@typesol/cli 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -6,6 +6,27 @@ codes, and says so here.
 
 ## Unreleased
 
+## 0.28.0 — 2026-10-29
+
+A port of coral-xyz/multisig, checked against the program deployed on mainnet, and the features it needed. The
+benchmark programs compile to the same numbers as in 0.27.0.
+
+- New: `invokeInstruction(programId, metas, data, infos, signerSeeds?)`, a CPI decided at run time (Rust's
+  `invoke_signed` of an `Instruction` built from data): metas are structs with `pubkey`, `isSigner`, `isWritable`, the
+  data a list of u8, and every account in `infos` (the remaining accounts or a slice) goes to the runtime.
+- New: `Signed<A>`, Anchor's `signer` constraint on an account that is not a `Signer` (2002); the IDL marks it a signer.
+- New: `Zeroed<T>` of a `@layout borsh` struct (Anchor's `#[account(zero)]` on a Borsh account): it starts empty and is
+  written as Borsh when the instruction returns.
+- New: a Seeds bump stored in another struct account, `Seeds<A, ["@multisig"], "@multisig.nonce">` (Anchor's
+  `bump = multisig.nonce`).
+- New: `list = vecArgument` copies a `Vec` argument (or another list of the same elements) into a `FixedVec` (5104 when
+  it does not fit).
+- Changed: a `Zeroed<T>` account whose discriminator is already set fails with 2013 (ConstraintZero), checked before its
+  owner, as under Anchor; it was 3000 after the owner check.
+- Changed: `key`, `lamports`, `dataLen`, `isSigner`, `isWritable` and `pdaBump` are refused as field names only in
+  structs held in an account (where they would shadow `acct.key` and the others), no longer in every struct.
+- Docs: `docs/case-study-multisig.md`; the mainnet binary is in `test/programs/coral_multisig.so`.
+
 ## 0.27.0 — 2026-10-29
 
 Anchor 1.0 parity: instruction introspection, `Dup<…>` and account migration. Existing programs compile to the same

package/README.md

@@ -175,7 +175,8 @@ program's address.
 
 Coming from Anchor: [docs/migrate-from-anchor.md](docs/migrate-from-anchor.md) maps every construct, `typesol port`
 starts from your program's IDL, and [docs/case-study-escrow.md](docs/case-study-escrow.md) follows one complete Anchor
-program through the port. Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
+program through the port; [docs/case-study-multisig.md](docs/case-study-multisig.md) ports coral-xyz/multisig and
+checks it against the binary deployed on mainnet (same outcomes and account bytes; 73–84% fewer compute units). Tests use `typesol/testing` (accounts by name, plain values; [docs/test-your-program.md](docs/test-your-program.md)). To go to
 mainnet (wallet, cost, deploy, IDL, verification), follow [docs/mainnet.md](docs/mainnet.md).
 
 ## How it works
@@ -323,6 +324,7 @@ Details are in [docs/testing.md](docs/testing.md).
 | [`relay.ts`](examples/relay.ts), [`caller.ts`](examples/caller.ts) | generic `invoke`, PDA-signed transfers, return data |
 | [`profiles.ts`](examples/profiles.ts) | nested structs, FixedString, events |
 | [`orderbook/`](examples/orderbook) | a three-file, 28 KiB zero-copy limit order book |
+| [`multisig.ts`](examples/multisig.ts) | coral-xyz/multisig: stored instructions run with `invokeInstruction`, a PDA signing, Anchor's Borsh accounts |
 
 ## Status
 

package/dist/compiler/analyze.d.ts

@@ -2,6 +2,8 @@ import ts from "typescript";
 import { Reporter } from "./diagnostics.js";
 import { type DataEnumDef, type EnumDef, type GenericHelper, type Helper, type ProgramModel, type ScalarType, type StructDef, type ValueType, isScalar } from "./model.js";
 export declare const LIB_PATH: string;
+/** A struct used as account data: none of its fields may shadow an account member. */
+export declare function checkAccountMembers(s: StructDef, at: ts.Node, reporter: Reporter): void;
 /** Why a name cannot be used as a C member, or undefined when it can. */
 export declare function cNameProblem(name: string): string | undefined;
 /** Solana's account size limit, and what a program can allocate itself through a CPI (Init<T>). */

package/dist/compiler/analyze.js

@@ -8,7 +8,15 @@ import { borshIdentical } from "./emit/borsh.js";
 import { optionKey, INT_INFO, INT_NAMES, scalarKey, fixedVecName, isScalar, scalarSize, typeName, } from "./model.js";
 export const LIB_PATH = fileURLToPath(new URL("../../lib/typesol.d.ts", import.meta.url));
 /** Names a struct field may not use because account parameters already expose them. */
-const RESERVED_FIELDS = new Set(["key", "lamports", "dataLen", "create", "equals", "get", "set", "length", "isSigner", "isWritable", "pdaBump"]);
+const RESERVED_FIELDS = new Set(["create", "equals", "get", "set", "length"]);
+/** Members every account parameter has (`acct.key`, `acct.isSigner`, …): a struct held in an account cannot use them. */
+const ACCOUNT_MEMBERS = new Set(["key", "lamports", "dataLen", "isSigner", "isWritable", "pdaBump"]);
+/** A struct used as account data: none of its fields may shadow an account member. */
+export function checkAccountMembers(s, at, reporter) {
+    const clash = s.fields.find((f) => ACCOUNT_MEMBERS.has(f.name));
+    if (clash)
+        reporter.fail(at, `${s.name}.${clash.name}: "${clash.name}" is an account member (acct.${clash.name}); rename the field to hold ${s.name} in an account`);
+}
 /**
  * Struct fields and enum variants become C member names as written. C keywords and the object-like
  * macros of the Solana C SDK / TypeSOL runtime would break or silently change the generated C.
@@ -86,6 +94,7 @@ const TYPE_EXPORTS = new Set([
     "Owner",
     "Executable",
     "Dup",
+    "Signed",
     "Migrate",
     "Optional",
     "EventAuthority",
@@ -1341,7 +1350,8 @@ function analyzeHelper(fn, name, display, reporter, scope, structs, skip = new S
             wrapped === "Seeds" ||
             wrapped === "CloseTo" ||
             wrapped === "Address" ||
-            wrapped === "Ata")
+            wrapped === "Ata" ||
+            wrapped === "Signed")
             reporter.fail(p.type, "constraints belong on instruction parameters; helpers take the plain account type");
         const account = resolveAccountKind(p.type, reporter, scope.imports, structs);
         if (account.kind === "init" || account.kind === "initIfNeeded" || account.kind === "zeroed" || account.kind === "migrate")
@@ -1529,9 +1539,20 @@ function analyzeInstruction(fn, reporter, scope, structs) {
                 if (!accounts.some((o) => o.name === f))
                     reporter.fail(a.node, `HasOne<…, "${f}">: add an account parameter named "${f}"`);
             }
-            if (c.seeds?.bump) {
+            if (c.seeds?.bump?.startsWith("@")) {
+                // "@acct.field": the bump stored in another struct account (Anchor `bump = multisig.nonce`).
+                const [owner, field, ...rest] = c.seeds.bump.slice(1).split(".");
+                const o = accounts.find((x) => x.name === owner);
+                const os = o?.kind.kind === "account" ? o.kind.struct : undefined;
+                if (!os || !field || rest.length)
+                    reporter.fail(a.node, `Seeds bump: "${c.seeds.bump}" must name a u8 field of a struct account parameter ("@config.bump")`);
+                const bf = os.fields.find((x) => x.name === field);
+                if (!bf || bf.type.kind !== "int" || bf.type.name !== "u8")
+                    reporter.fail(a.node, `Seeds bump: ${os.name} needs a u8 field "${field}"`);
+            }
+            else if (c.seeds?.bump) {
                 if (!struct)
-                    reporter.fail(a.node, "Seeds with a bump field needs a struct account");
+                    reporter.fail(a.node, `Seeds with a bump field needs a struct account; for a bump stored elsewhere name it "@acct.field"`);
                 const bf = struct.fields.find((x) => x.name === c.seeds.bump);
                 if (!bf || bf.type.kind !== "int" || bf.type.name !== "u8")
                     reporter.fail(a.node, `Seeds bump: ${struct.name} needs a u8 field "${c.seeds.bump}"`);
@@ -1562,6 +1583,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
             ...c.hasOne.map((e) => e.split("=").at(-1)),
             ...(c.seeds?.names ?? []).filter((n) => n.startsWith("@")).map((n) => n.slice(1).split(".")[0]),
             ...(c.seeds?.program?.startsWith("@") ? [c.seeds.program.slice(1)] : []),
+            ...(c.seeds?.bump?.startsWith("@") ? [c.seeds.bump.slice(1).split(".")[0]] : []),
             ...(c.closeTo ? [c.closeTo] : []),
             ...(c.ata
                 ? [c.ata.owner, c.ata.mint, ...(a.kind.kind === "token" ? [] : accounts.filter((o) => o.kind.kind === "tokenProgram").map((o) => o.name))]
@@ -1631,7 +1653,7 @@ function analyzeInstruction(fn, reporter, scope, structs) {
 /** Peel HasOne / Seeds / CloseTo wrappers off a parameter type, recording what they ask for. */
 function unwrapConstraints(node, reporter, imports, out) {
     const name = typesolName(node, imports);
-    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable", "Dup"].includes(name ?? ""))
+    if (!["HasOne", "TokenOf", "MintOf", "Seeds", "CloseTo", "Address", "Ata", "Owner", "Executable", "Dup", "Signed"].includes(name ?? ""))
         return node;
     const args = node.typeArguments ?? [];
     const lit = (t) => {
@@ -1675,6 +1697,8 @@ function unwrapConstraints(node, reporter, imports, out) {
         out.executable = true;
     if (name === "Dup")
         out.dup = true;
+    if (name === "Signed")
+        out.signed = true;
     if (name === "Address") {
         const text = lit(args[1])[0];
         const bytes = text === undefined ? undefined : decodeAddress(text);
@@ -1719,6 +1743,8 @@ function resolveAccountKind(node, reporter, imports, structs) {
         const s = ts.isTypeReferenceNode(t) && ts.isIdentifier(t.typeName) ? structs.get(t.typeName.text) : undefined;
         if (s && s.size === undefined)
             reporter.fail(t, `${s.name} has a variable-length string field and cannot be account data; use FixedString<N>`);
+        if (s)
+            checkAccountMembers(s, t, reporter);
         return s;
     };
     switch (outer) {
@@ -1831,9 +1857,7 @@ function resolveAccountKind(node, reporter, imports, structs) {
             if (!s)
                 reporter.fail(node, "Zeroed<T> needs a struct declared in this program");
             if (s.vec)
-                reporter.fail(node, `${s.name} has a growable Vec; Zeroed<T> is for fixed-size (large) accounts`);
-            if (s.layout === "borsh")
-                reporter.fail(node, `${s.name} is @layout borsh; Zeroed<T> reads large accounts in place, so it takes fixed layouts only`);
+                reporter.fail(node, `${s.name} has a growable Vec; Zeroed<T> is for fixed-size accounts (or @layout borsh with FixedVec)`);
             return { kind: "zeroed", struct: s };
         }
         case "Mut": {

