@typesol/cli 0.24.1 → 0.26.0

package/CHANGELOG.md

@@ -6,6 +6,57 @@ codes, and says so here.
 
 ## Unreleased
 
+## 0.26.0 — 2026-10-29
+
+A first-run experience pass, the security model and audit package, and more fuzzing. The compiler's output is the
+same as 0.25.0 for every program.
+
+- New: `typesol doctor` checks Node.js, the platform-tools, the Solana CLI, its keypair, the RPC and the keypair's
+  balance there, and the project, and prints the command that fixes each problem (exit 1 when building is impossible).
+- `typesol init` prints the files it creates relative to where it runs, warns with the install commands when the
+  platform-tools are missing, and lists the next steps.
+- `typesol deploy` checks, before sending anything, that the RPC answers (else: start `solana-test-validator`, or
+  `--url devnet`) and that the payer can pay the rent (else: how much, and the `solana airdrop` command on devnet or a
+  local validator). RPC URLs in these messages show only the host.
+- Docs: [security model](docs/security-model.md) (the guarantees a compiled program can rely on, trust boundaries,
+  what is left to the author) and [audit package](docs/audit.md) (scope, priorities, earlier reviews, evidence);
+  README: deploying on devnet and on a local validator.
+- Tests: `test/verification/fuzz-layout.test.ts`, model-based fuzzing of an account with two growable Vecs and of
+  `loadAccountMut` aliasing through remaining accounts (also in `pnpm fuzz`).
+- Repository: tests grouped by subject under `test/`, the Anchor twins in `test/anchor-twins` (`pnpm build:twins`),
+  the generators and chain tooling in `src/tools/` (the package's import paths are unchanged); Dependabot for npm and
+  GitHub Actions.
+
+## 0.25.0 — 2026-10-29
+
+Security review (October 2026) fixes, and error codes aligned with Anchor. Some refused transactions now report a
+different error code (below): a minor version.
+
+- Fixed: `loadAccountMut` on the same remaining account twice (`rest.get(i)`, `rest.get(j)` with `i == j`) gave two
+  writable views of one account; a program reading both before writing both could be made to create value. The second
+  load is now refused with 2040.
+- Fixed: a Vec element written with a right side that resizes the Vec (`book.bids.get(i).qty += settle(book)` where the
+  helper pops, a closure, or a `push` / `pop` / `clear` in the expression) wrote through the element's old position,
+  into the bytes of the next Vec. Such an assignment is now a compile error ("store its result in a local first"),
+  as it already was for a plain `=` with a helper.
+- Fixed: `Ata<Init<…>>` / `Ata<InitIfNeeded<…>>` creation and `Ata<AccountInfo, …>` with two token program parameters
+  used the first one; they now need exactly one (use `TokenInterface`).
+- New: `TokenOf<…, …, …, "tokenProgram">` / `MintOf<…, …, …, "tokenProgram">`, Anchor's `token::token_program` /
+  `mint::token_program` (2021 / 2022). The escrow port uses it.
+- New: `pythPrice(update, feedId, maxAge, exponent)` refuses a feed whose exponent is not the one given;
+  `switchboardValue(…, minSamples)` refuses a result resting on fewer oracle samples.
+- Changed: each account's constraints are checked in Anchor's order (seeds, associated token account, has_one, owner,
+  executable, address, token::, mint::), so a transaction breaking several fails with Anchor's code: e.g. a stranger's
+  call on a `Seeds<HasOne<…>>` account now fails with 2006 (ConstraintSeeds) instead of 2001, and an `Ata<…>` of
+  another wallet with 2015 instead of 2009. A `Mut<…>` account passed read-only fails with 2000 (ConstraintMut), as
+  Anchor's `#[account(mut)]`, instead of 3006. docs/errors.md lists the order and the differences left.
+- Docs: unchecked raw Pyth fields, `requirePda` with a bump from the arguments, Merkle leaves, and what
+  `createIfNeeded` leaves unchecked on an existing account.
+- Docs: [Case study: porting Anchor's escrow](docs/case-study-escrow.md), one Anchor program ported end to end, with the
+  differences, the checks run against the original and the cost.
+- Releases: the release workflow checks that CHANGELOG.md has the version, and after publishing installs the package
+  from npm, scaffolds a project from each template and runs its typecheck, build and test.
