Merge branch 'main' into schouhy/add-block-context-system-accounts

programs/amm/src/new_definition.rs

@@ -2,11 +2,11 @@ use std::num::NonZeroU128;
 
 use amm_core::{
     PoolDefinition, compute_liquidity_token_pda, compute_liquidity_token_pda_seed,
-    compute_pool_pda, compute_vault_pda,
+    compute_pool_pda, compute_pool_pda_seed, compute_vault_pda, compute_vault_pda_seed,
 };
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::{AccountPostState, ChainedCall, ProgramId},
+    program::{AccountPostState, ChainedCall, Claim, ProgramId},
 };
 
 #[expect(clippy::too_many_arguments, reason = "TODO: Fix later")]
@@ -108,36 +108,52 @@ pub fn new_definition(
     };
 
     pool_post.data = Data::from(&pool_post_definition);
-    let pool_post = AccountPostState::new_claimed_if_default(pool_post);
+    let pool_pda_seed = compute_pool_pda_seed(definition_token_a_id, definition_token_b_id);
+    let pool_post = AccountPostState::new_claimed_if_default(pool_post, Claim::Pda(pool_pda_seed));
 
     let token_program_id = user_holding_a.account.program_owner;
 
     // Chain call for Token A (user_holding_a -> Vault_A)
+    let vault_a_seed = compute_vault_pda_seed(pool.account_id, definition_token_a_id);
+    let vault_a_authorized = AccountWithMetadata {
+        is_authorized: true,
+        ..vault_a.clone()
+    };
     let call_token_a = ChainedCall::new(
         token_program_id,
-        vec![user_holding_a.clone(), vault_a.clone()],
+        vec![user_holding_a.clone(), vault_a_authorized],
         &token_core::Instruction::Transfer {
             amount_to_transfer: token_a_amount.into(),
         },
-    );
+    )
+    .with_pda_seeds(vec![vault_a_seed]);
+
     // Chain call for Token B (user_holding_b -> Vault_B)
+    let vault_b_seed = compute_vault_pda_seed(pool.account_id, definition_token_b_id);
+    let vault_b_authorized = AccountWithMetadata {
+        is_authorized: true,
+        ..vault_b.clone()
+    };
     let call_token_b = ChainedCall::new(
         token_program_id,
-        vec![user_holding_b.clone(), vault_b.clone()],
+        vec![user_holding_b.clone(), vault_b_authorized],
         &token_core::Instruction::Transfer {
             amount_to_transfer: token_b_amount.into(),
         },
-    );
-
-    let mut pool_lp_auth = pool_definition_lp.clone();
-    pool_lp_auth.is_authorized = true;
+    )
+    .with_pda_seeds(vec![vault_b_seed]);
 
+    let pool_lp_pda_seed = compute_liquidity_token_pda_seed(pool.account_id);
+    let pool_lp_authorized = AccountWithMetadata {
+        is_authorized: true,
+        ..pool_definition_lp.clone()
+    };
     let call_token_lp = ChainedCall::new(
         token_program_id,
-        vec![pool_lp_auth, user_holding_lp.clone()],
+        vec![pool_lp_authorized, user_holding_lp.clone()],
         &instruction,
     )
-    .with_pda_seeds(vec![compute_liquidity_token_pda_seed(pool.account_id)]);
+    .with_pda_seeds(vec![pool_lp_pda_seed]);
 
     let chained_calls = vec![call_token_lp, call_token_b, call_token_a];
 

programs/amm/src/tests.rs

@@ -1,4 +1,4 @@
-use std::num::NonZero;
+use std::{num::NonZero, vec};
 
 use amm_core::{
     PoolDefinition, compute_liquidity_token_pda, compute_liquidity_token_pda_seed,
@@ -1756,7 +1756,7 @@ impl AccountsForExeTests {
                 definition_id: IdForExeTests::token_lp_definition_id(),
                 balance: BalanceForExeTests::lp_supply_init(),
             }),
-            nonce: 0_u128.into(),
+            nonce: 1_u128.into(),
         }
     }
 
