure `\|x\| x + offset` | `const f = (x: u64): u64 => x + offset` (it may read and write the function's variables) |
+| a closure `\|x\| x + offset`, `let fee = \|x: u64\| x / 100;` | `const f = (x: u64): u64 => x + offset` (it may read and write the function's variables), `const fee = (x: u64): u64 => x / 100n;` |
 | `x.unwrap_or(d)` | `x ?? d` |
 | `fn max<T: PartialOrd>(a: T, b: T) -> T` | `function max<T extends bigint>(a: T, b: T): T` (one copy per type used) |
-| `let fee = \|x: u64\| x / 100;` (no captures) | `const fee = (x: u64): u64 => x / 100n;` |
 
 ## Tooling
 

package/docs/runtime.md

@@ -0,0 +1,59 @@
+# The C runtime
+
+`runtime/typesol_rt.h` is included by every generated program. It holds what the emitted C calls: error codes, the
+entry point's input parser, account checks, checked arithmetic, Borsh helpers, CPIs, sysvars, strings and the heap.
+This page is for people changing it; programs never call it directly.
+
+## Conventions
+
+- **Header-only, `static inline`.** Each program compiles the header with its own code, and `--gc-sections` drops
+  what it does not use. `always_inline` marks the few helpers that must disappear into their caller (word loads and
+  stores, `ts_memcpy`, checked add/subtract); `noinline` marks the ones that should exist once per program because
+  many call sites would otherwise each grow the binary (`ts_fail`, the rent fallback `ts_rent_slow`, PDA search).
+- **Errors are return values.** A function that can fail returns `uint64_t`: `SUCCESS`, or an error code. Fail with
+  `TS_FAIL(code, "TypeSOL: …")` (logs the message, then returns the code) and propagate with `TS_TRY(call)`.
+  Nothing aborts: the instruction returns the code, and the runtime reports it as `Custom(code)`.
+- **Error codes follow Anchor.** Where Anchor has a framework error with the same meaning, its number is used (2006
+  ConstraintSeeds, 3003 AccountDidNotDeserialize, …), so Anchor and Codama clients name failures correctly.
+  TypeSOL-only conditions are 5100–5199; user errors start at 6000. Every code is listed in [errors.md](errors.md).
+- **No byte loops from the SDK.** The SDK's `sol_memcpy`, `sol_memcmp` and `SolPubkey_same` move one byte per
+  iteration. The runtime uses `ts_ld64` / `ts_st64` (unaligned 8-byte loads and stores, which SBF allows) in
+  `ts_memcpy`, `ts_memzero`, `ts_mem_eq`, `ts_key_eq` and `ts_memmove`.
+- **Same results as the reference.** Fast paths must give bit-identical results to what they replace: `ts_add_overflow_u64`
+  matches `__builtin_add_overflow`, the rent fast path and `ts_rent_slow` match the double computation, PDA search
+  matches `sol_try_find_program_address`. A change here needs a test against the reference, not only against itself.
+
+## Sections
+
+In file order:
+
+| Section | What it provides |
+| --- | --- |
+| Error codes, `TS_FAIL`, `TS_TRY` | The codes above and the two macros |
+| Word-wise memory helpers | `ts_ld64`, `ts_st64`, `ts_memcpy`, `ts_memmove`, `ts_memzero`, `ts_mem_eq`; checked u64 add/subtract/multiply |
+| Well-known program ids | System, Token, Token-2022, ATA, Metaplex and the other programs the language names |
+| Strings | `TS_Str` views (pointer, length), UTF-8 validation, comparison, `FixedString<N>` storage |
+| Entry point input | `TsAccount` (the loader's serialized account, read in place), `TsParams`, `ts_deserialize` |
+| Account checks | owner, discriminator, signer, writable, executable, address, size, uniqueness (`ts_check_*`), growable Vec lengths |
+| Little-endian IO | `ts_read_le` and friends for argument decoding and Borsh |
+| Sysvars | clock, rent (`ts_rent`, `ts_minimum_balance_of`, `ts_minimum_balance`), program data |
+| PDA | `ts_pda_hash`, `ts_create_pda_address`, `ts_find_pda` (canonical bump), `ts_require_pda` |
+| System program CPIs | create, assign, allocate, transfer, `ts_create_pda`, `ts_resize` / `ts_realloc`, close |
+| Token-2022 extensions | TLV walking for the extensions the language reads |
+| Metaplex Core and Bubblegum | account readers (`coreAssetOwner`, …) |
+| SPL Token / Token-2022 CPIs | transfer, mint, burn, approve, close, freeze and their checked forms |
+| Return data | `sol_set_return_data` wrappers |
+| Crypto | sha256, keccak256, ed25519 / secp256k1 verification helpers, Merkle proofs |
+| Heap | `ts_alloc`, a bump allocator (32 KiB by default, `HEAP_SIZE_KIB` up to 256), string building (`ts_str_join`, `ts_str_append`, number and base58 text) |
+| Oracles | Pyth price updates, Switchboard |
+| Associated token accounts, token metadata, transfer hooks | ATA derivation and creation, Token Metadata CPIs, transfer-hook extra accounts |
+
+## Changing it
+
+- Every runtime change can move compute units or binary size. Measure it before and after with
+  [typesol/benchmarks](https://github.com/typesol/benchmarks) pointed at your checkout, and put the difference in
+  the pull request (see CONTRIBUTING).
+- A change that alters behavior (a result, an error code, a log line, account bytes) is a language change and goes
+  in the CHANGELOG as one. One that only changes cost says so: "same results".
+- New error codes: add the `#define` here, the row in [errors.md](errors.md) and the name in the compiler's runtime
+  error list (`TYPESOL_ERRORS` in `src/clientgen.ts`), so clients name it (a test checks every code has a name).

