@typesol/cli 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -6,6 +6,24 @@ codes, and says so here.
 
 ## Unreleased
 
+## 0.27.0 — 2026-10-29
+
+Anchor 1.0 parity: instruction introspection, `Dup<…>` and account migration. Existing programs compile to the same
+binaries as in 0.26.0.
+
+- New: instruction introspection. `InstructionsSysvar` has `length`, `currentIndex()` and `get(i)`, a
+  `TransactionInstruction` with `programId`, its accounts (key, signer, writable), its data
+  (`readU8/U16/U32/U64/readPubkey`) and `is(program, "name")` (an instruction by its Anchor discriminator); every read
+  is bounds-checked (5104). `stackHeight()` is 1 at the top level, more under a CPI.
+- New: `Dup<…>`, Anchor's `dup`: a writable parameter that may be the same account as another, for accounts read and
+  written in place (not created, closed, a close destination or `@layout borsh`, which are refused at compile time).
+- New: `Migrate<From, To>`, Anchor 1.0's `Migration`: an existing account rewritten from one struct to another with
+  `acct.migrate(payer, value)`, the old data readable through `acct.from` until then (the new value is built before
+  the bytes are rewritten), the new through `acct.to` after; resized with the payer topping up rent. For now:
+  fixed-layout structs without growable Vecs, no constraints on the account, and it cannot be passed to a helper.
+- New: `/** @discriminator … */` on an account struct (a sha256 preimage such as `account:Counter`, or 0x and 8
+  bytes), Anchor's `#[account(discriminator = …)]`: keeps an old type's on-chain discriminator under a new name.
+
 ## 0.26.0 — 2026-10-29
 
 A first-run experience pass, the security model and audit package, and more fuzzing. The compiler's output is the

package/dist/compiler/analyze.js

@@ -85,6 +85,8 @@ const TYPE_EXPORTS = new Set([
     "Ata",
     "Owner",
     "Executable",
+    "Dup",
+    "Migrate",
     "Optional",
     "EventAuthority",
     "MplCoreProgram",
@@ -114,6 +116,22 @@ export function snakeCase(name) {
         .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2")
         .toLowerCase();
 }
+/**
+ * An account struct's discriminator: Anchor's sha256("account:<Name>")[..8], or the one a `/** @discriminator … *\/` tag
+ * gives (a sha256 preimage such as `account:Counter`, or 0x and 8 bytes), e.g. for an old version of a struct kept under
+ * a new name for Migrate<From, To>.
+ */
+function accountDiscriminator(decl, name, reporter) {
+    const tag = ts.getJSDocTags(decl).find((t) => t.tagName.text === "discriminator");
+    if (!tag)
+        return discriminator(`account:${name}`);
+    const text = (typeof tag.comment === "string" ? tag.comment : (ts.getTextOfJSDocComment(tag.comment) ?? "")).trim();
+    if (/^0x([0-9a-fA-F]{2}){8}$/.test(text))
+        return [...Buffer.from(text.slice(2), "hex")];
+    if (text && !text.startsWith("0x"))
+        return discriminator(text);
+    reporter.fail(decl, "@discriminator on an account struct needs a sha256 preimage (account:<Name>) or 0x and 8 bytes");
+}
 export function discriminator(preimage) {
     return [...createHash("sha256").update(preimage).digest().subarray(0, 8)];
 }
@@ -601,12 +619,17 @@ export function analyze(entry) {
         // A returned struct goes out in its fixed layout, like an argument comes in: it cannot also be a Borsh event.
         if (ix.returns?.kind === "struct")
             collectStructs(ix.returns, structs, dataEnums, argStructs);
-        for (const a of ix.accounts)
+        for (const a of ix.accounts) {
+            if (a.kind.kind === "migrate") {
+                accountStructs.add(a.kind.from.name);
+                accountStructs.add(a.kind.to.name);
+            }
             if (a.kind.kind === "account" || a.kind.kind === "init" || a.kind.kind === "zeroed" || a.kind.kind === "initIfNeeded") {
                 accountStructs.add(a.kind.struct.name);
                 if (a.kind.struct.viewsOnly)
                     reporter.error(a.node, `${a.kind.struct.name} holds a string (or an enum carrying one), so it is an argument, return value or event; account data uses FixedString<N>`);
             }
+        }
     }
     // Arguments are Borsh, where a FixedVec is a Vec (only what it holds). A struct passed as a whole argument and used
     // nowhere else (not account data, not nested, not returned) is read as Anchor sends it: @layout borsh, implied.
@@ -966,7 +989,7 @@ function analyzeStructs(items, aliases, dataEnums, reporter, scopeFor, fstrings,
                 name,
                 fields: stored,
                 size: undefined,
-                accountDiscriminator: discriminator(`account:${name}`),
+                accountDiscriminator: accountDiscriminator(decl, name, reporter),
                 eventDiscriminator: discriminator(`event:${name}`),
                 node: decl,
                 layout: layoutText === "borsh" ? "borsh" : "fixed",
@@ -1321,7 +1344,7 @@ function analyzeHelper(fn, name, display, reporter, scope, structs, skip = new S
             wrapped === "Ata")
             reporter.fail(p.type, "constraints belong on instruction parameters; helpers take the plain account type");
         const account = resolveAccountKind(p.type, reporter, scope.imports, structs);
-        if (account.kind === "init" || account.kind === "initIfNeeded" || account.kind === "zeroed")
+        if (account.kind === "init" || account.kind === "initIfNeeded" || account.kind === "zeroed" || account.kind === "migrate")
             reporter.fail(p.type, "helpers take accounts that exist: create Init/InitIfNeeded/Zeroed accounts in the instruction, then pass them as Mut<T>");
         return { name: p.name.text, type: { kind: "account" }, account, node: p };
     });
@@ -1445,7 +1468,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
             const inner = unwrapConstraints(typeNode, reporter, imports, constraints);
             const kind = resolveAccountKind(inner, reporter, imports, structs);
             if (optional &&
-                (["init", "initIfNeeded", "zeroed", "pyth", "eventAuthority", "selfProgram", "programData"].includes(kind.kind) ||
+                (["init", "initIfNeeded", "zeroed", "migrate", "pyth", "eventAuthority", "selfProgram", "programData"].includes(kind.kind) ||
                     ((kind.kind === "token" || kind.kind === "mint") && kind.init)))
                 reporter.fail(p, "Init, InitIfNeeded, Zeroed, PythPriceUpdate, EventAuthority, SelfProgram and ProgramData accounts cannot be optional");
             accounts.push({ name: p.name.text, index: accounts.length, kind, node: p, constraints, ...(optional ? { optional } : {}) });
@@ -1566,6 +1589,18 @@ function analyzeInstruction(fn, reporter, scope, structs) {
         reporter.error(fn.name, "instructions that grow a Vec (push) need a SystemProgram parameter to top up rent");
     if (needs("init") && !needs("system"))
         reporter.error(fn.name, "instructions with Init<...> accounts need a SystemProgram parameter");
+    if (accounts.some((a) => a.kind.kind === "migrate" && a.kind.to.size > a.kind.from.size) && !needs("system"))
+        reporter.error(fn.name, "a Migrate<From, To> that grows the account needs a SystemProgram parameter (the payer tops up its rent)");
+    for (const a of accounts)
+        if (a.kind.kind === "migrate" &&
+            (a.constraints.hasOne.length ||
+                a.constraints.seeds ||
+                a.constraints.closeTo ||
+                a.constraints.ata ||
+                a.constraints.address ||
+                a.constraints.owner ||
+                a.constraints.dup))
+            reporter.error(a.node, "Migrate<From, To> takes no constraints yet: check the old fields with require(…, …) on acct.from");
     const name = snakeCase(fn.name.text);
     // `/** @discriminator spl-transfer-hook-interface:execute */` (sha256 preimage) or `@discriminator 0x...` (raw bytes)
     // lets an instruction implement another program's interface.
@@ -1596,7 +1631,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
 /** Peel HasOne / Seeds / CloseTo wrappers off a parameter type, recording what they ask for. */
 function unwrapConstraints(node, reporter, imports, out) {
     const name = typesolName(node, imports);
-    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable"].includes(name ?? ""))
+    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable", "Dup"].includes(name ?? ""))
         return node;
     const args = node.typeArguments ?? [];
     const lit = (t) => {
@@ -1638,6 +1673,8 @@ function unwrapConstraints(node, reporter, imports, out) {
     }
     if (name === "Executable")
         out.executable = true;
+    if (name === "Dup")
+        out.dup = true;
     if (name === "Address") {
         const text = lit(args[1])[0];
         const bytes = text === undefined ? undefined : decodeAddress(text);
@@ -1668,6 +1705,8 @@ function unwrapConstraints(node, reporter, imports, out) {
         reporter.fail(node, `${name}<…> wraps an account type`);
     return unwrapConstraints(args[0], reporter, imports, out);
 }
+/** Solana: an account grows at most this many bytes per instruction. */
+const MAX_PERMITTED_DATA_INCREASE = 10_240;
 function resolveAccountKind(node, reporter, imports, structs) {
     const outer = typesolName(node, imports);
     const ref = node;
@@ -1769,6 +1808,24 @@ function resolveAccountKind(node, reporter, imports, structs) {
                 reporter.fail(node, `${s.name} is too large to create in a program; use Zeroed<${s.name}>`);
             return { kind: "initIfNeeded", struct: s };
         }
+        case "Migrate": {
+            const [fromNode, toNode] = ref.typeArguments ?? [];
+            const from = fromNode && structOf(fromNode);
+            const to = toNode && structOf(toNode);
+            if (!from || !to || ref.typeArguments.length !== 2)
+                reporter.fail(node, "Migrate<From, To> takes two account structs declared in this program");
+            for (const s of [from, to]) {
+                if (s.vec)
+                    reporter.fail(node, `${s.name} has a growable Vec; Migrate<From, To> takes fixed-size structs`);
+                if (s.layout === "borsh")
+                    reporter.fail(node, `${s.name} is @layout borsh; Migrate<From, To> takes fixed layouts`);
+            }
+            if (from.accountDiscriminator.join() === to.accountDiscriminator.join())
+                reporter.fail(node, `${from.name} and ${to.name} have the same discriminator: give the new struct another name (or the old one /** @discriminator account:<OldName> */)`);
+            if (to.size - from.size > MAX_PERMITTED_DATA_INCREASE)
+                reporter.fail(node, `${to.name} is more than 10 KiB larger than ${from.name}; an account grows at most 10 KiB per instruction`);
+            return { kind: "migrate", from, to };
+        }
         case "Zeroed": {
             const s = structOf(inner());
             if (!s)

