openzoo 0.51.0 → 0.51.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.51.0",
+  "version": "0.51.2",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun \u2014 point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental. `openzoo build|deploy|serve|hub` transmute a Vercel-shaped app (Next.js / Vite + /api) into a Pinocchio program + asset accounts on Solana mainnet.",
   "license": "MIT",
   "type": "module",

package/transmute/lib/build.js

@@ -150,7 +150,7 @@ export async function estimateCost({ staticFiles = [], soSize = null, manifestBy
     if (upgrade) items.push({ label: 'program upgrade buffer (refunded on success)', kind: 'buffer', bytes: accountBytesFor('buffer', soSize), transient: true });
     else {
       items.push({ label: 'program account', kind: 'program', bytes: accountBytesFor('program', 0) });
-      items.push({ label: `program data (2×.so = ${(soSize * 2).toLocaleString()} B)`, kind: 'programdata', bytes: accountBytesFor('programdata', soSize * 2) });
+      items.push({ label: `program data (.so = ${soSize.toLocaleString()} B)`, kind: 'programdata', bytes: accountBytesFor('programdata', soSize) });
     }
   } else {
     items.push({ label: 'program (no .so built yet)', kind: 'program', bytes: 0, unknown: true });

package/transmute/lib/cli.js

@@ -26,7 +26,7 @@ export const USAGE = `openzoo-transmute — Vercel app → Solana program + asse
 usage:
   openzoo-transmute build   [dir] [--out .zoo-out] [--name <crate>] [--arch v0|v3] [--cluster <c>] [--skip-cargo]
   openzoo-transmute deploy  [dir|outDir] [--cluster mainnet|devnet|localnet|<url>] [--keypair <path>] [--yes] [--program <id>]
-                            [--concurrency 4] [--skip-assets] [--force]
+                            [--concurrency 4] [--skip-assets] [--force] [--headroom 1.5]
   openzoo-transmute serve   <programId> [--cluster <c>] [--port ${DEFAULT_PORT}] [--keypair <path>] [--host 127.0.0.1] [--quiet]
   openzoo-transmute hub     [--cluster mainnet] [--port 8080] [--host 0.0.0.0] [--public-url <https://…>]
                             hosted explorer for EVERY program on the cluster (/s/<programId>), read-only
@@ -198,8 +198,14 @@ async function cmdHub(p, f, log) {
   // The hosted explorer: every program on the cluster from one public host,
   // read-only by default (a public signer would be a drain). --keypair opts in.
   const cluster = f.cluster || process.env.OPENZOO_CLUSTER || 'mainnet';
+  // A signer makes the demo real (visitors can POST). It is bounded: a per-IP
+  // rate limit and a daily SOL budget (OPENZOO_HUB_WRITE_BUDGET_SOL), so a
+  // public hub can sign without being drained. Keypair from --keypair or the
+  // OPENZOO_HUB_KEYPAIR secret (JSON byte array).
   let keypair = null;
-  if (typeof f.keypair === 'string') { keypair = loadWallet({ keypair: f.keypair }).keypair; log(`warning: this hub signs writes with ${keypair.publicKey.toBase58()} for anyone who can reach it`); }
+  if (typeof f.keypair === 'string') keypair = loadWallet({ keypair: f.keypair }).keypair;
+  else if (process.env.OPENZOO_HUB_KEYPAIR) { const { Keypair } = await import('@solana/web3.js'); keypair = Keypair.fromSecretKey(Uint8Array.from(JSON.parse(process.env.OPENZOO_HUB_KEYPAIR))); }
+  if (keypair) log(`hub signs writes with ${keypair.publicKey.toBase58()} (budget ${process.env.OPENZOO_HUB_WRITE_BUDGET_SOL || '0.05'} SOL/day, ${process.env.OPENZOO_HUB_WRITES_PER_MIN || '3'} writes/min/ip)`);
   const port = f.port != null ? Number(f.port) : Number(process.env.PORT || DEFAULT_HUB_PORT);
   const h = await startHub({ cluster, port, host: f.host || '0.0.0.0', keypair, log, quiet: !!f.quiet, publicUrl: f.publicUrl || process.env.OPENZOO_HUB_URL || null, maxSites: f.maxSites ? Number(f.maxSites) : undefined });
   log(`openzoo hub → ${h.url}/.hub  (cluster ${cluster}; sites at ${h.url}/s/<programId>)`);

package/transmute/lib/compile/rust.js

@@ -741,10 +741,14 @@ libm = "0.2"
 zoo-host = { path = ${JSON.stringify(runtimePath)} }
 
