openzoo 0.51.2 → 0.51.3

package/transmute/runtime/zoo-host/src/assets.rs

@@ -31,6 +31,29 @@ pub fn pda_for_hash(program_id: &Address, hash: &[u8; 32]) -> (Address, u8) {
     Address::find_program_address(&[b"asset", hash], program_id)
 }
 
+/// Asset PDA under the shared runtime: `["asset", site_id, hash]`.
+pub fn pda_for_hash_ns(program_id: &Address, ns: Option<&[u8; 32]>, hash: &[u8; 32]) -> (Address, u8) {
+    match ns {
+        Some(n) => Address::find_program_address(&[b"asset", n, hash], program_id),
+        None => pda_for_hash(program_id, hash),
+    }
+}
+
+/// Who may write assets: a compiled site's upgrade authority, or under the
+/// shared runtime the authority recorded in the site account (`accounts[1]`).
+#[derive(Clone, Copy)]
+pub enum Auth {
+    Upgrade,
+    Site([u8; 32]),
+}
+
+pub fn check_auth(program_id: &Address, accounts: &[AccountView], auth: Auth) -> ProgramResult {
+    match auth {
+        Auth::Upgrade => check_authority(program_id, accounts),
+        Auth::Site(site) => crate::site::check_site_authority(program_id, accounts, &site),
+    }
+}
+
 /// Verify `accounts[0]` signs as the upgrade authority of `program_id`
 /// (read off `accounts[1]`, the ProgramData account).
 pub fn check_authority(program_id: &Address, accounts: &[AccountView]) -> ProgramResult {
@@ -67,7 +90,11 @@ fn split_hash(data: &[u8]) -> Result<(&[u8; 32], &[u8]), ProgramError> {
 /// `[32 hash][u32 total_len][u8 ct_len][ct]`; accounts: authority, program
 /// data, asset PDA, system program.
 pub fn init(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) -> ProgramResult {
-    check_authority(program_id, accounts)?;
+    init_ns(program_id, accounts, data, None, Auth::Upgrade)
+}
+
+pub fn init_ns(program_id: &Address, accounts: &mut [AccountView], data: &[u8], ns: Option<[u8; 32]>, auth: Auth) -> ProgramResult {
+    check_auth(program_id, accounts, auth)?;
     let (hash, rest) = split_hash(data)?;
     if rest.len() < 5 {
         return Err(ProgramError::InvalidInstructionData);
@@ -76,7 +103,7 @@ pub fn init(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) ->
     let ct_len = rest[4] as usize;
     let ct = rest.get(5..5 + ct_len).ok_or(ProgramError::InvalidInstructionData)?;
     let header = FIXED_HEADER + ct_len;
-    let (addr, bump) = pda_for_hash(program_id, hash);
+    let (addr, bump) = pda_for_hash_ns(program_id, ns.as_ref(), hash);
     let (head, tail) = accounts.split_at_mut(2);
     let authority = &head[0];
     let asset = tail.first_mut().ok_or(ProgramError::NotEnoughAccountKeys)?;
@@ -94,10 +121,18 @@ pub fn init(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) ->
         asset.resize(space)?;
     } else {
         let bump_bytes = [bump];
-        let seeds = [Seed::from(b"asset".as_ref()), Seed::from(hash.as_ref()), Seed::from(bump_bytes.as_ref())];
-        let signer = Signer::from(&seeds);
-        CreateAccount::with_minimum_balance(authority, asset, space as u64, program_id, None)?
-            .invoke_signed(&[signer])?;
+        match ns.as_ref() {
+            Some(n) => {
+                let seeds = [Seed::from(b"asset".as_ref()), Seed::from(n.as_ref()), Seed::from(hash.as_ref()), Seed::from(bump_bytes.as_ref())];
+                let signer = Signer::from(&seeds);
+                CreateAccount::with_minimum_balance(authority, asset, space as u64, program_id, None)?.invoke_signed(&[signer])?;
+            }
+            None => {
+                let seeds = [Seed::from(b"asset".as_ref()), Seed::from(hash.as_ref()), Seed::from(bump_bytes.as_ref())];
+                let signer = Signer::from(&seeds);
+                CreateAccount::with_minimum_balance(authority, asset, space as u64, program_id, None)?.invoke_signed(&[signer])?;
+            }
+        }
     }
     let mut d = asset.try_borrow_mut()?;
     d[0] = 1;
@@ -110,14 +145,18 @@ pub fn init(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) ->
 