package/docs/test-your-program.md

@@ -23,6 +23,9 @@ it("counts", async () => {
 
 ## Instructions
 
+`t.pda(...seeds)` derives this program's PDA for the seeds; `t.pdaWithBump(...seeds)` gives `[address, bump]`, for an
+instruction that takes the bump as an argument.
+
 `t.ix(name, args, accounts, remaining?)` builds one instruction.
 
 - **Accounts by name**, in camelCase or snake_case. Their signer and writable flags come from the IDL, and accounts
@@ -31,7 +34,8 @@ it("counts", async () => {
   signs, an address otherwise, and `null` to leave an optional account out.
 - **Arguments as plain values:** bigints or numbers for integers, address strings for Pubkeys, `null` for an empty
   Option, objects for structs (camelCase or snake_case fields), arrays for Vecs.
-- **Remaining accounts:** `[{ address, writable?, signer? }]`.
+- **Remaining accounts:** `[{ address, writable?, signer? }]`, where `signer` is the account's `KeyPairSigner` (it then
+  signs as a signer account; `writable` defaults to false).
 
 `t.send(payer, ...ixs)` sends them in one transaction; keypairs given as accounts sign too.
 
@@ -44,7 +48,7 @@ it("counts", async () => {
 | `t.account(type, address)` | the account decoded by its IDL type (bigints, address strings), or `null` once closed. TypeSOL fixed layouts come back as their IDL structs: a `FixedString<N>` as `{ len, bytes }`, a `FixedVec<T, N>` as `{ len, items }` (the generated client gives strings and arrays) |
 | `t.returned(instruction, res)` | the instruction's return data: an integer, boolean, Pubkey or struct |
 | `t.balance(address)` | lamports |
-| `t.connection` | `{ rpc, rpcSubscriptions }` answered by this LiteSVM, for the generated client: `counter.sendInstructions(t.connection, alice, [ix])`, `counter.accounts.Counter.fetch(t.connection.rpc, address)`, views, `resolve`, `watch` and `watchEvents` |
+| `t.connection` | `{ rpc, rpcSubscriptions }` answered by this LiteSVM, for the generated client: `counter.sendInstructions(t.connection, alice, [ix])`, `counter.accounts.Counter.fetch(t.connection.rpc, address)`, views, `resolve`, `watch` and `watchEvents` (as on a cluster: `watch` yields when a later transaction changes the account, not at once; `watchEvents` gets transactions sent after it subscribed, failed ones included in the stream and skipped by the client) |
 