package/dist/compiler/emit/base.d.ts

@@ -112,6 +112,8 @@ export declare abstract class EmitterBase {
     protected abstract call(node: ts.CallExpression, topLevel: boolean): Value | undefined;
     protected abstract isRemaining(node: ts.Expression): boolean;
     protected abstract handle(node: ts.Expression): string | undefined;
+    protected abstract instructionsParam(node: ts.Expression): AccountParam | undefined;
+    protected abstract isTxIx(node: ts.Expression): boolean;
     protected abstract seeds(node: ts.Expression, extra: number): {
         name: string;
         count: number;

package/dist/compiler/emit/base.js

@@ -65,7 +65,10 @@ export class EmitterBase {
             this.ix = target;
             for (const a of target.accounts) {
                 this.accounts.set(a.name, a);
-                if (a.kind.kind === "init" || a.kind.kind === "initIfNeeded" || ((a.kind.kind === "token" || a.kind.kind === "mint") && a.kind.init))
+                if (a.kind.kind === "init" ||
+                    a.kind.kind === "initIfNeeded" ||
+                    a.kind.kind === "migrate" ||
+                    ((a.kind.kind === "token" || a.kind.kind === "mint") && a.kind.init))
                     this.pendingInit.add(a.name);
             }
             for (const a of target.args)

package/dist/compiler/emit/calls.d.ts

@@ -1,5 +1,5 @@
 import ts from "typescript";
-import { type ErrorDef, type FieldType, type Helper } from "../model.js";
+import { type AccountParam, type ErrorDef, type FieldType, type Helper } from "../model.js";
 import { type Value, type Ref, type Closure } from "./shared.js";
 import { ExpressionEmitter } from "./expressions.js";
 export declare abstract class CallEmitter extends ExpressionEmitter {
@@ -20,6 +20,15 @@ export declare abstract class CallEmitter extends ExpressionEmitter {
     /** `remainingAccounts()` or a const bound to it. */
     protected isRemaining(node: ts.Expression): boolean;
     /** C pointer (`TsAccount *`) for an expression naming a remaining account, or undefined. */
+    /** Whether `node` is an InstructionsSysvar parameter. */
+    protected instructionsParam(node: ts.Expression): AccountParam | undefined;
+    /** Whether `node` is a TransactionInstruction: a local holding one, or `ixs.get(i)`. */
+    protected isTxIx(node: ts.Expression): boolean;
+    /**
+     * InstructionsSysvar.currentIndex() / .get(i) and the methods of a TransactionInstruction: bounds-checked reads of the
+     * sysvar (ts_ix_* in the runtime). Undefined when the call is something else.
+     */
+    protected instructionsCall(node: ts.CallExpression, callee: ts.PropertyAccessExpression, method: string): Value | undefined;
     protected handle(node: ts.Expression): string | undefined;
     /** A declared account parameter or a remaining account, as a `TsAccount *` C expression. */
     protected anyAccount(node: ts.Expression, what: string): string;
@@ -29,6 +38,12 @@ export declare abstract class CallEmitter extends ExpressionEmitter {
     protected loadForeign(node: ts.CallExpression): Value;
     /** `loadAccount<T>(acct)` / `loadAccountMut<T>(acct)`: checked view of a program account. */
     protected loadAccount(node: ts.CallExpression, mut: boolean): Value;
+    /**
+     * `acct.migrate(payer, value)` on a Migrate<From, To> account: the new value is built in full first (it may read
+     * acct.from, whose bytes the rewrite overwrites), then the account is resized (the payer tops up the rent when it
+     * grows; shrinking keeps the lamports) and rewritten with To's discriminator and the value.
+     */
+    protected migrate(node: ts.CallExpression, a: AccountParam, topLevel: boolean): Value | undefined;
     /** Whether a helper (or one it calls) grows a Vec, which needs the instruction's SystemProgram for rent. */
     private helperGrows;
     /**