+
 ## 0.24.1 — 2026-10-28
 
 Smaller programs and fewer compute units, with the same results; no change to the language, IDLs or error codes. Also

package/README.md

@@ -149,9 +149,20 @@ npx @typesol/cli init my-app --name counter   # typesol.json, programs/counter.t
 cd my-app && npm install
 npm test                                      # builds the program and runs it in LiteSVM, an in-process Solana runtime
 npx typesol build                             # target/counter/{counter.so, counter.json (IDL), counter.client.ts, counter.build.json}
-npx typesol deploy --url http://127.0.0.1:8899 --keypair ~/.config/solana/id.json
 ```
 
+`npx typesol doctor` checks all of this (Node.js, platform-tools, Solana CLI, keypair, RPC) and prints the command
+that fixes anything missing. To deploy, on devnet:
+
+```sh
+solana-keygen new                             # once, if you have no keypair (~/.config/solana/id.json)
+solana airdrop 2 --url devnet                 # test SOL for the rent (rate-limited: https://faucet.solana.com also works)
+npx typesol deploy --url devnet
+```
+
+or on a local validator: `solana-test-validator` in another terminal, `solana airdrop 5 --url localhost`, then
+`npx typesol deploy --url localhost`. `deploy` checks the RPC and the payer's balance before sending anything.
+
 `--template vault` or `--template escrow` starts from a SOL vault or an SPL token escrow instead of the counter, each
 with a passing LiteSVM test.
 
@@ -162,8 +173,9 @@ existing project: `npm install -D typesol@npm:@typesol/cli`.
 Deploying again upgrades the program in place. Keep `target/deploy/<name>-keypair.json`: that keypair is your
 program's address.
 
-Coming from Anchor: [docs/migrate-from-anchor.md](docs/migrate-from-anchor.md) maps every construct, and `typesol port`
-starts from your program's IDL. Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
+Coming from Anchor: [docs/migrate-from-anchor.md](docs/migrate-from-anchor.md) maps every construct, `typesol port`
+starts from your program's IDL, and [docs/case-study-escrow.md](docs/case-study-escrow.md) follows one complete Anchor
+program through the port. Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
 mainnet (wallet, cost, deploy, IDL, verification), follow [docs/mainnet.md](docs/mainnet.md).
 
 ## How it works
@@ -261,23 +273,28 @@ units are not a safety claim. The differential tests also run the escrow against
 ### On mainnet
 
 The official escrow ([tokens/escrow](https://github.com/solana-developers/program-examples/tree/de090195e4de698e150572c4f886c333323a64a5/tokens/escrow)),
-deployed to Solana mainnet-beta in all four versions on 2026-10-27 and called with the same mints, amounts and accounts,
-one instruction per transaction. Each figure is the compute units of that transaction, linked to Solscan; the lowest per row is in bold. The deployed
-programs match these builds byte for byte (`typesol verify` for TypeSOL), and the TypeSOL program's IDL is published
-on chain with `typesol idl publish`.
+deployed to Solana mainnet-beta in all four versions and called with the same mints, amounts and accounts, one
+instruction per transaction. The TypeSOL program was upgraded in place to 0.25.0 on 2026-10-29; the others are as first
+deployed on 2026-10-27. Each figure is the compute units of that transaction, linked to Solscan; the lowest per row is
+in bold. The deployed programs match these builds byte for byte (`typesol verify` for TypeSOL), and the TypeSOL
+program's IDL is published on chain with `typesol idl publish`.
 