package/dist/compiler/emit/base.d.ts

@@ -131,6 +131,7 @@ export declare abstract class EmitterBase {
     protected abstract coreOp(node: ts.CallExpression, core: AccountParam, method: string): undefined;
     protected abstract bubblegumOp(node: ts.CallExpression, bg: AccountParam, method: string): undefined;
     protected abstract invoke(node: ts.CallExpression): undefined;
+    protected abstract invokeInstruction(node: ts.CallExpression): undefined;
     protected abstract emitEvent(node: ts.CallExpression, cpi?: {
         authority: string;
         program: string;

package/dist/compiler/emit/calls.js

@@ -288,6 +288,8 @@ export class CallEmitter extends ExpressionEmitter {
             }
             case "invoke":
                 return this.invoke(node);
+            case "invokeInstruction":
+                return this.invokeInstruction(node);
             case "sha256":
             case "keccak256":
                 return this.hashCall(node, builtin);

package/dist/compiler/emit/cpi.d.ts

@@ -157,6 +157,15 @@ export declare abstract class CpiEmitter extends CallEmitter {
         to: string;
     } | undefined;
     protected invoke(node: ts.CallExpression): undefined;
+    /**
+     * `invokeInstruction(programId, metas, data, infos, signerSeeds?)`: a CPI decided at run time (Rust's
+     * `invoke_signed(&Instruction { program_id, accounts, data }, infos, seeds)`), e.g. one stored in account data. Each
+     * meta is a struct with `pubkey`, `isSigner` and `isWritable`; `data` a list of u8; every account in `infos` (the
+     * remaining accounts, or a slice of them) goes to the runtime, which finds each meta's account there by key (an
+     * account missing there fails the CPI, as under Rust) and checks the privileges: a meta may only be a signer or
+     * writable as the transaction passed it, or a PDA of this program that `signerSeeds` sign for.
+     */
+    protected invokeInstruction(node: ts.CallExpression): undefined;
     /**
      * A byte buffer written front to back. Its C declaration is patched in afterwards so it is
      * exactly as large as the fixed content, and only falls back to `max` when strings make it dynamic.

package/dist/compiler/emit/cpi.js

@@ -2746,6 +2746,69 @@ export class CpiEmitter extends CallEmitter {
             this.line(`TS_TRY(ts_invoke(params, &${ixName}, NULL, 0));`);
         return undefined;
     }
+    /**
+     * `invokeInstruction(programId, metas, data, infos, signerSeeds?)`: a CPI decided at run time (Rust's
+     * `invoke_signed(&Instruction { program_id, accounts, data }, infos, seeds)`), e.g. one stored in account data. Each
+     * meta is a struct with `pubkey`, `isSigner` and `isWritable`; `data` a list of u8; every account in `infos` (the
+     * remaining accounts, or a slice of them) goes to the runtime, which finds each meta's account there by key (an
+     * account missing there fails the CPI, as under Rust) and checks the privileges: a meta may only be a signer or
+     * writable as the transaction passed it, or a PDA of this program that `signerSeeds` sign for.
+     */
+    invokeInstruction(node) {
+        const a = node.arguments;
+        if (!this.ix)
+            this.fail(node, "invokeInstruction is only available in instructions (it passes remaining accounts)");
+        if (a.length !== 4 && a.length !== 5)
+            this.fail(node, "invokeInstruction(programId, accounts, data, infos, signerSeeds?) takes 4 or 5 arguments");
+        const program = this.expect(this.expr(a[0], PUBKEY), PUBKEY, a[0]);
+        const programKey = this.tmp("dprog");
+        this.line(`SolPubkey ${programKey} = *(${program.c});`);
+        const list = (e, what) => {
+            const l = ts.isIdentifier(e) ? this.lookup(e.text) : undefined;
+            if (l?.type.kind === "vecArg")
+                return { items: `${l.c}.ptr`, count: `((uint64_t)${l.c}.len)`, elem: l.type.elem };
+            const r = this.ref(e);
+            if (r?.vec && r.type.kind === "vec")
+                return { items: `${r.vec.items}`, count: vecCount(r.vec), elem: r.type.elem };
+            this.fail(e, `${what}: a Vec or FixedVec (account data, an argument or a local list)`);
+        };
+        const metas = list(a[1], "the accounts");
+        const elem = metas.elem;
+        const st = elem.kind === "struct" ? this.model.structs.get(elem.name) : undefined;
+        const field = (name, kind) => st?.fields.find((f) => f.name === name && f.type.kind === kind);
+        if (!st || !field("pubkey", "pubkey") || !field("isSigner", "bool") || !field("isWritable", "bool"))
+            this.fail(a[1], "each account is a struct with pubkey: Pubkey, isSigner: boolean and isWritable: boolean");
+        const data = list(a[2], "the data");
+        if (data.elem.kind !== "int" || data.elem.name !== "u8")
+            this.fail(a[2], "the data is a list of u8");
+        const range = this.remainingRange(a[3]) ?? this.fail(a[3], "pass the accounts the CPI may use: remainingAccounts() or rest.slice(a, b)");
+        const seeds = a.length === 5 ? this.signingSeeds(a[4]) : undefined;
+        const n = this.tmp("dn");
+        const m = this.tmp("dmetas");
+        const i = this.tmp("di");
+        const k = this.tmp("dk");
+        this.line(`uint64_t ${n} = ${metas.count};`);
+        this.line(`SolAccountMeta *${m} = NULL;`);
+        this.line(`TS_TRY(ts_alloc(${n} * sizeof(SolAccountMeta) + 1, (uint8_t **)&${m}));`);
+        this.line(`for (uint64_t ${i} = 0; ${i} < ${n}; ${i}++) {`);
+        this.line(`  const TSS_${st.name} *e = &((const TSS_${st.name} *)${metas.items})[${i}];`);
+        this.line(`  ${m}[${i}] = (SolAccountMeta){(SolPubkey *)&e->pubkey, e->isWritable != 0, e->isSigner != 0};`);
+        this.line(`}`);
+        // Every account offered goes along as an AccountInfo (ts_invoke's scratch holds TS_MAX_ACCOUNTS of them).
+        const base = this.ix.accounts.length;
+        this.line(`uint64_t ${k} = 0;`);
+        this.line(`for (uint64_t ${i}b = ${base} + ${range.from}; ${i}b < ${base} + ${range.to}; ${i}b++) ts_info(params->ka[${i}b], &params->infos[${k}++]);`);
+        const ixName = this.tmp("cpi");
+        this.line(`SolInstruction ${ixName} = {&${programKey}, ${m}, ${n}, (uint8_t *)${data.items}, ${data.count}};`);
+        if (seeds) {
+            const signer = this.tmp("signer");
+            this.line(`SolSignerSeeds ${signer} = {${seeds.name}, ${seeds.count}};`);
+            this.line(`TS_TRY(sol_invoke_signed(&${ixName}, params->infos, ${k}, &${signer}, ${typeof seeds.count === "number" ? (seeds.count > 0 ? 1 : 0) : `${seeds.count} > 0 ? 1 : 0`}));`);
+        }
+        else
+            this.line(`TS_TRY(sol_invoke_signed(&${ixName}, params->infos, ${k}, NULL, 0));`);
+        return undefined;
+    }
     /**
      * A byte buffer written front to back. Its C declaration is patched in afterwards so it is
      * exactly as large as the fixed content, and only falls back to `max` when strings make it dynamic.

