pub struct ForeignLens<'a, T>where
T: AccountLayout + LayoutContract,{ /* private fields */ }Expand description
A verified read-only handle into a foreign account.
ForeignLens<'a, T> borrows the underlying account data for its
lifetime. Field access (.get(), .field::<F, OFFSET>()) performs
only pointer arithmetic. no further verification, because all
cross-program invariants were pinned at construction.
Implementations§
Source§impl<'a, T> ForeignLens<'a, T>where
T: AccountLayout + LayoutContract,
impl<'a, T> ForeignLens<'a, T>where
T: AccountLayout + LayoutContract,
Sourcepub fn open(
account: &'a AccountView,
manifest: &ForeignManifest,
) -> Result<ForeignLens<'a, T>, ProgramError>
pub fn open( account: &'a AccountView, manifest: &ForeignManifest, ) -> Result<ForeignLens<'a, T>, ProgramError>
Verify a foreign account against the supplied manifest and, on success, return a read-only lens into its body.
The four verification steps correspond one-to-one with the audit’s page-14 requirements:
- owner match
- discriminator match (both
T::DISCandmanifest.expected_disc) - wire-fingerprint match
- schema_epoch in supported range
Sourcepub fn get(&self) -> &T
pub fn get(&self) -> &T
The full verified layout. Field access through this path is zero-cost; no further checks fire.
Sourcepub fn field<F, const OFFSET: usize>(&self) -> Result<&F, ProgramError>where
F: ZeroCopy,
pub fn field<F, const OFFSET: usize>(&self) -> Result<&F, ProgramError>where
F: ZeroCopy,
Project a typed field by byte offset. Returns a pointer-cast reference with the lens’s lifetime.
OFFSET must be the field’s offset within the layout body
(i.e. already past the 16-byte Hopper header). Callers should
prefer the auto-emitted {FIELD}_OFFSET constants from
#[hopper::state].