 /// `[32 hash][u32 offset][bytes]`; same accounts as `init`.
 pub fn write(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) -> ProgramResult {
-    check_authority(program_id, accounts)?;
+    write_ns(program_id, accounts, data, None, Auth::Upgrade)
+}
+
+pub fn write_ns(program_id: &Address, accounts: &mut [AccountView], data: &[u8], ns: Option<[u8; 32]>, auth: Auth) -> ProgramResult {
+    check_auth(program_id, accounts, auth)?;
     let (hash, rest) = split_hash(data)?;
     if rest.len() < 4 {
         return Err(ProgramError::InvalidInstructionData);
     }
     let offset = u32::from_le_bytes([rest[0], rest[1], rest[2], rest[3]]) as usize;
     let bytes = &rest[4..];
-    let (addr, _) = pda_for_hash(program_id, hash);
+    let (addr, _) = pda_for_hash_ns(program_id, ns.as_ref(), hash);
     let (head, tail) = accounts.split_at_mut(2);
     let authority = &head[0];
     let asset = tail.first_mut().ok_or(ProgramError::NotEnoughAccountKeys)?;
@@ -153,9 +192,13 @@ pub fn write(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) ->
 
 /// `[32 hash]`: reclaim the rent to the authority.
 pub fn close(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) -> ProgramResult {
-    check_authority(program_id, accounts)?;
+    close_ns(program_id, accounts, data, None, Auth::Upgrade)
+}
+
+pub fn close_ns(program_id: &Address, accounts: &mut [AccountView], data: &[u8], ns: Option<[u8; 32]>, auth: Auth) -> ProgramResult {
+    check_auth(program_id, accounts, auth)?;
     let (hash, _) = split_hash(data)?;
-    let (addr, _) = pda_for_hash(program_id, hash);
+    let (addr, _) = pda_for_hash_ns(program_id, ns.as_ref(), hash);
     let (head, tail) = accounts.split_at_mut(2);
     let authority = &mut head[0];
     let asset = tail.first_mut().ok_or(ProgramError::NotEnoughAccountKeys)?;

package/transmute/runtime/zoo-host/src/ctx.rs

@@ -17,6 +17,11 @@ pub struct Ctx<'a> {
     pub res: Resp,
     pub sent: bool,
     pub env: &'a [(&'static str, &'static str)],
+    /// Environment from a bytecode module (shared runtime); consulted first.
+    pub env_dyn: Vec<(String, String)>,
+    /// Site namespace for KV/asset seeds: `None` for a compiled site program
+    /// (the program id is the namespace), `Some(site_id)` under the shared runtime.
+    pub ns: Option<[u8; 32]>,
     pub kv: KvState,
     query_cache: Option<Val>,
     body_cache: Option<Val>,
@@ -36,6 +41,8 @@ impl<'a> Ctx<'a> {
             res: Resp::default(),
             sent: false,
             env,
+            env_dyn: Vec::new(),
+            ns: None,
             kv: KvState::default(),
             query_cache: None,
             body_cache: None,
@@ -216,6 +223,11 @@ impl<'a> Ctx<'a> {
 
     pub fn env(&self, name: &Val) -> Val {
         let n = name.to_js_string();
+        for (k, v) in self.env_dyn.iter() {
+            if *k == n {
+                return Val::str(v);
+            }
+        }
         for (k, v) in self.env.iter() {
             if *k == n {
                 return Val::str(v);
@@ -225,6 +237,9 @@ impl<'a> Ctx<'a> {
     }
     pub fn env_obj(&self) -> Val {
         let mut o = Val::obj();
+        for (k, v) in self.env_dyn.iter() {
+            o.set_str(k, Val::str(v));
+        }
         for (k, v) in self.env.iter() {
             o.set_str(k, Val::str(v));
         }