 | Transaction | TypeSOL | Pinocchio | Native Rust | Anchor |
 | --- | ---: | ---: | ---: | ---: |
-| make_offer (offer 1) | [20,304](https://solscan.io/tx/32PVva77dT1rSWrMWX2sHTMPZiwztdEZYtpANaxrsuJxPcd3hnV6pDgJJaV4LkL3bX6ALDoHMNF8fjngtodYHBS1) | [**19,645**](https://solscan.io/tx/528BdMTrnLWauSXVh2vaFfy4XwKFpbyt95hQ6w3fwjtpkT85RPkRhGydunAizNDRqTTLPxcEVMrdcDvRer4H9LRE) | [30,698](https://solscan.io/tx/4MQgt75MvojaAkfxnvrE2yJWabGpE8bsZhNq2CeGJxHZg6uD6A64Kv71JmrsgiGnaEovvv8K34DYL49owLjhs4QJ) | [38,648](https://solscan.io/tx/9T1ZY9JaSMb1GMqv1i22AuZuJQN6B5XcgqeDv5tGqEm5Uox3MBTdXsECt59GwcXkFG9QKgXJyqndTEzpSXhbAVM) |
-| take_offer (offer 1) | [**7,998**](https://solscan.io/tx/49EQwgnKShFdsAs37AEzYmv6tLY8DipcCjmRgqwj4fVTFEgVVWdEXw5AvuEufL5ymJYs4T4hVFdkENW9XK9een5m) | [25,206](https://solscan.io/tx/21MGkXpKRe4c7EeA1hC6JHevsk78xUdbcWmyqG47EbLeCNKSMTzTjkJQqtydnQmV8uHPmr6bJHnvQmmQTSZB7Am2) | [28,612](https://solscan.io/tx/B1hu1EL4Y5vWhBVWdyZEpzRNJb8kd6G9CgN7KtyNNGpQ84o9dfn1sdy9Z1UCHECNtp24Mw8bEH2iYz2YADdEUjx) | [32,835](https://solscan.io/tx/3ZLuQQz7Bx5YdgmFXpVQWHn5kyc8v39jr2BnfofH6sqenzfJpAdVm4h38uYcHwYygnfso92kJe7HRHeASsABoKPQ) |
-| make_offer (offer 2) | [21,804](https://solscan.io/tx/xuu9KXbZvzGDpTEEcDE9LYvBqmPen81y6ty92e6crRxT8m4Mc4XyxhjWHbjVNsr9RE3QY4M1j1Sw9cH7PRMKKuc) | [**19,645**](https://solscan.io/tx/LLzS13AJrqACGoT1VHZN278ij39pNkttb1Z4Wh2AYXknWxwjaiaiMeD7WZomjP6TBv18RHfQHUfogQzApvXr2mC) | [35,198](https://solscan.io/tx/4xiKfzyccVatef1T52tZ3VAJwcx5R7iWgHWezBzZ3p2WpvoLzMp1PSUgr7x3sspE53mDE5JaghaNPKuUohVgPuwc) | [47,648](https://solscan.io/tx/4mxW8D5zpY8t4fL8JRbvhp6ejU6CUvB3iWmFjACipzexW6tZfFeatfnEnDTX3Y97BxsvAftoX9eQauiVu84xrLxh) |
-| refund_offer (offer 2) | [**5,961**](https://solscan.io/tx/4kY7s3y95Lrd2WGCWGPWW3zFBVtEKH6EskdscuYmRCRRgPt2rJTZ1CmZMGUUkHs7aai9AygEiTSUG23EMUrFr7rg) | [13,387](https://solscan.io/tx/QUXWwdbKRcT6WhZvSe4U8nxr4GAMaPNV6pZ1fwrC28kRxdJm7HKXVr2DFRuKD9bEzoS6hFdiA2rLr1mQWyrN3oz) | [17,731](https://solscan.io/tx/5zj7E4c61j1JzUsUPC1fNs9ECFLVmCug9rsdYsVLn7YD1RSxdbAJUQDam1BX3epTzW6ed2uFGwTiNhwaYo7vqdwm) | [23,576](https://solscan.io/tx/5Kjwnq5tN8mzj5s67VGxSry4kRzZk6HLdgXW65FyTvpUeC1D7aQoDGTwzrA7kqyYEvV9y9znnZmLaqU98zFrJJo4) |
+| make_offer (offer 1) | [29,205](https://solscan.io/tx/4AaenpnDGYmT2JXAm8HuN5D9GkEWLYeqyMNxJq6D9aYk6ssunSwNTigFmZoCJtY7MZ3FFBXLsig8jo1YmjUFVTpX) | [**21,145**](https://solscan.io/tx/3tWjcMQxTja6QjEmAvi1MRF9qCsnPBsAmQNPnd5RcNTwnkkJYmk9JFFnZoJbTAc6MEr2QYQd7KtgPGtaNr3inrCG) | [45,698](https://solscan.io/tx/4AgQzePrXL4f4qYrFQBzE65d8cszpmqSiQVt9yVsAotbrYTnartXuM2g2PFg7VhUGaZpbhfH9jzXgwXdRLXwB7tk) | [38,648](https://solscan.io/tx/4Hm62foYd5hoNqmEfLk51HhVVb5VHa5oTr81rjAKNNXyKFYwSrpXZhzFVwbk3WxRzEsiqGxHbn7B4eBop6RC1Sgx) |
+| take_offer (offer 1) | [**9,951**](https://solscan.io/tx/52ej6M3zFt5kgMGKUef9VGZdmZWqJdSoHCvCEB9P3btg7DSbvHkM24uk95W7HXjSX12XHmEmXATC7GLcQQ1U22kK) | [26,706](https://solscan.io/tx/4KLfVqTM2KmwgqF4xECWmNuZWYufsWcocdT5saamWdZQfRYhY7aTsyEyk5pVTxug6LJnngJhWDU7NMiPnZxu9sH2) | [31,628](https://solscan.io/tx/5f2VxEcPUfZbCVHpbYbUntVwfUN4k6ieetxSjdpJVwfck2tDuv2QTGbFFtNcy34Nn8d6bKSp5efzKDSbg7xj5TbJ) | [32,835](https://solscan.io/tx/3sJVTUvGRRtvYisFyqthvYQUZpeLmNN2UtXJq9TsQHW2TLP8YwtiuFGoPvu51w5YoZyJjKc3dM3zF6JXTFRFjc6H) |
+| make_offer (offer 2) | [20,205](https://solscan.io/tx/36mSJoMESxSLoxL5apVkoPzptAgFmUM9z2ZVuKpCadQajxbTF3T6BT93bw2ugHfLX7qSXvcBQ96kd8m22y3DsbTH) | [**19,645**](https://solscan.io/tx/PXPGNGCN3RN15L812K9Ho99Xz5YmUgMDaDy8aXuSg1kFgtdX42Z6foLLJkn8X9XB68xgeQsTBQhoDdUfRPKks2f) | [29,198](https://solscan.io/tx/2n38Urd1FsijNB2kbQy1b2cNHrvU7sXwYe5zH9SeyZUJRhUaD8TXSJGkvjEGYCTy3bdmAvEqqE27Ufgcxg3S3uFe) | [38,648](https://solscan.io/tx/185ZpYg3H1Ku4upHPBoBavrTczwzwxQiz7wjqqYWXd8MmxbimbLz7VvjuQdnqAGaAMy11G8M1QqPzXbrPof8gQb) |