package/dist/compiler/emit/calls.js

@@ -1,5 +1,5 @@
 import ts from "typescript";
-import { calleeName, resolveScalarType, resolveValueType } from "../analyze.js";
+import { calleeName, discriminator, resolveScalarType, resolveValueType, snakeCase } from "../analyze.js";
 import { ANCHOR_ERRORS } from "../anchor-errors.js";
 import { decodeAddress } from "../../keys.js";
 import { INT_INFO, INT_NAMES, isScalar, isWritable, sameType, scalarSize, typeName, } from "../model.js";
@@ -21,6 +21,11 @@ export class CallEmitter extends ExpressionEmitter {
             return this.cast(args[0], { kind: "int", name: builtin });
         }
         switch (builtin) {
+            case "stackHeight": {
+                if (args.length)
+                    this.fail(node, "stackHeight() takes no arguments");
+                return { c: "sol_get_stack_height()", type: U64 };
+            }
             case "require": {
                 if (args.length !== 2)
                     this.fail(node, "require(condition, error) takes two arguments");
@@ -484,6 +489,9 @@ export class CallEmitter extends ExpressionEmitter {
             return this.callHelper(node, helper);
         if (ts.isPropertyAccessExpression(callee)) {
             const method = callee.name.text;
+            const introspected = this.instructionsCall(node, callee, method);
+            if (introspected)
+                return introspected;
             // xs.some(…) and friends on a Vec, FixedArray, FixedVec or Vec argument: a loop with the callback expanded in it.
             if (LIST_METHODS.has(method)) {
                 const l = ts.isIdentifier(callee.expression) ? this.lookup(callee.expression.text) : undefined;
@@ -570,6 +578,8 @@ export class CallEmitter extends ExpressionEmitter {
                     return target.kind.kind === "token" && target.constraints.ata ? this.createAta(node, target, topLevel) : this.createToken(node, target, topLevel);
                 if (target?.kind.kind === "init" && method === "create")
                     return this.create(node, target, topLevel);
+                if (target?.kind.kind === "migrate" && method === "migrate")
+                    return this.migrate(node, target, topLevel);
                 if (target?.kind.kind === "initIfNeeded" && method === "createIfNeeded")
                     return this.create(node, target, topLevel, true);
                 if (target?.kind.kind === "system" && method === "transfer")
@@ -878,6 +888,92 @@ export class CallEmitter extends ExpressionEmitter {
         return ts.isCallExpression(node) && this.exportName(node.expression) === "remainingAccounts";
     }
     /** C pointer (`TsAccount *`) for an expression naming a remaining account, or undefined. */
+    /** Whether `node` is an InstructionsSysvar parameter. */
+    instructionsParam(node) {
+        const a = ts.isIdentifier(node) ? this.accounts.get(node.text) : undefined;
+        return a?.kind.kind === "instructionsSysvar" ? a : undefined;
+    }
+    /** Whether `node` is a TransactionInstruction: a local holding one, or `ixs.get(i)`. */
+    isTxIx(node) {
+        if (ts.isParenthesizedExpression(node))
+            return this.isTxIx(node.expression);
+        if (ts.isIdentifier(node))
+            return this.lookup(node.text)?.type.kind === "txIx";
+        return (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.text === "get" &&
+            !!this.instructionsParam(node.expression.expression));
+    }
+    /**
+     * InstructionsSysvar.currentIndex() / .get(i) and the methods of a TransactionInstruction: bounds-checked reads of the
+     * sysvar (ts_ix_* in the runtime). Undefined when the call is something else.
+     */
+    instructionsCall(node, callee, method) {
+        const args = node.arguments;
+        const sysvar = this.instructionsParam(callee.expression);
+        if (sysvar) {
+            this.assertUsable(sysvar, callee.expression);
+            if (method === "currentIndex") {
+                if (args.length)
+                    this.fail(node, "currentIndex() takes no arguments");
+                const t = this.tmp("ixi");
+                this.line(`uint64_t ${t};`);
+                this.line(`TS_TRY(ts_ix_current(a_${sysvar.name}, &${t}));`);
+                return { c: t, type: U64 };
+            }
+            if (method === "get") {
+                if (args.length !== 1)
+                    this.fail(node, "get(index) takes the instruction's index");
+                const i = this.expect(this.expr(args[0], U64), U64, args[0]);
+                const t = this.tmp("ix");
+                this.line(`TsIx ${t};`);
+                this.line(`TS_TRY(ts_ix_load(a_${sysvar.name}, ${i.c}, &${t}));`);
+                return { c: t, type: { kind: "txIx" } };
+            }
+            this.fail(node, "the Instructions sysvar has .length, currentIndex() and get(index)");
+        }
+        if (!this.isTxIx(callee.expression))
+            return undefined;
+        const ix = this.expr(callee.expression);
+        const one = (what) => {
+            if (args.length !== 1)
+                this.fail(node, `${method}(${what}) takes one argument`);
+            return this.expect(this.expr(args[0], U64), U64, args[0]).c;
+        };
+        if (method === "accountKey" || method === "accountIsSigner" || method === "accountIsWritable") {
+            const i = one("i");
+            const t = this.tmp("ixa");
+            this.line(`const uint8_t *${t};`);
+            this.line(`TS_TRY(ts_ix_account(&${ix.c}, ${i}, &${t}));`);
+            if (method === "accountKey")
+                return { c: `((const SolPubkey *)(${t} + 1))`, type: PUBKEY };
+            return { c: `((${t}[0] & ${method === "accountIsSigner" ? 1 : 2}) != 0)`, type: BOOL };
+        }
+        const reads = {
+            readU8: ["uint8_t", U8],
+            readU16: ["uint16_t", { kind: "int", name: "u16" }],
+            readU32: ["uint32_t", { kind: "int", name: "u32" }],
+            readU64: ["uint64_t", U64],
+            readPubkey: ["SolPubkey", PUBKEY],
+        };
+        if (reads[method]) {
+            const [c, type] = reads[method];
+            const off = one("offset");
+            const t = this.tmp("ixr");
+            this.line(`${c} ${t};`);
+            this.line(`TS_TRY(ts_ix_read(&${ix.c}, ${off}, sizeof(${c}), &${t}));`);
+            return type.kind === "pubkey" ? { c: `(&${t})`, type } : { c: t, type };
+        }
+        if (method === "is") {
+            if (args.length !== 2 || !ts.isStringLiteralLike(args[1]))
+                this.fail(node, 'is(program, "instruction_name") takes the program and the instruction name as a string literal');
+            const program = this.expect(this.expr(args[0], PUBKEY), PUBKEY, args[0]);
+            const disc = this.tmp("disc");
+            this.line(`static const uint8_t ${disc}[8] = ${cBytes(discriminator(`global:${snakeCase(args[1].text)}`))};`);
+            return { c: `ts_ix_is(&${ix.c}, ${program.c}, ${disc})`, type: BOOL };
+        }
+        this.fail(node, "a TransactionInstruction has programId, accountsLength, dataLength, accountKey/accountIsSigner/accountIsWritable(i), readU8/U16/U32/U64/readPubkey(offset) and is(program, name)");
+    }
     handle(node) {
         if (ts.isParenthesizedExpression(node))
             return this.handle(node.expression);
@@ -984,6 +1080,38 @@ export class CallEmitter extends ExpressionEmitter {
         }
         return { c: `((TSS_${s.name} *)(${h}->data + 8))`, type: { kind: "structRef", struct: s.name, writable: mut } };
     }
+    /**
+     * `acct.migrate(payer, value)` on a Migrate<From, To> account: the new value is built in full first (it may read
+     * acct.from, whose bytes the rewrite overwrites), then the account is resized (the payer tops up the rent when it
+     * grows; shrinking keeps the lamports) and rewritten with To's discriminator and the value.
+     */
+    migrate(node, a, topLevel) {
+        const k = a.kind;
+        const call = `${a.name}.migrate`;
+        if (!topLevel)
+            this.fail(node, `${call}(…) must be a top-level statement of the instruction`);
+        if (this.created.has(a.name))
+            this.fail(node, `${a.name} is already migrated`);
+        if (node.arguments.length !== 2)
+            this.fail(node, `${call}(payer, value) takes the payer and the new ${k.to.name}`);
+        const payer = this.accountParam(node.arguments[0], "the payer");
+        if (payer.kind.kind !== "signer" || !payer.kind.mut)
+            this.fail(node.arguments[0], "the payer must be a Mut<Signer>");
+        this.assertNotAliased([a.name], node, "migrate");
+        const To = k.to.name;
+        const tmp = this.tmp("next");
+        this.line(`TSS_${To} *${tmp} = NULL;`);
+        this.line(`TS_TRY(ts_alloc(sizeof(TSS_${To}), (uint8_t **)&${tmp}));`);
+        this.writeAggregate({ lv: `(*${tmp})`, type: { kind: "struct", name: To }, writable: true }, node.arguments[1]);
+        this.line(`TS_TRY(ts_resize(params, a_${payer.name}, a_${a.name}, 8 + sizeof(TSS_${To}), entry_${a.name}));`);
+        this.line(`ts_memcpy(a_${a.name}->data, TS_DISC_${To}, 8);`);
+        this.line(`ts_memcpy(a_${a.name}->data + 8, ${tmp}, sizeof(TSS_${To}));`);
+        this.line(`TSS_${To} *dt_${a.name} = (TSS_${To} *)(a_${a.name}->data + 8);`);
+        this.line(`(void)dt_${a.name};`);
+        this.created.add(a.name);
+        this.pendingInit.delete(a.name);
+        return undefined;
+    }
     /** Whether a helper (or one it calls) grows a Vec, which needs the instruction's SystemProgram for rent. */
     helperGrows(body, seen = new Set()) {
         if (seen.has(body))