package/transmute/runtime/zoo-host/src/helpers.rs

@@ -0,0 +1,245 @@
+//! Bridge helpers shared by compiled sites (the generated prelude calls
+//! these) and the bytecode interpreter (by id).
+use crate::json;
+use crate::val::{url_decode, Val};
+use crate::Ctx;
+use alloc::{string::String, vec::Vec};
+
+/// Response value for app-router handlers: a tagged object `send` turns into
+/// the bridge response.
+pub fn resp(kind: &str, a: Val, b: Val) -> Val {
+    let mut o = Val::obj();
+    o.set_str("__zoo", Val::str(kind));
+    o.set_str("a", a);
+    o.set_str("b", b);
+    o
+}
+
+pub fn send(cx: &mut Ctx, v: &Val) -> Result<(), Val> {
+    let kind = v.get_str("__zoo");
+    match kind.as_str() {
+        Some("json") => { let a = v.get_str("a"); let b = v.get_str("b"); cx.respond_json(&a, &b); Ok(()) }
+        Some("raw") => { let a = v.get_str("a"); let b = v.get_str("b"); cx.respond(&a, &b); Ok(()) }
+        Some("redirect") => {
+            let url = v.get_str("a");
+            let mut st = v.get_str("b");
+            if let Val::Obj(_) = st { st = st.get_str("status"); }
+            cx.respond_redirect(&url, &st);
+            Ok(())
+        }
+        _ => if v.is_undef() { Ok(()) } else { Err(Val::str("TypeError: the handler returned a value that is not a Response")) },
+    }
+}
+
+/// Runtime throws are strings ("SyntaxError: ..."); in a catch they become
+/// Error-like objects so `e.message` / `e.name` read as in Node.
+pub fn caught(v: Val) -> Val {
+    if let Val::Str(s) = &v {
+        if let Some(i) = s.find(": ") {
+            let name = &s[..i];
+            if name.ends_with("Error") && !name.contains(' ') {
+                let mut o = Val::obj();
+                o.set_str("name", Val::str(name));
+                o.set_str("message", Val::str(&s[i + 2..]));
+                return o;
+            }
+        }
+    }
+    v
+}
+
+pub fn param_value(s: &str, catch_all: bool) -> Val {
+    if catch_all {
+        Val::Arr(s.split('/').filter(|p| !p.is_empty()).map(|p| Val::Str(url_decode(p))).collect())
+    } else {
+        Val::Str(url_decode(s))
+    }
+}
+
+/// A dynamic segment, passed by the gateway as the `x-zoo-param-<name>` header.
+pub fn param(cx: &mut Ctx, name: &str, catch_all: bool) -> Val {
+    let mut h = String::from("x-zoo-param-");
+    h.push_str(name);
+    match cx.req_header(&Val::Str(h)) {
+        Val::Str(s) => param_value(&s, catch_all),
+        _ => Val::Undef,
+    }
+}
+
+pub fn params(cx: &mut Ctx, params: &[(&str, bool)]) -> Val {
+    let mut o = Val::obj();
+    for (name, catch_all) in params.iter() {
+        let v = param(cx, name, *catch_all);
+        if !v.is_undef() { o.set_str(name, v); }
+    }
+    o
+}
+
+/// `req.query`: the query string plus the route's dynamic segments.
+pub fn query(cx: &mut Ctx, params: &[(&str, bool)]) -> Val {
+    let mut q = cx.req_query();
+    for (name, catch_all) in params.iter() {
+        let v = param(cx, name, *catch_all);
+        if !v.is_undef() { q.set_str(name, v); }
+    }
+    q
+}
+
+pub fn cookies(cx: &mut Ctx) -> Val {