+| refund_offer (offer 2) | [**5,478**](https://solscan.io/tx/55Q7pTfsew4F4N9DPB21BEqeHPANhkgQmUGAYVerFP73D7qMTp4eeo5CPMpYQqU7SLS4e49fuKtLkZ9XowbyoKET) | [13,387](https://solscan.io/tx/2cNkvA4xuFJBQzFcFTnLrxRzDU1q5617T8TCF5sBS7JeNzCPUxCPfzS37uv1RUg7xs9Mqyya6KDV9GSZxGiToevT) | [17,731](https://solscan.io/tx/Nj8RGLqEgbj8SEhd9hLcB2JQJY7YwkP1CnMdeJFBdsFhftntFqm1j1wAD1Mc715wrkPv2pFCWu93AF29oHQUDYr) | [20,576](https://solscan.io/tx/5on9Fxe6mADcbWwVn43yQ5wYtdWyx2u3Ry2hSniLJjRqoj2J55Hbgv4AbZoVZ5CDp2VrrghEkKRBvmXxjv1TynmY) |
+| escrow program's own part, 4 transactions | **28,118** | 36,956 | 93,273 | 102,926 |
 | program | [65ybkcg6…](https://solscan.io/account/65ybkcg6mQa9t5EuHtirRdvf2qAu12qRiK6wYBbGk16P) | [FrQwq3iU…](https://solscan.io/account/FrQwq3iUa8ZkWEne1y27webXTAyLgH4Hj6t986t6VS2G) | [5pnmi1Md…](https://solscan.io/account/5pnmi1MdxzXKmgX7ooRSE212rzZK8rb7nNpRTSMqP8V1) | [EG7M3sLL…](https://solscan.io/account/EG7M3sLLwB7MhmtzwYsaxbhZaFDbshL9hmVK79bQVyVq) |
 
-Most of make_offer is the Associated Token Account program creating the vault (about 13,500 CU in every version); it
-searches for the vault address's bump itself at 1,500 CU a try, which is why TypeSOL's offer 2 cost 1,500 more than
-offer 1 (its own part was 6,719 CU both times). The Pinocchio version takes the offer PDA's bump from the client instead
-of searching for it (its own part: 6,051 CU). Mainnet figures differ from the LiteSVM means above.
+Most of make_offer is the Associated Token Account program creating the vault. It searches for the vault address's
+bump itself at 1,500 CU a try, and every offer has its own vault, so that part varies from offer to offer in every
+version (13,585 to 22,585 CU of the make_offers above); programs that check the vault's address re-derive it, so
+take_offer and refund_offer vary with it too. The escrow program's own part is steadier: TypeSOL's make_offer spent
+6,620 CU of its own on both offers. The Pinocchio version takes the offer PDA's bump from the client instead of
+searching for it. Mainnet figures differ from the LiteSVM means above. Every run, including the one before the
+upgrade, is in [typesol/benchmarks](https://github.com/typesol/benchmarks) (`results/`).
 
 ## How it is tested
 
@@ -315,7 +332,9 @@ change.
 - The compiler, runtime and tooling have been through internal security reviews and are covered by the tests above.
 - They have **not been audited by an independent firm**. Do not put significant value behind programs built with
   TypeSOL until such an audit is published.
-- Audit your own programs as you would any Solana program.
+- Audit your own programs as you would any Solana program. What a compiled program can rely on, and what is left to
+  you, is in [docs/security-model.md](docs/security-model.md); [docs/audit.md](docs/audit.md) is the package for an
+  external audit.
 - Report vulnerabilities as described in [SECURITY.md](SECURITY.md).
 
 Not supported yet: see the end of [docs/language.md](docs/language.md#not-supported-yet).

package/SECURITY.md

@@ -9,6 +9,8 @@ TypeSOL generates programs that hold funds. Treat it accordingly.
   firm.** Do not put significant value behind programs built with it until an external audit of the compiler and
   runtime is published, and audit your own programs as you would any Solana program.