 [profile.release]
-overflow-checks = false
+# Size is rent: every KB of program is ~0.007 SOL on mainnet.
+opt-level = "z"
 lto = "fat"
 codegen-units = 1
-opt-level = 3
+panic = "abort"
+strip = true
+debug = false
+overflow-checks = false
 `;
   const envTable = env.map(([k, v]) => `(${rustStr(k)}, ${rustStr(v)})`).join(', ');
   const routesTable = Array.from({ length: routeCount }, (_, i) => `route_${i}`).join(', ');

package/transmute/lib/deploy.js

@@ -159,7 +159,7 @@ export async function deploy(o = {}) {
     signatures.program = r.signature;
     log(`upgraded ${programId.toBase58()} in ${((Date.now() - t0) / 1000).toFixed(1)}s (${r.signature})`);
   } else {
-    const r = await deployProgram(connection, { payer, programKeypair, so, onProgress });
+    const r = await deployProgram(connection, { payer, programKeypair, so, onProgress, headroom: o.headroom ? Number(o.headroom) : 1 });
     signatures.program = r.signature;
     log(`deployed ${programId.toBase58()} in ${((Date.now() - t0) / 1000).toFixed(1)}s (${r.signature}); max data len ${r.maxDataLen.toLocaleString()} B`);
   }

package/transmute/lib/hub.js

@@ -78,12 +78,33 @@ export function makeHub(o = {}) {
     log: o.log ?? (() => {}),
     makeSite: o.makeSite ?? null,
     startedAt: Date.now(),
-    stats: { requests: 0, sitesLoaded: 0 },
+    stats: { requests: 0, sitesLoaded: 0, writes: 0, writesRefused: 0, spentLamports: 0 },
     publicUrl: o.publicUrl || null,
+    // write governor: per-IP token bucket + a daily lamport budget for the signer
+    writesPerMin: o.writesPerMin ?? Number(process.env.OPENZOO_HUB_WRITES_PER_MIN || 3),
+    budgetLamports: Math.round((o.writeBudgetSol ?? Number(process.env.OPENZOO_HUB_WRITE_BUDGET_SOL || 0.05)) * 1e9),
+    ipHits: new Map(),
+    dayStart: Date.now(),
   };
   return hub;
 }
 
+const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+
+/** Allow a signed write? Refills per minute per IP; budget resets daily. */
+export function allowWrite(hub, ip, now = Date.now()) {
+  if (!hub.keypair) return { ok: false, reason: 'no signer' };
+  if (now - hub.dayStart > 86_400_000) { hub.dayStart = now; hub.stats.spentLamports = 0; }
+  if (hub.stats.spentLamports >= hub.budgetLamports) return { ok: false, reason: 'daily write budget spent' };
+  const key = ip || 'unknown';
+  const win = hub.ipHits.get(key) || { t: now, n: 0 };
+  if (now - win.t > 60_000) { win.t = now; win.n = 0; }
+  if (win.n >= hub.writesPerMin) return { ok: false, reason: `rate limit: ${hub.writesPerMin} writes/min` };
+  win.n++; hub.ipHits.set(key, win);
+  if (hub.ipHits.size > 10_000) hub.ipHits.clear();
+  return { ok: true };
+}
+
 async function siteFor(hub, programId) {
   const hit = hub.sites.get(programId);
   if (hit) {
@@ -215,7 +236,17 @@ export async function handleHub(hub, req) {
   if (state.noManifest && (rest === '/' || rest === MANIFEST_PATH)) {
     return json(404, { error: 'no site at this program id', program: target, hint: `no manifest at ${MANIFEST_PATH}; is this an openzoo-transmute deployment on ${hub.cluster}?` }, pin ? { 'set-cookie': setCookie(target) } : {});
   }
+  if (!READ_METHODS.includes(method) && hub.keypair) {
+    const gate = allowWrite(hub, req.remoteAddress || req.headers?.['fly-client-ip'] || req.headers?.['x-forwarded-for']);
+    if (!gate.ok) { hub.stats.writesRefused++; return json(429, { error: 'write refused', reason: gate.reason, hint: 'run `npx openzoo serve <programId>` locally to write with your own wallet' }, { 'x-zoo-site': target }); }
+  }
+  const before = hub.keypair && !READ_METHODS.includes(method) ? await hub.connection.getBalance(hub.keypair.publicKey).catch(() => null) : null;
   const r = await handleRequest(state, { ...req, method, url: rest + (url.search || '') });
+  if (before != null) {
+    hub.stats.writes++;
+    const after = await hub.connection.getBalance(hub.keypair.publicKey).catch(() => before);
+    hub.stats.spentLamports += Math.max(0, before - after);
+  }
   const headers = { ...(r.headers || {}), 'x-zoo-site': target };
   if (pin) headers['set-cookie'] = setCookie(target);
   return { ...r, headers };

package/transmute/lib/solana.js

@@ -102,12 +102,14 @@ async function writeBuffer(connection, payer, authority, so, { onProgress } = {}
 