package/dist/compiler/emit/function.js

@@ -40,8 +40,14 @@ export class FunctionEmitter extends StatementEmitter {
                 head.push(`  TS_TRY(ts_check_signer(${v}));`);
             // Mut<…>: Anchor's `mut` (2000). Anchor checks it with the constraints, after seeds and associated token; here it
             // sits with the type checks, which keeps binaries smaller (only a transaction breaking both sees the difference).
+            // Zeroed<T> (Anchor's `zero`): its discriminator, owner and size come before `mut`, as under Anchor.
+            if (k.kind === "zeroed")
+                head.push(`  TS_TRY(ts_check_zeroed(${v}, params->program_id, ${k.struct.layout === "borsh" ? borshMinSize(k.struct, this.model) : `sizeof(TSS_${k.struct.name})`}));`);
             if (isWritable(k))
                 head.push(`  TS_TRY(ts_check_mut(${v}));`);
+            // Signed<…>: Anchor's `signer` constraint (2002), right after `mut`.
+            if (a.constraints.signed)
+                head.push(`  if (!${v}->is_signer) TS_FAIL(TS_ERR_CONSTRAINT_SIGNER, "TypeSOL: ${a.name} must sign");`);
             // A @layout borsh account only has to hold its smallest Borsh form (unpacking checks the rest).
             if (k.kind === "account")
                 head.push(`  TS_TRY(ts_check_program_account(${v}, params->program_id, TS_DISC_${k.struct.name}, ${k.struct.layout === "borsh" ? borshMinSize(k.struct, this.model) : emptySizeC(k.struct)}));`);
@@ -94,10 +100,10 @@ export class FunctionEmitter extends StatementEmitter {
             if (k.kind === "migrate")
                 head.push(`  TS_TRY(ts_check_program_account(${v}, params->program_id, TS_DISC_${k.from.name}, sizeof(TSS_${k.from.name})));`, `  const TSS_${k.from.name} *df_${a.name} = (const TSS_${k.from.name} *)(${v}->data + 8);`, `  uint64_t entry_${a.name} = ${v}->data_len;`);
             if (k.kind === "zeroed")
-                head.push(`  TS_TRY(ts_init_zeroed(${v}, params->program_id, TS_DISC_${k.struct.name}, sizeof(TSS_${k.struct.name})));`);
+                head.push(`  TS_TRY(ts_init_zeroed(${v}, TS_DISC_${k.struct.name}));`);
             if (k.kind === "initIfNeeded" && k.struct.vec)
                 this.reporter.fail(a.node, "InitIfNeeded accounts cannot end in a Vec yet");
-            if ((k.kind === "account" || k.kind === "init" || k.kind === "initIfNeeded") && k.struct.layout === "borsh") {
+            if ((k.kind === "account" || k.kind === "init" || k.kind === "initIfNeeded" || k.kind === "zeroed") && k.struct.layout === "borsh") {
                 // Worked on as its fixed-layout struct on the heap, packed back when the instruction returns. The heap is zero at
                 // entry and these are its first allocations (before the body uses it), so a string's padding and a list's
                 // unused slots start as zero: ts_unpack_* only writes what the Borsh bytes hold.
@@ -379,7 +385,7 @@ export class FunctionEmitter extends StatementEmitter {
             return [];
         // @layout borsh accounts go back to their Borsh bytes (unless closed, or never created).
         const packs = this.ix.accounts
-            .filter((a) => (a.kind.kind === "account" ? a.kind.mut : a.kind.kind === "init" || a.kind.kind === "initIfNeeded"))
+            .filter((a) => (a.kind.kind === "account" ? a.kind.mut : a.kind.kind === "init" || a.kind.kind === "initIfNeeded" || a.kind.kind === "zeroed"))
             .filter((a) => a.kind.struct.layout === "borsh")
             .map((a) => {
             const v = `a_${a.name}`;
@@ -588,9 +594,11 @@ export class FunctionEmitter extends StatementEmitter {
         const seeds = `cs_${a.name}`;
         out.push(`  SolSignerSeed ${seeds}[${parts.length + 1}] = {${parts.join(", ")}};`);
         if (c.seeds.bump) {
-            out.push(`  ${seeds}[${parts.length}] = (SolSignerSeed){&d_${a.name}->${c.seeds.bump}, 1};`);
+            // The account's own bump field, or "@acct.field": one stored in another struct account.
+            const bump = c.seeds.bump.startsWith("@") ? `d_${c.seeds.bump.slice(1).replace(".", "->")}` : `d_${a.name}->${c.seeds.bump}`;
+            out.push(`  ${seeds}[${parts.length}] = (SolSignerSeed){&${bump}, 1};`);
             out.push(`  TS_TRY(ts_require_pda(a_${a.name}, ${seeds}, ${parts.length + 1}, ${program}));`);
-            this.bumps.set(a.name, `d_${a.name}->${c.seeds.bump}`);
+            this.bumps.set(a.name, bump);
         }
         else {
             bumpDecls.push(`  uint8_t sb_${a.name}; (void)sb_${a.name};`);

package/dist/compiler/emit/storage.js

@@ -685,9 +685,30 @@ export class StorageEmitter extends EmitterBase {
             this.line(`}`);
             return;
         }
+        // `list = owners`: a Vec argument, or a Vec / FixedVec of the same elements, copied whole into a FixedVec (Anchor's
+        // `multisig.owners = owners`); more elements than it holds fail with 5104, as push does.
+        if (target.type.kind === "vec" && target.type.cap !== undefined && target.type.elem.kind !== "string" && target.type.elem.kind !== "fstring") {
+            const t = target.type;
+            const l = ts.isIdentifier(valueNode) ? this.lookup(valueNode.text) : undefined;
+            const r = l?.type.kind === "vecArg" ? undefined : this.reporter.guard(() => this.ref(valueNode));
+            const from = l?.type.kind === "vecArg" && sameType(l.type.elem, t.elem)
+                ? { items: `${l.c}.ptr`, count: `((uint64_t)${l.c}.len)` }
+                : r?.vec && r.type.kind === "vec" && sameType(r.type.elem, t.elem) && !sameType(r.type, t)
+                    ? { items: r.vec.items, count: vecCount(r.vec) }
+                    : undefined;
+            if (from) {
+                const n = this.tmp("vn");
+                this.line(`uint64_t ${n} = ${from.count};`);
+                this.line(`if (${n} > ${t.cap}) TS_FAIL(TS_ERR_INDEX, "TypeSOL: more elements than the ${typeName(t)} holds");`);
+                // Slots past the new length keep what they held, as after pop() / clear().
+                this.line(`ts_memcpy(${target.lv}.items, (const uint8_t *)${from.items}, ${n} * ${this.fieldBytes(t.elem)});`);
+                this.line(`${target.lv}.len = (uint32_t)${n};`);
+                return;
+            }
+        }
         const src = this.ref(valueNode) ?? this.wholeAccount(valueNode);
         if (!src || !sameType(src.type, target.type))
-            this.fail(valueNode, `expected a ${typeName(target.type)}: an object literal or another ${typeName(target.type)}`);
+            this.fail(valueNode, `expected a ${typeName(target.type)}: an object literal, another ${typeName(target.type)}${target.type.kind === "vec" && target.type.cap !== undefined ? " or a Vec of the same elements" : ""}`);
         // Same-typed places are either distinct or identical (`a.p = a.p`); ts_copy skips the latter.
         this.line(`ts_copy(&${target.lv}, &${src.lv}, sizeof(${target.lv}));`);
     }

