@typesol/cli 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -6,6 +6,45 @@ codes, and says so here.
 
 ## Unreleased
 
+## 0.28.0 — 2026-10-29
+
+A port of coral-xyz/multisig, checked against the program deployed on mainnet, and the features it needed. The
+benchmark programs compile to the same numbers as in 0.27.0.
+
+- New: `invokeInstruction(programId, metas, data, infos, signerSeeds?)`, a CPI decided at run time (Rust's
+  `invoke_signed` of an `Instruction` built from data): metas are structs with `pubkey`, `isSigner`, `isWritable`, the
+  data a list of u8, and every account in `infos` (the remaining accounts or a slice) goes to the runtime.
+- New: `Signed<A>`, Anchor's `signer` constraint on an account that is not a `Signer` (2002); the IDL marks it a signer.
+- New: `Zeroed<T>` of a `@layout borsh` struct (Anchor's `#[account(zero)]` on a Borsh account): it starts empty and is
+  written as Borsh when the instruction returns.
+- New: a Seeds bump stored in another struct account, `Seeds<A, ["@multisig"], "@multisig.nonce">` (Anchor's
+  `bump = multisig.nonce`).
+- New: `list = vecArgument` copies a `Vec` argument (or another list of the same elements) into a `FixedVec` (5104 when
+  it does not fit).
+- Changed: a `Zeroed<T>` account whose discriminator is already set fails with 2013 (ConstraintZero), checked before its
+  owner, as under Anchor; it was 3000 after the owner check.
+- Changed: `key`, `lamports`, `dataLen`, `isSigner`, `isWritable` and `pdaBump` are refused as field names only in
+  structs held in an account (where they would shadow `acct.key` and the others), no longer in every struct.
+- Docs: `docs/case-study-multisig.md`; the mainnet binary is in `test/programs/coral_multisig.so`.
+
+## 0.27.0 — 2026-10-29
+
+Anchor 1.0 parity: instruction introspection, `Dup<…>` and account migration. Existing programs compile to the same
+binaries as in 0.26.0.
+
+- New: instruction introspection. `InstructionsSysvar` has `length`, `currentIndex()` and `get(i)`, a
+  `TransactionInstruction` with `programId`, its accounts (key, signer, writable), its data
+  (`readU8/U16/U32/U64/readPubkey`) and `is(program, "name")` (an instruction by its Anchor discriminator); every read
+  is bounds-checked (5104). `stackHeight()` is 1 at the top level, more under a CPI.
+- New: `Dup<…>`, Anchor's `dup`: a writable parameter that may be the same account as another, for accounts read and
+  written in place (not created, closed, a close destination or `@layout borsh`, which are refused at compile time).
+- New: `Migrate<From, To>`, Anchor 1.0's `Migration`: an existing account rewritten from one struct to another with
+  `acct.migrate(payer, value)`, the old data readable through `acct.from` until then (the new value is built before
+  the bytes are rewritten), the new through `acct.to` after; resized with the payer topping up rent. For now:
+  fixed-layout structs without growable Vecs, no constraints on the account, and it cannot be passed to a helper.
+- New: `/** @discriminator … */` on an account struct (a sha256 preimage such as `account:Counter`, or 0x and 8
+  bytes), Anchor's `#[account(discriminator = …)]`: keeps an old type's on-chain discriminator under a new name.
+
 ## 0.26.0 — 2026-10-29
 
 A first-run experience pass, the security model and audit package, and more fuzzing. The compiler's output is the

package/README.md

@@ -175,7 +175,8 @@ program's address.
 
 Coming from Anchor: [docs/migrate-from-anchor.md](docs/migrate-from-anchor.md) maps every construct, `typesol port`
 starts from your program's IDL, and [docs/case-study-escrow.md](docs/case-study-escrow.md) follows one complete Anchor
-program through the port. Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
+program through the port; [docs/case-study-multisig.md](docs/case-study-multisig.md) ports coral-xyz/multisig and
+checks it against the binary deployed on mainnet (same outcomes and account bytes; 73–84% fewer compute units). Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
 mainnet (wallet, cost, deploy, IDL, verification), follow [docs/mainnet.md](docs/mainnet.md).
 
 ## How it works
@@ -323,6 +324,7 @@ Details are in [docs/testing.md](docs/testing.md).
 | [`relay.ts`](examples/relay.ts), [`caller.ts`](examples/caller.ts) | generic `invoke`, PDA-signed transfers, return data |
 | [`profiles.ts`](examples/profiles.ts) | nested structs, FixedString, events |
 | [`orderbook/`](examples/orderbook) | a three-file, 28 KiB zero-copy limit order book |
+| [`multisig.ts`](examples/multisig.ts) | coral-xyz/multisig: stored instructions run with `invokeInstruction`, a PDA signing, Anchor's Borsh accounts |
 