 /**
  * Deploy `so` as a new upgradeable program. Returns {programId, signature}.
- * `maxDataLen` defaults to 2× the binary so later upgrades can grow.
+ * `maxDataLen` defaults to the binary's exact size (rent is per byte; an
+ * upgrade that grows the program redeploys to a new id). Pass `headroom`
+ * (a multiplier) or `maxDataLen` to reserve room for in-place upgrades.
  */
-export async function deployProgram(connection, { payer, authority = payer, programKeypair = Keypair.generate(), so, maxDataLen, onProgress }) {
+export async function deployProgram(connection, { payer, authority = payer, programKeypair = Keypair.generate(), so, maxDataLen, headroom = 1, onProgress }) {
   const buffer = await writeBuffer(connection, payer, authority, so, { onProgress });
   const programLamports = await connection.getMinimumBalanceForRentExemption(36);
-  const max = maxDataLen || so.length * 2;
+  const max = maxDataLen || Math.ceil(so.length * Math.max(1, headroom));
   const programData = programDataPda(programKeypair.publicKey);
   const sig = await sendTx(connection, [
     SystemProgram.createAccount({ fromPubkey: payer.publicKey, newAccountPubkey: programKeypair.publicKey, lamports: programLamports, space: 36, programId: BPF_LOADER_UPGRADEABLE }),

package/transmute/runtime/zoo-host/Cargo.toml

@@ -23,6 +23,8 @@ solana-sha256-hasher = { version = "3", features = ["sha2"] }
 
 [features]
 default = []
+# Transcendental Math.* (log/exp/trig) and non-integer `**`: +7 KB of libm.
+mathx = []
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(target_os, values("solana"))'] }

package/transmute/runtime/zoo-host/src/assets.rs

@@ -60,7 +60,8 @@ fn split_hash(data: &[u8]) -> Result<(&[u8; 32], &[u8]), ProgramError> {
         return Err(ProgramError::InvalidInstructionData);
     }
     let (h, rest) = data.split_at(32);
-    Ok((h.try_into().unwrap(), rest))
+    let h: &[u8; 32] = match h.try_into() { Ok(h) => h, Err(_) => return Err(ProgramError::InvalidInstructionData) };
+    Ok((h, rest))
 }
 
 /// `[32 hash][u32 total_len][u8 ct_len][ct]`; accounts: authority, program

package/transmute/runtime/zoo-host/src/ctx.rs

@@ -3,7 +3,8 @@ use crate::json;
 use crate::kv::KvState;
 use crate::val::{parse_query, Val};
 use crate::wire::{Req, Resp};
-use alloc::{format, string::String, vec::Vec};
+use alloc::{string::String, vec::Vec};
+use crate::fmt::{push_i64, push_padded};
 use pinocchio::{
     sysvars::{clock::Clock, Sysvar},
     AccountView, Address,
@@ -54,13 +55,18 @@ impl<'a> Ctx<'a> {
         if self.req.query.is_empty() {
             Val::str(&self.req.path)
         } else {
-            Val::Str(format!("{}?{}", self.req.path, self.req.query))
+            let mut u = String::from(self.req.path.as_str());
+            u.push('?');
+            u.push_str(&self.req.query);
+            Val::Str(u)
         }
     }
     /// Full URL for `new URL(request.url)` in app-router handlers. The origin
     /// is synthetic; only path/search matter on chain.
     pub fn req_full_url(&self) -> Val {
-        Val::Str(format!("https://zoo.sol{}", self.req_url().to_js_string()))
+        let mut u = String::from("https://zoo.sol");
+        u.push_str(&self.req_url().to_js_string());
+        Val::Str(u)
     }
     pub fn req_query(&mut self) -> Val {
         if self.query_cache.is_none() {
@@ -279,18 +285,25 @@ pub fn iso8601(ms: f64) -> String {
     let d = doy - (153 * mp + 2) / 5 + 1;
     let m = if mp < 10 { mp + 3 } else { mp - 9 };
     let y = if m <= 2 { y + 1 } else { y };
-    format!(
-        "{:04}-{:02}-{:02}T{:02}:{:02}:{:02}.{:03}Z",
-        y,
-        m,
-        d,
-        sod / 3600,
-        (sod % 3600) / 60,
-        sod % 60,
-        milli
-    )
+    let mut out = String::new();
+    push_i64(&mut out, y);
+    out.push('-');
+    push_padded(&mut out, m as u64, 2);
+    out.push('-');
+    push_padded(&mut out, d as u64, 2);
+    out.push('T');
+    push_padded(&mut out, (sod / 3600) as u64, 2);
+    out.push(':');
+    push_padded(&mut out, ((sod % 3600) / 60) as u64, 2);
+    out.push(':');
+    push_padded(&mut out, (sod % 60) as u64, 2);
+    out.push('.');
+    push_padded(&mut out, milli as u64, 3);
+    out.push('Z');
+    out
 }
 