 `t.svm`, `t.programId`, `t.idl` and `t.coder` are there for anything else, e.g. writing a mint straight into the VM
 with `t.svm.setAccount` (see the escrow template). `programHarness(svm, programId, idl)` gives the same helpers for a

package/docs/testing.md

@@ -8,7 +8,7 @@ run prints its seed; reproduce with `FUZZ_SEED=<n>`, widen with `FUZZ_RUNS` / `F
 | `test/fuzz-arith.test.ts` | BigInt | `+ - * / % **`, `& \| ^ << >> ~`, unary minus, comparisons and casts at every width u8…u128 / i8…i128, plus `mulDiv`, `mulDivCeil`, `isqrt`, `min`, `max`, return the same value or abort with the same code (5100/5101/4102), for edge and random inputs |
 | `test/fuzz-state.test.ts` | TypeScript state model | random honest + hostile actions on vault and escrow: every outcome as predicted, balances equal the model, SOL conserved up to fees, token supply exactly conserved; random filings/decisions/resets on ledgerbook: Vec contents, account size and rent exemption equal the model |
 | `test/differential.test.ts` | Anchor twins in `bench/anchor` | identical transactions to TypeSOL and Anchor programs: same outcomes, same account contents, same wallet and token balances after every step |
-| `test/ports-*.test.ts` | the Anchor programs of solana-developers/program-examples and their tests | TypeSOL rewrites under `test/ports/` run the originals' flows and failure paths with the same outcomes, error codes and balances; each BLOCKED probe fails once its construct starts compiling, meaning that program can then be ported ([test/ports/README.md](../test/ports/README.md)) |
+| `test/ports-*.test.ts` | the Anchor programs of solana-developers/program-examples and their tests | TypeSOL rewrites under `test/ports/` run the originals' flows and failure paths with the same outcomes, error codes and balances ([test/ports/README.md](../test/ports/README.md)) |
 
 Compute-unit and binary-size comparisons with Anchor, native Rust and Pinocchio are in the README
 ([Numbers](../README.md#numbers)).

package/docs/troubleshooting.md

@@ -27,8 +27,9 @@ or declare `const HEAP_SIZE_KIB = 64n` and add a ComputeBudget `requestHeapFrame
 `solana-test-validator` (Agave 3.1 included) rejects a System instruction that the current Program Metadata program
 uses. Publishing works on mainnet-beta. The error shows the failing transaction's last log lines.
 
-**"instruction X needs N bytes of stack; SBF gives each function 4096"** — every function on Solana gets a 4 KiB
-stack frame, and going past it corrupts memory, so the build refuses it. Large structs and arrays copied into typed
+**"instruction X (with the helpers inlined into it) needs N bytes of stack; SBPF v0 gives each function 4096"** — under
+SBPF v0 (the default) every function gets a fixed 4 KiB stack frame, and going past it corrupts memory, so the build
+refuses it. SBPF v1 and v2 (`--sbpf v1` / `v2`) grow frames dynamically, so this limit does not apply there. Large structs and arrays copied into typed
 locals (`const q: Big = acct.big`) are the usual cause: bind them without a type (`const q = acct.big`, a reference
 into the account data) or move the work into helpers. Helpers are often inlined into their instruction, so their
 locals count toward its frame.

package/lib/typesol.d.ts

@@ -8,6 +8,10 @@
  * Integer types are all `bigint` to TypeScript. The compiler tracks the declared
  * width itself, rejects `number`, and checks every arithmetic operation for
  * overflow at runtime.
+ *
+ * Integer operators: + - * / % are checked (overflow and division by zero abort). & | ^ work on equal types;
+ * << aborts when bits would be lost or the amount is not below the width; >> is arithmetic on signed types;
+ * ~ flips the bits within the type's width.
  */
 
 export type u8 = bigint;
@@ -27,10 +31,6 @@ export interface Pubkey {
   equals(other: Pubkey): boolean;
 }
 
-/**
- * A fixed-length array stored inline in account data, e.g. `scores: FixedArray<u64, 8>`.
- * Indexes are bounds-checked; out of range aborts the instruction.
- */
 /**
  * Callback methods of Vec, FixedArray and FixedVec. Each expands into a loop over the elements (as `list.get(i)` gives
  * them: structs by reference) with the arrow written at the call; it may read and write the function's variables.
@@ -53,13 +53,19 @@ export interface ListMethods<T> {
   /**
    * The elements `fn` maps them to (integers, booleans, Pubkeys or enums). Use it right away (another list method,
    * `.length`, `for … of`: one loop, nothing stored) or store it (`const ys = xs.map(…)`: a FixedVec on the stack, as
-   * big as `xs`; from a `Vec`, annotate it: `const ys: FixedVec<u64, 16> = …`).
+   * big as `xs`; from a `Vec`, annotate it: `const ys: FixedVec<u64, 16> = …`). Stored with a `FixedVec<Struct, N>` or
+   * `FixedVec<FixedString<N>, M>` annotation it gives structs (`(o) => ({ qty: o.qty })`) or text. A stored list holds
+   * at most 2 KiB; one element more than it holds aborts (5104).
    */
   map<U>(fn: (x: T, index: u64) => U): FixedVec<U, never>;
   /** The elements `fn` holds for, used or stored like `map`'s; callbacks after it get the index among those. */
   filter(fn: (x: T, index: u64) => boolean): FixedVec<T, never>;
 }
 