 ## Status
 

package/dist/compiler/analyze.d.ts

@@ -2,6 +2,8 @@ import ts from "typescript";
 import { Reporter } from "./diagnostics.js";
 import { type DataEnumDef, type EnumDef, type GenericHelper, type Helper, type ProgramModel, type ScalarType, type StructDef, type ValueType, isScalar } from "./model.js";
 export declare const LIB_PATH: string;
+/** A struct used as account data: none of its fields may shadow an account member. */
+export declare function checkAccountMembers(s: StructDef, at: ts.Node, reporter: Reporter): void;
 /** Why a name cannot be used as a C member, or undefined when it can. */
 export declare function cNameProblem(name: string): string | undefined;
 /** Solana's account size limit, and what a program can allocate itself through a CPI (Init<T>). */

package/dist/compiler/analyze.js

@@ -8,7 +8,15 @@ import { borshIdentical } from "./emit/borsh.js";
 import { optionKey, INT_INFO, INT_NAMES, scalarKey, fixedVecName, isScalar, scalarSize, typeName, } from "./model.js";
 export const LIB_PATH = fileURLToPath(new URL("../../lib/typesol.d.ts", import.meta.url));
 /** Names a struct field may not use because account parameters already expose them. */
-const RESERVED_FIELDS = new Set(["key", "lamports", "dataLen", "create", "equals", "get", "set", "length", "isSigner", "isWritable", "pdaBump"]);
+const RESERVED_FIELDS = new Set(["create", "equals", "get", "set", "length"]);
+/** Members every account parameter has (`acct.key`, `acct.isSigner`, …): a struct held in an account cannot use them. */
+const ACCOUNT_MEMBERS = new Set(["key", "lamports", "dataLen", "isSigner", "isWritable", "pdaBump"]);
+/** A struct used as account data: none of its fields may shadow an account member. */
+export function checkAccountMembers(s, at, reporter) {
+    const clash = s.fields.find((f) => ACCOUNT_MEMBERS.has(f.name));
+    if (clash)
+        reporter.fail(at, `${s.name}.${clash.name}: "${clash.name}" is an account member (acct.${clash.name}); rename the field to hold ${s.name} in an account`);
+}
 /**
  * Struct fields and enum variants become C member names as written. C keywords and the object-like
  * macros of the Solana C SDK / TypeSOL runtime would break or silently change the generated C.
@@ -85,6 +93,9 @@ const TYPE_EXPORTS = new Set([
     "Ata",
     "Owner",
     "Executable",
+    "Dup",
+    "Signed",
+    "Migrate",
     "Optional",
     "EventAuthority",
     "MplCoreProgram",
@@ -114,6 +125,22 @@ export function snakeCase(name) {
         .replace(/([A-Z])([A-Z][a-z])/g, "$1_$2")
         .toLowerCase();
 }
+/**
+ * An account struct's discriminator: Anchor's sha256("account:<Name>")[..8], or the one a `/** @discriminator … *\/` tag
+ * gives (a sha256 preimage such as `account:Counter`, or 0x and 8 bytes), e.g. for an old version of a struct kept under
+ * a new name for Migrate<From, To>.
+ */
+function accountDiscriminator(decl, name, reporter) {
+    const tag = ts.getJSDocTags(decl).find((t) => t.tagName.text === "discriminator");
+    if (!tag)
+        return discriminator(`account:${name}`);
+    const text = (typeof tag.comment === "string" ? tag.comment : (ts.getTextOfJSDocComment(tag.comment) ?? "")).trim();
+    if (/^0x([0-9a-fA-F]{2}){8}$/.test(text))
+        return [...Buffer.from(text.slice(2), "hex")];
+    if (text && !text.startsWith("0x"))
+        return discriminator(text);
+    reporter.fail(decl, "@discriminator on an account struct needs a sha256 preimage (account:<Name>) or 0x and 8 bytes");
+}
 export function discriminator(preimage) {
     return [...createHash("sha256").update(preimage).digest().subarray(0, 8)];
 }
@@ -601,12 +628,17 @@ export function analyze(entry) {
         // A returned struct goes out in its fixed layout, like an argument comes in: it cannot also be a Borsh event.
         if (ix.returns?.kind === "struct")
             collectStructs(ix.returns, structs, dataEnums, argStructs);
-        for (const a of ix.accounts)
+        for (const a of ix.accounts) {
+            if (a.kind.kind === "migrate") {
+                accountStructs.add(a.kind.from.name);
+                accountStructs.add(a.kind.to.name);
+            }
             if (a.kind.kind === "account" || a.kind.kind === "init" || a.kind.kind === "zeroed" || a.kind.kind === "initIfNeeded") {
                 accountStructs.add(a.kind.struct.name);
                 if (a.kind.struct.viewsOnly)
                     reporter.error(a.node, `${a.kind.struct.name} holds a string (or an enum carrying one), so it is an argument, return value or event; account data uses FixedString<N>`);
             }
+        }
     }
     // Arguments are Borsh, where a FixedVec is a Vec (only what it holds). A struct passed as a whole argument and used
     // nowhere else (not account data, not nested, not returned) is read as Anchor sends it: @layout borsh, implied.
@@ -966,7 +998,7 @@ function analyzeStructs(items, aliases, dataEnums, reporter, scopeFor, fstrings,
                 name,
                 fields: stored,
                 size: undefined,
