Module systems

Expand description

Protocol-grade Hopper surface.

Import this when a program deliberately reaches beyond framework mode into layout contracts, segment registries, receipts, policies, migrations, manifests, overlays, or cross-program interface pinning.

Re-exports§

pub use crate::interface;
pub use crate::layout;
pub use crate::migration;
pub use crate::policy;
pub use crate::receipt;
pub use crate::schema;
pub use crate::segment;
pub use crate::interface::*;
pub use crate::layout::*;
pub use crate::migration::*;
pub use crate::policy::*;
pub use crate::receipt::*;
pub use crate::schema::*;
pub use crate::segment::*;

Macros§

const_assert_pod: Compile-time assertion for safe manual Pod implementations.
fast_entrypoint: Backward-compatible alias for the fast Hopper entrypoint macro.
hopper_accounts: Generate a typed instruction context struct with validated account parsing.
hopper_assert_compatible: Assert that two layout versions have compatible fingerprints.
hopper_assert_fingerprint: Assert that a layout’s fingerprint matches an expected value.
hopper_check: Composable account constraint checking.
hopper_close: Safely close an account with sentinel protection.
hopper_dynamic_fields: Explicit sugar for declaring bounded dynamic-tail fields.
hopper_dynamic_tail: Declare a dynamic-tail payload with bounded dynamic fields.
hopper_entrypoint: Declare the explicit Hopper runtime entrypoint bridge.
hopper_error: Generate sequential error codes.
hopper_fast_entrypoint: Declare the fast two-argument Hopper entrypoint.
hopper_init: Initialize an account: allocate, assign, zero-init, write header.
hopper_interface: Declare a cross-program interface view.
hopper_invariant: Invariant checking macro.
hopper_layout: Define a zero-copy account layout.
hopper_lazy_entrypoint: Declare the Hopper lazy entrypoint.
hopper_load: Destructuring sugar for raw-dispatch handlers.
hopper_manifest: Generate a layout manifest for schema tooling.
hopper_register_discs: Discriminator registry – compile-time uniqueness enforcement.
hopper_require: Require a condition, returning a custom error if false.
hopper_segment: Declare a segmented account with typed segments.
hopper_validate: Build a validation pipeline declaratively.
hopper_verify_pda: PDA verification with BUMP_OFFSET optimization.
hopper_virtual: Declare a multi-account virtual state mapping.
layout_migrations: Compose a layout’s LayoutMigration::MIGRATIONS chain from a list of #[hopper::migrate]-emitted edge constants.
lazy_entrypoint: Backward-compatible alias for the lazy Hopper entrypoint macro.
no_allocator
nostd_panic_handler
program_entrypoint: Declare the canonical Hopper program entrypoint.

Structs§

Account: A typed, owner-validated account (immutable).
AccountHeader: The 16-byte account header, overlay-safe.
AccountMut: A typed, owner-validated account (mutable).
AccountReader: Header-aware read-only account reader.
Authority: Marker: an authority/signer address.
BoundedString: Bounded UTF-8 string for Hopper dynamic tails.
BoundedVec: Bounded dynamic vector for Hopper dynamic tails.
CachedClock: Cached Clock sysvar fields.
CachedRent: Cached Rent sysvar fields.
CpiAccount: C-ABI account info passed to sol_invoke_signed_c.
DynamicView: An inline dynamic view that caches offsets for O(1) field access.
DynamicViewMut: Mutable inline dynamic view for writing dynamic fields.
FieldInfo: Descriptor for one field in a Hopper layout.
HopperAccount: A layout-bound, owner-validated account.
HopperCpi: Stack-allocated CPI call with compile-time-known account count and data size.
HopperCpiBuf: Variable-data CPI builder – const accounts, runtime data length.
HopperCtx: Typed instruction context carrying validated accounts, bumps, and metadata.
InstructionAccount: Metadata for an account referenced in a CPI instruction.
InstructionView: A cross-program instruction to invoke.
InvariantSet: Batch invariant checker.
Mint: Marker: a mint address.
Mut: Writable wrapper – validates that the account is writable.
Program: Marker: a program address (executable).
ProgramAccount: A generic program-owned account.
ProgramRef: A verified executable program reference.
ReallocGuard: Per-instruction realloc budget guard.
Seed: A single PDA seed for CPI signing.
Segment: Compile-time descriptor of a typed byte range inside an account.
SegmentBorrow: A single active segment borrow.
SegmentBorrowRegistry: Instruction-scoped segment borrow registry.
SegmentEntry: A segment entry in the registry.
SegmentRegistry: Read-only view over a segmented account’s registry.
SegmentRegistryMut: Mutable view over a segmented account’s registry.
SegmentedAccount: A segmented account with role-aware region access.
Signer: Signer wrapper – validates that the account is a signer.
SignerAccount: A verified signer account.
StaticSegment: A compile-time constant segment descriptor.
SysvarContext: Combined sysvar context for a single instruction.
TokenAccount: Marker: a token account address.
TrustFlags: Policy flags for additional constraints.
TrustProfile: A foreign-account trust profile.
TypedAddress: A 32-byte public key tagged with a phantom layout type.
UncheckedAccount: An unchecked account. No validation is performed.
UntypedAddress: An untyped 32-byte address (interop bridge).
VerifiedAccount: Immutable verified account – proof that validation passed.
VerifiedAccountMut: Mutable verified account – proof that validation passed, with write access.