package/dist/compiler/idl.js

@@ -93,7 +93,7 @@ function accountEntry(ix, name, k, programAddress) {
         entry.writable = true;
     if (param?.optional)
         entry.optional = true;
-    if (k.kind === "signer" || param?.signsInit)
+    if (k.kind === "signer" || param?.signsInit || param?.constraints.signed)
         entry.signer = true;
     if (k.kind === "system")
         entry.address = SYSTEM_PROGRAM;

package/dist/compiler/model.d.ts

@@ -275,6 +275,8 @@ export interface Constraints {
     executable?: boolean;
     /** Dup<A> (Anchor's `dup`): may be the same account as another writable parameter (see function.ts). */
     dup?: boolean;
+    /** Signed<A> (Anchor's `signer` constraint on an account of another type): it must sign (2002). */
+    signed?: boolean;
     /** Close this account into that parameter when the instruction succeeds. */
     closeTo?: string;
     /** Address<A, "base58">: the account must be exactly this address. */

package/docs/architecture.md

@@ -102,7 +102,8 @@ These invariants are easy to break. Each one has tests.
   pointer per account, and lengths, lamports and owners a CPI changes are seen without copying anything back. CPIs
   go through `ts_invoke`, which builds `SolAccountInfo` records only for the accounts the call lists. It finds each
   record from its meta (the key sits 8 bytes into it), so every `SolAccountMeta` must point at `&acct->key` of an
-  instruction account, never at a derived or local `SolPubkey`.
+  instruction account, never at a derived or local `SolPubkey`. `invokeInstruction` is the one exception: its metas
+  point into data, so it calls `sol_invoke_signed` directly with records for every account it was handed.
 - **Runtime messages carry the source location.** `line()` appends `(file.ts:line)` to every `"TypeSOL: …"`
   message.
 - **No SDK byte loops.** Generated code and the runtime compare, copy and zero memory with `ts_key_eq`, `ts_mem_eq`,

package/docs/audit.md

@@ -40,6 +40,7 @@ accepts. Areas where a bug would be most damaging, and where earlier internal re
   the Vecs that follow, `@layout borsh` accounts.
 - **Arithmetic**: every operator and cast at every width, compound assignment, `mulDiv`, rent.
 - **CPIs and signing**: signer-seed arrays (including their reuse across statements), account flags in `invoke`,
+  `invokeInstruction` (metas from data, the infos it hands over, `ts_alloc` of the meta array),
   account creation on pre-funded addresses, closing.
 - **The runtime's parsing**: instruction data, the serialized accounts, Token-2022 extension data, oracle accounts and
   the instructions sysvar.

