@typesol/cli 0.26.0 → 0.28.0

package/docs/migrate-from-anchor.md

@@ -46,7 +46,12 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `Option<Account<'info, T>>` | `Mut<T> \| null` (the client passes the program id to leave it out) |
 | `UncheckedAccount` / `AccountInfo` | `AccountInfo` / `Mut<AccountInfo>`: check what you rely on yourself |
 | `SystemAccount<'info>` | `SystemAccount` / `Mut<SystemAccount>` |
+| `Migration<'info, From, To>` | `Migrate<From, To>`, then `acct.migrate(payer, value)`; the old struct keeps its on-chain discriminator with `/** @discriminator account:<OldName> */` |
+| `#[account(discriminator = …)]` | `/** @discriminator <preimage or 0x8 bytes> */` on the struct |
 | `AccountLoader<T>` with `#[account(zero)]` | `Zeroed<T>` (TypeSOL reads every account in place: no copy to avoid) |
+| `Account<T>` with `#[account(zero)]` (Borsh) | `Zeroed<T>` of a `/** @layout borsh */` struct |
+| `#[account(signer)]` on a non-`Signer` account | `Signed<A>`, e.g. `Signed<Zeroed<Multisig>>` |
+| `seeds = [multisig.key().as_ref()], bump = multisig.nonce` | `Seeds<A, ["@multisig"], "@multisig.nonce">` |
 | `Program<'info, System>` | `SystemProgram` |
 | `Program<'info, Token>` / `Token2022` / `Interface<'info, TokenInterface>` | `TokenProgram` / `Token2022Program` / `TokenInterface` |
 | `Account<'info, TokenAccount>` / `Account<'info, Mint>` (`InterfaceAccount`) | `TokenAccount` / `Mint` (`Mut<…>` when written) |
@@ -57,6 +62,8 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `#[account(init, payer = p, seeds = […], bump, token::mint = m, token::authority = a)]` | `Init<TokenAccount>`, then `vault.create(p, […], m, a.key)` (`InitIfNeeded<TokenAccount>` + `createIfNeeded`) |
 | `associated_token::mint = m, associated_token::authority = a` | `Ata<TokenAccount, "a", "m">`; `Ata<Init<TokenAccount>, "a", "m">` creates it |
 | `ctx.remaining_accounts` | `remainingAccounts()` |
+| `#[account(mut, dup)]` | `Dup<Mut<T>>` (in-place accounts only) |
+| `sysvar::instructions` (`load_current_index_checked`, `load_instruction_at_checked`), `get_stack_height()` | `InstructionsSysvar`: `currentIndex()`, `get(i)`, `.length`; `stackHeight()` |
 | `ctx.bumps.vault` | the value `create` returns, or `acct.pdaBump` |
 
 ## Account data
@@ -104,6 +111,8 @@ Anchor instruction that takes or returns a struct with `String` / `Vec` / `Optio
 | `system_program::transfer(CpiContext::new(…), lamports)` | `systemProgram.transfer(from, to, lamports)` |
 | `token::transfer_checked(CpiContext::new_with_signer(…, seeds), amount, decimals)` | `tokenProgram.transferChecked(from, mint, to, authority, amount, ["seed", key, bump])` |
 | `invoke_signed(&ix, &accounts, &[seeds])` | `invoke(program, [writable(a), readonly(b)], [data…], seeds)` |
+| `invoke_signed(&Instruction { program_id, accounts, data }, ctx.remaining_accounts, …)` built at run time | `invokeInstruction(programId, metas, data, remainingAccounts(), seeds)` |
+| `multisig.owners = owners` (a `Vec` argument into account data) | the same, into a `FixedVec<Pubkey, N>` |
 | `declare_program!(other)` / CPI to another Anchor program | `typesol cpi other.json` generates typed helpers |
 | `for x in v.iter()` | `for (const x of v)` |
 | `v.iter().any(\|x\| …)`, `.all`, `.position`, `.find`, `.fold(init, …)`, `.contains(&x)` | `v.some((x) => …)`, `every`, `findIndex`, `find`, `reduce((acc, x) => …, init)`, `includes(x)` |