-                accountDiscriminator: discriminator(`account:${name}`),
+                accountDiscriminator: accountDiscriminator(decl, name, reporter),
                 eventDiscriminator: discriminator(`event:${name}`),
                 node: decl,
                 layout: layoutText === "borsh" ? "borsh" : "fixed",
@@ -1318,10 +1350,11 @@ function analyzeHelper(fn, name, display, reporter, scope, structs, skip = new S
             wrapped === "Seeds" ||
             wrapped === "CloseTo" ||
             wrapped === "Address" ||
-            wrapped === "Ata")
+            wrapped === "Ata" ||
+            wrapped === "Signed")
             reporter.fail(p.type, "constraints belong on instruction parameters; helpers take the plain account type");
         const account = resolveAccountKind(p.type, reporter, scope.imports, structs);
-        if (account.kind === "init" || account.kind === "initIfNeeded" || account.kind === "zeroed")
+        if (account.kind === "init" || account.kind === "initIfNeeded" || account.kind === "zeroed" || account.kind === "migrate")
             reporter.fail(p.type, "helpers take accounts that exist: create Init/InitIfNeeded/Zeroed accounts in the instruction, then pass them as Mut<T>");
         return { name: p.name.text, type: { kind: "account" }, account, node: p };
     });
@@ -1445,7 +1478,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
             const inner = unwrapConstraints(typeNode, reporter, imports, constraints);
             const kind = resolveAccountKind(inner, reporter, imports, structs);
             if (optional &&
-                (["init", "initIfNeeded", "zeroed", "pyth", "eventAuthority", "selfProgram", "programData"].includes(kind.kind) ||
+                (["init", "initIfNeeded", "zeroed", "migrate", "pyth", "eventAuthority", "selfProgram", "programData"].includes(kind.kind) ||
                     ((kind.kind === "token" || kind.kind === "mint") && kind.init)))
                 reporter.fail(p, "Init, InitIfNeeded, Zeroed, PythPriceUpdate, EventAuthority, SelfProgram and ProgramData accounts cannot be optional");
             accounts.push({ name: p.name.text, index: accounts.length, kind, node: p, constraints, ...(optional ? { optional } : {}) });
@@ -1506,9 +1539,20 @@ function analyzeInstruction(fn, reporter, scope, structs) {
                 if (!accounts.some((o) => o.name === f))
                     reporter.fail(a.node, `HasOne<…, "${f}">: add an account parameter named "${f}"`);
             }
-            if (c.seeds?.bump) {
+            if (c.seeds?.bump?.startsWith("@")) {
+                // "@acct.field": the bump stored in another struct account (Anchor `bump = multisig.nonce`).
+                const [owner, field, ...rest] = c.seeds.bump.slice(1).split(".");
+                const o = accounts.find((x) => x.name === owner);
+                const os = o?.kind.kind === "account" ? o.kind.struct : undefined;
+                if (!os || !field || rest.length)
+                    reporter.fail(a.node, `Seeds bump: "${c.seeds.bump}" must name a u8 field of a struct account parameter ("@config.bump")`);
+                const bf = os.fields.find((x) => x.name === field);
+                if (!bf || bf.type.kind !== "int" || bf.type.name !== "u8")
+                    reporter.fail(a.node, `Seeds bump: ${os.name} needs a u8 field "${field}"`);
+            }
+            else if (c.seeds?.bump) {
                 if (!struct)
-                    reporter.fail(a.node, "Seeds with a bump field needs a struct account");
+                    reporter.fail(a.node, `Seeds with a bump field needs a struct account; for a bump stored elsewhere name it "@acct.field"`);
                 const bf = struct.fields.find((x) => x.name === c.seeds.bump);
                 if (!bf || bf.type.kind !== "int" || bf.type.name !== "u8")
                     reporter.fail(a.node, `Seeds bump: ${struct.name} needs a u8 field "${c.seeds.bump}"`);
@@ -1539,6 +1583,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
             ...c.hasOne.map((e) => e.split("=").at(-1)),
             ...(c.seeds?.names ?? []).filter((n) => n.startsWith("@")).map((n) => n.slice(1).split(".")[0]),
             ...(c.seeds?.program?.startsWith("@") ? [c.seeds.program.slice(1)] : []),
+            ...(c.seeds?.bump?.startsWith("@") ? [c.seeds.bump.slice(1).split(".")[0]] : []),
             ...(c.closeTo ? [c.closeTo] : []),
             ...(c.ata
                 ? [c.ata.owner, c.ata.mint, ...(a.kind.kind === "token" ? [] : accounts.filter((o) => o.kind.kind === "tokenProgram").map((o) => o.name))]
@@ -1566,6 +1611,18 @@ function analyzeInstruction(fn, reporter, scope, structs) {
         reporter.error(fn.name, "instructions that grow a Vec (push) need a SystemProgram parameter to top up rent");
     if (needs("init") && !needs("system"))
         reporter.error(fn.name, "instructions with Init<...> accounts need a SystemProgram parameter");
+    if (accounts.some((a) => a.kind.kind === "migrate" && a.kind.to.size > a.kind.from.size) && !needs("system"))