+
 const B58: &[u8; 58] = b"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 
 pub fn base58(bytes: &[u8]) -> String {

package/transmute/runtime/zoo-host/src/fmt.rs

@@ -0,0 +1,188 @@
+//! Number and hex formatting without `core::fmt`: the float/integer printers
+//! behind `format!` cost ~50 KB of program (flt2dec dragon/grisu + Formatter),
+//! which at Solana rent rates is a third of a SOL per site. These are the
+//! handful of shapes the runtime actually needs.
+use alloc::string::String;
+
+pub fn push_u64(out: &mut String, mut n: u64) {
+    if n == 0 {
+        out.push('0');
+        return;
+    }
+    let mut buf = [0u8; 20];
+    let mut i = buf.len();
+    while n > 0 {
+        i -= 1;
+        buf[i] = b'0' + (n % 10) as u8;
+        n /= 10;
+    }
+    for &b in &buf[i..] {
+        out.push(b as char);
+    }
+}
+
+pub fn push_i64(out: &mut String, n: i64) {
+    if n < 0 {
+        out.push('-');
+        push_u64(out, n.unsigned_abs());
+    } else {
+        push_u64(out, n as u64);
+    }
+}
+
+/// Zero-padded decimal (for dates: `2026`, `09`, `007`).
+pub fn push_padded(out: &mut String, n: u64, width: usize) {
+    let mut tmp = String::new();
+    push_u64(&mut tmp, n);
+    for _ in tmp.len()..width {
+        out.push('0');
+    }
+    out.push_str(&tmp);
+}
+
+pub fn push_hex2(out: &mut String, b: u8) {
+    const H: &[u8; 16] = b"0123456789ABCDEF";
+    out.push(H[(b >> 4) as usize] as char);
+    out.push(H[(b & 15) as usize] as char);
+}
+
+pub fn u64_string(n: u64) -> String {
+    let mut s = String::new();
+    push_u64(&mut s, n);
+    s
+}
+
+/// 10^k for small k without `libm::pow`.
+pub fn pow10(k: u32) -> f64 {
+    let mut v = 1.0;
+    for _ in 0..k {
+        v *= 10.0;
+    }
+    v
+}
+
+/// JS `Number.prototype.toString()` for the common cases, hand-rolled:
+/// integers exactly (|n| < 1e21), otherwise up to 15 significant digits with
+/// trailing zeros trimmed (`0.1 + 0.2` prints `0.30000000000000004` in JS and
+/// `0.3` here — the one visible difference), exponent form outside
+/// [1e-6, 1e21) like JS.
+pub fn push_f64(out: &mut String, n: f64) {
+    if n.is_nan() {
+        out.push_str("NaN");
+        return;
+    }
+    if n.is_infinite() {
+        out.push_str(if n > 0.0 { "Infinity" } else { "-Infinity" });
+        return;
+    }
+    if n == 0.0 {
+        out.push('0');
+        return;
+    }
+    let neg = n < 0.0;
+    let a = if neg { -n } else { n };
+    if neg {
+        out.push('-');
+    }
+    if a == libm::trunc(a) && a < 9.0e18 {
+        push_u64(out, a as u64);
+        return;
+    }
+    // Scientific decomposition: a = m × 10^e with 1 <= m < 10.
+    let mut e: i32 = 0;
+    let mut m = a;
+    while m >= 10.0 {
+        m /= 10.0;
+        e += 1;
+    }
+    while m < 1.0 {
+        m *= 10.0;
+        e -= 1;
+    }
+    // 15 significant digits, rounded.
+    let mut digits = [0u8; 17];
+    let mut nd = 0;
+    let mut scaled = m * 1e14; // 15 digits before the point
+    scaled = libm::round(scaled);
+    if scaled >= 1e15 {
+        scaled /= 10.0;
+        e += 1;
+    }
+    let mut v = scaled as u64;
+    let mut tmp = [0u8; 20];
+    let mut i = tmp.len();
+    while v > 0 {
+        i -= 1;
+        tmp[i] = (v % 10) as u8;
+        v /= 10;
+    }
+    for &d in &tmp[i..] {
+        digits[nd] = d;
+        nd += 1;
+    }
+    while nd > 1 && digits[nd - 1] == 0 {
+        nd -= 1;
+    }
+    if !(-7..21).contains(&e) {
+        out.push((b'0' + digits[0]) as char);
+        if nd > 1 {
+            out.push('.');
+            for &d in &digits[1..nd] {
+                out.push((b'0' + d) as char);
+            }
+        }
+        out.push('e');
+        out.push(if e < 0 { '-' } else { '+' });
+        push_u64(out, e.unsigned_abs() as u64);
+        return;
+    }
+    if e < 0 {
+        out.push_str("0.");
+        for _ in 0..(-e - 1) {
+            out.push('0');
+        }
+        for &d in &digits[..nd] {
+            out.push((b'0' + d) as char);
+        }
+        return;
+    }
+    let int_len = (e + 1) as usize;
+    for k in 0..int_len {
+        out.push((b'0' + if k < nd { digits[k] } else { 0 }) as char);
+    }
+    if nd > int_len {
+        out.push('.');
+        for &d in &digits[int_len..nd] {
+            out.push((b'0' + d) as char);
+        }
+    }
+}
+
+/// `toFixed(digits)`.
+pub fn to_fixed(n: f64, digits: usize) -> String {
+    let mut out = String::new();
+    if n.is_nan() {
+        out.push_str("NaN");
+        return out;
+    }
+    let neg = n < 0.0;
+    let a = if neg { -n } else { n };
+    let m = pow10(digits as u32);
+    let scaled = libm::round(a * m) as u64;
+    let int = scaled / (m as u64);
+    let frac = scaled % (m as u64);
+    if neg && scaled != 0 {
+        out.push('-');
+    }
+    push_u64(&mut out, int);
+    if digits > 0 {
+        out.push('.');
+        let mut f = String::new();
+        push_u64(&mut f, frac);
+        for _ in f.len()..digits {
+            out.push('0');
+        }
+        out.push_str(&f);
+    }
+    out
+}