+/**
+ * A fixed-length array stored inline in account data, e.g. `scores: FixedArray<u64, 8>`.
+ * Indexes are bounds-checked; out of range aborts the instruction.
+ */
 export interface FixedArray<T, N extends number> extends ListMethods<T> {
   readonly length: u64;
   get(index: bigint): T;
@@ -82,15 +88,17 @@ export type FixedString<N extends number> = string & { readonly __capacity?: N }
 export declare function byteLength(value: string): u64;
 
 /**
- * An optional scalar: `best: Option<u64>` (same as `u64 | null`). Compare with `=== null` / `!== null`;
+ * An optional value: `best: Option<u64>` (same as `u64 | null`), also of a struct (`home: Option<Point>`). Compare with `=== null` / `!== null`;
  * TypeScript narrows it, and using an empty option where a value is needed aborts (5108).
  * In account data it takes a fixed 1 + size(T) bytes.
  */
 export type Option<T> = T | null;
 
 /**
- * A growable list. As the last field of an account struct it is stored Borsh-style (u32 length + elements)
- * and the account is resized as it grows. As an instruction argument it is a read-only view.
+ * A growable list. As an account struct field it is stored Borsh-style (u32 length + elements) and the account is
+ * resized as it grows. An account may have any number of them, declared anywhere: they are stored after the
+ * fixed-size fields, in the order declared (in a `@layout borsh` struct, a Vec must be the last field). As an
+ * instruction argument it is a read-only view.
  */
 export interface Vec<T> extends ListMethods<T> {
   readonly length: u64;
@@ -108,8 +116,8 @@ export interface Vec<T> extends ListMethods<T> {
 
 /**
  * A list stored inline with room for N elements: a u32 length, then N slots (Anchor `Vec<T>` with `#[max_len(N)]`, but
- * always 4 + N × size(T) bytes). Unlike `Vec<T>` it can be any field, any number of times, and in nested structs;
- * `push` fails (5104) when it is full. Write a whole one with `fixedVec([a, b])`.
+ * always 4 + N × size(T) bytes). Unlike `Vec<T>` its size is fixed: it keeps its place among the fields, can be in
+ * nested structs, and `push` takes no payer; `push` fails (5104) when it is full. Write a whole one with `fixedVec([a, b])`.
  */
 export interface FixedVec<T, N extends number> extends ListMethods<T> {
   readonly length: u64;
@@ -611,11 +619,6 @@ export interface SelfProgram extends AccountMeta {
  */
 export declare function emitCpi<T>(event: T, eventAuthority: EventAuthority, self: SelfProgram): void;
 