package/docs/security-model.md

@@ -31,7 +31,8 @@ Each holds for every instruction of every program the compiler accepts. A break
    initialized account of that kind (3007 / 3003); program parameters at their fixed address and executable
    (3008 / 3009); `SystemAccount` owned by the System Program (3011); `Zeroed<T>` owned, all-zero discriminator and
    rent-exempt.
-3. **No aliasing.** Two writable parameters are never the same account (2040), whatever slots the transaction uses.
+3. **No aliasing.** Two writable parameters are never the same account (2040), whatever slots the transaction uses,
+   unless the program marks one `Dup<…>`, and then only for accounts read and written in place (see below).
 4. **Arguments.** Every argument is length-checked before it is read; strings are valid UTF-8; booleans, enums and
    options have valid tags (102).
 5. **Constraints.** `Seeds` (2006, with the stored or the canonical bump), `Ata` (2015 / 2009 / 2014), `HasOne`
@@ -50,7 +51,9 @@ Each holds for every instruction of every program the compiler accepts. A break
    written before it (compile error). Creation refuses an account that already exists (3000), and an address someone
    pre-funded still gets created. `createIfNeeded` on an existing account re-derives the canonical PDA and checks
    owner, discriminator and size (token accounts: mint and owner; mints: decimals, authorities and the extensions it
-   names).
+   names). A `Migrate<From, To>` account is checked as an existing `From`; `migrate(…)` is a top-level statement every
+   path reaches, builds the new value before rewriting the bytes, and nothing reads the old data after it (compile
+   errors).
 9. **Writes through references.** A place is never written after the code that computes its value may have moved it:
    replacing or resizing what a live reference points into is a compile error, as is writing a Vec element with a
    right side that may resize the Vec.
@@ -62,6 +65,10 @@ Each holds for every instruction of every program the compiler accepts. A break
 12. **CPIs.** A program signs only for its own PDAs (the runtime enforces it; the seeds are those written in the
     source). `invoke` marks an account writable or signer only when the parameter is `Mut` / `Signer` or the program
     signs for it; remaining accounts keep the flags they were passed with, or are checked for the role requested.
+    `invokeInstruction` is the exception by design: its program, account flags and data come from values (stored in
+    account data or passed in), so the compiler cannot check them; the runtime does, refusing any account the
+    transaction did not pass that way and any signer the program's seeds do not cover. Only programs that store
+    instructions to run (a multisig, a DAO) need it; review who can write those values.
     Return data is read only from the program named, at the expected size (5106).
 13. **Events.** `emitCpi` is accepted only from this program's event-authority PDA, signed (2002).
 
@@ -78,6 +85,10 @@ Each holds for every instruction of every program the compiler accepts. A break
 - **`AccountInfo` / `UncheckedProgram`.** Unchecked by design, as in Anchor: check what you rely on.
 - **`requirePda(account, seeds, bump)`.** Any valid bump passes (Anchor's `bump = expr`). Use a stored bump, never one
   from the arguments.
+- **`Dup<…>`.** A parameter marked `Dup` may be the same account as another writable one. Reads see every write
+  (both are the same bytes), so a value read before a write through the other slot is stale: read, then write.
+- **Instruction introspection.** The Instructions sysvar holds what the transaction's author put there. Require things
+  of the transaction with it (that a repay instruction follows), never treat it as proof of who did what.
 - **Oracles.** `pythPrice` checks verification, feed and age (pass the exponent you scale by); the raw `update.*`
   fields are unchecked. `switchboardValue` needs the expected feed; set `minSamples`.
 - **`merkleVerify`.** Leaves and inner nodes hash alike: build leaves as `keccak256(keccak256(data))` in the program.
@@ -87,7 +98,8 @@ Each holds for every instruction of every program the compiler accepts. A break
 
 ## Where TypeSOL is stricter than Anchor
 
-- Any two writable parameters naming one account are refused (Anchor compares only program and token accounts).
+- Any two writable parameters naming one account are refused unless one is `Dup<…>` (Anchor compares only program
+  and token accounts, and `dup` lifts that).
 - Arithmetic overflow returns an error code (5100) in every build; Anchor aborts the program, and only when
   overflow checks are enabled.
 