package/dist/compiler/emit/expressions.js

@@ -265,6 +265,14 @@ export class ExpressionEmitter extends StorageEmitter {
         if (field === "length") {
             if (this.isRemaining(node.expression))
                 return { c: `((uint64_t)(params->ka_num - ${this.ix.accounts.length}))`, type: U64 };
+            const sysvar = this.instructionsParam(node.expression);
+            if (sysvar) {
+                this.assertUsable(sysvar, node.expression);
+                const t = this.tmp("ixn");
+                this.line(`uint64_t ${t};`);
+                this.line(`TS_TRY(ts_ix_count(a_${sysvar.name}, &${t}));`);
+                return { c: t, type: U64 };
+            }
             // The number of elements a map / filter chain gives: counted, nothing stored.
             if (this.isPipeline(node.expression)) {
                 const n = this.tmp("count");
@@ -284,6 +292,16 @@ export class ExpressionEmitter extends StorageEmitter {
             }
             this.fail(node, "use byteLength(s) for strings; .length is available on arrays, Vecs and remainingAccounts()");
         }
+        if (this.isTxIx(node.expression)) {
+            const ix = this.expr(node.expression);
+            if (field === "programId")
+                return { c: `(${ix.c}.program_id)`, type: PUBKEY };
+            if (field === "accountsLength")
+                return { c: `((uint64_t)${ix.c}.num_accounts)`, type: U64 };
+            if (field === "dataLength")
+                return { c: `((uint64_t)${ix.c}.data_len)`, type: U64 };
+            this.fail(node.name, `a TransactionInstruction has programId, accountsLength and dataLength, not ${field}`);
+        }
         const h = this.handle(node.expression);
         if (h) {
             switch (field) {

package/dist/compiler/emit/function.js

@@ -90,6 +90,9 @@ export class FunctionEmitter extends StatementEmitter {
                 }
                 head.push(`  TS_TRY(ts_check_executable(${v}));`);
             }
+            // Migrate<From, To>: an existing From account (owner, discriminator, size), kept to be rewritten as To.
+            if (k.kind === "migrate")
+                head.push(`  TS_TRY(ts_check_program_account(${v}, params->program_id, TS_DISC_${k.from.name}, sizeof(TSS_${k.from.name})));`, `  const TSS_${k.from.name} *df_${a.name} = (const TSS_${k.from.name} *)(${v}->data + 8);`, `  uint64_t entry_${a.name} = ${v}->data_len;`);
             if (k.kind === "zeroed")
                 head.push(`  TS_TRY(ts_init_zeroed(${v}, params->program_id, TS_DISC_${k.struct.name}, sizeof(TSS_${k.struct.name})));`);
             if (k.kind === "initIfNeeded" && k.struct.vec)
@@ -152,9 +155,30 @@ export class FunctionEmitter extends StatementEmitter {
         // The loader passes each account once and marks repeats as duplicates, which share its record (ts_deserialize),
         // so two parameters name the same account exactly when their pointers are equal.
         const writable = ix.accounts.filter((a) => isWritable(a.kind));
+        // Dup<…> (Anchor's `dup`) lifts the check for a pair when both accounts are read and written in place: not created
+        // here, not closed or a close destination, not a @layout borsh heap copy (a lost update when packed back).
+        const closing = new Set(ix.accounts.flatMap((a) => (a.constraints.closeTo ? [a.name, a.constraints.closeTo] : [])));
+        const inPlace = (a) => {
+            const k = a.kind;
+            if (closing.has(a.name))
+                return false;
+            if (k.kind === "account")
+                return k.struct.layout !== "borsh";
+            if (k.kind === "token" || k.kind === "mint")
+                return !k.init;
+            return k.kind === "signer" || k.kind === "info";
+        };
+        for (const a of writable)
+            if (a.constraints.dup && !inPlace(a))
+                this.reporter.fail(a.node, "Dup<…> is for accounts read and written in place: not created, closed, a close destination or @layout borsh");
+        for (const a of ix.accounts)
+            if (a.constraints.dup && !isWritable(a.kind))
+                this.reporter.fail(a.node, "Dup<…> lets a writable account alias another; this one is not writable");
         const pairs = [];
         for (let i = 0; i < writable.length; i++)
             for (let j = i + 1; j < writable.length; j++) {
+                if ((writable[i].constraints.dup || writable[j].constraints.dup) && inPlace(writable[i]) && inPlace(writable[j]))
+                    continue;
                 const present = [writable[i], writable[j]]
                     .filter((a) => a.optional)
                     .map((a) => `a_${a.name} && `)
@@ -331,6 +355,10 @@ export class FunctionEmitter extends StatementEmitter {
         for (const name of this.pendingInit) {
             const k = this.accounts.get(name).kind;
             const a = this.accounts.get(name);
+            if (k.kind === "migrate") {
+                this.reporter.error(a.node, `Migrate account "${name}" is never migrated; call ${name}.migrate(payer, value) (Anchor fails such an instruction with AccountNotMigrated)`);
+                continue;
+            }
             const how = k.kind === "token" && a.constraints.ata
                 ? `${name}.${k.init === "create" ? "create" : "createIfNeeded"}(payer)`
                 : k.kind === "token"

package/dist/compiler/emit/shared.js

@@ -61,6 +61,8 @@ export function valueC(t) {
             return "TS_VecArg";
         case "account":
             return "TsAccount *";
+        case "txIx":
+            return "TsIx";
         case "structRef":
             return `TSS_${t.struct} *`;
         case "enumRef":