-/**
- * Metaplex Core (CoREEN…), address checked. Assets and collections without plugins; `null` leaves an optional
- * account out. Accounts that sign (the new asset/collection, authorities) are keypair Signers, or PDAs of this
- * program covered by `signerSeeds`.
- */
 /**
  * Who manages a Metaplex Core plugin: `"owner"`, `"updateAuthority"`, `"none"` (nobody: fixed), or an address. Left out,
  * the plugin type's default (the owner for owner-managed plugins, the update authority for the others).
@@ -650,7 +653,49 @@ export type CorePlugin = (
   | { kind: "PermanentFreezeExecute"; frozen: boolean }
 ) & { authority?: CorePluginAuthority };
 export type CorePluginKind = CorePlugin["kind"] | "Groups";
+/** When a Core lifecycle event reaches an external plugin, and what the plugin may do about it. */
+export interface CoreLifecycleCheck {
+  event: "create" | "transfer" | "burn" | "update" | "execute";
+  canListen?: boolean;
+  canApprove?: boolean;
+  canReject?: boolean;
+}
+/** An account Core passes to an external plugin: one it already has, or an address. */
+export type CoreExtraAccount =
+  | { kind: "program" | "collection" | "owner" | "recipient" | "asset"; isSigner?: boolean; isWritable?: boolean }
+  | { kind: "address"; address: Pubkey; isSigner?: boolean; isWritable?: boolean };
+/**
+ * A Metaplex Core external plugin adapter, written as an object literal: data a third party writes (`AppData`), an
+ * account that approves or rejects lifecycle events (`Oracle`), or a program called on them (`LifecycleHook`); the
+ * `Linked` forms go on a collection, for each of its assets. `authority` manages the adapter itself.
+ */
+export type CoreExternalPlugin = (
+  | { kind: "AppData" | "LinkedAppData"; dataAuthority: CorePluginAuthority; schema?: "binary" | "json" | "msgpack" }
+  | {
+      kind: "Oracle";
+      baseAddress: Pubkey;
+      checks: CoreLifecycleCheck[];
+      baseAddressConfig?: CoreExtraAccount;
+      resultsOffset?: "none" | "anchor" | u64;
+    }
+  | {
+      kind: "LifecycleHook" | "LinkedLifecycleHook";
+      hookedProgram: Pubkey;
+      checks: CoreLifecycleCheck[];
+      extraAccounts?: CoreExtraAccount[];
+      dataAuthority?: CorePluginAuthority;
+      schema?: "binary" | "json" | "msgpack";
+    }
+) & { authority?: CorePluginAuthority };
+/** Which external plugin: an AppData by its data authority, an Oracle by its base address, a LifecycleHook by its program. */
+export type CoreExternalPluginKey =
+  { kind: "AppData" | "LinkedAppData"; dataAuthority: CorePluginAuthority } | { kind: "Oracle" | "LifecycleHook" | "LinkedLifecycleHook"; address: Pubkey };
 
+/**
+ * Metaplex Core (CoREEN…), address checked. Assets and collections, with plugins and external plugin adapters; `null`
+ * leaves an optional account out. Accounts that sign (the new asset/collection, authorities) are keypair Signers, or
+ * PDAs of this program covered by `signerSeeds`.
+ */
 export interface MplCoreProgram extends AccountMeta {
   readonly __mpl_core: void;
   /**
@@ -753,6 +798,61 @@ export interface MplCoreProgram extends AccountMeta {
     kind: CorePluginKind,
     signerSeeds?: Seed[] | SignerSeeds,
   ): void;
+  /** AddExternalPluginAdapterV1, signed by the update authority as `authority` (`null`: the payer). */
+  addExternalPlugin(
+    asset: AccountMeta,
+    collection: AccountMeta | null,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    plugin: CoreExternalPlugin,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
+  removeExternalPlugin(
+    asset: AccountMeta,
+    collection: AccountMeta | null,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    key: CoreExternalPluginKey,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
+  /** WriteExternalPluginAdapterDataV1, signed by the plugin's data authority: `data` replaces what it holds (`null` clears it). */
+  writeExternalPluginData(
+    asset: AccountMeta,
+    collection: AccountMeta | null,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    key: CoreExternalPluginKey,
+    data: string | Vec<u8> | null,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
+  addCollectionExternalPlugin(
+    collection: AccountMeta,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    plugin: CoreExternalPlugin,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
+  removeCollectionExternalPlugin(
+    collection: AccountMeta,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    key: CoreExternalPluginKey,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
+  writeCollectionExternalPluginData(
+    collection: AccountMeta,
+    payer: Mut<Signer>,
+    authority: AccountMeta | null,
+    systemProgram: SystemProgram,
+    key: CoreExternalPluginKey,
+    data: string | Vec<u8> | null,
+    signerSeeds?: Seed[] | SignerSeeds,
+  ): void;
   /** TransferV1, signed by the owner (or a delegate) as `authority` (`null`: the payer). */
   transferAsset(
     asset: AccountMeta,
@@ -1437,7 +1537,6 @@ export declare function invoke(
   signerSeeds?: Seed[] | SignerSeeds,
 ): void;
 