+        reporter.error(fn.name, "a Migrate<From, To> that grows the account needs a SystemProgram parameter (the payer tops up its rent)");
+    for (const a of accounts)
+        if (a.kind.kind === "migrate" &&
+            (a.constraints.hasOne.length ||
+                a.constraints.seeds ||
+                a.constraints.closeTo ||
+                a.constraints.ata ||
+                a.constraints.address ||
+                a.constraints.owner ||
+                a.constraints.dup))
+            reporter.error(a.node, "Migrate<From, To> takes no constraints yet: check the old fields with require(…, …) on acct.from");
     const name = snakeCase(fn.name.text);
     // `/** @discriminator spl-transfer-hook-interface:execute */` (sha256 preimage) or `@discriminator 0x...` (raw bytes)
     // lets an instruction implement another program's interface.
@@ -1596,7 +1653,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
 /** Peel HasOne / Seeds / CloseTo wrappers off a parameter type, recording what they ask for. */
 function unwrapConstraints(node, reporter, imports, out) {
     const name = typesolName(node, imports);
-    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable"].includes(name ?? ""))
+    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable", "Dup", "Signed"].includes(name ?? ""))
         return node;
     const args = node.typeArguments ?? [];
     const lit = (t) => {
@@ -1638,6 +1695,10 @@ function unwrapConstraints(node, reporter, imports, out) {
     }
     if (name === "Executable")
         out.executable = true;
+    if (name === "Dup")
+        out.dup = true;
+    if (name === "Signed")
+        out.signed = true;
     if (name === "Address") {
         const text = lit(args[1])[0];
         const bytes = text === undefined ? undefined : decodeAddress(text);
@@ -1668,6 +1729,8 @@ function unwrapConstraints(node, reporter, imports, out) {
         reporter.fail(node, `${name}<…> wraps an account type`);
     return unwrapConstraints(args[0], reporter, imports, out);
 }
+/** Solana: an account grows at most this many bytes per instruction. */
+const MAX_PERMITTED_DATA_INCREASE = 10_240;
 function resolveAccountKind(node, reporter, imports, structs) {
     const outer = typesolName(node, imports);
     const ref = node;
@@ -1680,6 +1743,8 @@ function resolveAccountKind(node, reporter, imports, structs) {
         const s = ts.isTypeReferenceNode(t) && ts.isIdentifier(t.typeName) ? structs.get(t.typeName.text) : undefined;
         if (s && s.size === undefined)
             reporter.fail(t, `${s.name} has a variable-length string field and cannot be account data; use FixedString<N>`);
+        if (s)
+            checkAccountMembers(s, t, reporter);
         return s;
     };
     switch (outer) {
@@ -1769,14 +1834,30 @@ function resolveAccountKind(node, reporter, imports, structs) {
                 reporter.fail(node, `${s.name} is too large to create in a program; use Zeroed<${s.name}>`);
             return { kind: "initIfNeeded", struct: s };
         }
+        case "Migrate": {
+            const [fromNode, toNode] = ref.typeArguments ?? [];
+            const from = fromNode && structOf(fromNode);
+            const to = toNode && structOf(toNode);
+            if (!from || !to || ref.typeArguments.length !== 2)
+                reporter.fail(node, "Migrate<From, To> takes two account structs declared in this program");
+            for (const s of [from, to]) {
+                if (s.vec)
+                    reporter.fail(node, `${s.name} has a growable Vec; Migrate<From, To> takes fixed-size structs`);
+                if (s.layout === "borsh")
+                    reporter.fail(node, `${s.name} is @layout borsh; Migrate<From, To> takes fixed layouts`);
+            }
+            if (from.accountDiscriminator.join() === to.accountDiscriminator.join())
+                reporter.fail(node, `${from.name} and ${to.name} have the same discriminator: give the new struct another name (or the old one /** @discriminator account:<OldName> */)`);
+            if (to.size - from.size > MAX_PERMITTED_DATA_INCREASE)
+                reporter.fail(node, `${to.name} is more than 10 KiB larger than ${from.name}; an account grows at most 10 KiB per instruction`);
+            return { kind: "migrate", from, to };
+        }
         case "Zeroed": {
             const s = structOf(inner());
             if (!s)
                 reporter.fail(node, "Zeroed<T> needs a struct declared in this program");
             if (s.vec)
-                reporter.fail(node, `${s.name} has a growable Vec; Zeroed<T> is for fixed-size (large) accounts`);
-            if (s.layout === "borsh")
-                reporter.fail(node, `${s.name} is @layout borsh; Zeroed<T> reads large accounts in place, so it takes fixed layouts only`);
+                reporter.fail(node, `${s.name} has a growable Vec; Zeroed<T> is for fixed-size accounts (or @layout borsh with FixedVec)`);
             return { kind: "zeroed", struct: s };
         }
         case "Mut": {