package/docs/case-study-multisig.md

@@ -0,0 +1,167 @@
+# Case study: porting coral-xyz/multisig
+
+This page ports a program that holds real authority on mainnet:
+[coral-xyz/multisig](https://github.com/coral-xyz/multisig) (`programs/multisig/src/lib.rs`, Anchor 0.25, Apache-2.0),
+deployed at `msigUdDBsR4zSUYqYEDrc1LcgtmuSDDM7KxpRUXNC6U`. The port is
+[`examples/multisig.ts`](../examples/multisig.ts). Instead of a twin built for the occasion, it is checked against the
+binary that runs on mainnet: [`test/examples/multisig.test.ts`](../test/examples/multisig.test.ts) runs both under the
+same program id and compares every outcome and every account byte. See
+[case-study-escrow.md](case-study-escrow.md) for a token program and [Migrate from Anchor](migrate-from-anchor.md) for
+the general reference.
+
+## The program
+
+A multisig executes arbitrary instructions once `threshold` of its owners approve them. Its PDA (`[multisig]`, bump
+`multisig.nonce`) signs the instruction, so it can hold anything a key can: a program's upgrade authority, a mint
+authority, a treasury.
+
+- `create_multisig(owners, threshold, nonce)` initializes an account the client allocated in the same transaction.
+- `create_transaction(pid, accs, data)` stores a proposed instruction; the proposer, an owner, approves it.
+- `approve()` adds an owner's approval.
+- `execute_transaction()` runs the stored instruction through a CPI signed by the PDA once enough owners approved.
+- `set_owners(owners)`, `change_threshold(threshold)` and `set_owners_and_change_threshold(...)` change the multisig;
+  only its PDA can sign them, so they run as stored transactions the multisig executes on itself.
+
+Upstream it is 337 lines of Rust; the port is 184 lines of TypeScript, comments included.
+
+## What it needed
+
+The port needed five features TypeSOL did not have. They are general features now, each with tests of its own
+(`test/language/dynamic-cpi.test.ts`):
+
+| Anchor | TypeSOL | |
+| --- | --- | --- |
+| `invoke_signed(&ix, ctx.remaining_accounts, …)` with `ix` built from account data | `invokeInstruction(programId, metas, data, remainingAccounts(), seeds)` | A CPI decided at run time. Each meta is a struct with `pubkey`, `isSigner`, `isWritable`. The runtime finds each account among the infos by key and checks privileges, as it does for Rust. |
+| `#[account(zero, signer)] multisig: Box<Account<'info, Multisig>>` | `Signed<Zeroed<Multisig>>` of a `/** @layout borsh */` struct | `Zeroed` now takes Borsh structs (they start empty and are written as Borsh on return). `Signed<…>` is Anchor's `signer` constraint (2002). `Zeroed` now reports an already-set discriminator first, with Anchor's 2013. |
+| `seeds = [multisig.key().as_ref()], bump = multisig.nonce` | `Seeds<Signer, ["@multisig"], "@multisig.nonce">` | A bump stored in another account. |
+| `multisig.owners = owners` | the same, into a `FixedVec<Pubkey, 34>` | A `Vec` argument copied whole into a list in account data. |
+| `TransactionAccount { pubkey, is_signer, is_writable }` | `interface TransactionAccount { pubkey; isSigner; isWritable }` | `isSigner` / `isWritable` were reserved field names everywhere; now only in structs held in an account, where they would shadow `acct.isSigner`. |
+
+## Side by side
+
+The heart of the program, executing an approved transaction:
+
+```rust
+pub fn execute_transaction(ctx: Context<ExecuteTransaction>) -> Result<()> {
+    if ctx.accounts.transaction.did_execute {
+        return Err(ErrorCode::AlreadyExecuted.into());
+    }
+    let sig_count = ctx.accounts.transaction.signers.iter().filter(|&did_sign| *did_sign).count() as u64;
+    if sig_count < ctx.accounts.multisig.threshold {
+        return Err(ErrorCode::NotEnoughSigners.into());
+    }
+    let mut ix: Instruction = (*ctx.accounts.transaction).deref().into();
+    ix.accounts = ix.accounts.iter().map(|acc| {
+        let mut acc = acc.clone();
+        if &acc.pubkey == ctx.accounts.multisig_signer.key {
+            acc.is_signer = true;
+        }
+        acc
+    }).collect();
+    let multisig_key = ctx.accounts.multisig.key();
+    let seeds = &[multisig_key.as_ref(), &[ctx.accounts.multisig.nonce]];
+    let signer = &[&seeds[..]];
+    let accounts = ctx.remaining_accounts;
+    solana_program::program::invoke_signed(&ix, accounts, signer)?;
+    ctx.accounts.transaction.did_execute = true;
+    Ok(())
+}
+```
+
+```ts
+export function executeTransaction(
+  multisig: Account<Multisig>,
+  multisigSigner: Seeds<AccountInfo, ["@multisig"], "@multisig.nonce">,
+  transaction: HasOne<Mut<Transaction>, "multisig">,
+): void {
+  require(multisig.ownerSetSeqno === transaction.ownerSetSeqno, AnchorError.ConstraintRaw);
+  require(!transaction.didExecute, ErrorCode.AlreadyExecuted);
+  let sigCount = 0n;
+  for (const didSign of transaction.signers) if (didSign) sigCount++;
+  require(sigCount >= multisig.threshold, ErrorCode.NotEnoughSigners);
+  const metas: FixedVec<TransactionAccount, 32> = transaction.accounts.map((acc) => ({
+    pubkey: acc.pubkey,
+    isSigner: acc.isSigner || acc.pubkey === multisigSigner.key,
+    isWritable: acc.isWritable,
+  }));
+  invokeInstruction(transaction.programId, metas, transaction.data, remainingAccounts(), [multisig.key, multisig.nonce]);
+  transaction.didExecute = true;
+}
+```
+
+The `#[derive(Accounts)]` structs become parameter types. Anchor's `constraint = multisig.owner_set_seqno ==
+transaction.owner_set_seqno` becomes the first `require`, raising the same 2003. The error enum keeps its order and
+messages, so the codes stay 6000–6008. Account and instruction names and the Borsh layout are the original's, so
+existing clients and existing accounts work with the port unchanged.
+
+## How it was checked
+
+`test/programs/coral_multisig.so` is the program dumped from mainnet on 2026-10-29 (sha256 in
+[`test/programs/SOURCES.md`](../test/programs/SOURCES.md)). The test loads it into one LiteSVM and the port into
+another, both at `msigUdDB…`, then sends each transaction to both. After each one it requires the same outcome (success,
+or the same error down to the code) and the same lamports, owner and data bytes for every account involved.
+
+There are 43 transactions:
+
+- **The upstream test suite** (`tests/multisig.js`): create a 2-of-3 multisig, propose `set_owners`, approve, and
+  execute through the PDA. Then `Assert Unique Owners` (6008).
+- **Every `create_multisig` refusal**: threshold 0 or above the owner count (6007), no owners, the account not signing
+  (2002), not rent-exempt (2005), owned by another program (3007), too small for the empty value (3003) or for the
+  owners (3004), already initialized (2013).
+- **Proposals, approvals and executions**:
+  - a proposer or approver outside the owner set (6000);
+  - another multisig's transaction (2001);
+  - too few approvals (6002);
+  - a wrong PDA (2006);
+  - executing twice (6006);
+  - a changed owner set invalidating a proposal (2003);
+  - `set_owners` sent directly, which the PDA cannot sign (3010);
+  - a Transaction passed as a Multisig (3002);
+  - the target program missing from the remaining accounts (the runtime's error).
+- **Self-calls through `execute_transaction`**:
+  - `change_threshold`;
+  - `set_owners` shrinking the owner set below the threshold, which drops the threshold;
+  - `set_owners_and_change_threshold`;
+  - a threshold too high, which fails inside the CPI and fails the whole execution with 6007.
+- **A real payout**: the PDA sends 1.5 SOL through a System transfer. A stored meta claiming the recipient signed is
+  refused by the runtime under both programs.
+
+## Cost
+
+These are compute units per transaction, original versus port, from that test. Each `execute` figure includes the
+instruction it runs.
+
+| Instruction | Anchor 0.25 (mainnet) | TypeSOL | |
+| --- | ---: | ---: | ---: |
+| `create_multisig` | 3,591 | 564 | −84% |
+| `create_transaction` | 6,591 | 1,077 | −84% |
+| `approve` | 5,515 | 1,003 | −82% |
+| `execute_transaction` → `set_owners` | 15,227 | 4,133 | −73% |
+| `execute_transaction` → `change_threshold` | 14,723 | 3,781 | −74% |
+| `execute_transaction` → `set_owners_and_change_threshold` | 15,129 | 4,095 | −73% |
+| `execute_transaction` → System transfer | 9,961 | 3,182 | −68% |
+
+Refusals cost less too. For example, an already-initialized account costs 3,378 against 160, and a missing signature
+4,229 against 177. The binary is 526,688 bytes on mainnet and 29,984 bytes for the port, 18 times smaller. Deploying it
+needs about 3.5 SOL less rent.
+
+The original was built with Anchor 0.25; a rebuild with a current Anchor would cost less than the mainnet figures. The
+escrow case study and the benchmarks compare against Anchor 1.x.
+
+## Where they differ
+
+- **List capacities.** Anchor's `Vec` fields are bounded only by the account's size. The port's lists are `FixedVec`s:
+  - 34 owners;
+  - 32 accounts and 1,100 data bytes per stored instruction;
+  - 34 approvals.
+
+  A transaction (1,232 bytes) cannot carry more than these, so a client never meets them. A program calling the
+  multisig through a CPI can send more (CPI data may reach 10 KiB). The original would accept that if the account were
+  large enough; the port refuses with 5104. Reading an account the original wrote with more elements fails with 3003.
+- **Check order on one double fault.** In `approve` and `execute_transaction` the original checks the owner-set
+  sequence number (2003) with the multisig account, before the transaction's `has_one` (2001). The port checks
+  `has_one` in the prologue and the sequence number first in the body. So a transaction that belongs to another
+  multisig *and* has a stale sequence number gets 2001 here and 2003 there. A transaction breaking only one of the two
+  gets the same code under both.
+- **Logs.** Error messages are logged in TypeSOL's words and the original's error names are not logged; codes are the
+  same.

package/docs/errors.md

@@ -7,19 +7,20 @@ Framework errors use Anchor's numbers where Anchor has the same check, so client
 | 100 / 101 / 102 | instruction data missing / unknown instruction / malformed arguments (InstructionMissing / FallbackNotFound / DidNotDeserialize) |
 | 2000 | a `Mut<…>` / `Init<…>` account passed read-only (ConstraintMut) |
 | 2001 | HasOne constraint failed (ConstraintHasOne) |
-| 2002 | event authority did not sign (ConstraintSigner) |
+| 2002 | a `Signed<…>` account (or the event authority) did not sign (ConstraintSigner) |
 | 2004 | Owner constraint failed (ConstraintOwner) |
 | 2005 | Zeroed account is not rent-exempt (ConstraintRentExempt) |
 | 2006 | PDA seeds mismatch (ConstraintSeeds) |
 | 2007 | Executable constraint failed (ConstraintExecutable) |
 | 2009 | not the associated token account (ConstraintAssociated) |
 | 2012 | not the expected address (ConstraintAddress) |
+| 2013 | a `Zeroed<…>` account whose discriminator is already set (ConstraintZero; checked before its owner, as under Anchor) |
 | 2014 / 2015 | token account mint / owner mismatch (ConstraintTokenMint / ConstraintTokenOwner) |
 | 2016 / 2017 / 2018 | mint authority / freeze authority / decimals mismatch (2018: an existing mint `createIfNeeded` found) |
 | 2021 / 2022 | token account / mint not owned by the token program `TokenOf` / `MintOf` names (ConstraintTokenTokenProgram / ConstraintMintTokenProgram) |
 | 2024–2039 | an existing mint `createIfNeeded` found lacks a Token-2022 extension it was given, or holds other keys in it: group pointer 2024–2026, group member pointer 2027–2029, metadata pointer 2030–2032, close authority 2033–2034, permanent delegate 2035–2036, transfer hook 2037–2039 (the first code of each: the extension is missing; the next: the authority / address differs) (ConstraintMint…Extension…) |
 | 2040 | the same account passed in two writable slots (ConstraintDuplicateMutableAccount) |
-| 3000 | account already exists / initialized (AccountDiscriminatorAlreadySet) |
+| 3000 | account already exists (AccountDiscriminatorAlreadySet; an `Init` account) |
 | 3002 | discriminator mismatch (AccountDiscriminatorMismatch) |
 | 3003 | data too small, not an initialized token account / mint, a read past the end, or a `@layout borsh` account whose bytes are not a valid Borsh value (AccountDidNotDeserialize) |
 | 3004 | a `@layout borsh` account too small for the value it would now hold (AccountDidNotSerialize) |