 - Only the latest 0.x release receives security fixes.
+- What a compiled program can rely on is specified in [docs/security-model.md](docs/security-model.md); the package
+  for an external audit is [docs/audit.md](docs/audit.md).
 
 ## Reporting a vulnerability
 

package/dist/cli.js

@@ -7,14 +7,15 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import ts from "typescript";
 import { build, CompileError, COMPILER_VERSION, generate, SBPF_VERSIONS, verifyBinary } from "./compiler/index.js";
-import { generateCpi } from "./cpigen.js";
-import { generatePort } from "./portgen.js";
-import { generateClient, writeClient } from "./clientgen.js";
+import { generateCpi } from "./tools/cpigen.js";
+import { generatePort } from "./tools/portgen.js";
+import { generateClient, writeClient } from "./tools/clientgen.js";
 import { buildIdl } from "./compiler/idl.js";
 import { decodeAddress, loadOrCreateKeypair, readKeypair } from "./keys.js";
-import { formatProfile, profileLogs } from "./profile.js";
+import { formatProfile, profileLogs } from "./tools/profile.js";
 import { TEMPLATE_NAMES } from "./templates.js";
 import { buildWorkspace, CONFIG, deployArgs, findWorkspace, programAddress, programForEntry, programPaths, scaffold } from "./workspace.js";
+import { clusterUrl, deployPreflight, doctorChecks, formatChecks, INSTALL_AGAVE, solanaConfig as readSolanaConfig, toolchainCheck } from "./tools/doctor.js";
 const ASSETS = fileURLToPath(new URL("../assets/", import.meta.url));
 /** A usage problem: printed with the command's help, exit code 2. */
 class UsageError extends Error {
@@ -65,9 +66,18 @@ const COMMANDS = {
                 .replace(/^_+|_+$/g, "")
                 .toLowerCase();
             const name = v.name ?? (/^[a-z]/.test(derived) ? derived : `p_${derived || "program"}`);
+            const rel = path.relative(process.cwd(), root) || ".";
             for (const f of scaffold(root, name, template))
-                log(`  created ${path.join(root, f)}`);
-            log(`\n  next: cd ${path.relative(process.cwd(), root) || "."} && npm install && npm test`);
+                log(`  created ${path.join(rel, f)}`);
+            const tools = toolchainCheck();
+            if (!tools.ok)
+                log(`\n  ! The Solana platform-tools are not installed yet; npm test compiles with them. Install once:\n` +
+                    (tools.fix ?? []).map((f) => `      ${f}`).join("\n"));
+            log(`\n  next:\n` +
+                (rel === "." ? "" : `    cd ${rel}\n`) +
+                `    npm install\n` +
+                `    npm test             # builds ${name} and runs its test in LiteSVM, a Solana runtime in-process\n` +
+                `    npx typesol doctor   # checks the toolchain, keypair and RPC before a deploy`);
             return 0;
         },
     },
@@ -166,6 +176,20 @@ const COMMANDS = {
             return 0;
         },
     },
+    doctor: {
+        usage: "typesol doctor [--url <rpc>] [--config <solana cli config>]",
+        help: [
+            "Check what building, testing and deploying need: Node.js, the platform-tools, the Solana CLI, its keypair, the RPC",
+            "(and the keypair's balance there) and the project. Each problem comes with the command that fixes it. Exit code 1",
+            "when building is impossible (Node.js or the platform-tools); a missing deploy piece is a warning.",
+        ].join("\n  "),
+        options: { url: { type: "string" }, config: { type: "string" } },
+        async run(v) {
+            const checks = await doctorChecks({ cwd: process.cwd(), url: v.url, config: v.config });
+            log(formatChecks(checks));
+            return checks.some((c) => !c.ok && !c.optional) ? 1 : 0;
+        },
+    },
     deploy: {
         usage: "typesol deploy [<program>…] [--url <rpc>] [--keypair <payer.json>] [--config <solana cli config>] [--sbpf v0|v1|v2] [--dry-run]",
         help: [
@@ -174,9 +198,20 @@ const COMMANDS = {
             "Needs the Agave CLI (`solana`) on PATH.",
         ].join("\n  "),
         options: { url: { type: "string" }, keypair: { type: "string" }, config: { type: "string" }, "dry-run": { type: "boolean" }, sbpf: { type: "string" } },
-        run(v, args) {
+        async run(v, args) {
             const ws = needWorkspace("deploy");
             const built = buildWorkspace(ws, names(ws, args), { sbpf: sbpfOf(v) });
+            if (!v["dry-run"]) {
+                // Before any transaction: the RPC answers and the payer can afford it, with what to do if not.