package/dist/compiler/emit/base.d.ts

@@ -112,6 +112,8 @@ export declare abstract class EmitterBase {
     protected abstract call(node: ts.CallExpression, topLevel: boolean): Value | undefined;
     protected abstract isRemaining(node: ts.Expression): boolean;
     protected abstract handle(node: ts.Expression): string | undefined;
+    protected abstract instructionsParam(node: ts.Expression): AccountParam | undefined;
+    protected abstract isTxIx(node: ts.Expression): boolean;
     protected abstract seeds(node: ts.Expression, extra: number): {
         name: string;
         count: number;
@@ -129,6 +131,7 @@ export declare abstract class EmitterBase {
     protected abstract coreOp(node: ts.CallExpression, core: AccountParam, method: string): undefined;
     protected abstract bubblegumOp(node: ts.CallExpression, bg: AccountParam, method: string): undefined;
     protected abstract invoke(node: ts.CallExpression): undefined;
+    protected abstract invokeInstruction(node: ts.CallExpression): undefined;
     protected abstract emitEvent(node: ts.CallExpression, cpi?: {
         authority: string;
         program: string;

package/dist/compiler/emit/base.js

@@ -65,7 +65,10 @@ export class EmitterBase {
             this.ix = target;
             for (const a of target.accounts) {
                 this.accounts.set(a.name, a);
-                if (a.kind.kind === "init" || a.kind.kind === "initIfNeeded" || ((a.kind.kind === "token" || a.kind.kind === "mint") && a.kind.init))
+                if (a.kind.kind === "init" ||
+                    a.kind.kind === "initIfNeeded" ||
+                    a.kind.kind === "migrate" ||
+                    ((a.kind.kind === "token" || a.kind.kind === "mint") && a.kind.init))
                     this.pendingInit.add(a.name);
             }
             for (const a of target.args)

package/dist/compiler/emit/calls.d.ts

@@ -1,5 +1,5 @@
 import ts from "typescript";
-import { type ErrorDef, type FieldType, type Helper } from "../model.js";
+import { type AccountParam, type ErrorDef, type FieldType, type Helper } from "../model.js";
 import { type Value, type Ref, type Closure } from "./shared.js";
 import { ExpressionEmitter } from "./expressions.js";
 export declare abstract class CallEmitter extends ExpressionEmitter {
@@ -20,6 +20,15 @@ export declare abstract class CallEmitter extends ExpressionEmitter {
     /** `remainingAccounts()` or a const bound to it. */
     protected isRemaining(node: ts.Expression): boolean;
     /** C pointer (`TsAccount *`) for an expression naming a remaining account, or undefined. */
+    /** Whether `node` is an InstructionsSysvar parameter. */
+    protected instructionsParam(node: ts.Expression): AccountParam | undefined;
+    /** Whether `node` is a TransactionInstruction: a local holding one, or `ixs.get(i)`. */
+    protected isTxIx(node: ts.Expression): boolean;
+    /**
+     * InstructionsSysvar.currentIndex() / .get(i) and the methods of a TransactionInstruction: bounds-checked reads of the
+     * sysvar (ts_ix_* in the runtime). Undefined when the call is something else.
+     */
+    protected instructionsCall(node: ts.CallExpression, callee: ts.PropertyAccessExpression, method: string): Value | undefined;
     protected handle(node: ts.Expression): string | undefined;
     /** A declared account parameter or a remaining account, as a `TsAccount *` C expression. */
     protected anyAccount(node: ts.Expression, what: string): string;
@@ -29,6 +38,12 @@ export declare abstract class CallEmitter extends ExpressionEmitter {
     protected loadForeign(node: ts.CallExpression): Value;
     /** `loadAccount<T>(acct)` / `loadAccountMut<T>(acct)`: checked view of a program account. */
     protected loadAccount(node: ts.CallExpression, mut: boolean): Value;
+    /**
+     * `acct.migrate(payer, value)` on a Migrate<From, To> account: the new value is built in full first (it may read
+     * acct.from, whose bytes the rewrite overwrites), then the account is resized (the payer tops up the rent when it
+     * grows; shrinking keeps the lamports) and rewritten with To's discriminator and the value.
+     */
+    protected migrate(node: ts.CallExpression, a: AccountParam, topLevel: boolean): Value | undefined;
     /** Whether a helper (or one it calls) grows a Vec, which needs the instruction's SystemProgram for rent. */
     private helperGrows;
     /**