package/transmute/runtime/zoo-host/src/json.rs

@@ -96,7 +96,11 @@ struct Parser<'a> {
 
 impl<'a> Parser<'a> {
     fn err(&self, msg: &str) -> Val {
-        Val::Str(alloc::format!("SyntaxError: {} at position {}", msg, self.i))
+        let mut m = String::from("SyntaxError: ");
+        m.push_str(msg);
+        m.push_str(" at position ");
+        crate::fmt::push_u64(&mut m, self.i as u64);
+        Val::Str(m)
     }
     fn ws(&mut self) {
         while self.i < self.b.len() && matches!(self.b[self.i], b' ' | b'\n' | b'\r' | b'\t') {
@@ -190,8 +194,10 @@ impl<'a> Parser<'a> {
         if self.i + 4 > self.b.len() {
             return Err(self.err("Bad unicode escape"));
         }
-        let s = core::str::from_utf8(&self.b[self.i..self.i + 4]).map_err(|_| self.err("Bad unicode escape"))?;
-        let v = u32::from_str_radix(s, 16).map_err(|_| self.err("Bad unicode escape"))?;
+        let mut v: u32 = 0;
+        for &c in &self.b[self.i..self.i + 4] {
+            v = v * 16 + match (c as char).to_digit(16) { Some(d) => d, None => return Err(self.err("Bad unicode escape")) };
+        }
         self.i += 4;
         Ok(v)
     }

package/transmute/runtime/zoo-host/src/kv.rs

@@ -178,5 +178,8 @@ impl<'a> Ctx<'a> {
 
 pub fn err_str(what: &str, e: pinocchio::error::ProgramError) -> String {
     let code: u64 = e.into();
-    alloc::format!("{} failed: program error {}", what, code)
+    let mut m = String::from(what);
+    m.push_str(" failed: program error ");
+    crate::fmt::push_u64(&mut m, code);
+    m
 }

package/transmute/runtime/zoo-host/src/lib.rs

@@ -22,6 +22,7 @@ extern crate alloc;
 
 pub mod assets;
 pub mod ctx;
+pub mod fmt;
 pub mod json;
 pub mod kv;
 pub mod val;

package/transmute/runtime/zoo-host/src/val.rs

@@ -1,10 +1,11 @@
 //! A JS-semantics dynamic value. Every expression in a transmuted handler
 //! evaluates to a `Val`; the operators here follow ECMAScript coercion rules
 //! for the subset the transmuter accepts.
-use alloc::{format, string::String, vec::Vec};
+use alloc::{string::String, vec::Vec};
+use crate::fmt::{push_f64, push_hex2, pow10};
 use core::cmp::Ordering;
 