package/dist/compiler/emit/storage.js

@@ -277,6 +277,24 @@ export class StorageEmitter extends EmitterBase {
         }
         if (ts.isPropertyAccessExpression(node)) {
             const field = node.name.text;
+            // Migrate<From, To>: acct.from (the old data, read-only, until migrate()) and acct.to (after it).
+            if (ts.isIdentifier(node.expression)) {
+                const m = this.accounts.get(node.expression.text);
+                if (m?.kind.kind === "migrate") {
+                    const migrated = this.created.has(m.name);
+                    if (field === "from") {
+                        if (migrated)
+                            this.fail(node, `${m.name}.from is gone after ${m.name}.migrate(…): read what you need from it before`);
+                        return { lv: `(*df_${m.name})`, type: { kind: "struct", name: m.kind.from.name }, writable: false, account: m, path: ["from"] };
+                    }
+                    if (field === "to") {
+                        if (!migrated)
+                            this.fail(node, `${m.name}.to exists after ${m.name}.migrate(payer, value)`);
+                        return { lv: `(*dt_${m.name})`, type: { kind: "struct", name: m.kind.to.name }, writable: true, account: m, path: ["to"] };
+                    }
+                    this.fail(node.name, `a Migrate account has .from (before migrate), .to (after), key, lamports and migrate(payer, value)`);
+                }
+            }
             // acct.field on a struct account
             if (ts.isIdentifier(node.expression)) {
                 const a = this.accounts.get(node.expression.text);

package/dist/compiler/model.d.ts

@@ -63,6 +63,10 @@ export type ValueType = ScalarType | {
  | {
     kind: "remaining";
 }
+/** One instruction of the transaction (InstructionsSysvar.get(i)): a `TsIx` view into the sysvar. */
+ | {
+    kind: "txIx";
+}
 /** A struct loaded from a remaining account with loadAccount / loadAccountMut. */
  | {
     kind: "structRef";
@@ -190,6 +194,12 @@ export type ParamKind = {
     kind: "zeroed";
     struct: StructDef;
 }
+/** Anchor's Migration<From, To>: an existing `from` account rewritten as `to` by `acct.migrate(payer, value)`. */
+ | {
+    kind: "migrate";
+    from: StructDef;
+    to: StructDef;
+}
 /** `init`: an associated token account this instruction creates (`Ata<Init<TokenAccount>, …>`, create) or creates when
  * missing (`Ata<InitIfNeeded<TokenAccount>, …>`, createIfNeeded); it is a TokenAccount once that call has run. */
  | {
@@ -263,6 +273,8 @@ export interface Constraints {
     };
     /** Executable<A>: the account must be an executable program. */
     executable?: boolean;
+    /** Dup<A> (Anchor's `dup`): may be the same account as another writable parameter (see function.ts). */
+    dup?: boolean;
     /** Close this account into that parameter when the instruction succeeds. */
     closeTo?: string;
     /** Address<A, "base58">: the account must be exactly this address. */

package/dist/compiler/model.js

@@ -20,6 +20,7 @@ export function isWritable(k) {
         case "init":
         case "zeroed":
         case "initIfNeeded":
+        case "migrate":
             return true;
         case "signer":
         case "info":
@@ -67,6 +68,8 @@ export function typeName(t) {
             return "AccountInfo";
         case "remaining":
             return "RemainingAccounts";
+        case "txIx":
+            return "TransactionInstruction";
         case "structRef":
             return t.struct;
     }

package/docs/case-study-escrow.md

@@ -184,9 +184,9 @@ Both implementations refuse the hostile calls the comparison makes:
 
 TypeSOL checks each account's constraints in Anchor's order, so a refused transaction usually gets the same error
 code (see [which error a transaction gets](errors.md#which-error-a-transaction-gets)). The second call differs on
-purpose: taker and maker are then the same writable account, which TypeSOL refuses for any two writable parameters,
-where Anchor only compares program and token accounts and fails later, on the maker's token account. A client that
-matches on this code needs to accept either.
+purpose: taker and maker are then the same writable account, which TypeSOL refuses for any two writable parameters
+unless one is marked `Dup<…>`, where Anchor only compares program and token accounts and fails later, on the maker's
+token account. A client that matches on this code needs to accept either.
 
 ## Cost
 

package/docs/errors.md

@@ -70,5 +70,5 @@ Where TypeSOL's order differs, only a transaction that breaks two of these check
 - Too few accounts fails with 3005 before any account is checked; Anchor fails on the first account it cannot find.
 - Accounts the instruction creates (`Init<…>`, `create(…)`) are created in the body, after every other check, where
   Anchor creates them before checking the other accounts.
-- TypeSOL refuses any two writable parameters naming one account (2040), where Anchor only compares program and token
+- TypeSOL refuses any two writable parameters naming one account (2040) unless one is `Dup<…>`, where Anchor only compares program and token
   accounts: a signer passed as two writable parameters fails with 2040 here and later, or not at all, under Anchor.