package/lib/typesol.d.ts

@@ -123,7 +123,8 @@ export interface FixedVec<T, N extends number> extends ListMethods<T> {
   readonly length: u64;
   get(index: bigint): T;
   set(index: bigint, value: T): void;
-  push(value: T): void;
+  // `...rest: never[]` takes nothing, but lets a Vec (whose push takes a payer) be assigned to a FixedVec: `acct.owners = owners`.
+  push(value: T, ...rest: never[]): void;
   pop(): T;
   clear(): void;
   [Symbol.iterator](): Iterator<T>;
@@ -186,10 +187,43 @@ export declare function keccak256(...parts: (string | Pubkey | Hash | bigint | b
  */
 export declare function merkleVerify(leaf: Hash, proof: Vec<Hash>, root: Hash): boolean;
 
-/** The Instructions sysvar (Sysvar1nstructions…). Its address is checked. */
+/**
+ * The Instructions sysvar (Sysvar1nstructions…): every instruction of the transaction being executed. Its address is
+ * checked. What it holds is the transaction author's: use it to require something of the transaction (a repay
+ * instruction after a flash loan, a fee instruction before), never as proof of anything else.
+ */
 export interface InstructionsSysvar extends AccountMeta {
   readonly __instructions_sysvar: void;
+  /** How many instructions the transaction has. */
+  readonly length: u64;
+  /** The index of the top-level instruction being executed (this one, or the one that CPI'd into this program). */
+  currentIndex(): u64;
+  /** The transaction's instruction at `index` (5104 when there is none). */
+  get(index: u64): TransactionInstruction;
 }
+/** One instruction of the transaction, read from the Instructions sysvar. Reads past its end fail with 5104. */
+export interface TransactionInstruction {
+  readonly __transaction_instruction: void;
+  readonly programId: Pubkey;
+  readonly accountsLength: u64;
+  readonly dataLength: u64;
+  accountKey(i: u64): Pubkey;
+  accountIsSigner(i: u64): boolean;
+  accountIsWritable(i: u64): boolean;
+  /** Little-endian integers and keys from the instruction data. */
+  readU8(offset: u64): u8;
+  readU16(offset: u64): u16;
+  readU32(offset: u64): u32;
+  readU64(offset: u64): u64;
+  readPubkey(offset: u64): Pubkey;
+  /** `program`'s instruction `name` (snake_case or camelCase): its program id and 8-byte Anchor discriminator match. */
+  is(program: Pubkey, name: string): boolean;
+}
+/**
+ * How deep in cross-program calls this program runs: 1 when the transaction calls it directly, more when another
+ * program invoked it. `require(stackHeight() === 1n, …)` refuses CPI callers.
+ */
+export declare function stackHeight(): u64;
 
 /**
  * True when this transaction contains an Ed25519 precompile instruction that verified `message`
@@ -597,6 +631,32 @@ export type TokenOf<A, MintParam extends string, AuthorityParam extends string =
 export type MintOf<A, AuthorityParam extends string, FreezeAuthorityParam extends string = never, TokenProgramParam extends string = never> = A & {
   readonly __mintOf?: [AuthorityParam, FreezeAuthorityParam, TokenProgramParam];
 };
+/**
+ * Anchor's `dup`: this writable account may be the same account as another writable parameter (TypeSOL refuses that
+ * otherwise, 2040). Both are read and written in place, so a write through one is seen through the other: read
+ * what you need before writing. Not for accounts that are created, closed, a close destination or `@layout borsh`.
+ */
+export type Dup<A> = A & { readonly __dup?: true };
+/**
+ * The account must sign the transaction (Anchor's `signer` constraint on an account that is not a `Signer`; 2002), e.g.
+ * `Signed<Zeroed<Multisig>>` for an account the client creates with a fresh keypair in the same transaction.
+ */
+export type Signed<A> = A & { readonly __signed?: true };
+/**
+ * Anchor 1.0's `Migration<From, To>`: an existing `From` account (owner, discriminator and size checked) that this
+ * instruction rewrites as `To` with `acct.migrate(payer, value)`, a top-level statement every path must reach. Read
+ * the old data through `acct.from` before migrating (the new value may use it: it is built in full before the account
+ * is rewritten), and the new data through `acct.to` after. The account is resized to `To`: the payer tops up the rent
+ * when it grows (at most 10 KiB), and shrinking keeps the lamports. `From` usually keeps the old type's discriminator
+ * under a new name: `/** @discriminator account:Counter *\/ interface CounterV1 { … }`. An account already migrated
+ * fails with 3002, as under Anchor.
+ */
+export interface Migrate<From, To> extends AccountMeta {
+  readonly __migrate: [From, To];
+  readonly from: Readonly<From>;
+  readonly to: To;
+  migrate(payer: Mut<Signer>, value: To): void;
+}
 export type Seeds<A, Names extends readonly string[], Bump extends string = never, ProgramId extends string = never> = A & {
   readonly __seeds?: [Names, Bump, ProgramId];
   /** The PDA's bump (Anchor `ctx.bumps.<account>`): the stored bump field when one is named, else the canonical bump found. */
@@ -1325,9 +1385,10 @@ export type Init<T> = T extends TokenAccount
         };
 