-/** Abort with the given error unless `condition` holds. Use a string enum member or a string literal. */
 /**
  * Anchor's own error codes (anchor-lang `ErrorCode`): `require(condition, AnchorError.AccountDidNotDeserialize)` fails
  * with that code, as `require!(condition, ErrorCode::AccountDidNotDeserialize)` does. Not listed in the IDL's errors.
@@ -1521,6 +1620,11 @@ export declare enum AnchorError {
   InvalidNumericConversion = 4102,
   Deprecated = 5000,
 }
+/**
+ * Abort with the given error unless `condition` holds. The error is a member of an exported string enum, any
+ * `AnchorError` member, or a string literal: each distinct literal becomes an error named `RequireFailed<N>` with code
+ * 6000 + N, numbered after the program's error enums and listed in the IDL.
+ */
 export declare function require(condition: boolean, error: string | AnchorError): asserts condition;
 
 /** Write a string, integer or pubkey to the program log. */
@@ -1562,11 +1666,6 @@ export declare function i16(value: bigint): i16;
 export declare function i32(value: bigint): i32;
 export declare function i128(value: bigint): i128;
 
-/**
- * Integer operators: + - * / % are checked (overflow and division by zero abort). & | ^ work on equal types;
- * << aborts when bits would be lost or the amount is not below the width; >> is arithmetic on signed types;
- * ~ flips the bits within the type's width.
- */
 /** floor(a * b / c) with a double-width intermediate (all u64, or all u128); aborts if c is 0 or the result does not fit. */
 export declare function mulDiv(a: u64, b: u64, c: u64): u64;
 /** ceil(a * b / c), like mulDiv. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typesol/cli",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "description": "Compile a TypeScript-syntax language directly to Solana SBF programs.",
   "type": "module",
   "license": "MIT",

package/runtime/typesol_rt.h

@@ -62,11 +62,12 @@
 #define TS_ERR_NO_RETURN 5114
 #define TS_ERR_ACCOUNT_MISSING 5115
 
-#define TS_FAIL(code, msg) \
-  do {                     \
-    sol_log(msg);          \
-    return (code);         \
-  } while (0)
+/* Every failure logs through this one sol_log_ call: each syscall call site costs a 16-byte relocation in the binary. */
+static __attribute__((noinline)) uint64_t ts_fail(uint64_t code, const char *msg, uint64_t len) {
+  sol_log_(msg, len);
+  return code;
+}
+#define TS_FAIL(code, msg) return ts_fail((code), (msg), sol_strlen(msg))
 
 #define TS_TRY(expr)                 \
   do {                               \
@@ -369,9 +370,19 @@ static inline uint64_t ts_create_pda_address(const SolSignerSeed *seeds, int n,
 /* sol_try_find_program_address: the canonical (highest) bump. */
 static inline uint64_t ts_find_pda(const SolSignerSeed *seeds, int n, const SolPubkey *program, SolPubkey *out, uint8_t *bump_out) {
   if (!ts_pda_seeds_ok(seeds, n, TS_MAX_PDA_SEEDS - 1)) return 1; /* not SUCCESS: the PDA syscalls fail the same inputs */
+  /* The seed list is built once; each attempt only changes the bump byte it points at. */
+  SolBytes parts[TS_MAX_PDA_SEEDS + 2];
+  int k = 0;
+  for (int i = 0; i < n; i++) parts[k++] = (SolBytes){seeds[i].addr, seeds[i].len};
+  uint8_t bump = 255;
+  parts[k++] = (SolBytes){&bump, 1};
+  parts[k++] = (SolBytes){program->x, 32};
+  parts[k++] = (SolBytes){(const uint8_t *)"ProgramDerivedAddress", 21};
   for (int b = 255; b >= 0; b--) {
-    uint8_t bump = (uint8_t)b;
-    if (ts_pda_hash(seeds, n, &bump, program, out)) {
+    bump = (uint8_t)b;
+    sol_sha256(parts, k, out->x);
+    uint8_t ignored;
+    if (sol_curve_validate_point(0 /* CURVE25519_EDWARDS */, out->x, &ignored) != 0) {
       *bump_out = bump;
       return SUCCESS;
     }
@@ -493,10 +504,52 @@ static inline void ts_write_le(uint8_t *p, uint64_t v, int n) { ts_memcpy(p, &v,
 uint64_t sol_get_rent_sysvar(void *ret);
 uint64_t sol_get_clock_sysvar(void *ret);
 