-#[derive(Clone, Debug)]
+#[derive(Clone)]
 pub enum Val {
     Undef,
     Null,
@@ -47,32 +48,11 @@ impl From<bool> for Val {
     }
 }
 
-/// JS Number::toString for the common cases.
+/// JS Number::toString for the common cases (see fmt::push_f64).
 pub fn num_to_string(n: f64) -> String {
-    if n.is_nan() {
-        return String::from("NaN");
-    }
-    if n.is_infinite() {
-        return String::from(if n > 0.0 { "Infinity" } else { "-Infinity" });
-    }
-    if n == 0.0 {
-        return String::from("0");
-    }
-    if n == libm::trunc(n) && libm::fabs(n) < 1e21 {
-        return format!("{}", n as i128);
-    }
-    let a = libm::fabs(n);
-    if !(1e-6..1e21).contains(&a) {
-        // JS switches to exponent notation here; Rust's `{:e}` prints "1e-7"
-        // and JS prints "1e-7" too, so mirror it (JS adds "+" for positive
-        // exponents).
-        let s = format!("{:e}", n);
-        return match s.find('e') {
-            Some(i) if !s[i + 1..].starts_with('-') => format!("{}e+{}", &s[..i], &s[i + 1..]),
-            _ => s,
-        };
-    }
-    format!("{}", n)
+    let mut s = String::new();
+    push_f64(&mut s, n);
+    s
 }
 
 /// JS ToNumber for strings.
@@ -82,10 +62,11 @@ pub fn str_to_num(s: &str) -> f64 {
         return 0.0;
     }
     if let Some(h) = t.strip_prefix("0x").or_else(|| t.strip_prefix("0X")) {
-        return match u64::from_str_radix(h, 16) {
-            Ok(v) => v as f64,
-            Err(_) => f64::NAN,
-        };
+        let mut v: f64 = 0.0;
+        for c in h.chars() {
+            match c.to_digit(16) { Some(d) => v = v * 16.0 + d as f64, None => return f64::NAN }
+        }
+        return v;
     }
     match t {
         "Infinity" | "+Infinity" => return f64::INFINITY,
@@ -150,9 +131,9 @@ pub fn parse_decimal(s: &str) -> Option<f64> {
     }
     let total = frac_exp + exp;
     let v = if total >= 0 {
-        mant * libm::pow(10.0, total as f64)
+        mant * pow10(total as u32)
     } else {
-        mant / libm::pow(10.0, (-total) as f64)
+        mant / pow10((-total) as u32)
     };
     Some(if neg { -v } else { v })
 }
@@ -435,7 +416,7 @@ impl Val {
         Val::Num(libm::fmod(self.to_num(), o.to_num()))
     }
     pub fn pow(&self, o: &Val) -> Val {
-        Val::Num(libm::pow(self.to_num(), o.to_num()))
+        Val::Num(js_pow(self.to_num(), o.to_num()))
     }
     pub fn neg(&self) -> Val {
         Val::Num(-self.to_num())
@@ -709,17 +690,40 @@ impl Val {
                 "toString" => Ok(Val::Str(self.to_js_string())),
                 _ => Err(type_error(name)),
             },
-            Val::Undef | Val::Null => Err(Val::Str(format!(
-                "TypeError: Cannot read properties of {} (reading '{}')",
-                self.to_js_string(),
-                name
-            ))),
+            Val::Undef | Val::Null => {
+                let mut m = String::from("TypeError: Cannot read properties of ");
+                m.push_str(&self.to_js_string());
+                m.push_str(" (reading '");
+                m.push_str(name);
+                m.push_str("')");
+                Err(Val::Str(m))
+            }
         }
     }
 }
 
 fn type_error(name: &str) -> Val {
-    Val::Str(format!("TypeError: {} is not a function", name))
+    let mut m = String::from("TypeError: ");
+    m.push_str(name);
+    m.push_str(" is not a function");
+    Val::Str(m)
+}
+
+/// `**` / Math.pow: exact for integer exponents (a loop), libm only with the
+/// `mathx` feature.
+pub fn js_pow(base: f64, exp: f64) -> f64 {
+    if exp == libm::trunc(exp) && libm::fabs(exp) <= 64.0 {
+        let mut r = 1.0;
+        let n = libm::fabs(exp) as u32;
+        for _ in 0..n {
+            r *= base;
+        }
+        return if exp < 0.0 { 1.0 / r } else { r };
+    }
+    #[cfg(feature = "mathx")]
+    { libm::pow(base, exp) }
+    #[cfg(not(feature = "mathx"))]
+    { f64::NAN }
 }
 