package/dist/compiler/emit/calls.js

@@ -1,5 +1,5 @@
 import ts from "typescript";
-import { calleeName, resolveScalarType, resolveValueType } from "../analyze.js";
+import { calleeName, discriminator, resolveScalarType, resolveValueType, snakeCase } from "../analyze.js";
 import { ANCHOR_ERRORS } from "../anchor-errors.js";
 import { decodeAddress } from "../../keys.js";
 import { INT_INFO, INT_NAMES, isScalar, isWritable, sameType, scalarSize, typeName, } from "../model.js";
@@ -21,6 +21,11 @@ export class CallEmitter extends ExpressionEmitter {
             return this.cast(args[0], { kind: "int", name: builtin });
         }
         switch (builtin) {
+            case "stackHeight": {
+                if (args.length)
+                    this.fail(node, "stackHeight() takes no arguments");
+                return { c: "sol_get_stack_height()", type: U64 };
+            }
             case "require": {
                 if (args.length !== 2)
                     this.fail(node, "require(condition, error) takes two arguments");
@@ -283,6 +288,8 @@ export class CallEmitter extends ExpressionEmitter {
             }
             case "invoke":
                 return this.invoke(node);
+            case "invokeInstruction":
+                return this.invokeInstruction(node);
             case "sha256":
             case "keccak256":
                 return this.hashCall(node, builtin);
@@ -484,6 +491,9 @@ export class CallEmitter extends ExpressionEmitter {
             return this.callHelper(node, helper);
         if (ts.isPropertyAccessExpression(callee)) {
             const method = callee.name.text;
+            const introspected = this.instructionsCall(node, callee, method);
+            if (introspected)
+                return introspected;
             // xs.some(…) and friends on a Vec, FixedArray, FixedVec or Vec argument: a loop with the callback expanded in it.
             if (LIST_METHODS.has(method)) {
                 const l = ts.isIdentifier(callee.expression) ? this.lookup(callee.expression.text) : undefined;
@@ -570,6 +580,8 @@ export class CallEmitter extends ExpressionEmitter {
                     return target.kind.kind === "token" && target.constraints.ata ? this.createAta(node, target, topLevel) : this.createToken(node, target, topLevel);
                 if (target?.kind.kind === "init" && method === "create")
                     return this.create(node, target, topLevel);
+                if (target?.kind.kind === "migrate" && method === "migrate")
+                    return this.migrate(node, target, topLevel);
                 if (target?.kind.kind === "initIfNeeded" && method === "createIfNeeded")
                     return this.create(node, target, topLevel, true);
                 if (target?.kind.kind === "system" && method === "transfer")
@@ -878,6 +890,92 @@ export class CallEmitter extends ExpressionEmitter {
         return ts.isCallExpression(node) && this.exportName(node.expression) === "remainingAccounts";
     }
     /** C pointer (`TsAccount *`) for an expression naming a remaining account, or undefined. */
+    /** Whether `node` is an InstructionsSysvar parameter. */
+    instructionsParam(node) {
+        const a = ts.isIdentifier(node) ? this.accounts.get(node.text) : undefined;
+        return a?.kind.kind === "instructionsSysvar" ? a : undefined;
+    }
+    /** Whether `node` is a TransactionInstruction: a local holding one, or `ixs.get(i)`. */
+    isTxIx(node) {
+        if (ts.isParenthesizedExpression(node))
+            return this.isTxIx(node.expression);
+        if (ts.isIdentifier(node))
+            return this.lookup(node.text)?.type.kind === "txIx";
+        return (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.text === "get" &&
+            !!this.instructionsParam(node.expression.expression));
+    }
+    /**
+     * InstructionsSysvar.currentIndex() / .get(i) and the methods of a TransactionInstruction: bounds-checked reads of the
+     * sysvar (ts_ix_* in the runtime). Undefined when the call is something else.
+     */
+    instructionsCall(node, callee, method) {
+        const args = node.arguments;
+        const sysvar = this.instructionsParam(callee.expression);
+        if (sysvar) {
+            this.assertUsable(sysvar, callee.expression);
+            if (method === "currentIndex") {
+                if (args.length)
+                    this.fail(node, "currentIndex() takes no arguments");
+                const t = this.tmp("ixi");
+                this.line(`uint64_t ${t};`);
+                this.line(`TS_TRY(ts_ix_current(a_${sysvar.name}, &${t}));`);
+                return { c: t, type: U64 };
+            }
+            if (method === "get") {
+                if (args.length !== 1)
+                    this.fail(node, "get(index) takes the instruction's index");
+                const i = this.expect(this.expr(args[0], U64), U64, args[0]);
+                const t = this.tmp("ix");
+                this.line(`TsIx ${t};`);