Enums§

AccessKind: Read or write access intent for a segment borrow.
SegmentRole: Segment role classification.
TrustLevel: Trust level for foreign account validation.

Constants§

CLOSE_SENTINEL: Sentinel byte written to byte 0 when an account is closed. Prevents account revival attacks.
EVENT_CPI_PREFIX: Event CPI prefix. Programs should check for this at dispatch entry and return Ok(()) to allow self-CPI events to pass through.
HEADER_EXECUTABLE: Non-duplicate + executable.
HEADER_LEN: Header length in bytes.
HEADER_SIGNER: Non-duplicate + signer.
HEADER_SIGNER_WRITABLE: Non-duplicate + signer + writable.
HEADER_WRITABLE: Non-duplicate + writable.
SEG_ROLE_AUDIT
SEG_ROLE_CACHE
SEG_ROLE_CORE: Segment role flags – convenience constants for SegmentEntry::new().
SEG_ROLE_EXTENSION
SEG_ROLE_INDEX
SEG_ROLE_JOURNAL
SEG_ROLE_SHARD

Traits§

AccountMetaProvider: Trait for types that provide static metadata about themselves.
FieldMap: Trait for layouts that expose field metadata in wire order.
FixedLayout: Trait for types with a compile-time known wire size.
FromAccount: Trait for types that can be constructed from an AccountView with validation.
HasView: Helper trait for types that hold an &AccountView.
HopperAccounts: Trait implemented by account structs (manually or via derive).
HopperIx: Trait defining a Hopper instruction.
HopperLayout: Trait implemented by hopper_layout! types providing layout metadata.
Pod: Marker for types that can be safely overlaid on raw account bytes.
TailCodec: Canonical serializer for dynamic-tail payloads.
TailElement: Element type accepted by #[tail(vec<T, N>)] in #[hopper::dynamic_account].
ValidateAccount: Trait for accounts that can self-validate.