+    let mut o = Val::obj();
+    if let Val::Str(h) = cx.req_header(&Val::str("cookie")) {
+        for part in h.split(';') {
+            let p = part.trim();
+            if let Some(i) = p.find('=') { o.set_str(&p[..i], Val::Str(url_decode(&p[i + 1..]))); }
+        }
+    }
+    o
+}
+
+pub fn log(a: &[Val]) -> Val {
+    let mut s = String::new();
+    for (i, v) in a.iter().enumerate() {
+        if i > 0 { s.push(' '); }
+        match v {
+            Val::Str(x) => s.push_str(x),
+            Val::Obj(_) | Val::Arr(_) => s.push_str(&json::stringify(v)),
+            other => s.push_str(&other.to_js_string()),
+        }
+    }
+    crate::wire::log_str(&s);
+    Val::Undef
+}
+
+/// Helper ids shared with the bytecode emitter (lib/compile/bytecode.js).
+pub const H_COOKIES: u8 = 0;
+pub const H_COOKIE_GET: u8 = 1;
+pub const H_COOKIE_HAS: u8 = 2;
+pub const H_COOKIE_ALL: u8 = 3;
+pub const H_HEADER_HAS: u8 = 4;
+pub const H_QUERY_HAS: u8 = 5;
+pub const H_QUERY_GET_ALL: u8 = 6;
+pub const H_SEARCH: u8 = 7;
+pub const H_ASSIGN: u8 = 8;
+pub const H_OMIT: u8 = 9;
+pub const H_FROM_ENTRIES: u8 = 10;
+pub const H_ARRAY_FROM: u8 = 11;
+pub const H_SLICE_FROM: u8 = 12;
+pub const H_URL: u8 = 13;
+pub const H_NUM: u8 = 14;
+pub const H_SET_HEADERS: u8 = 15;
+
+pub fn helper_id(name: &str) -> Option<u8> {
+    Some(match name {
+        "cookies" => H_COOKIES, "cookie_get" => H_COOKIE_GET, "cookie_has" => H_COOKIE_HAS, "cookie_all" => H_COOKIE_ALL,
+        "header_has" => H_HEADER_HAS, "query_has" => H_QUERY_HAS, "query_get_all" => H_QUERY_GET_ALL, "search" => H_SEARCH,
+        "assign" => H_ASSIGN, "omit" => H_OMIT, "from_entries" => H_FROM_ENTRIES, "array_from" => H_ARRAY_FROM,
+        "slice_from" => H_SLICE_FROM, "url" => H_URL, "num" => H_NUM, "set_headers" => H_SET_HEADERS,
+        _ => return None,
+    })
+}
+
+pub fn helper(cx: &mut Ctx, id: u8, a: &[Val]) -> Val {
+    let arg = |i: usize| a.get(i).cloned().unwrap_or(Val::Undef);
+    match id {
+        H_COOKIES => cookies(cx),
+        H_COOKIE_GET => {
+            let name = arg(0);
+            let v = cookies(cx).get(&name);
+            if v.is_undef() { return Val::Undef; }
+            let mut o = Val::obj();
+            o.set_str("name", name);
+            o.set_str("value", v);
+            o
+        }
+        H_COOKIE_HAS => Val::Bool(cookies(cx).has(&arg(0))),
+        H_COOKIE_ALL => {
+            let mut out = Val::arr();
+            if let Val::Obj(kv) = cookies(cx) {
+                for (k, v) in kv {
+                    let mut o = Val::obj();
+                    o.set_str("name", Val::Str(k));
+                    o.set_str("value", v);
+                    out.push(o);
+                }
+            }
+            out
+        }
+        H_HEADER_HAS => Val::Bool(!cx.req_header(&arg(0)).is_nullish()),
+        H_QUERY_HAS => Val::Bool(cx.req_query().has(&arg(0))),
+        H_QUERY_GET_ALL => match cx.req_query_get(&arg(0)) {
+            Val::Null | Val::Undef => Val::arr(),
+            v => Val::Arr(alloc::vec![v]),
+        },