 /**
- * A large account (over 10 KiB, up to 10 MiB) the client already allocated with System CreateAccount,
- * owned by this program and still zeroed. Owner, size, rent exemption and emptiness are checked, then
- * the discriminator is written: from here on it is a `Mut<T>`. Same idea as Anchor's zero-copy `zero`.
+ * An account the client already allocated with System CreateAccount (any size up to 10 MiB; over 10 KiB a program
+ * cannot create it itself), owned by this program and still zeroed: Anchor's `zero`. Emptiness (2013), owner, size and
+ * rent exemption are checked, then the discriminator is written: from here on it is a `Mut<T>`. A `@layout borsh`
+ * struct starts empty (lists and strings empty, Options None) and is written as Borsh when the instruction returns.
  */
 export type Zeroed<T> = T & AccountMeta;
 
@@ -1556,6 +1617,32 @@ export declare function invoke(
   signerSeeds?: Seed[] | SignerSeeds,
 ): void;
 
+/** One account of an instruction built at run time (Rust's `AccountMeta`): any struct with these three fields. */
+export interface InstructionAccountMeta {
+  readonly pubkey: Pubkey;
+  readonly isSigner: boolean;
+  readonly isWritable: boolean;
+}
+/** A list read by index: a Vec or FixedVec in account data, a Vec argument, or a stored local list. */
+export interface IndexedList<T> {
+  readonly length: u64;
+  get(index: bigint): T;
+}
+/**
+ * A CPI decided at run time, e.g. one stored in account data (Rust's `invoke_signed(&Instruction { program_id,
+ * accounts, data }, infos, seeds)`). Every account in `infos` (`remainingAccounts()` or a slice of it) is handed to the
+ * runtime, which finds each meta's account there by key: one that is missing fails the CPI, as under Rust. A meta may
+ * be a signer or writable only as the transaction passed that account, or as a PDA of this program `signerSeeds` sign
+ * for (`signer([multisig.key, multisig.nonce])`).
+ */
+export declare function invokeInstruction(
+  programId: Pubkey,
+  accounts: IndexedList<InstructionAccountMeta>,
+  data: IndexedList<u8>,
+  infos: RemainingAccounts | RemainingSlice,
+  signerSeeds?: Seed[] | SignerSeeds,
+): void;
+
 /**
  * Anchor's own error codes (anchor-lang `ErrorCode`): `require(condition, AnchorError.AccountDidNotDeserialize)` fails
  * with that code, as `require!(condition, ErrorCode::AccountDidNotDeserialize)` does. Not listed in the IDL's errors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typesol/cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Compile a TypeScript-syntax language directly to Solana SBF programs.",
   "type": "module",
   "license": "MIT",