Functions§

assert_segment_field_alignment: Compile-time assertion that a type’s SegmentMap and FieldMap are isomorphic: same count, same names, same offsets, same sizes.
bps_of: Basis-point fee (floor): amount * bps / 10_000.
bps_of_ceil: Basis-point fee (ceiling): ceil(amount * bps / 10_000).
cast_unchecked^⚠: Raw unchecked cast from bytes to an immutable reference.
cast_unchecked_mut^⚠: Raw unchecked cast from bytes to a mutable reference.
check_account: Combined account check: owner + discriminator + minimum size.
check_account_fast: Fast single-compare account validation.
check_authority_fast: Validate a signer + writable account (authority) with single u32 compare.
check_cooldown_elapsed: Check that enough time has elapsed since the last operation.
check_deadline_not_passed: Check that a deadline has NOT passed (now < deadline).
check_discriminator: Check that the discriminator byte matches.
check_executable: Check that an account is executable (a program).
check_executable_fast: Validate an executable (program) account with single u32 compare.
check_has_one: Check has_one: a stored address in account data matches another account’s address.
check_invariant: Check a single invariant condition.
check_invariant_fn: Check a single invariant with a closure (lazy evaluation).
check_keys_eq: Check that two account addresses are equal.
check_lamport_conservation: Verify SOL conservation: total lamports before == total lamports after.
check_no_subsequent_invocation: Ensure our program is not invoked after the current instruction.
check_owner: Check that an account is owned by the expected program.
check_owner_multi: Check that an account is owned by one of the given program IDs.
check_program: Check that an account is a specific program: its key matches expected_program_id and it is flagged executable.
check_rent_exempt: Check that an account is rent exempt.
check_signer: Check that an account is a signer.
check_signer_fast: Validate a signer account with single u32 compare.
check_size: Check minimum data size.
check_staleness: Check that data is not stale (updated recently enough).
check_state_transition: Check that a state transition is valid.
check_writable: Check that an account is writable.
check_writable_coherence: Validate that every writable account in the slice is also a signer OR is owned by our program.
check_writable_fast: Validate a writable account with single u32 compare.
checked_add: Checked addition.
checked_div: Checked division (returns error on divide by zero).
checked_div_ceil: Checked ceiling division: ceil(a / b).
checked_mul: Checked multiplication.
checked_mul_div: Compute (a * b) / c with u128 intermediate to prevent overflow.
checked_mul_div_ceil: Compute ceil((a * b) / c) with u128 intermediate.
checked_pow: Checked exponentiation via repeated squaring.
checked_sub: Checked subtraction.
detect_flash_loan_bracket: Detect flash-loan bracket: same program called before AND after current.
dispatch_instruction: Read a 1-byte dispatch tag from instruction data.
dispatch_instruction_8: Read an 8-byte discriminator (Anchor/Quasar compatible).
dispatch_instruction_u16: Read a 2-byte dispatch tag (for programs with >256 instructions).
div_ceil: Compute ceil(a / b) without overflow (for u64).
emit_event: Emit a Pod event via sol_log_data.
emit_event_tagged: Emit event with a discriminator prefix for easy client-side filtering.
emit_slices: Emit one or more byte slices as a single sol_log_data entry.
find_and_verify_pda: Find a PDA and verify it matches the account, returning the bump.
hopper_entry: Typed instruction entry point.
is_zero_address: Check if a 32-byte address is all zeros (the default/system address).
keys_eq_fast: Fast 32-byte key equality check using 4x u64 comparisons.
load_foreign_with_profile: Load a foreign account with a trust profile, returning a typed overlay.
overlay: Overlay immutable reference to a Pod type at the start of a byte slice.
overlay_mut: Overlay mutable reference to a Pod type at the start of a byte slice.
pod_from_bytes: Zero-copy cast from bytes to an immutable reference.
pod_from_bytes_mut: Zero-copy cast from bytes to a mutable reference.
pod_read: Copy a Pod value from bytes (alignment-safe).
pod_write: Write a Pod value to bytes (alignment-safe).
read_dynamic_u8: Read a u8-prefixed dynamic field: returns (data_slice, next_offset).
read_dynamic_u16: Read a u16-prefixed dynamic field.
read_dynamic_u32: Read a u32-prefixed dynamic field.
read_layout_id: Read the 8-byte layout_id.
rent_exempt_min: Rent-exempt minimum lamports for a given data size.
require_all_unique: Verify that all accounts in a slice have unique addresses.
require_authority: Validate an authority account: must be signer, owned by expected program.
require_owned_writable: Validate a writable program-owned account.
require_payer: Validate a payer account: must be signer + writable.
require_top_level: Require that the current instruction is top-level (not a CPI).
require_unique_signers: Verify that no duplicated account is used as a signer.
require_unique_writable: Verify that no duplicated account is writable.
safe_close: Safely close an account by draining all lamports to destination.
safe_close_with_sentinel: Close with sentinel – writes CLOSE_SENTINEL to byte 0 after zeroing.
safe_realloc: Reallocate an account to a new size.
scale_amount: Scale a token amount between different decimal precisions (floor).
scale_amount_ceil: Scale a token amount between decimal precisions, rounding up.
scale_bps: Scale a value in basis points (BPS). value * bps / 10_000, with overflow protection via u128 intermediate.
scale_fraction: Scale a value by a fraction (numerator / denominator).
segment_id: Compute a segment ID from a name (const FNV-1a hash, truncated to 4 bytes).
snapshot_lamports: Snapshot lamport values for conservation checking.
to_u64: Safe narrowing cast from u128 to u64.
verify_pda: Verify a PDA with bump, using the cheap create_program_address path.
verify_pda_cached: Verify a PDA by reading the bump from account data at a known offset.
write_dynamic_u8: Write a u8-prefixed dynamic field. Returns next offset after written data.
write_dynamic_u16: Write a u16-prefixed dynamic field.
write_dynamic_u32: Write a u32-prefixed dynamic field.
write_header: Write a complete header to the beginning of data.
zero_init: Zero-initialize a byte slice. Must be called before write_header.

Type Aliases§

HopperString: Short alias for bounded UTF-8 strings in dynamic tails.
HopperVec: Short alias for bounded vectors in dynamic tails.
SegmentId: A 4-byte segment identifier, computed from a name at compile time.
Token: Alias for TokenAccount.

Module systems

Module systems Copy item path

Re-exports§

Macros§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Module systems