+                const cfg = solanaConfig(v.config);
+                const url = v.url ?? cfg.url;
+                if (url)
+                    await deployPreflight({
+                        url: clusterUrl(url),
+                        payer: v.keypair ?? cfg.keypair ?? path.join(os.homedir(), ".config/solana/id.json"),
+                        programs: built.map((b) => ({ soPath: b.result.soPath, address: b.address, name: b.paths.name })),
+                    });
+            }
             for (const b of built) {
                 const cliArgs = deployArgs(b.result.soPath, b.paths.keypair, { url: v.url, payer: v.keypair, config: v.config });
                 if (v["dry-run"]) {
@@ -189,7 +224,7 @@ const COMMANDS = {
                 }
                 catch (e) {
                     if (e.code === "ENOENT")
-                        throw new Error("`solana` was not found on PATH. Install the Agave CLI: https://docs.anza.xyz/cli/install");
+                        throw new Error(`\`solana\` was not found on PATH. Install the Agave CLI: ${INSTALL_AGAVE}`);
                     throw new Error(`solana program deploy failed for ${b.paths.name} (see its output above)`);
                 }
             }
@@ -217,7 +252,7 @@ const COMMANDS = {
                 throw new Error(`no signer keypair${keyFile ? ` at ${keyFile}` : ""}: pass --keypair, or set keypair_path in the Solana CLI config`);
             // Loaded only here: the other commands do not need an RPC client.
             const kit = await import("@solana/kit");
-            const { publishIdl, rpcChain } = await import("./idlpublish.js");
+            const { publishIdl, rpcChain } = await import("./tools/idlpublish.js");
             const signer = await kit.createKeyPairSignerFromBytes(readKeypair(keyFile));
             const chain = rpcChain(kit.createSolanaRpc(clusterUrl(rpcUrl)));
             for (const name of names(ws, args)) {
@@ -297,7 +332,7 @@ const COMMANDS = {
                     throw new Error("no RPC: pass --url, or set json_rpc_url in the Solana CLI config");
                 // Loaded only here: the other commands do not need an RPC client.
                 const kit = await import("@solana/kit");
-                const { fetchProgramIdl } = await import("./idlpublish.js");
+                const { fetchProgramIdl } = await import("./tools/idlpublish.js");
                 const found = await fetchProgramIdl(kit.createSolanaRpc(clusterUrl(rpcUrl)), kit.address(v.address));
                 console.error(`  IDL from ${found.source === "anchor" ? "Anchor's IDL account" : "the Program Metadata program"}`);
                 idl = found.idl;
@@ -360,7 +395,7 @@ const COMMANDS = {
                     throw new Error("no RPC: pass --url, or set json_rpc_url in the Solana CLI config");
                 // Loaded only here: the other commands do not need an RPC client.
                 const kit = await import("@solana/kit");
-                const { fetchDeployed } = await import("./onchain.js");
+                const { fetchDeployed } = await import("./tools/onchain.js");
                 const rpc = kit.createSolanaRpc(clusterUrl(rpcUrl));
                 const info = await fetchDeployed(rpc, address);
                 onChain = { address, info, rpc };
@@ -387,8 +422,8 @@ const COMMANDS = {
                 return same ? 0 : 3;
             const { info } = onChain;
             log(`  authority ${info.authority ?? "none: the program is immutable"}${info.slot !== undefined ? `; last deployed in slot ${info.slot}` : ""}`);
-            const { fetchIdl, metadataAddress } = await import("./idlpublish.js");
-            const { canonicalJson } = await import("./onchain.js");
+            const { fetchIdl, metadataAddress } = await import("./tools/idlpublish.js");
+            const { canonicalJson } = await import("./tools/onchain.js");
             // No canonical metadata account means nothing was published; one that cannot be read is an error, not "none".
