Module capability 

Compile-time account capability types.

Instead of sprinkling require_signer() / require_writable() calls throughout business logic, Hopper elevates account roles to the type system. A SignerView proves at compile time that the signer check happened. Functions that need a signer take SignerView – zero runtime cost after the single boundary check.

This pattern has no equivalent in pinocchio, Anchor, Steel, or any other Solana framework. Anchor’s Signer<'info> is a macro-generated wrapper that re-checks at runtime. Hopper’s capability types are zero-size wrappers that PROVE the check already happened.

Usage

use hopper_native::capability::{SignerView, WritableView, MutableView};

fn deposit(
    payer: MutableView,     // proven: is_signer + is_writable
    vault: WritableView,    // proven: is_writable
    amount: u64,
) -> ProgramResult {
    // No runtime checks needed -- the types guarantee the properties.
    let lamports = payer.lamports();
    // ...
    Ok(())
}

Structs

ExecutableView

An AccountView proven to contain an executable program.

MutableView

An AccountView that has been proven to be BOTH a signer AND writable.

OwnedView

An AccountView that has been proven to be owned by a specific program.

ReadonlyView

An AccountView proven to be a non-signer, non-writable read-only account. Useful for cross-program reads where you explicitly want to prevent accidental mutation attempts.

SignerView

An AccountView that has been proven to be a transaction signer.

WritableView

An AccountView that has been proven to be writable.