+                this.line(`TS_TRY(ts_ix_load(a_${sysvar.name}, ${i.c}, &${t}));`);
+                return { c: t, type: { kind: "txIx" } };
+            }
+            this.fail(node, "the Instructions sysvar has .length, currentIndex() and get(index)");
+        }
+        if (!this.isTxIx(callee.expression))
+            return undefined;
+        const ix = this.expr(callee.expression);
+        const one = (what) => {
+            if (args.length !== 1)
+                this.fail(node, `${method}(${what}) takes one argument`);
+            return this.expect(this.expr(args[0], U64), U64, args[0]).c;
+        };
+        if (method === "accountKey" || method === "accountIsSigner" || method === "accountIsWritable") {
+            const i = one("i");
+            const t = this.tmp("ixa");
+            this.line(`const uint8_t *${t};`);
+            this.line(`TS_TRY(ts_ix_account(&${ix.c}, ${i}, &${t}));`);
+            if (method === "accountKey")
+                return { c: `((const SolPubkey *)(${t} + 1))`, type: PUBKEY };
+            return { c: `((${t}[0] & ${method === "accountIsSigner" ? 1 : 2}) != 0)`, type: BOOL };
+        }
+        const reads = {
+            readU8: ["uint8_t", U8],
+            readU16: ["uint16_t", { kind: "int", name: "u16" }],
+            readU32: ["uint32_t", { kind: "int", name: "u32" }],
+            readU64: ["uint64_t", U64],
+            readPubkey: ["SolPubkey", PUBKEY],
+        };
+        if (reads[method]) {
+            const [c, type] = reads[method];
+            const off = one("offset");
+            const t = this.tmp("ixr");
+            this.line(`${c} ${t};`);
+            this.line(`TS_TRY(ts_ix_read(&${ix.c}, ${off}, sizeof(${c}), &${t}));`);
+            return type.kind === "pubkey" ? { c: `(&${t})`, type } : { c: t, type };
+        }
+        if (method === "is") {
+            if (args.length !== 2 || !ts.isStringLiteralLike(args[1]))
+                this.fail(node, 'is(program, "instruction_name") takes the program and the instruction name as a string literal');
+            const program = this.expect(this.expr(args[0], PUBKEY), PUBKEY, args[0]);
+            const disc = this.tmp("disc");
+            this.line(`static const uint8_t ${disc}[8] = ${cBytes(discriminator(`global:${snakeCase(args[1].text)}`))};`);
+            return { c: `ts_ix_is(&${ix.c}, ${program.c}, ${disc})`, type: BOOL };
+        }
+        this.fail(node, "a TransactionInstruction has programId, accountsLength, dataLength, accountKey/accountIsSigner/accountIsWritable(i), readU8/U16/U32/U64/readPubkey(offset) and is(program, name)");
+    }
     handle(node) {
         if (ts.isParenthesizedExpression(node))
             return this.handle(node.expression);
@@ -984,6 +1082,38 @@ export class CallEmitter extends ExpressionEmitter {
         }
         return { c: `((TSS_${s.name} *)(${h}->data + 8))`, type: { kind: "structRef", struct: s.name, writable: mut } };
     }
+    /**
+     * `acct.migrate(payer, value)` on a Migrate<From, To> account: the new value is built in full first (it may read
+     * acct.from, whose bytes the rewrite overwrites), then the account is resized (the payer tops up the rent when it
+     * grows; shrinking keeps the lamports) and rewritten with To's discriminator and the value.
+     */
+    migrate(node, a, topLevel) {
+        const k = a.kind;
+        const call = `${a.name}.migrate`;
+        if (!topLevel)
+            this.fail(node, `${call}(…) must be a top-level statement of the instruction`);
+        if (this.created.has(a.name))
+            this.fail(node, `${a.name} is already migrated`);
+        if (node.arguments.length !== 2)
+            this.fail(node, `${call}(payer, value) takes the payer and the new ${k.to.name}`);
+        const payer = this.accountParam(node.arguments[0], "the payer");
+        if (payer.kind.kind !== "signer" || !payer.kind.mut)
+            this.fail(node.arguments[0], "the payer must be a Mut<Signer>");
+        this.assertNotAliased([a.name], node, "migrate");
+        const To = k.to.name;
+        const tmp = this.tmp("next");
+        this.line(`TSS_${To} *${tmp} = NULL;`);
+        this.line(`TS_TRY(ts_alloc(sizeof(TSS_${To}), (uint8_t **)&${tmp}));`);
+        this.writeAggregate({ lv: `(*${tmp})`, type: { kind: "struct", name: To }, writable: true }, node.arguments[1]);
+        this.line(`TS_TRY(ts_resize(params, a_${payer.name}, a_${a.name}, 8 + sizeof(TSS_${To}), entry_${a.name}));`);
+        this.line(`ts_memcpy(a_${a.name}->data, TS_DISC_${To}, 8);`);
+        this.line(`ts_memcpy(a_${a.name}->data + 8, ${tmp}, sizeof(TSS_${To}));`);
+        this.line(`TSS_${To} *dt_${a.name} = (TSS_${To} *)(a_${a.name}->data + 8);`);
+        this.line(`(void)dt_${a.name};`);
+        this.created.add(a.name);
+        this.pendingInit.delete(a.name);
+        return undefined;
+    }
     /** Whether a helper (or one it calls) grows a Vec, which needs the instruction's SystemProgram for rent. */
     helperGrows(body, seen = new Set()) {
         if (seen.has(body))