package/runtime/typesol_rt.h

@@ -27,6 +27,7 @@
 #define TS_ERR_CONSTRAINT_EXECUTABLE 2007  /* ConstraintExecutable */
 #define TS_ERR_ASSOCIATED 2009             /* ConstraintAssociated */
 #define TS_ERR_ADDRESS 2012                /* ConstraintAddress */
+#define TS_ERR_CONSTRAINT_ZERO 2013        /* ConstraintZero */
 #define TS_ERR_TOKEN_MINT 2014             /* ConstraintTokenMint */
 #define TS_ERR_TOKEN_OWNER 2015            /* ConstraintTokenOwner */
 #define TS_ERR_MINT_AUTHORITY 2016         /* ConstraintMintMintAuthority */
@@ -654,10 +655,15 @@ static inline uint64_t ts_now(int64_t *out) {
  * to this program. It must be writable, rent-exempt, big enough and still all-zero in its discriminator;
  * the discriminator is written here so the account can never be initialized twice.
  */
-static inline uint64_t ts_init_zeroed(TsAccount *a, const SolPubkey *program_id, const uint8_t disc[8], uint64_t size) {
+/* Zeroed<T> (Anchor's `zero`), in Anchor's order: a discriminator already set (2013), then owner and size as the
+ * account type checks them; the rent check and the discriminator write come after the mut / signer checks. */
+static inline uint64_t ts_check_zeroed(const TsAccount *a, const SolPubkey *program_id, uint64_t size) {
+  if (a->data_len >= 8 && ts_ld64(a->data) != 0) TS_FAIL(TS_ERR_CONSTRAINT_ZERO, "TypeSOL: account already initialized");
   if (!ts_key_eq(&a->owner, program_id)) TS_FAIL(TS_ERR_WRONG_OWNER, "TypeSOL: account not owned by this program");
   if (a->data_len < 8 + size) TS_FAIL(TS_ERR_ACCOUNT_TOO_SMALL, "TypeSOL: account data too small");
-  if (ts_ld64(a->data) != 0) TS_FAIL(TS_ERR_ALREADY_INITIALIZED, "TypeSOL: account already initialized");
+  return SUCCESS;
+}
+static inline uint64_t ts_init_zeroed(TsAccount *a, const uint8_t disc[8]) {
   uint64_t need;
   TS_TRY(ts_minimum_balance(a->data_len, &need));
   if (a->lamports < need) TS_FAIL(TS_ERR_NOT_RENT_EXEMPT, "TypeSOL: account is not rent-exempt");
@@ -1121,6 +1127,81 @@ static inline bool ts_merkle_verify(const SolPubkey *leaf, const uint8_t *proof,
   return ts_mem_eq(node, root, 32);
 }
 