package/docs/language.md

@@ -38,7 +38,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | Option of structs | `home: Option<Point>` in account data — `=== null`, `p.home.x` after narrowing, `p.home = null` / `{ x, y }` |
 | Strings at runtime | `"hello, " + name`, `` `#${n}` ``, `` `owner ${acct.owner}` `` (a Pubkey or Hash as base58) — built on the 32 KiB heap (5110 when full): a template is joined in one allocation, text known at compile time (literals, string and Pubkey constants) is folded in, and `s += …` grows the newest heap string in place |
 | `switch` | on integers (128-bit ones too), enums and data-enum `.kind`, with JS `break` / fallthrough; case labels are literals, constants or enum members |
-| Hashing & signatures | `sha256(...)`, `keccak256(...)` → `Hash`; `findProgramAddress(seeds, program)` → the canonical PDA of any program (Rust `Pubkey::find_program_address(..).0`, e.g. a Bubblegum asset id); `merkleVerify(leaf, proof: Vec<Hash>, root)` (sorted-pair keccak, OpenZeppelin convention; inner nodes and leaves are hashed alike, so hash leaves as OpenZeppelin does, `keccak256(keccak256(data))`, and never take the leaf itself from the arguments: an inner node would pass as a leaf); `verifyEd25519(instructionsSysvar, signer, message)` checks an Ed25519 precompile instruction in the same transaction; `verifySecp256k1(keccak256(...message) | ethMessageHash(message), recoveryId, r, s, ethAddress)` (the hash must be computed in the program; a passed-in hash could be forged) |
+| Hashing & signatures | `sha256(...)`, `keccak256(...)` → `Hash`; `findProgramAddress(seeds, program)` → the canonical PDA of any program (Rust `Pubkey::find_program_address(..).0`, e.g. a Bubblegum asset id); `merkleVerify(leaf, proof: Vec<Hash>, root)` (sorted-pair keccak, OpenZeppelin convention; inner nodes and leaves are hashed alike, so hash leaves as OpenZeppelin does, `keccak256(keccak256(data))`, and never take the leaf itself from the arguments: an inner node would pass as a leaf); `verifyEd25519(instructionsSysvar, signer, message)` checks an Ed25519 precompile instruction in the same transaction; `stackHeight()` is 1 when the transaction calls the program directly, more under a CPI (`require(stackHeight() === 1n, …)` refuses CPI callers); `verifySecp256k1(keccak256(...message) | ethMessageHash(message), recoveryId, r, s, ethAddress)` (the hash must be computed in the program; a passed-in hash could be forged) |
 | Oracles | `pythPrice(update: PythPriceUpdate, feedId, maxAgeSeconds, exponent?)` (fully verified, feed-matched, fresh; with `exponent`, a feed at another scale is refused); raw `update.price / conf / exponent / publishTime` are unchecked (any feed, partially verified or stale: check `feedId`, `fullyVerified` and the age yourself, or use `pythPrice`); `switchboardValue(feed: SwitchboardFeed, expectedFeed, maxStaleSlots, decimals, minSamples?)` (the feed must be the expected one: anyone can create feeds; `minSamples`, default 1, the fewest oracle samples accepted) (mainnet program unless `SwitchboardFeed<"devnet">`) |
 | Multiple files | `import { Side, min } from "./math"` — structs, enums, constants and helpers can live in other files; only the entry file's exported functions are instructions; names are program-wide, so imports from TypeSOL files cannot be renamed; error codes number imported files first |
 | Loops | `for (let i = 0n; i < n; i++)`, `while`, `do … while`, `for (const x of list)` over a `Vec` or `FixedArray` (each `x` is what `list.get(i)` gives: a value, or a reference into account data for structs; the length is read again every step, as in JS), `break`, `continue` — bounded by the compute budget. Remaining accounts are iterated by index |
@@ -76,6 +76,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | `A \| null` / `Optional<A>` | optional account (Anchor `Option<Account>`): the client passes this program's id to leave it out; its checks and constraints run only when present; `x !== null` before use, or `x!` / `x!.field` to assert it was passed (5115 otherwise); `optional` in the IDL |
 | `ProgramData` | this program's ProgramData (address derived from the program id, upgradeable-loader owner and state checked); `upgradeAuthority`, `deploySlot` — gate admin setup on `programData.upgradeAuthority === admin.key` |
 | `EventAuthority`, `SelfProgram` | Anchor's `["__event_authority"]` PDA, and this program's own address, for `emitCpi` |
+| `Migrate<From, To>` | Anchor 1.0's `Migration`: an existing `From` account (owner, discriminator, size) rewritten as `To` by `acct.migrate(payer, value)`, a top-level statement the instruction must reach. `acct.from` (read-only) before it, `acct.to` after; the value is built in full before the rewrite, so it may read `acct.from`. Resized to `To` (the payer tops up rent when it grows, at most 10 KiB; shrinking keeps the lamports; growing needs `SystemProgram`). Fixed-layout structs without growable Vecs; no constraints yet; the account cannot be passed to a helper (use `acct.to` fields in the instruction). An account already migrated fails with 3002. Keep the old struct under a new name with its discriminator: `/** @discriminator account:Counter */ interface CounterV1 { … }` |
 | `Zeroed<T>` | large accounts (up to 10 MiB) the client allocated with System `CreateAccount`: owned by this program, big enough, rent-exempt, discriminator still zero — then initialized; like Anchor's zero-copy `zero` |
 | `Init<Mint>`, `InitIfNeeded<Mint>` | Anchor `init` / `init_if_needed` with `mint::decimals` / `mint::authority` / `mint::freeze_authority`: `const bump = mint.create(payer, ["mint", payer.key], 6n, authority, freezeAuthority \| null)` creates the mint at that PDA of this program, or with `null` seeds as a new keypair account that signs (3010 if it did not), under the instruction's token program (its only token program parameter, or one passed as the last argument of `create` / `createIfNeeded`; plus `SystemProgram`). Token-2022 extensions (Anchor's `extensions::…`) go after the freeze authority: `mint.create(payer, null, 6n, authority, null, { metadataPointer: { authority, metadataAddress: mint.key }, transferHook: { authority, programId }, closeAuthority, permanentDelegate, nonTransferable: true, defaultAccountState: true, interestBearing: { rateAuthority, rate }, transferFee: { configAuthority, withdrawAuthority, basisPoints, maximumFee }, groupPointer, groupMemberPointer })` sizes the mint for them and initializes each before InitializeMint2. With `createIfNeeded` an existing mint must carry groupPointer / groupMemberPointer / metadataPointer / closeAuthority / permanentDelegate / transferHook with those keys (Anchor's 2024–2039); extensions not listed are not looked at, so an existing mint may carry others (a permanent delegate, say). `createIfNeeded(…)` returns whether it created it; an existing one must be that PDA and have those decimals and authorities (2018 / 2016 / 2017) |
 | `Init<TokenAccount>`, `InitIfNeeded<TokenAccount>` (no `Ata<…>`) | Anchor `init` / `init_if_needed` with `token::mint` / `token::authority`: `vault.create(payer, ["vault", mint.key], mint, authority)` (the authority may be `vault.key` itself) creates a token account at that PDA (or a keypair account with `null`), sized for the mint's extensions under Token-2022. `createIfNeeded` checks an existing one has that mint and owner (2014 / 2015), not its delegate or close authority (as Anchor) |
@@ -86,6 +87,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | `AssociatedTokenProgram` | `create` / `createIdempotent` CPIs; `associatedTokenAddress(owner, mint, tokenProgram)` |
 | `TokenMetadataProgram` | Metaplex `createV3(...)` (CreateMetadataAccountV3), optionally with `{ creators: [{ address, verified, share }], collection: mint }` after `isMutable` (1–5 creators, shares adding up to 100; only the update authority, signing, can be `verified: true`; the collection is written unverified; `isCollection: true` makes the NFT a sized collection); `createMasterEditionV3(edition, mint, updateAuthority, mintAuthority, payer, metadata, tokenProgram, systemProgram, maxSupply \| null)`; `verifyCollection(authority, metadata, collectionMint, collectionMetadata, collectionMasterEdition, systemProgram, instructionsSysvar)` (Verify with CollectionV1); `metadataAddress(mint)`, `masterEditionAddress(mint)` |
 | `InstructionsSysvar`, `PythPriceUpdate`, `SwitchboardFeed` | exact address / owner program + discriminator |
+| `InstructionsSysvar` (introspection) | `ixs.length`, `ixs.currentIndex()` (the top-level instruction being executed), `ixs.get(i)` → a `TransactionInstruction`: `programId`, `accountsLength`, `dataLength`, `accountKey(j)` / `accountIsSigner(j)` / `accountIsWritable(j)`, `readU8/U16/U32/U64/readPubkey(offset)` (little-endian), `is(program, "name")` (that program's instruction by its default Anchor discriminator, sha256("global:<name>"); an instruction with its own `@discriminator` is matched with `programId` and `readU64(0)` instead). Every read is bounds-checked (5104). It is the transaction author's data: require things of the transaction with it (a repay instruction after a flash loan), never treat it as proof |
 | `Program<"Address…">` | exact program address + executable |
 | `UncheckedProgram` | executable only — check `.key` yourself |
 | `AccountInfo` / `Mut<AccountInfo>` | nothing (writable for `Mut`); `owner`, `executable` |
@@ -94,7 +96,10 @@ The full reference. For a tour, start with the [README](../README.md).
 Every account exposes `key`, `lamports`, `dataLen`, `isSigner`, `isWritable`. At most 32 accounts per instruction (more is refused, 5113).
 
 Two writable parameters can never be the same account: aliasing is refused with error 2040 (also when a remaining
-account written through `.lamports` or `loadAccountMut` is another account of the instruction). A remaining account
+account written through `.lamports` or `loadAccountMut` is another account of the instruction). `Dup<Mut<T>>`
+(Anchor's `dup`) lifts that for one parameter when both accounts are read and written in place (not created, closed,
+a close destination or `@layout borsh`): a write through either is seen through the other, so read what you need
+before writing. A remaining account
 can be loaded with `loadAccountMut` once per instruction: loading the same one again (`rest.get(i)` and `rest.get(j)`
 with `i == j`) is refused with 2040 too, since the two views would alias.
 