package/dist/compiler/emit/cpi.d.ts

@@ -157,6 +157,15 @@ export declare abstract class CpiEmitter extends CallEmitter {
         to: string;
     } | undefined;
     protected invoke(node: ts.CallExpression): undefined;
+    /**
+     * `invokeInstruction(programId, metas, data, infos, signerSeeds?)`: a CPI decided at run time (Rust's
+     * `invoke_signed(&Instruction { program_id, accounts, data }, infos, seeds)`), e.g. one stored in account data. Each
+     * meta is a struct with `pubkey`, `isSigner` and `isWritable`; `data` a list of u8; every account in `infos` (the
+     * remaining accounts, or a slice of them) goes to the runtime, which finds each meta's account there by key (an
+     * account missing there fails the CPI, as under Rust) and checks the privileges: a meta may only be a signer or
+     * writable as the transaction passed it, or a PDA of this program that `signerSeeds` sign for.
+     */
+    protected invokeInstruction(node: ts.CallExpression): undefined;
     /**
      * A byte buffer written front to back. Its C declaration is patched in afterwards so it is
      * exactly as large as the fixed content, and only falls back to `max` when strings make it dynamic.

package/dist/compiler/emit/cpi.js

@@ -2746,6 +2746,69 @@ export class CpiEmitter extends CallEmitter {
             this.line(`TS_TRY(ts_invoke(params, &${ixName}, NULL, 0));`);
         return undefined;
     }
+    /**
+     * `invokeInstruction(programId, metas, data, infos, signerSeeds?)`: a CPI decided at run time (Rust's
+     * `invoke_signed(&Instruction { program_id, accounts, data }, infos, seeds)`), e.g. one stored in account data. Each
+     * meta is a struct with `pubkey`, `isSigner` and `isWritable`; `data` a list of u8; every account in `infos` (the
+     * remaining accounts, or a slice of them) goes to the runtime, which finds each meta's account there by key (an
+     * account missing there fails the CPI, as under Rust) and checks the privileges: a meta may only be a signer or
+     * writable as the transaction passed it, or a PDA of this program that `signerSeeds` sign for.
+     */
+    invokeInstruction(node) {
+        const a = node.arguments;
+        if (!this.ix)
+            this.fail(node, "invokeInstruction is only available in instructions (it passes remaining accounts)");
+        if (a.length !== 4 && a.length !== 5)
+            this.fail(node, "invokeInstruction(programId, accounts, data, infos, signerSeeds?) takes 4 or 5 arguments");
+        const program = this.expect(this.expr(a[0], PUBKEY), PUBKEY, a[0]);
+        const programKey = this.tmp("dprog");
+        this.line(`SolPubkey ${programKey} = *(${program.c});`);
+        const list = (e, what) => {
+            const l = ts.isIdentifier(e) ? this.lookup(e.text) : undefined;
+            if (l?.type.kind === "vecArg")
+                return { items: `${l.c}.ptr`, count: `((uint64_t)${l.c}.len)`, elem: l.type.elem };
+            const r = this.ref(e);
+            if (r?.vec && r.type.kind === "vec")
+                return { items: `${r.vec.items}`, count: vecCount(r.vec), elem: r.type.elem };
+            this.fail(e, `${what}: a Vec or FixedVec (account data, an argument or a local list)`);
+        };
+        const metas = list(a[1], "the accounts");
+        const elem = metas.elem;
+        const st = elem.kind === "struct" ? this.model.structs.get(elem.name) : undefined;
+        const field = (name, kind) => st?.fields.find((f) => f.name === name && f.type.kind === kind);
+        if (!st || !field("pubkey", "pubkey") || !field("isSigner", "bool") || !field("isWritable", "bool"))
+            this.fail(a[1], "each account is a struct with pubkey: Pubkey, isSigner: boolean and isWritable: boolean");
+        const data = list(a[2], "the data");
+        if (data.elem.kind !== "int" || data.elem.name !== "u8")
+            this.fail(a[2], "the data is a list of u8");
+        const range = this.remainingRange(a[3]) ?? this.fail(a[3], "pass the accounts the CPI may use: remainingAccounts() or rest.slice(a, b)");
+        const seeds = a.length === 5 ? this.signingSeeds(a[4]) : undefined;
+        const n = this.tmp("dn");
+        const m = this.tmp("dmetas");
+        const i = this.tmp("di");
+        const k = this.tmp("dk");
+        this.line(`uint64_t ${n} = ${metas.count};`);
+        this.line(`SolAccountMeta *${m} = NULL;`);
+        this.line(`TS_TRY(ts_alloc(${n} * sizeof(SolAccountMeta) + 1, (uint8_t **)&${m}));`);
+        this.line(`for (uint64_t ${i} = 0; ${i} < ${n}; ${i}++) {`);
+        this.line(`  const TSS_${st.name} *e = &((const TSS_${st.name} *)${metas.items})[${i}];`);
+        this.line(`  ${m}[${i}] = (SolAccountMeta){(SolPubkey *)&e->pubkey, e->isWritable != 0, e->isSigner != 0};`);
+        this.line(`}`);
+        // Every account offered goes along as an AccountInfo (ts_invoke's scratch holds TS_MAX_ACCOUNTS of them).
+        const base = this.ix.accounts.length;
+        this.line(`uint64_t ${k} = 0;`);
+        this.line(`for (uint64_t ${i}b = ${base} + ${range.from}; ${i}b < ${base} + ${range.to}; ${i}b++) ts_info(params->ka[${i}b], &params->infos[${k}++]);`);
+        const ixName = this.tmp("cpi");
+        this.line(`SolInstruction ${ixName} = {&${programKey}, ${m}, ${n}, (uint8_t *)${data.items}, ${data.count}};`);
+        if (seeds) {
+            const signer = this.tmp("signer");
+            this.line(`SolSignerSeeds ${signer} = {${seeds.name}, ${seeds.count}};`);
+            this.line(`TS_TRY(sol_invoke_signed(&${ixName}, params->infos, ${k}, &${signer}, ${typeof seeds.count === "number" ? (seeds.count > 0 ? 1 : 0) : `${seeds.count} > 0 ? 1 : 0`}));`);
+        }
+        else
+            this.line(`TS_TRY(sol_invoke_signed(&${ixName}, params->infos, ${k}, NULL, 0));`);
+        return undefined;
+    }
     /**
      * A byte buffer written front to back. Its C declaration is patched in afterwards so it is
      * exactly as large as the fixed content, and only falls back to `max` when strings make it dynamic.