+/*
+ * The Instructions sysvar: u16 count, u16 offsets[count], then per instruction u16 num_accounts,
+ * num_accounts * (u8 flags: bit 0 signer, bit 1 writable; 32-byte key), 32-byte program id, u16 data_len, data; the
+ * last two bytes of the account are the index of the instruction being executed. Everything here is the transaction
+ * author's data: bounds-checked, never trusted for anything but what it says.
+ */
+typedef struct {
+  const uint8_t *accounts; /* num_accounts * 33 bytes */
+  const SolPubkey *program_id;
+  const uint8_t *data;
+  uint16_t num_accounts;
+  uint16_t data_len;
+} TsIx;
+
+/* Instruction `index` of the transaction; false when out of range or malformed. */
+static inline bool ts_ix_at(const TsAccount *ixs, uint64_t index, TsIx *out) {
+  const uint8_t *d = ixs->data;
+  uint64_t len = ixs->data_len;
+  if (len < 2) return false;
+  uint16_t count;
+  ts_memcpy(&count, d, 2);
+  if (index >= count || 2 + (uint64_t)count * 2 > len) return false;
+  uint16_t at;
+  ts_memcpy(&at, d + 2 + index * 2, 2);
+  uint64_t p = at;
+  if (p + 2 > len) return false;
+  ts_memcpy(&out->num_accounts, d + p, 2);
+  p += 2;
+  out->accounts = d + p;
+  p += (uint64_t)out->num_accounts * 33;
+  if (p + 34 > len) return false;
+  out->program_id = (const SolPubkey *)(d + p);
+  p += 32;
+  ts_memcpy(&out->data_len, d + p, 2);
+  p += 2;
+  if (p + out->data_len > len) return false;
+  out->data = d + p;
+  return true;
+}
+static inline uint64_t ts_ix_load(const TsAccount *ixs, uint64_t index, TsIx *out) {
+  if (!ts_ix_at(ixs, index, out)) TS_FAIL(TS_ERR_INDEX, "TypeSOL: no such instruction in the transaction");
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_count(const TsAccount *ixs, uint64_t *out) {
+  if (ixs->data_len < 2) TS_FAIL(TS_ERR_INDEX, "TypeSOL: empty instructions sysvar");
+  uint16_t n;
+  ts_memcpy(&n, ixs->data, 2);
+  *out = n;
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_current(const TsAccount *ixs, uint64_t *out) {
+  if (ixs->data_len < 4) TS_FAIL(TS_ERR_INDEX, "TypeSOL: empty instructions sysvar");
+  uint16_t i;
+  ts_memcpy(&i, ixs->data + ixs->data_len - 2, 2);
+  *out = i;
+  return SUCCESS;
+}
+static inline uint64_t ts_ix_account(const TsIx *ix, uint64_t i, const uint8_t **out) {
+  if (i >= ix->num_accounts) TS_FAIL(TS_ERR_INDEX, "TypeSOL: the instruction has no account at that index");
+  *out = ix->accounts + i * 33;
+  return SUCCESS;
+}
+/* `n` bytes of the instruction's data at `off` (little-endian integers, keys). */
+static inline uint64_t ts_ix_read(const TsIx *ix, uint64_t off, uint64_t n, void *out) {
+  if (off > ix->data_len || n > ix->data_len - off) TS_FAIL(TS_ERR_INDEX, "TypeSOL: read past the end of the instruction's data");
+  ts_memcpy(out, ix->data + off, n);
+  return SUCCESS;
+}
+/* Is it `program`'s instruction with this 8-byte discriminator (Anchor's sha256("global:<name>")[..8])? */
+static inline bool ts_ix_is(const TsIx *ix, const SolPubkey *program, const uint8_t disc[8]) {
+  return ts_key_eq(ix->program_id, program) && ix->data_len >= 8 && ts_mem_eq(ix->data, disc, 8);
+}
+/* How deep in CPIs the program runs: 1 when the transaction calls it directly. */
+extern uint64_t sol_get_stack_height(void);
+
 /*
  * Did an Ed25519 precompile instruction in this transaction verify `message` signed by `signer`?
  * Reads the Instructions sysvar (data: u16 count, u16 offsets[count], then per instruction
@@ -1129,29 +1210,15 @@ static inline bool ts_merkle_verify(const SolPubkey *leaf, const uint8_t *proof,
  * message, with offsets pointing into the precompile's own data (instruction index 0xFFFF).
  */
 static inline bool ts_ed25519_verified(const TsAccount *ixs, const SolPubkey *signer, TS_Str message) {
-  const uint8_t *d = ixs->data;
-  uint64_t len = ixs->data_len;
-  if (len < 2) return false;
+  if (ixs->data_len < 2) return false;
   uint16_t count;
-  ts_memcpy(&count, d, 2);
-  if (2 + (uint64_t)count * 2 > len) return false;
+  ts_memcpy(&count, ixs->data, 2);
   for (uint16_t i = 0; i < count; i++) {
-    uint16_t at;
-    ts_memcpy(&at, d + 2 + (uint64_t)i * 2, 2);
-    uint64_t p = at;
-    if (p + 2 > len) return false;
-    uint16_t nacc;
-    ts_memcpy(&nacc, d + p, 2);
-    p += 2 + (uint64_t)nacc * 33;
-    if (p + 34 > len) return false;
-    bool is_ed = ts_mem_eq(d + p, &TS_ED25519_PROGRAM_ID, 32);
-    p += 32;
-    uint16_t dlen;
-    ts_memcpy(&dlen, d + p, 2);
-    p += 2;
-    if (p + dlen > len) return false;
-    if (!is_ed || dlen < 2) continue;
-    const uint8_t *ix = d + p;
+    TsIx t;
+    if (!ts_ix_at(ixs, i, &t)) return false;
+    if (!ts_key_eq(t.program_id, &TS_ED25519_PROGRAM_ID) || t.data_len < 2) continue;
+    uint16_t dlen = t.data_len;
+    const uint8_t *ix = t.data;
     uint8_t nsig = ix[0];
     for (uint8_t k = 0; k < nsig; k++) {
       uint64_t o = 2 + (uint64_t)k * 14;