package/docs/migrate-from-anchor.md

@@ -46,6 +46,8 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `Option<Account<'info, T>>` | `Mut<T> \| null` (the client passes the program id to leave it out) |
 | `UncheckedAccount` / `AccountInfo` | `AccountInfo` / `Mut<AccountInfo>`: check what you rely on yourself |
 | `SystemAccount<'info>` | `SystemAccount` / `Mut<SystemAccount>` |
+| `Migration<'info, From, To>` | `Migrate<From, To>`, then `acct.migrate(payer, value)`; the old struct keeps its on-chain discriminator with `/** @discriminator account:<OldName> */` |
+| `#[account(discriminator = …)]` | `/** @discriminator <preimage or 0x8 bytes> */` on the struct |
 | `AccountLoader<T>` with `#[account(zero)]` | `Zeroed<T>` (TypeSOL reads every account in place: no copy to avoid) |
 | `Program<'info, System>` | `SystemProgram` |
 | `Program<'info, Token>` / `Token2022` / `Interface<'info, TokenInterface>` | `TokenProgram` / `Token2022Program` / `TokenInterface` |
@@ -57,6 +59,8 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `#[account(init, payer = p, seeds = […], bump, token::mint = m, token::authority = a)]` | `Init<TokenAccount>`, then `vault.create(p, […], m, a.key)` (`InitIfNeeded<TokenAccount>` + `createIfNeeded`) |
 | `associated_token::mint = m, associated_token::authority = a` | `Ata<TokenAccount, "a", "m">`; `Ata<Init<TokenAccount>, "a", "m">` creates it |
 | `ctx.remaining_accounts` | `remainingAccounts()` |
+| `#[account(mut, dup)]` | `Dup<Mut<T>>` (in-place accounts only) |
+| `sysvar::instructions` (`load_current_index_checked`, `load_instruction_at_checked`), `get_stack_height()` | `InstructionsSysvar`: `currentIndex()`, `get(i)`, `.length`; `stackHeight()` |
 | `ctx.bumps.vault` | the value `create` returns, or `acct.pdaBump` |
 
 ## Account data

package/docs/security-model.md

@@ -31,7 +31,8 @@ Each holds for every instruction of every program the compiler accepts. A break
    initialized account of that kind (3007 / 3003); program parameters at their fixed address and executable
    (3008 / 3009); `SystemAccount` owned by the System Program (3011); `Zeroed<T>` owned, all-zero discriminator and
    rent-exempt.
-3. **No aliasing.** Two writable parameters are never the same account (2040), whatever slots the transaction uses.
+3. **No aliasing.** Two writable parameters are never the same account (2040), whatever slots the transaction uses,
+   unless the program marks one `Dup<…>`, and then only for accounts read and written in place (see below).
 4. **Arguments.** Every argument is length-checked before it is read; strings are valid UTF-8; booleans, enums and
    options have valid tags (102).
 5. **Constraints.** `Seeds` (2006, with the stored or the canonical bump), `Ata` (2015 / 2009 / 2014), `HasOne`
@@ -50,7 +51,9 @@ Each holds for every instruction of every program the compiler accepts. A break
    written before it (compile error). Creation refuses an account that already exists (3000), and an address someone
    pre-funded still gets created. `createIfNeeded` on an existing account re-derives the canonical PDA and checks
    owner, discriminator and size (token accounts: mint and owner; mints: decimals, authorities and the extensions it
-   names).
+   names). A `Migrate<From, To>` account is checked as an existing `From`; `migrate(…)` is a top-level statement every
+   path reaches, builds the new value before rewriting the bytes, and nothing reads the old data after it (compile
+   errors).
 9. **Writes through references.** A place is never written after the code that computes its value may have moved it:
    replacing or resizing what a live reference points into is a compile error, as is writing a Vec element with a
    right side that may resize the Vec.
@@ -78,6 +81,10 @@ Each holds for every instruction of every program the compiler accepts. A break
 - **`AccountInfo` / `UncheckedProgram`.** Unchecked by design, as in Anchor: check what you rely on.
 - **`requirePda(account, seeds, bump)`.** Any valid bump passes (Anchor's `bump = expr`). Use a stored bump, never one
   from the arguments.
+- **`Dup<…>`.** A parameter marked `Dup` may be the same account as another writable one. Reads see every write
+  (both are the same bytes), so a value read before a write through the other slot is stale: read, then write.
+- **Instruction introspection.** The Instructions sysvar holds what the transaction's author put there. Require things
+  of the transaction with it (that a repay instruction follows), never treat it as proof of who did what.
 - **Oracles.** `pythPrice` checks verification, feed and age (pass the exponent you scale by); the raw `update.*`
   fields are unchecked. `switchboardValue` needs the expected feed; set `minSamples`.
 - **`merkleVerify`.** Leaves and inner nodes hash alike: build leaves as `keccak256(keccak256(data))` in the program.
@@ -87,7 +94,8 @@ Each holds for every instruction of every program the compiler accepts. A break
 
 ## Where TypeSOL is stricter than Anchor
 
-- Any two writable parameters naming one account are refused (Anchor compares only program and token accounts).
+- Any two writable parameters naming one account are refused unless one is `Dup<…>` (Anchor compares only program
+  and token accounts, and `dup` lifts that).
 - Arithmetic overflow returns an error code (5100) in every build; Anchor aborts the program, and only when
   overflow checks are enabled.
 

package/lib/typesol.d.ts

@@ -186,10 +186,43 @@ export declare function keccak256(...parts: (string | Pubkey | Hash | bigint | b
  */
 export declare function merkleVerify(leaf: Hash, proof: Vec<Hash>, root: Hash): boolean;
 
-/** The Instructions sysvar (Sysvar1nstructions…). Its address is checked. */
+/**
+ * The Instructions sysvar (Sysvar1nstructions…): every instruction of the transaction being executed. Its address is
+ * checked. What it holds is the transaction author's: use it to require something of the transaction (a repay
+ * instruction after a flash loan, a fee instruction before), never as proof of anything else.
+ */
 export interface InstructionsSysvar extends AccountMeta {
   readonly __instructions_sysvar: void;
+  /** How many instructions the transaction has. */
+  readonly length: u64;
+  /** The index of the top-level instruction being executed (this one, or the one that CPI'd into this program). */
+  currentIndex(): u64;
+  /** The transaction's instruction at `index` (5104 when there is none). */
+  get(index: u64): TransactionInstruction;
 }
+/** One instruction of the transaction, read from the Instructions sysvar. Reads past its end fail with 5104. */
+export interface TransactionInstruction {
+  readonly __transaction_instruction: void;
+  readonly programId: Pubkey;
+  readonly accountsLength: u64;
+  readonly dataLength: u64;
+  accountKey(i: u64): Pubkey;
+  accountIsSigner(i: u64): boolean;
+  accountIsWritable(i: u64): boolean;
+  /** Little-endian integers and keys from the instruction data. */
+  readU8(offset: u64): u8;
+  readU16(offset: u64): u16;
+  readU32(offset: u64): u32;
+  readU64(offset: u64): u64;
+  readPubkey(offset: u64): Pubkey;
+  /** `program`'s instruction `name` (snake_case or camelCase): its program id and 8-byte Anchor discriminator match. */
+  is(program: Pubkey, name: string): boolean;
+}
+/**
+ * How deep in cross-program calls this program runs: 1 when the transaction calls it directly, more when another
+ * program invoked it. `require(stackHeight() === 1n, …)` refuses CPI callers.
+ */
+export declare function stackHeight(): u64;
 