package/docs/language.md

@@ -25,8 +25,8 @@ The full reference. For a tour, start with the [README](../README.md).
 | Enums | `export enum Status { Pending, Approved }` — unit variants stored as the Borsh u8 index; `Status.Approved`, `===` |
 | Options | `best: Option<u64>` (or `u64 \| null`) — `null`, `=== null`, TypeScript narrowing; `===` between options or with a value follows JS (null equals null, empty never equals a value); empty use aborts (5108); `acct?.field` on an optional account and `x.home?.field` on an `Option<struct>` give an Option (empty when the account was left out / the option is empty), `a ?? b` takes b only when a is empty (b runs only then; the result is an Option when b can be null), `x!` is the value or aborts with 5108; `${opt}` prints the value or `null`. Borsh `option` in arguments/events, fixed `{ is_some, value }` in account data |
 | Vecs | `entries: Vec<Entry>` in account data, any number of them, declared anywhere: they are stored after the fixed-size fields in the order declared (so every other field keeps its offset; the IDL lists that order), and a push, pop or clear moves the Vecs after it (a reference into one of those cannot be used across it). In a `@layout borsh` struct a Vec is the last field (Anchor's order) — `get`, `set`, `push(v, payer)`, `pop()`, `clear()`, `.length`; the account is resized (realloc) and rent topped up by `payer`; `Vec<u64>` arguments are read-only views; `Vec<string>` arguments (Anchor's `Vec<String>`) are views of the instruction data, each checked as UTF-8 on entry (102), and go back out as Borsh through `invoke`; `pop()` of a Vec of structs works as a statement |
-| Anchor's account bytes | `/** @layout borsh */` on an account struct stores it as Anchor does (Borsh: a `FixedString<N>` is a String, a `FixedVec<T, N>` a Vec, an `Option` one byte when empty, and the fields after them move), so a TypeSOL program can take over accounts an Anchor program wrote and the IDL lists Anchor's own types. The instruction unpacks it into the usual fixed layout when it starts (bad bytes fail with 3003) and packs it back when it returns (3004 when the account is too small for the new value), so everything else works on it unchanged. Programs invoked from the body (CPIs) see the account's bytes as they were when the instruction started. Costs more compute than the fixed layout (the whole account is read and written each time; see the benchmarks); nested structs and list elements must be fixed-size (FixedString elements allowed). The same struct is Borsh as a whole instruction argument (checked like Borsh deserialization, UTF-8 included), as return data and as an event; as those (not as account data) it may also hold `string` fields and data enums carrying strings, Anchor's `String` and enums in argument structs (account data takes data enums without strings); not inside list or enum arguments, `Zeroed<T>`, `loadAccount` or a growable `Vec<T>` |
-| Fixed-capacity lists | `owners: FixedVec<Pubkey, 8>` — any field, any number of them, in nested structs too: a u32 length and room for N elements (always 4 + N × size bytes), the same `get`, `set`, `push(v)`, `pop()`, `clear()`, `.length` and `for … of`; `push` on a full one fails (5104); `acct.owners = fixedVec([a, b])` writes a whole one (unused slots zeroed). In account data, returned structs and events; as an argument (`ids: FixedVec<u64, 8>`) it is a Borsh Vec of at most N elements, read like a `Vec` argument (more fail with 102) |
+| Anchor's account bytes | `/** @layout borsh */` on an account struct stores it as Anchor does (Borsh: a `FixedString<N>` is a String, a `FixedVec<T, N>` a Vec, an `Option` one byte when empty, and the fields after them move), so a TypeSOL program can take over accounts an Anchor program wrote and the IDL lists Anchor's own types. The instruction unpacks it into the usual fixed layout when it starts (bad bytes fail with 3003) and packs it back when it returns (3004 when the account is too small for the new value), so everything else works on it unchanged. Programs invoked from the body (CPIs) see the account's bytes as they were when the instruction started. Costs more compute than the fixed layout (the whole account is read and written each time; see the benchmarks); nested structs and list elements must be fixed-size (FixedString elements allowed). The same struct is Borsh as a whole instruction argument (checked like Borsh deserialization, UTF-8 included), as return data and as an event; as those (not as account data) it may also hold `string` fields and data enums carrying strings, Anchor's `String` and enums in argument structs (account data takes data enums without strings); not inside list or enum arguments, `loadAccount` or a growable `Vec<T>` |
+| Fixed-capacity lists | `owners: FixedVec<Pubkey, 8>` — any field, any number of them, in nested structs too: a u32 length and room for N elements (always 4 + N × size bytes), the same `get`, `set`, `push(v)`, `pop()`, `clear()`, `.length` and `for … of`; `push` on a full one fails (5104); `acct.owners = fixedVec([a, b])` writes a whole one (unused slots zeroed), and `acct.owners = owners` copies a `Vec` argument (or another list of the same elements) into it, Anchor's `multisig.owners = owners` (more than N fail with 5104). In account data, returned structs and events; as an argument (`ids: FixedVec<u64, 8>`) it is a Borsh Vec of at most N elements, read like a `Vec` argument (more fail with 102) |
 | Struct arguments | `order: Order`, `ids: FixedArray<u8, 4>`, `orders: Vec<Order>` — fixed layouts, Borsh-identical, validated on entry (bools, enums, option tags, string lengths, enum tags; 102) and read-only. A struct holding a FixedVec that is only ever an argument is read as Anchor sends it (its FixedVec a Borsh Vec, as `@layout borsh`) |
 | Remaining accounts | `remainingAccounts()` — `.length`, `.get(i)` → `key`, `owner`, `lamports` (writes check writability), `isSigner`, `isWritable`; `loadAccount<T>` / `loadAccountMut<T>` give checked struct views; pass them to `invoke`, one at a time or spread: `...remainingAccounts()` (each with the flags it was passed with), `...readonly(rest)` / `...writable(rest)` (all with that role), `rest.slice(a, b)` for part of them; a CPI lists at most 32 accounts (5113) |
 | Struct literals | `book.entries.push({ who: who.key, amount, status: Status.Pending, note }, who)` — every field required |
@@ -66,7 +66,7 @@ The full reference. For a tour, start with the [README](../README.md).
 | `Account<T>` / `Mut<T>` | owned by this program, 8-byte discriminator matches, data large enough (and writable) |
 | `Init<T>` | writable; `create(payer, seeds)` derives the PDA, verifies it, funds rent, writes the discriminator (up to 10 KiB); `create(payer, null)` creates a new keypair account that signs the transaction instead (3010 if it did not; a signer in the IDL); a third argument is Anchor's `space = …` (discriminator included, at least 8 + the struct's size) |
 | `InitIfNeeded<T>` | `const created = acct.createIfNeeded(payer, seeds)` — creates once; afterwards re-derives the PDA and checks owner, discriminator and size (Anchor `init_if_needed`); `acct.pdaBump` after create. An existing account is used as it is: check the fields you rely on |
-| `HasOne<A, "owner">`, `Seeds<A, ["vault", "@owner"], "bump">`, `CloseTo<A, "owner">` | declarative constraints like Anchor's `has_one`, `seeds`/`bump` and `close`: checked before the body (2001 / 2006), close runs when the instruction succeeds; `"@name"` = account key or argument bytes, `"@acct.field"` = a Pubkey, integer or unit enum field of a struct account parameter (also the account's own: `["offer", "@maker", "@offer.id"]`), other strings are literals; recorded as `relations` / `pda` in the IDL. `acct.pdaBump` is the bump (Anchor `ctx.bumps.acct`): the stored field when one is named, else the canonical bump the check found — use it to sign as the PDA |
+| `HasOne<A, "owner">`, `Seeds<A, ["vault", "@owner"], "bump">`, `CloseTo<A, "owner">` | declarative constraints like Anchor's `has_one`, `seeds`/`bump` and `close`: checked before the body (2001 / 2006), close runs when the instruction succeeds; `"@name"` = account key or argument bytes, `"@acct.field"` = a Pubkey, integer or unit enum field of a struct account parameter (also the account's own: `["offer", "@maker", "@offer.id"]`), other strings are literals; recorded as `relations` / `pda` in the IDL. a bump stored in another struct account is named `"@acct.field"` (Anchor `bump = multisig.nonce`); `acct.pdaBump` is the bump (Anchor `ctx.bumps.acct`): the stored field when one is named, else the canonical bump the check found — use it to sign as the PDA |
 | `HasOne<TokenAccount, "mint" \| "owner">`, `HasOne<Mint, "mintAuthority" \| "freezeAuthority">` | token constraints (2014 / 2015 / 2016 / 2017) against the parameter with that name; `TokenOf<TokenAccount, "mintParam", "authorityParam", "tokenProgramParam">` / `MintOf<Mint, "authorityParam", "freezeParam", "tokenProgramParam">` name the parameters, as Anchor's `token::mint = …` / `mint::authority = …` / `…::token_program = …` do (`never` leaves one out; the token program one: owned by that token program, 2021 / 2022) |
 | `Ata<TokenAccount, "owner", "mint">` | the account is the associated token account of those parameters (2009; ATA `pda` in the IDL) |
 | `Ata<Init<TokenAccount>, "owner", "mint">`, `Ata<InitIfNeeded<TokenAccount>, "owner", "mint">` | Anchor `init` / `init_if_needed` with `associated_token::…`: `acct.create(payer)` creates the ATA (fails if it exists); `const created = acct.createIfNeeded(payer)` creates it only when missing, otherwise checks it is that ATA (2009). Then it is a `TokenAccount` of that mint and owner (2014 / 2015). Needs `AssociatedTokenProgram`, `SystemProgram` and a token program parameter; call it at the top level before using the account |
@@ -77,7 +77,8 @@ The full reference. For a tour, start with the [README](../README.md).
 | `ProgramData` | this program's ProgramData (address derived from the program id, upgradeable-loader owner and state checked); `upgradeAuthority`, `deploySlot` — gate admin setup on `programData.upgradeAuthority === admin.key` |
 | `EventAuthority`, `SelfProgram` | Anchor's `["__event_authority"]` PDA, and this program's own address, for `emitCpi` |
 | `Migrate<From, To>` | Anchor 1.0's `Migration`: an existing `From` account (owner, discriminator, size) rewritten as `To` by `acct.migrate(payer, value)`, a top-level statement the instruction must reach. `acct.from` (read-only) before it, `acct.to` after; the value is built in full before the rewrite, so it may read `acct.from`. Resized to `To` (the payer tops up rent when it grows, at most 10 KiB; shrinking keeps the lamports; growing needs `SystemProgram`). Fixed-layout structs without growable Vecs; no constraints yet; the account cannot be passed to a helper (use `acct.to` fields in the instruction). An account already migrated fails with 3002. Keep the old struct under a new name with its discriminator: `/** @discriminator account:Counter */ interface CounterV1 { … }` |
-| `Zeroed<T>` | large accounts (up to 10 MiB) the client allocated with System `CreateAccount`: owned by this program, big enough, rent-exempt, discriminator still zero — then initialized; like Anchor's zero-copy `zero` |
+| `Zeroed<T>` | accounts (up to 10 MiB) the client allocated with System `CreateAccount`, Anchor's `zero`: discriminator still zero (2013, checked first as under Anchor), owned by this program, big enough, rent-exempt — then initialized. A `@layout borsh` struct starts empty and is written as Borsh when the instruction returns |
+| `Signed<A>` | the account must sign the transaction (Anchor's `signer` constraint, 2002), e.g. `Signed<Zeroed<Multisig>>` for an account the client creates with a fresh keypair; the IDL marks it a signer |
 | `Init<Mint>`, `InitIfNeeded<Mint>` | Anchor `init` / `init_if_needed` with `mint::decimals` / `mint::authority` / `mint::freeze_authority`: `const bump = mint.create(payer, ["mint", payer.key], 6n, authority, freezeAuthority \| null)` creates the mint at that PDA of this program, or with `null` seeds as a new keypair account that signs (3010 if it did not), under the instruction's token program (its only token program parameter, or one passed as the last argument of `create` / `createIfNeeded`; plus `SystemProgram`). Token-2022 extensions (Anchor's `extensions::…`) go after the freeze authority: `mint.create(payer, null, 6n, authority, null, { metadataPointer: { authority, metadataAddress: mint.key }, transferHook: { authority, programId }, closeAuthority, permanentDelegate, nonTransferable: true, defaultAccountState: true, interestBearing: { rateAuthority, rate }, transferFee: { configAuthority, withdrawAuthority, basisPoints, maximumFee }, groupPointer, groupMemberPointer })` sizes the mint for them and initializes each before InitializeMint2. With `createIfNeeded` an existing mint must carry groupPointer / groupMemberPointer / metadataPointer / closeAuthority / permanentDelegate / transferHook with those keys (Anchor's 2024–2039); extensions not listed are not looked at, so an existing mint may carry others (a permanent delegate, say). `createIfNeeded(…)` returns whether it created it; an existing one must be that PDA and have those decimals and authorities (2018 / 2016 / 2017) |
 | `Init<TokenAccount>`, `InitIfNeeded<TokenAccount>` (no `Ata<…>`) | Anchor `init` / `init_if_needed` with `token::mint` / `token::authority`: `vault.create(payer, ["vault", mint.key], mint, authority)` (the authority may be `vault.key` itself) creates a token account at that PDA (or a keypair account with `null`), sized for the mint's extensions under Token-2022. `createIfNeeded` checks an existing one has that mint and owner (2014 / 2015), not its delegate or close authority (as Anchor) |
 | `TokenAccount` / `Mut<TokenAccount>` | owned by SPL Token or Token-2022 (extensions allowed, multisig accounts refused), initialized; `mint`, `owner`, `amount`, `delegate`, `delegatedAmount`, `isFrozen`, `isNative`, `closeAuthority`, `tokenProgram` |
@@ -151,6 +152,20 @@ export function payOut(admin: Signer, treasury: Mut<SystemAccount>, recipient: M
 - `signerSeeds` (with the bump) signs for this program's PDA.
 - After the call, `returnData<u64>(program)` reads what the callee returned, checking the size and that it came from `program`.
 