+        H_SEARCH => {
+            let with_q = arg(0).truthy();
+            let u = cx.req_url().to_js_string();
+            match u.find('?') {
+                Some(i) => Val::Str(String::from(if with_q { &u[i..] } else { &u[i + 1..] })),
+                None => Val::str(""),
+            }
+        }
+        H_ASSIGN => {
+            let mut t = if a.is_empty() { Val::obj() } else { arg(0) };
+            for src in a.iter().skip(1) {
+                if let Val::Obj(kv) = src { for (k, v) in kv.iter() { t.set_str(k, v.clone()); } }
+            }
+            t
+        }
+        H_OMIT => {
+            let mut out = Val::obj();
+            let skip: Vec<String> = arg(1).iter_values().iter().map(|k| k.to_js_string()).collect();
+            if let Val::Obj(kv) = arg(0) {
+                for (k, v) in kv.iter() { if !skip.iter().any(|s| s == k) { out.set_str(k, v.clone()); } }
+            }
+            out
+        }
+        H_FROM_ENTRIES => {
+            let mut o = Val::obj();
+            for pair in arg(0).iter_values() {
+                let k = pair.get(&Val::Num(0.0));
+                let v = pair.get(&Val::Num(1.0));
+                o.set(&k, v);
+            }
+            o
+        }
+        H_ARRAY_FROM => Val::Arr(arg(0).iter_values()),
+        H_SLICE_FROM => {
+            let items = arg(0).iter_values();
+            let from = arg(1).to_num().max(0.0) as usize;
+            Val::Arr(items.into_iter().skip(from).collect())
+        }
+        H_URL => {
+            let input = arg(0).to_js_string();
+            let base = if arg(1).is_undef() { String::new() } else { arg(1).to_js_string() };
+            if input.contains("://") || base.is_empty() { return Val::Str(input); }
+            let origin_end = match base.find("://") {
+                Some(i) => base[i + 3..].find('/').map(|j| i + 3 + j).unwrap_or(base.len()),
+                None => 0,
+            };
+            let mut out = String::new();
+            if input.starts_with('/') { out.push_str(&base[..origin_end]); out.push_str(&input); return Val::Str(out); }
+            let path_end = base.rfind('/').map(|i| i + 1).unwrap_or(base.len()).max(origin_end).min(base.len());
+            out.push_str(&base[..path_end]);
+            out.push_str(&input);
+            Val::Str(out)
+        }
+        H_NUM => {
+            let name = arg(0).to_js_string();
+            let n = match a.get(1) { Some(Val::Num(n)) => *n, _ => return Val::Bool(false) };
+            Val::Bool(match name.as_str() {
+                "isInteger" => n.is_finite() && n == libm::trunc(n),
+                "isNaN" => n.is_nan(),
+                "isFinite" => n.is_finite(),
+                "isSafeInteger" => n.is_finite() && n == libm::trunc(n) && libm::fabs(n) <= 9007199254740991.0,
+                _ => false,
+            })
+        }
+        H_SET_HEADERS => {
+            if let Val::Obj(kv) = arg(0) {
+                for (k, v) in kv.iter() { cx.res_header(&Val::str(k), v); }
+            }
+            Val::Undef
+        }
+        _ => Val::Undef,
+    }
+}