-static inline uint64_t ts_minimum_balance(uint64_t data_len, uint64_t *out) {
-  /* Rent { lamports_per_byte_year: u64, exemption_threshold: f64, burn_percent: u8 } */
-  uint64_t rent[3] = {0};
-  if (sol_get_rent_sysvar(rent) != SUCCESS) TS_FAIL(TS_ERR_SYSVAR, "TypeSOL: rent sysvar unavailable");
+/* The general case, in integers: exactly (uint64_t)((double)per_year * threshold) as soft-float computes it (the
+   conversion and the product rounded to nearest, ties to even; NaN, negative and < 1 give 0), or UINT64_MAX when that
+   product is >= 2^64 (no double below 2^64 converts to UINT64_MAX: the largest is 2^64 - 2048). No soft-float routine
+   is linked, which keeps about 1.7 KB out of every program that creates accounts. */
+static __attribute__((noinline, minsize)) uint64_t ts_rent_slow(uint64_t per_year, uint64_t tbits) {
+  uint64_t e = (tbits >> 52) & 0x7ff, f = tbits & 0xfffffffffffffULL;
+  if (e == 0x7ff) return !f && per_year && !(tbits >> 63) ? UINT64_MAX : 0; /* +inf overflows; NaN, inf * 0, -inf: 0 */
+  if ((tbits >> 63) || !per_year || (!e && !f)) return 0;                   /* a negative or zero product */
+  /* Round v * 2^ex (with a sticky bit for bits already dropped) to 53 bits, nearest-even, twice: per_year to a double,
+     then the exact product of the two significands. */
+  uint64_t v = per_year, sticky = 0, mt = e ? f | (1ULL << 52) : f;
+  int64_t ex = (e ? (int64_t)e : 1) - 1075;
+  for (int pass = 0; pass < 2; pass++) {
+    int top = 63;
+    while (!(v >> top)) top--;
+    if (top > 52) {
+      int sh = top - 52;
+      uint64_t rem = v & ((1ULL << sh) - 1), half = 1ULL << (sh - 1);
+      v >>= sh;
+      ex += sh;
+      if (rem > half || (rem == half && (sticky || (v & 1)))) v++;
+      if (v >> 53) v >>= 1, ex++;
+    }
+    if (pass) break;
+    /* v (< 2^53) * mt (< 2^53) as hi:lo, folded to 64 bits with the dropped low bits as the sticky bit. */
+    uint64_t a0 = v & 0xffffffff, a1 = v >> 32, b0 = mt & 0xffffffff, b1 = mt >> 32;
+    uint64_t lo = a0 * b0, mid = a0 * b1 + a1 * b0, hi = a1 * b1;
+    uint64_t lo2 = lo + (mid << 32);
+    hi += (mid >> 32) + (lo2 < lo);
+    lo = lo2;
+    int s = 0;
+    while (hi >> s) s++;
+    v = s ? (hi << (64 - s)) | (lo >> s) : lo;
+    sticky = s ? (lo & ((1ULL << s) - 1)) != 0 : 0;
+    ex += s;
+  }
+  int top = 63;
+  while (!(v >> top)) top--;
+  if (top + ex >= 64) return UINT64_MAX;
+  if (ex >= 0) return v << ex;
+  return ex > -64 ? v >> -ex : 0;
+}
+
+/* The minimum balance of `data_len` bytes under `rent`, the Rent sysvar
+   { lamports_per_byte_year: u64, exemption_threshold: f64, burn_percent: u8 }. */
+static inline uint64_t ts_minimum_balance_of(const uint64_t rent[3], uint64_t data_len, uint64_t *out) {
   uint64_t bytes, per_year;
   if (ts_add_overflow_u64(data_len, 128, &bytes) || ts_mul_overflow_u64(bytes, rent[0], &per_year))
     TS_FAIL(TS_ERR_OVERFLOW, "TypeSOL: arithmetic overflow");
@@ -511,14 +564,24 @@ static inline uint64_t ts_minimum_balance(uint64_t data_len, uint64_t *out) {
       return SUCCESS;
     }
   }
-  double threshold;
-  ts_memcpy(&threshold, &rent[1], 8);
-  double lamports = (double)per_year * threshold;
-  if (lamports >= 18446744073709551615.0) TS_FAIL(TS_ERR_OVERFLOW, "TypeSOL: arithmetic overflow");
-  *out = (uint64_t)lamports;
+  uint64_t lamports = ts_rent_slow(per_year, rent[1]);
+  if (lamports == UINT64_MAX) TS_FAIL(TS_ERR_OVERFLOW, "TypeSOL: arithmetic overflow");
+  *out = lamports;
+  return SUCCESS;
+}
+
+static inline uint64_t ts_rent(uint64_t rent[3]) {
+  rent[0] = rent[1] = rent[2] = 0;
+  if (sol_get_rent_sysvar(rent) != SUCCESS) TS_FAIL(TS_ERR_SYSVAR, "TypeSOL: rent sysvar unavailable");
   return SUCCESS;
 }
 