 /**
  * True when this transaction contains an Ed25519 precompile instruction that verified `message`
@@ -597,6 +630,27 @@ export type TokenOf<A, MintParam extends string, AuthorityParam extends string =
 export type MintOf<A, AuthorityParam extends string, FreezeAuthorityParam extends string = never, TokenProgramParam extends string = never> = A & {
   readonly __mintOf?: [AuthorityParam, FreezeAuthorityParam, TokenProgramParam];
 };
+/**
+ * Anchor's `dup`: this writable account may be the same account as another writable parameter (TypeSOL refuses that
+ * otherwise, 2040). Both are read and written in place, so a write through one is seen through the other: read
+ * what you need before writing. Not for accounts that are created, closed, a close destination or `@layout borsh`.
+ */
+export type Dup<A> = A & { readonly __dup?: true };
+/**
+ * Anchor 1.0's `Migration<From, To>`: an existing `From` account (owner, discriminator and size checked) that this
+ * instruction rewrites as `To` with `acct.migrate(payer, value)`, a top-level statement every path must reach. Read
+ * the old data through `acct.from` before migrating (the new value may use it: it is built in full before the account
+ * is rewritten), and the new data through `acct.to` after. The account is resized to `To`: the payer tops up the rent
+ * when it grows (at most 10 KiB), and shrinking keeps the lamports. `From` usually keeps the old type's discriminator
+ * under a new name: `/** @discriminator account:Counter *\/ interface CounterV1 { … }`. An account already migrated
+ * fails with 3002, as under Anchor.
+ */
+export interface Migrate<From, To> extends AccountMeta {
+  readonly __migrate: [From, To];
+  readonly from: Readonly<From>;
+  readonly to: To;
+  migrate(payer: Mut<Signer>, value: To): void;
+}
 export type Seeds<A, Names extends readonly string[], Bump extends string = never, ProgramId extends string = never> = A & {
   readonly __seeds?: [Names, Bump, ProgramId];
   /** The PDA's bump (Anchor `ctx.bumps.<account>`): the stored bump field when one is named, else the canonical bump found. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typesol/cli",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Compile a TypeScript-syntax language directly to Solana SBF programs.",
   "type": "module",
   "license": "MIT",

package/runtime/typesol_rt.h

@@ -1121,6 +1121,81 @@ static inline bool ts_merkle_verify(const SolPubkey *leaf, const uint8_t *proof,
   return ts_mem_eq(node, root, 32);
 }
 
+/*
+ * The Instructions sysvar: u16 count, u16 offsets[count], then per instruction u16 num_accounts,
+ * num_accounts * (u8 flags: bit 0 signer, bit 1 writable; 32-byte key), 32-byte program id, u16 data_len, data; the
+ * last two bytes of the account are the index of the instruction being executed. Everything here is the transaction
+ * author's data: bounds-checked, never trusted for anything but what it says.
+ */
+typedef struct {
+  const uint8_t *accounts; /* num_accounts * 33 bytes */
+  const SolPubkey *program_id;
+  const uint8_t *data;
+  uint16_t num_accounts;
+  uint16_t data_len;
+} TsIx;
+
+/* Instruction `index` of the transaction; false when out of range or malformed. */
+static inline bool ts_ix_at(const TsAccount *ixs, uint64_t index, TsIx *out) {
+  const uint8_t *d = ixs->data;
+  uint64_t len = ixs->data_len;
+  if (len < 2) return false;
+  uint16_t count;
+  ts_memcpy(&count, d, 2);
+  if (index >= count || 2 + (uint64_t)count * 2 > len) return false;
+  uint16_t at;
+  ts_memcpy(&at, d + 2 + index * 2, 2);
+  uint64_t p = at;
+  if (p + 2 > len) return false;
+  ts_memcpy(&out->num_accounts, d + p, 2);
+  p += 2;
+  out->accounts = d + p;
+  p += (uint64_t)out->num_accounts * 33;
+  if (p + 34 > len) return false;
+  out->program_id = (const SolPubkey *)(d + p);
+  p += 32;
+  ts_memcpy(&out->data_len, d + p, 2);
+  p += 2;
+  if (p + out->data_len > len) return false;
+  out->data = d + p;
+  return true;
+}
+static inline uint64_t ts_ix_load(const TsAccount *ixs, uint64_t index, TsIx *out) {
+  if (!ts_ix_at(ixs, index, out)) TS_FAIL(TS_ERR_INDEX, "TypeSOL: no such instruction in the transaction");
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_count(const TsAccount *ixs, uint64_t *out) {
+  if (ixs->data_len < 2) TS_FAIL(TS_ERR_INDEX, "TypeSOL: empty instructions sysvar");
+  uint16_t n;
+  ts_memcpy(&n, ixs->data, 2);
+  *out = n;
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_current(const TsAccount *ixs, uint64_t *out) {
+  if (ixs->data_len < 4) TS_FAIL(TS_ERR_INDEX, "TypeSOL: empty instructions sysvar");
+  uint16_t i;
+  ts_memcpy(&i, ixs->data + ixs->data_len - 2, 2);
+  *out = i;
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_account(const TsIx *ix, uint64_t i, const uint8_t **out) {
+  if (i >= ix->num_accounts) TS_FAIL(TS_ERR_INDEX, "TypeSOL: the instruction has no account at that index");
+  *out = ix->accounts + i * 33;
+  return SUCCESS;
+}
+/* `n` bytes of the instruction's data at `off` (little-endian integers, keys). */
+static inline uint64_t ts_ix_read(const TsIx *ix, uint64_t off, uint64_t n, void *out) {
+  if (off > ix->data_len || n > ix->data_len - off) TS_FAIL(TS_ERR_INDEX, "TypeSOL: read past the end of the instruction's data");
+  ts_memcpy(out, ix->data + off, n);
+  return SUCCESS;
+}
+/* Is it `program`'s instruction with this 8-byte discriminator (Anchor's sha256("global:<name>")[..8])? */
+static inline bool ts_ix_is(const TsIx *ix, const SolPubkey *program, const uint8_t disc[8]) {
+  return ts_key_eq(ix->program_id, program) && ix->data_len >= 8 && ts_mem_eq(ix->data, disc, 8);
+}
+/* How deep in CPIs the program runs: 1 when the transaction calls it directly. */
+extern uint64_t sol_get_stack_height(void);
+
 /*
  * Did an Ed25519 precompile instruction in this transaction verify `message` signed by `signer`?
  * Reads the Instructions sysvar (data: u16 count, u16 offsets[count], then per instruction
@@ -1129,29 +1204,15 @@ static inline bool ts_merkle_verify(const SolPubkey *leaf, const uint8_t *proof,
  * message, with offsets pointing into the precompile's own data (instruction index 0xFFFF).
  */
 static inline bool ts_ed25519_verified(const TsAccount *ixs, const SolPubkey *signer, TS_Str message) {
-  const uint8_t *d = ixs->data;
-  uint64_t len = ixs->data_len;
-  if (len < 2) return false;
+  if (ixs->data_len < 2) return false;
   uint16_t count;
-  ts_memcpy(&count, d, 2);
-  if (2 + (uint64_t)count * 2 > len) return false;
+  ts_memcpy(&count, ixs->data, 2);
   for (uint16_t i = 0; i < count; i++) {
-    uint16_t at;
-    ts_memcpy(&at, d + 2 + (uint64_t)i * 2, 2);
-    uint64_t p = at;
-    if (p + 2 > len) return false;
-    uint16_t nacc;
-    ts_memcpy(&nacc, d + p, 2);
-    p += 2 + (uint64_t)nacc * 33;
-    if (p + 34 > len) return false;
-    bool is_ed = ts_mem_eq(d + p, &TS_ED25519_PROGRAM_ID, 32);
-    p += 32;
-    uint16_t dlen;
-    ts_memcpy(&dlen, d + p, 2);
-    p += 2;
-    if (p + dlen > len) return false;
-    if (!is_ed || dlen < 2) continue;
-    const uint8_t *ix = d + p;
+    TsIx t;
+    if (!ts_ix_at(ixs, i, &t)) return false;
+    if (!ts_key_eq(t.program_id, &TS_ED25519_PROGRAM_ID) || t.data_len < 2) continue;
+    uint16_t dlen = t.data_len;
+    const uint8_t *ix = t.data;
     uint8_t nsig = ix[0];
     for (uint8_t k = 0; k < nsig; k++) {
       uint64_t o = 2 + (uint64_t)k * 14;