package/transmute/runtime/zoo-host/src/kv.rs

@@ -36,8 +36,17 @@ pub fn key_hash(key: &str) -> [u8; 32] {
 }
 
 pub fn pda_for(program_id: &Address, key: &str) -> (Address, u8, [u8; 32]) {
+    pda_for_ns(program_id, None, key)
+}
+
+/// KV PDA: `["kv", hash]` for a compiled site, `["kv", site_id, hash]` under
+/// the shared runtime.
+pub fn pda_for_ns(program_id: &Address, ns: Option<&[u8; 32]>, key: &str) -> (Address, u8, [u8; 32]) {
     let h = key_hash(key);
-    let (a, bump) = Address::find_program_address(&[b"kv", &h], program_id);
+    let (a, bump) = match ns {
+        Some(n) => Address::find_program_address(&[b"kv", n, &h], program_id),
+        None => Address::find_program_address(&[b"kv", &h], program_id),
+    };
     (a, bump, h)
 }
 
@@ -50,7 +59,7 @@ struct Slot {
 impl<'a> Ctx<'a> {
     fn kv_slot(&mut self, key: &Val) -> Result<Slot, Val> {
         let k = key.to_js_string();
-        let (addr, bump, hash) = pda_for(self.program_id, &k);
+        let (addr, bump, hash) = pda_for_ns(self.program_id, self.ns.as_ref(), &k);
         match self.accounts.iter().position(|a| *a.address() == addr) {
             Some(idx) => Ok(Slot { idx, bump, hash }),
             None => {
@@ -147,12 +156,24 @@ impl<'a> Ctx<'a> {
             if !payer.is_signer() {
                 return Err(Val::str("kv.set: payer must sign"));
             }
-            let seeds = [Seed::from(b"kv".as_ref()), Seed::from(s.hash.as_ref()), Seed::from(bump.as_ref())];
-            let signer = Signer::from(&seeds);
-            CreateAccount::with_minimum_balance(payer, acc, need as u64, program_id, None)
-                .map_err(|e| Val::Str(err_str("kv create", e)))?
-                .invoke_signed(&[signer])
-                .map_err(|e| Val::Str(err_str("kv create", e)))?;
+            let ns = self.ns;
+            let r = match ns.as_ref() {
+                Some(n) => {
+                    let seeds = [Seed::from(b"kv".as_ref()), Seed::from(n.as_ref()), Seed::from(s.hash.as_ref()), Seed::from(bump.as_ref())];
+                    let signer = Signer::from(&seeds);
+                    CreateAccount::with_minimum_balance(payer, acc, need as u64, program_id, None)
+                        .map_err(|e| Val::Str(err_str("kv create", e)))?
+                        .invoke_signed(&[signer])
+                }
+                None => {
+                    let seeds = [Seed::from(b"kv".as_ref()), Seed::from(s.hash.as_ref()), Seed::from(bump.as_ref())];
+                    let signer = Signer::from(&seeds);
+                    CreateAccount::with_minimum_balance(payer, acc, need as u64, program_id, None)
+                        .map_err(|e| Val::Str(err_str("kv create", e)))?
+                        .invoke_signed(&[signer])
+                }
+            };
+            r.map_err(|e| Val::Str(err_str("kv create", e)))?;
         } else if need > acc.data_len() {
             let rent = Rent::get().map_err(|e| Val::Str(err_str("rent", e)))?;
             let min = rent.try_minimum_balance(need).map_err(|e| Val::Str(err_str("rent", e)))?;

package/transmute/runtime/zoo-host/src/lib.rs

@@ -23,6 +23,9 @@ extern crate alloc;
 pub mod assets;
 pub mod ctx;
 pub mod fmt;
+pub mod helpers;
+pub mod site;
+pub mod vm;
 pub mod json;
 pub mod kv;
 pub mod val;
@@ -43,6 +46,16 @@ pub const TAG_INVOKE: u8 = 0;
 pub const TAG_ASSET_INIT: u8 = 1;
 pub const TAG_ASSET_WRITE: u8 = 2;
 pub const TAG_ASSET_CLOSE: u8 = 3;
+// Shared runtime (zoo-vm) tags. Instruction data after the tag starts with
+// the 32-byte site id, then the same payloads as the compiled-site tags.
+pub const TAG_SITE_INIT: u8 = 16;
+pub const TAG_SITE_SET_AUTHORITY: u8 = 17;
+pub const TAG_VM_INVOKE: u8 = 18;
+pub const TAG_VM_ASSET_INIT: u8 = 19;
+pub const TAG_VM_ASSET_WRITE: u8 = 20;
+pub const TAG_VM_ASSET_CLOSE: u8 = 21;
+/// Path of a site's bytecode asset under the shared runtime.
+pub const CODE_PATH: &str = "/.zoo/code.bin";
 
 /// Custom program error: a KV account the handler needed was not passed.
 /// The gateway reads the `ZOOK` log lines, adds the accounts and retries.