+A call decided at run time, such as one a multisig stored in account data, is `invokeInstruction` (Rust's
+`invoke_signed(&Instruction { program_id, accounts, data }, infos, seeds)`):
+
+```ts
+invokeInstruction(transaction.programId, transaction.accounts, transaction.data, remainingAccounts(), [multisig.key, multisig.nonce]);
+```
+
+- the accounts are a list of structs with `pubkey`, `isSigner` and `isWritable` (a Vec or FixedVec in account data, a
+  Vec argument, or a stored `map` result); the data a list of u8.
+- every account in the fourth argument (`remainingAccounts()` or a slice) is handed to the runtime, which finds each
+  meta's account there by key: one that is missing fails the call, as under Rust.
+- the runtime checks the privileges: a meta may be a signer or writable only as the transaction passed that account,
+  or as a PDA of this program the seeds (fifth argument) sign for. See `examples/multisig.ts`.
+
 Typed calls from an IDL: `typesol cpi other.json --out other_cpi.ts` writes one helper per instruction
 (`vaultDeposit(program, owner, vault, systemProgram, amount, seeds)`), with the account flags, discriminator and
 argument encoding taken from the IDL (Anchor 0.30+ / 1.x, or TypeSOL's own). Call it with `signer([...seeds, bump])`

package/docs/migrate-from-anchor.md

@@ -49,6 +49,9 @@ and error codes. Its notes (on stderr) list what an existing Anchor client would
 | `Migration<'info, From, To>` | `Migrate<From, To>`, then `acct.migrate(payer, value)`; the old struct keeps its on-chain discriminator with `/** @discriminator account:<OldName> */` |
 | `#[account(discriminator = …)]` | `/** @discriminator <preimage or 0x8 bytes> */` on the struct |
 | `AccountLoader<T>` with `#[account(zero)]` | `Zeroed<T>` (TypeSOL reads every account in place: no copy to avoid) |
+| `Account<T>` with `#[account(zero)]` (Borsh) | `Zeroed<T>` of a `/** @layout borsh */` struct |
+| `#[account(signer)]` on a non-`Signer` account | `Signed<A>`, e.g. `Signed<Zeroed<Multisig>>` |
+| `seeds = [multisig.key().as_ref()], bump = multisig.nonce` | `Seeds<A, ["@multisig"], "@multisig.nonce">` |
 | `Program<'info, System>` | `SystemProgram` |
 | `Program<'info, Token>` / `Token2022` / `Interface<'info, TokenInterface>` | `TokenProgram` / `Token2022Program` / `TokenInterface` |
 | `Account<'info, TokenAccount>` / `Account<'info, Mint>` (`InterfaceAccount`) | `TokenAccount` / `Mint` (`Mut<…>` when written) |
@@ -108,6 +111,8 @@ Anchor instruction that takes or returns a struct with `String` / `Vec` / `Optio
 | `system_program::transfer(CpiContext::new(…), lamports)` | `systemProgram.transfer(from, to, lamports)` |
 | `token::transfer_checked(CpiContext::new_with_signer(…, seeds), amount, decimals)` | `tokenProgram.transferChecked(from, mint, to, authority, amount, ["seed", key, bump])` |
 | `invoke_signed(&ix, &accounts, &[seeds])` | `invoke(program, [writable(a), readonly(b)], [data…], seeds)` |
+| `invoke_signed(&Instruction { program_id, accounts, data }, ctx.remaining_accounts, …)` built at run time | `invokeInstruction(programId, metas, data, remainingAccounts(), seeds)` |
+| `multisig.owners = owners` (a `Vec` argument into account data) | the same, into a `FixedVec<Pubkey, N>` |
 | `declare_program!(other)` / CPI to another Anchor program | `typesol cpi other.json` generates typed helpers |
 | `for x in v.iter()` | `for (const x of v)` |
 | `v.iter().any(\|x\| …)`, `.all`, `.position`, `.find`, `.fold(init, …)`, `.contains(&x)` | `v.some((x) => …)`, `every`, `findIndex`, `find`, `reduce((acc, x) => …, init)`, `includes(x)` |