 fn to_i32(n: f64) -> i32 {
@@ -737,7 +741,9 @@ fn parse_index(s: &str) -> Option<usize> {
     if s.len() > 1 && s.starts_with('0') {
         return None;
     }
-    s.parse::<usize>().ok()
+    let mut v: usize = 0;
+    for b in s.bytes() { v = v * 10 + (b - b'0') as usize; }
+    Some(v)
 }
 
 fn clamp_index(len: usize, v: &Val) -> usize {
@@ -763,24 +769,15 @@ fn slice_bounds(len: usize, start: &Val, end: &Val) -> (usize, usize) {
 }
 
 pub fn to_fixed(n: f64, digits: usize) -> String {
-    if n.is_nan() {
-        return String::from("NaN");
-    }
-    let m = libm::pow(10.0, digits as f64);
-    let r = libm::round(n * m) / m;
-    if digits == 0 {
-        return format!("{}", r as i128);
-    }
-    let s = format!("{:.*}", digits, r);
-    s
+    crate::fmt::to_fixed(n, digits)
 }
 
 fn str_method(s: &mut String, name: &str, args: &[Val]) -> Result<Val, Val> {
     let arg = |i: usize| args.get(i).cloned().unwrap_or(Val::Undef);
     let chars: Vec<char> = s.chars().collect();
     Ok(match name {
-        "toUpperCase" => Val::Str(s.to_uppercase()),
-        "toLowerCase" => Val::Str(s.to_lowercase()),
+        "toUpperCase" => Val::Str(s.to_ascii_uppercase()),
+        "toLowerCase" => Val::Str(s.to_ascii_lowercase()),
         "trim" => Val::Str(String::from(s.trim())),
         "trimStart" => Val::Str(String::from(s.trim_start())),
         "trimEnd" => Val::Str(String::from(s.trim_end())),
@@ -889,18 +886,26 @@ pub fn math(name: &str, args: &[Val]) -> Result<Val, Val> {
         "trunc" => libm::trunc(a(0)),
         "abs" => libm::fabs(a(0)),
         "sqrt" => libm::sqrt(a(0)),
-        "pow" => libm::pow(a(0), a(1)),
+        "pow" => js_pow(a(0), a(1)),
         "sign" => {
             let x = a(0);
             if x > 0.0 { 1.0 } else if x < 0.0 { -1.0 } else { x }
         }
+        #[cfg(feature = "mathx")]
         "log" => libm::log(a(0)),
+        #[cfg(feature = "mathx")]
         "log2" => libm::log2(a(0)),
+        #[cfg(feature = "mathx")]
         "log10" => libm::log10(a(0)),
+        #[cfg(feature = "mathx")]
         "exp" => libm::exp(a(0)),
+        #[cfg(feature = "mathx")]
         "sin" => libm::sin(a(0)),
+        #[cfg(feature = "mathx")]
         "cos" => libm::cos(a(0)),
+        #[cfg(feature = "mathx")]
         "tan" => libm::tan(a(0)),
+        #[cfg(feature = "mathx")]
         "atan2" => libm::atan2(a(0), a(1)),
         "min" => args.iter().map(|v| v.to_num()).fold(f64::INFINITY, f64::min),
         "max" => args.iter().map(|v| v.to_num()).fold(f64::NEG_INFINITY, f64::max),
@@ -998,7 +1003,8 @@ pub fn url_encode(s: &str, component: bool) -> String {
         if keep {
             out.push(b as char);
         } else {
-            out.push_str(&format!("%{:02X}", b));
+            out.push('%');
+            push_hex2(&mut out, b);
         }
     }
     out

package/transmute/site/public/index.html

@@ -43,6 +43,40 @@ input{padding:.4rem .6rem;font:inherit;border:1px solid #8884;border-radius:.4re
 <div class="demo"><b>/api/time</b> — <code>Date.now()</code> is the cluster clock<br><button id="time">GET /api/time</button><pre id="o-time"></pre></div>
 <div class="demo"><b>/api/echo</b> — app-router <code>POST(request)</code> with <code>await request.json()</code>, answers 201<br><button id="echo">POST /api/echo</button><pre id="o-echo"></pre></div>
 