+static inline uint64_t ts_minimum_balance(uint64_t data_len, uint64_t *out) {
+  uint64_t rent[3];
+  TS_TRY(ts_rent(rent));
+  return ts_minimum_balance_of(rent, data_len, out);
+}
+
 /* Clock sysvar word `i`: 0 slot, 2 epoch (u64). */
 static inline uint64_t ts_clock_u64(int i, uint64_t *out) {
   uint64_t clock[5] = {0};
@@ -791,9 +854,10 @@ static inline uint64_t ts_resize(TsParams *params, TsAccount *payer, TsAccount *
   if (new_len > old_len) {
     /* The payer always funds the extra rent, even when the account already holds enough lamports: those may be
        deposits, which must not become rent (and shrinking never pays anything back, see ts_realloc). */
-    uint64_t old_rent, new_rent;
-    TS_TRY(ts_minimum_balance(old_len, &old_rent));
-    TS_TRY(ts_minimum_balance(new_len, &new_rent));
+    uint64_t rent[3], old_rent, new_rent;
+    TS_TRY(ts_rent(rent)); /* read once: the sysvar cannot change within the instruction */
+    TS_TRY(ts_minimum_balance_of(rent, old_len, &old_rent));
+    TS_TRY(ts_minimum_balance_of(rent, new_len, &new_rent));
     if (new_rent > old_rent) {
       if (payer == NULL) TS_FAIL(TS_ERR_REALLOC, "TypeSOL: growing an account needs a payer");
       TS_TRY(ts_system_transfer(params, payer, acct, new_rent - old_rent));
@@ -1340,18 +1404,32 @@ static inline uint64_t ts_str_i128(__int128 v, TS_Str *out) {
   return ts_str_u128(mag, v < 0, out);
 }
 
+/* "00" … "99": two digits per division. */
+static const char TS_DIGIT_PAIRS[201] =
+    "00010203040506070809101112131415161718192021222324252627282930313233343536373839"
+    "40414243444546474849505152535455565758596061626364656667686970717273747576777879"
+    "8081828384858687888990919293949596979899";
 static inline uint64_t ts_str_u64(uint64_t v, bool negative, TS_Str *out) {
+  /* Written from the end, two digits at a time, then copied out in one go. */
   uint8_t tmp[21];
-  int n = 0;
-  do {
-    tmp[n++] = (uint8_t)('0' + v % 10);
-    v /= 10;
-  } while (v);
-  if (negative) tmp[n++] = '-';
+  int i = 21;
+  while (v >= 100) {
+    uint64_t q = v / 100, r = v - q * 100;
+    tmp[--i] = (uint8_t)TS_DIGIT_PAIRS[2 * r + 1];
+    tmp[--i] = (uint8_t)TS_DIGIT_PAIRS[2 * r];
+    v = q;
+  }
+  if (v >= 10) {
+    tmp[--i] = (uint8_t)TS_DIGIT_PAIRS[2 * v + 1];
+    tmp[--i] = (uint8_t)TS_DIGIT_PAIRS[2 * v];
+  } else
+    tmp[--i] = (uint8_t)('0' + v);
+  if (negative) tmp[--i] = '-';
+  uint64_t n = (uint64_t)(21 - i);
   uint8_t *p;
-  TS_TRY(ts_alloc((uint64_t)n, &p));
-  for (int i = 0; i < n; i++) p[i] = tmp[n - 1 - i];
-  *out = ts_str(p, (uint64_t)n);
+  TS_TRY(ts_alloc(n, &p));
+  ts_memcpy(p, tmp + i, n);
+  *out = ts_str(p, n);
   return SUCCESS;
 }
 static inline uint64_t ts_str_i64(int64_t v, TS_Str *out) {