             const at = await metadataAddress(onChain.address, null);
             const exists = (await onChain.rpc.getAccountInfo(at, { encoding: "base64" }).send()).value !== null;
@@ -492,32 +527,12 @@ function overrideFile(file, text) {
         sys.fileExists = fileExists;
     };
 }
-/** The Solana CLI's cluster monikers, as `solana --url` accepts them; anything else is used as given. */
-function clusterUrl(url) {
-    const monikers = {
-        "mainnet-beta": "https://api.mainnet-beta.solana.com",
-        m: "https://api.mainnet-beta.solana.com",
-        devnet: "https://api.devnet.solana.com",
-        d: "https://api.devnet.solana.com",
-        testnet: "https://api.testnet.solana.com",
-        t: "https://api.testnet.solana.com",
-        localhost: "http://127.0.0.1:8899",
-        l: "http://127.0.0.1:8899",
-    };
-    return monikers[url] ?? url;
-}
 /** json_rpc_url / keypair_path from a Solana CLI config (the given file, or the CLI's default one). */
 function solanaConfig(file) {
-    const configPath = file ?? path.join(os.homedir(), ".config/solana/cli/config.yml");
-    if (!existsSync(configPath)) {
-        if (file)
-            throw new UsageError(`${file} does not exist`);
-        return {};
-    }
-    const text = readFileSync(configPath, "utf8");
-    const get = (k) => new RegExp(`^${k}:\\s*["']?([^"'\\n]+?)["']?\\s*$`, "m").exec(text)?.[1];
-    const expand = (p) => (p?.startsWith("~/") ? path.join(os.homedir(), p.slice(2)) : p);
-    return { url: get("json_rpc_url"), keypair: expand(get("keypair_path")) };
+    const cfg = readSolanaConfig(file);
+    if (file && !cfg.exists)
+        throw new UsageError(`${file} does not exist`);
+    return { url: cfg.url, keypair: cfg.keypair };
 }
 export async function main(argv) {
     const [cmd, ...rest] = argv;

package/dist/compiler/analyze.js

@@ -1473,6 +1473,13 @@ function analyzeInstruction(fn, reporter, scope, structs) {
                 if (entry.includes("=")) {
                     if (!accounts.some((o) => o.name === param))
                         reporter.fail(a.node, `add an account parameter named "${param}"`);
+                    if (f === "tokenProgram") {
+                        if (a.kind.kind !== "token" && a.kind.kind !== "mint")
+                            reporter.fail(a.node, "TokenOf / MintOf apply to a TokenAccount / Mint");
+                        if (accounts.find((o) => o.name === param).kind.kind !== "tokenProgram")
+                            reporter.fail(a.node, `"${param}" must be a TokenProgram, Token2022Program or TokenInterface parameter`);
+                        continue;
+                    }
                     if (a.kind.kind === "token" ? f !== "mint" && f !== "owner" : a.kind.kind === "mint" ? false : true)
                         reporter.fail(a.node, a.kind.kind === "token" || a.kind.kind === "mint" ? "TokenOf<…> applies to a TokenAccount" : "TokenOf / MintOf apply to a TokenAccount / Mint");
                     if (a.kind.kind === "mint" && f !== "mintAuthority" && f !== "freezeAuthority")
@@ -1610,12 +1617,15 @@ function unwrapConstraints(node, reporter, imports, out) {
         const one = (t) => (t && t.kind !== ts.SyntaxKind.NeverKeyword ? lit(t)[0] : undefined);
         const p1 = one(args[1]);
         const p2 = one(args[2]);
-        if (!p1 && !p2)
+        const p3 = one(args[3]);
+        if (!p1 && !p2 && !p3)
             reporter.fail(node, `${name}<…> names at least one parameter`);
         if (p1)
             out.hasOne.push(`${first}=${p1}`);
         if (p2)
             out.hasOne.push(`${second}=${p2}`);
+        if (p3)
+            out.hasOne.push(`tokenProgram=${p3}`);
     }
     if (name === "CloseTo")
         out.closeTo = lit(args[1])[0];

package/dist/compiler/emit/calls.js

@@ -3,7 +3,7 @@ import { calleeName, resolveScalarType, resolveValueType } from "../analyze.js";
 import { ANCHOR_ERRORS } from "../anchor-errors.js";
 import { decodeAddress } from "../../keys.js";
 import { INT_INFO, INT_NAMES, isScalar, isWritable, sameType, scalarSize, typeName, } from "../model.js";
-import { U64, U8, I64, BOOL, PUBKEY, STRING, HASH, cBytes, cString, scalarC, scalarStorageC, optC, valueC, fieldC, storageDecl, accountMismatch, vecCount, emptySizeC, vecLenCheck, } from "./shared.js";
+import { U64, U8, I64, I32, BOOL, PUBKEY, STRING, HASH, cBytes, cString, scalarC, scalarStorageC, optC, valueC, fieldC, storageDecl, accountMismatch, vecCount, emptySizeC, vecLenCheck, } from "./shared.js";
 import { ExpressionEmitter } from "./expressions.js";
 /**
  * Calls: built-in functions, Vec methods, helpers, remaining accounts, foreign account reads and return data.
@@ -344,29 +344,29 @@ export class CallEmitter extends ExpressionEmitter {
                 return { c: `ts_secp256k1_verify(${h.c}, (uint64_t)${id.c}, ${r.c}, ${sv.c}, ${eth.c})`, type: BOOL };
             }
             case "pythPrice": {
-                if (args.length !== 3)
-                    this.fail(node, "pythPrice(update, feedId, maxAgeSeconds) takes three arguments");
+                if (args.length !== 3 && args.length !== 4)
+                    this.fail(node, "pythPrice(update, feedId, maxAgeSeconds, exponent?) takes three or four arguments");
                 const u = this.accountParam(args[0], "the price update");
                 if (u.kind.kind !== "pyth")
                     this.fail(args[0], "pass a PythPriceUpdate parameter");
-                const [feed, age] = this.lowerInOrder(args.slice(1), [HASH, U64]);
+                const [feed, age, expo] = this.lowerInOrder(args.slice(1), [HASH, U64, I32]);
                 const t = this.tmp("px");
                 this.line(`int64_t ${t};`);
-                this.line(`TS_TRY(ts_pyth_price(a_${u.name}, ${feed.c}, ${age.c}, &${t}));`);
+                this.line(`TS_TRY(ts_pyth_price(a_${u.name}, ${feed.c}, ${age.c}, ${expo ? `true, ${expo.c}` : "false, 0"}, &${t}));`);
                 return { c: t, type: I64 };
             }
             case "switchboardValue": {
                 // Anyone can create a Switchboard feed: like pythPrice's feed id, the expected feed address is required.