+<h2>Capabilities, side by side</h2>
+<p class="muted">Vercel the platform vs openzoo-transmute today. Honest, not flattering.</p>
+<table>
+<tr><th>Capability</th><th>Vercel</th><th>openzoo-transmute (Solana)</th></tr>
+<tr><td>Static hosting</td><td>CDN, any size</td><td>yes: files in accounts, read by any gateway; rent ~7 SOL per MB, so KBs not MBs</td></tr>
+<tr><td>Serverless functions</td><td>Node, Edge, Python, Go, Ruby…</td><td>JS/TS handlers only, compiled to a Rust subset</td></tr>
+<tr><td>Framework support</td><td>Next.js (full: SSR, RSC, ISR), 40+ frameworks</td><td>Next.js <code>pages/api</code> + app-router <code>route.ts</code>, Vite/static + <code>api/</code>; no SSR, no React Server Components, no ISR</td></tr>
+<tr><td>Language coverage</td><td>everything</td><td>expressions, control flow, strings/arrays/objects, JSON, <code>@vercel/kv</code>, <code>Date.now</code>, <code>process.env</code>; no npm packages, regex, classes, generators, closures over mutable state</td></tr>
+<tr><td>Outbound network</td><td><code>fetch</code> anything</td><td>none. A program cannot make HTTP calls</td></tr>
+<tr><td>Databases</td><td>Postgres, KV, Blob, any external DB</td><td>KV on program-derived accounts (10 KB values, public); cross-program reads possible in principle, not exposed</td></tr>
+<tr><td>Secrets</td><td>encrypted env vars</td><td>none. Env is baked into public bytecode</td></tr>
+<tr><td>Auth</td><td>anything (cookies, JWT, OAuth)</td><td>wallet signatures are the identity; no server secret, so no sessions/JWT</td></tr>
+<tr><td>Streaming / SSE / WebSockets</td><td>yes</td><td>no. One request = one transaction, ~8 KB response</td></tr>
+<tr><td>Request size</td><td>4.5 MB</td><td>~900 bytes body</td></tr>
+<tr><td>Execution limits</td><td>10–800 s, up to 4 GB</td><td>200k–1.4M compute units (~1–5 ms of CPU), 256 KB heap</td></tr>
+<tr><td>Randomness / time</td><td>yes</td><td>no <code>Math.random</code> (deterministic); time = slot clock</td></tr>
+<tr><td>Background work (<code>waitUntil</code>, queues, cron)</td><td>yes</td><td>no</td></tr>
+<tr><td>Middleware / edge</td><td>yes</td><td>no (gateway does routing/rewrites/redirects from <code>vercel.json</code>)</td></tr>
+<tr><td>Image optimization</td><td>yes</td><td>no</td></tr>
+<tr><td>Domains / TLS</td><td>built in</td><td>via a gateway host (this one or your own); the chain has no HTTP</td></tr>
+<tr><td>Previews / rollbacks / git integration</td><td>yes</td><td>no. Each deploy is a program (new rent) or an upgrade in place</td></tr>
+<tr><td>Observability</td><td>logs, analytics, tracing</td><td>transaction logs, compute-unit counts, block explorers</td></tr>
+<tr><td>Latency</td><td>~50–300 ms</td><td>reads 300–800 ms, writes 1–3 s</td></tr>
+<tr><td>Read cost</td><td>metered</td><td>free, unlimited, no account needed</td></tr>
+<tr><td>Write cost</td><td>free</td><td>~0.000005 SOL per transaction + rent for new state; a signer is required (your wallet, a bounded hub signer, or x402 pay-per-write once built)</td></tr>
+<tr><td>Deploy cost</td><td>free tier</td><td>rent up front (~1 SOL for a small app today; ~0.05 SOL once the shared runtime lands)</td></tr>
+<tr><td>Toolchain</td><td>node</td><td>node + Rust + <code>cargo-build-sbf</code> (goes away with the shared runtime)</td></tr>
+<tr><td>Who can take it down</td><td>Vercel, DNS, a card on file</td><td>nobody, if the upgrade authority is burned; any RPC + any gateway serves it</td></tr>
+<tr><td>Verifiability</td><td>trust the platform</td><td>the code and every state change are public and replayable</td></tr>
+<tr><td>Composability</td><td>HTTP APIs</td><td>other programs and wallets can call your routes as instructions</td></tr>
+<tr><td>Permanence</td><td>until the bill stops</td><td>until the rent is withdrawn; rent-exempt accounts persist indefinitely</td></tr>
+</table>
+<p>Summary: it is a permanent, permissionless, verifiable host for small stateful APIs and static frontends, not a general web platform. If your app needs the network, secrets, streaming, or heavy compute, it stays on Vercel; if what it needs is to exist forever and be readable by anyone for free, it belongs here.</p>
+
 <h2>Put your own app here</h2>
 <pre>npx openzoo inspect .                       # your app, in Vercel terms + what is eligible
 npx openzoo build .                         # Rust program + asset plan (needs cargo-build-sbf)