package/transmute/runtime/zoo-host/src/site.rs

@@ -0,0 +1,94 @@
+//! The shared runtime's site registry.
+//!
+//! Under the shared runtime program a site is not a program: it is a site
+//! account `["site", site_id]` naming its authority, a code asset
+//! (`/.zoo/code.bin`, the bytecode module), its static assets and its
+//! manifest, all PDAs of the runtime program namespaced by `site_id`, plus KV
+//! accounts `["kv", site_id, hash]`. `site_id` is any 32-byte id the deployer
+//! picks (the CLI uses a fresh keypair's public key so ids look like programs).
+use crate::ERR_NOT_AUTHORITY;
+use pinocchio::{
+    cpi::{Seed, Signer},
+    error::ProgramError,
+    AccountView, Address, ProgramResult,
+};
+use pinocchio_system::instructions::CreateAccount;
+
+pub const SITE_LEN: usize = 2 + 32 + 32; // ver, bump, authority, reserved
+
+pub fn site_pda(program_id: &Address, site_id: &[u8; 32]) -> (Address, u8) {
+    Address::find_program_address(&[b"site", site_id], program_id)
+}
+
+/// `accounts[0]` must sign as the authority recorded in the site account at `accounts[1]`.
+pub fn check_site_authority(program_id: &Address, accounts: &[AccountView], site_id: &[u8; 32]) -> ProgramResult {
+    let authority = accounts.first().ok_or(ProgramError::NotEnoughAccountKeys)?;
+    let site = accounts.get(1).ok_or(ProgramError::NotEnoughAccountKeys)?;
+    if !authority.is_signer() {
+        return Err(ProgramError::MissingRequiredSignature);
+    }
+    let (expected, _) = site_pda(program_id, site_id);
+    if *site.address() != expected || !site.owned_by(program_id) {
+        return Err(ProgramError::Custom(ERR_NOT_AUTHORITY));
+    }
+    let d = site.try_borrow()?;
+    if d.len() < SITE_LEN || d[0] != 1 || d[2..34] != authority.address().as_ref()[..] {
+        return Err(ProgramError::Custom(ERR_NOT_AUTHORITY));
+    }
+    Ok(())
+}
+
+/// `[32 site_id]`; accounts: authority (signer, pays), site PDA (writable), system program.
+/// Creates the site account owned by the runtime with `authority` in charge.
+pub fn init(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) -> ProgramResult {
+    if data.len() < 32 {
+        return Err(ProgramError::InvalidInstructionData);
+    }
+    let mut site_id = [0u8; 32];
+    site_id.copy_from_slice(&data[..32]);
+    let (head, tail) = accounts.split_at_mut(1);
+    let authority = &head[0];
+    let site = tail.first_mut().ok_or(ProgramError::NotEnoughAccountKeys)?;
+    if !authority.is_signer() {
+        return Err(ProgramError::MissingRequiredSignature);
+    }
+    let (addr, bump) = site_pda(program_id, &site_id);
+    if *site.address() != addr {
+        return Err(ProgramError::InvalidSeeds);
+    }
+    if site.owned_by(program_id) {
+        return Err(ProgramError::AccountAlreadyInitialized);
+    }
+    let bump_bytes = [bump];
+    let seeds = [Seed::from(b"site".as_ref()), Seed::from(site_id.as_ref()), Seed::from(bump_bytes.as_ref())];
+    let signer = Signer::from(&seeds);
+    CreateAccount::with_minimum_balance(authority, site, SITE_LEN as u64, program_id, None)?.invoke_signed(&[signer])?;
+    let mut d = site.try_borrow_mut()?;
+    d[0] = 1;
+    d[1] = bump;
+    d[2..34].copy_from_slice(authority.address().as_ref());
+    Ok(())
+}
+
+/// `[32 site_id][32 new_authority]`; accounts: authority (signer), site PDA (writable).
+pub fn set_authority(program_id: &Address, accounts: &mut [AccountView], data: &[u8]) -> ProgramResult {
+    if data.len() < 64 {
+        return Err(ProgramError::InvalidInstructionData);
+    }
+    let mut site_id = [0u8; 32];
+    site_id.copy_from_slice(&data[..32]);
+    check_site_authority(program_id, accounts, &site_id)?;
+    let site = accounts.get_mut(1).ok_or(ProgramError::NotEnoughAccountKeys)?;
+    let mut d = site.try_borrow_mut()?;
+    d[2..34].copy_from_slice(&data[32..64]);
+    Ok(())
+}
+
+pub fn site_id_from(data: &[u8]) -> Result<([u8; 32], &[u8]), ProgramError> {
+    if data.len() < 32 {
+        return Err(ProgramError::InvalidInstructionData);
+    }
+    let mut id = [0u8; 32];
+    id.copy_from_slice(&data[..32]);
+    Ok((id, &data[32..]))
+}