-                if (args.length !== 4)
-                    this.fail(node, "switchboardValue(feed, expectedFeed, maxStaleSlots, decimals) takes four arguments");
+                if (args.length !== 4 && args.length !== 5)
+                    this.fail(node, "switchboardValue(feed, expectedFeed, maxStaleSlots, decimals, minSamples?) takes four or five arguments");
                 const f = this.accountParam(args[0], "the feed");
                 if (f.kind.kind !== "switchboard")
                     this.fail(args[0], "pass a SwitchboardFeed parameter");
-                const [expected, stale, dec] = this.lowerInOrder(args.slice(1), [PUBKEY, U64, U8]);
+                const [expected, stale, dec, min] = this.lowerInOrder(args.slice(1), [PUBKEY, U64, U8, U8]);
                 const t = this.tmp("sb");
                 this.line(`int64_t ${t};`);
                 this.line(`if (!ts_key_eq(&a_${f.name}->key, ${expected.c})) TS_FAIL(TS_ERR_ORACLE, "TypeSOL: not the expected Switchboard feed");`);
-                this.line(`TS_TRY(ts_switchboard_value(a_${f.name}, ${stale.c}, ${dec.c}, &${t}));`);
+                this.line(`TS_TRY(ts_switchboard_value(a_${f.name}, ${stale.c}, ${dec.c}, ${min ? min.c : "1"}, &${t}));`);
                 return { c: t, type: I64 };
             }
             case "associatedTokenAddress": {
@@ -980,7 +980,7 @@ export class CallEmitter extends ExpressionEmitter {
                 this.line(l);
         if (mut) {
             this.line(`TS_TRY(ts_check_writable(${h}));`);
-            this.line(`TS_TRY(ts_check_unaliased(params, ${h}));`);
+            this.line(`TS_TRY(ts_claim_mut(params, ${h}));`);
         }
         return { c: `((TSS_${s.name} *)(${h}->data + 8))`, type: { kind: "structRef", struct: s.name, writable: mut } };
     }

package/dist/compiler/emit/cpi.js

@@ -774,6 +774,10 @@ export class CpiEmitter extends CallEmitter {
         const ataProgram = need("ataProgram", "an AssociatedTokenProgram");
         const system = need("system", "a SystemProgram");
         const tokenProgram = need("tokenProgram", "a token program (TokenProgram, Token2022Program or TokenInterface)");
+        // The address is derived under the token program: with two, which one the mint uses is not known here.
+        const tokenPrograms = this.ix.accounts.filter((o) => o.kind.kind === "tokenProgram");
+        if (tokenPrograms.length > 1)
+            this.fail(node, `${call}(...) needs exactly one token program parameter (found ${tokenPrograms.map((o) => o.name).join(", ")}); use TokenInterface`);
         const { owner, mint } = target.constraints.ata;
         const a = `a_${target.name}`;
         const create = `TS_TRY(ts_ata_create(params, a_${ataProgram.name}, a_${payer.name}, ${a}, a_${owner}, a_${mint}, a_${system.name}, a_${tokenProgram.name}, false));`;

package/dist/compiler/emit/function.d.ts

@@ -9,7 +9,16 @@ export declare class FunctionEmitter extends StatementEmitter {
     emitInstruction(): string;
     /** CloseTo<…> accounts are closed when the instruction succeeds, at every return. */
     protected epilogue(): string[];
+    /**
+     * Each account's constraints, account by account in parameter order and, within one account, in Anchor's order
+     * (anchor-syn's `linearize`): seeds, associated token, has_one, owner, executable, address, token::, mint::.
+     * A transaction that breaks several checks then fails with the same error code as under Anchor.
+     */
     protected constraintChecks(ix: Instruction): string[];
+    /** Ata<…>: the account's owner (2015) and address (2009) as Anchor checks them, then its mint. */
+    private ataCheck;
+    /** Seeds<…>: the account is the PDA of its seeds (with the stored bump, or the canonical one found here). */
+    private seedsCheck;
     /** Optional account parameters a piece of generated C refers to (a_name / d_name). */
     protected optionalIn(code: string): string[];
 }