package/docs/security-model.md

@@ -65,6 +65,10 @@ Each holds for every instruction of every program the compiler accepts. A break
 12. **CPIs.** A program signs only for its own PDAs (the runtime enforces it; the seeds are those written in the
     source). `invoke` marks an account writable or signer only when the parameter is `Mut` / `Signer` or the program
     signs for it; remaining accounts keep the flags they were passed with, or are checked for the role requested.
+    `invokeInstruction` is the exception by design: its program, account flags and data come from values (stored in
+    account data or passed in), so the compiler cannot check them; the runtime does, refusing any account the
+    transaction did not pass that way and any signer the program's seeds do not cover. Only programs that store
+    instructions to run (a multisig, a DAO) need it; review who can write those values.
     Return data is read only from the program named, at the expected size (5106).
 13. **Events.** `emitCpi` is accepted only from this program's event-authority PDA, signed (2002).
 

package/lib/typesol.d.ts

@@ -123,7 +123,8 @@ export interface FixedVec<T, N extends number> extends ListMethods<T> {
   readonly length: u64;
   get(index: bigint): T;
   set(index: bigint, value: T): void;
-  push(value: T): void;
+  // `...rest: never[]` takes nothing, but lets a Vec (whose push takes a payer) be assigned to a FixedVec: `acct.owners = owners`.
+  push(value: T, ...rest: never[]): void;
   pop(): T;
   clear(): void;
   [Symbol.iterator](): Iterator<T>;
@@ -636,6 +637,11 @@ export type MintOf<A, AuthorityParam extends string, FreezeAuthorityParam extend
  * what you need before writing. Not for accounts that are created, closed, a close destination or `@layout borsh`.
  */
 export type Dup<A> = A & { readonly __dup?: true };
+/**
+ * The account must sign the transaction (Anchor's `signer` constraint on an account that is not a `Signer`; 2002), e.g.
+ * `Signed<Zeroed<Multisig>>` for an account the client creates with a fresh keypair in the same transaction.
+ */
+export type Signed<A> = A & { readonly __signed?: true };
 /**
  * Anchor 1.0's `Migration<From, To>`: an existing `From` account (owner, discriminator and size checked) that this
  * instruction rewrites as `To` with `acct.migrate(payer, value)`, a top-level statement every path must reach. Read
@@ -1379,9 +1385,10 @@ export type Init<T> = T extends TokenAccount
         };
 
 /**
- * A large account (over 10 KiB, up to 10 MiB) the client already allocated with System CreateAccount,
- * owned by this program and still zeroed. Owner, size, rent exemption and emptiness are checked, then
- * the discriminator is written: from here on it is a `Mut<T>`. Same idea as Anchor's zero-copy `zero`.
+ * An account the client already allocated with System CreateAccount (any size up to 10 MiB; over 10 KiB a program
+ * cannot create it itself), owned by this program and still zeroed: Anchor's `zero`. Emptiness (2013), owner, size and
+ * rent exemption are checked, then the discriminator is written: from here on it is a `Mut<T>`. A `@layout borsh`
+ * struct starts empty (lists and strings empty, Options None) and is written as Borsh when the instruction returns.
  */
 export type Zeroed<T> = T & AccountMeta;
 
@@ -1610,6 +1617,32 @@ export declare function invoke(
   signerSeeds?: Seed[] | SignerSeeds,
 ): void;
 
+/** One account of an instruction built at run time (Rust's `AccountMeta`): any struct with these three fields. */
+export interface InstructionAccountMeta {
+  readonly pubkey: Pubkey;
+  readonly isSigner: boolean;
+  readonly isWritable: boolean;
+}
+/** A list read by index: a Vec or FixedVec in account data, a Vec argument, or a stored local list. */
+export interface IndexedList<T> {
+  readonly length: u64;
+  get(index: bigint): T;
+}
+/**
+ * A CPI decided at run time, e.g. one stored in account data (Rust's `invoke_signed(&Instruction { program_id,
+ * accounts, data }, infos, seeds)`). Every account in `infos` (`remainingAccounts()` or a slice of it) is handed to the
+ * runtime, which finds each meta's account there by key: one that is missing fails the CPI, as under Rust. A meta may
+ * be a signer or writable only as the transaction passed that account, or as a PDA of this program `signerSeeds` sign
+ * for (`signer([multisig.key, multisig.nonce])`).
+ */
+export declare function invokeInstruction(
+  programId: Pubkey,
+  accounts: IndexedList<InstructionAccountMeta>,
+  data: IndexedList<u8>,
+  infos: RemainingAccounts | RemainingSlice,
+  signerSeeds?: Seed[] | SignerSeeds,
+): void;
+
 /**
  * Anchor's own error codes (anchor-lang `ErrorCode`): `require(condition, AnchorError.AccountDidNotDeserialize)` fails
  * with that code, as `require!(condition, ErrorCode::AccountDidNotDeserialize)` does. Not listed in the IDL's errors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typesol/cli",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Compile a TypeScript-syntax language directly to Solana SBF programs.",
   "type": "module",
   "license": "MIT",

package/runtime/typesol_rt.h

@@ -27,6 +27,7 @@
 #define TS_ERR_CONSTRAINT_EXECUTABLE 2007  /* ConstraintExecutable */
 #define TS_ERR_ASSOCIATED 2009             /* ConstraintAssociated */
 #define TS_ERR_ADDRESS 2012                /* ConstraintAddress */
+#define TS_ERR_CONSTRAINT_ZERO 2013        /* ConstraintZero */
 #define TS_ERR_TOKEN_MINT 2014             /* ConstraintTokenMint */
 #define TS_ERR_TOKEN_OWNER 2015            /* ConstraintTokenOwner */
 #define TS_ERR_MINT_AUTHORITY 2016         /* ConstraintMintMintAuthority */
@@ -654,10 +655,15 @@ static inline uint64_t ts_now(int64_t *out) {
  * to this program. It must be writable, rent-exempt, big enough and still all-zero in its discriminator;
  * the discriminator is written here so the account can never be initialized twice.
  */
-static inline uint64_t ts_init_zeroed(TsAccount *a, const SolPubkey *program_id, const uint8_t disc[8], uint64_t size) {
+/* Zeroed<T> (Anchor's `zero`), in Anchor's order: a discriminator already set (2013), then owner and size as the
+ * account type checks them; the rent check and the discriminator write come after the mut / signer checks. */
+static inline uint64_t ts_check_zeroed(const TsAccount *a, const SolPubkey *program_id, uint64_t size) {
+  if (a->data_len >= 8 && ts_ld64(a->data) != 0) TS_FAIL(TS_ERR_CONSTRAINT_ZERO, "TypeSOL: account already initialized");
   if (!ts_key_eq(&a->owner, program_id)) TS_FAIL(TS_ERR_WRONG_OWNER, "TypeSOL: account not owned by this program");
   if (a->data_len < 8 + size) TS_FAIL(TS_ERR_ACCOUNT_TOO_SMALL, "TypeSOL: account data too small");
-  if (ts_ld64(a->data) != 0) TS_FAIL(TS_ERR_ALREADY_INITIALIZED, "TypeSOL: account already initialized");
+  return SUCCESS;
+}
+static inline uint64_t ts_init_zeroed(TsAccount *a, const uint8_t disc[8]) {
   uint64_t need;
   TS_TRY(ts_minimum_balance(a->data_len, &need));
   if (a->lamports < need) TS_FAIL(TS_ERR_NOT_RENT_EXEMPT, "TypeSOL: account is not rent-exempt");