@@ -1801,7 +1801,7 @@ impl AccountsForExeTests {
                 definition_id: IdForExeTests::token_lp_definition_id(),
                 balance: 0,
             }),
-            nonce: 0_u128.into(),
+            nonce: 1.into(),
         }
     }
 }
@@ -2733,7 +2733,7 @@ fn simple_amm_remove() {
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -2799,7 +2799,7 @@ fn simple_amm_new_definition_inactive_initialized_pool_and_uninit_user_lp() {
             IdForExeTests::user_token_b_id(),
             IdForExeTests::user_token_lp_id(),
         ],
-        vec![0_u128.into(), 0_u128.into()],
+        vec![0_u128.into(), 0_u128.into(), 0_u128.into()],
         instruction,
     )
     .unwrap();
@@ -2809,11 +2809,12 @@ fn simple_amm_new_definition_inactive_initialized_pool_and_uninit_user_lp() {
         &[
             &PrivateKeysForTests::user_token_a_key(),
             &PrivateKeysForTests::user_token_b_key(),
+            &PrivateKeysForTests::user_token_lp_key(),
         ],
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -2897,7 +2898,7 @@ fn simple_amm_new_definition_inactive_initialized_pool_init_user_lp() {
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -2955,7 +2956,7 @@ fn simple_amm_new_definition_uninitialized_pool() {
             IdForExeTests::user_token_b_id(),
             IdForExeTests::user_token_lp_id(),
         ],
-        vec![0_u128.into(), 0_u128.into()],
+        vec![0_u128.into(), 0_u128.into(), 0_u128.into()],
         instruction,
     )
     .unwrap();
@@ -2965,11 +2966,12 @@ fn simple_amm_new_definition_uninitialized_pool() {
         &[
             &PrivateKeysForTests::user_token_a_key(),
             &PrivateKeysForTests::user_token_b_key(),
+            &PrivateKeysForTests::user_token_lp_key(),
         ],
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -3031,7 +3033,7 @@ fn simple_amm_add() {
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -3088,7 +3090,7 @@ fn simple_amm_swap_1() {
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());
@@ -3138,7 +3140,7 @@ fn simple_amm_swap_2() {
     );
 
     let tx = PublicTransaction::new(message, witness_set);
-    state.transition_from_public_transaction(&tx).unwrap();
+    state.transition_from_public_transaction(&tx, 1, 0).unwrap();
 
     let pool_post = state.get_account_by_id(IdForExeTests::pool_definition_id());
     let vault_a_post = state.get_account_by_id(IdForExeTests::vault_a_id());

programs/associated_token_account/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "ata_program"
+version = "0.1.0"
+edition = "2024"
+license = { workspace = true }
+
+[dependencies]
+nssa_core.workspace = true
+token_core.workspace = true
+ata_core.workspace = true

programs/associated_token_account/core/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "ata_core"
+version = "0.1.0"
+edition = "2024"
+license = { workspace = true }
+
+[dependencies]
+nssa_core.workspace = true
+serde.workspace = true
+risc0-zkvm.workspace = true

programs/associated_token_account/core/src/lib.rs

@@ -0,0 +1,82 @@
+pub use nssa_core::program::PdaSeed;
+use nssa_core::{
+    account::{AccountId, AccountWithMetadata},
+    program::ProgramId,
+};
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize)]
+pub enum Instruction {
+    /// Create the Associated Token Account for (owner, definition).
+    /// Idempotent: no-op if the account already exists.
+    ///
+    /// Required accounts (3):
+    /// - Owner account
+    /// - Token definition account
+    /// - Associated token account (default/uninitialized, or already initialized)
+    ///
+    /// `token_program_id` is derived from `token_definition.account.program_owner`.
+    Create { ata_program_id: ProgramId },
+
+    /// Transfer tokens FROM owner's ATA to a recipient holding account.
+    /// Uses PDA seeds to authorize the ATA in the chained Token::Transfer call.
+    ///
+    /// Required accounts (3):
+    /// - Owner account (authorized)
+    /// - Sender ATA (owner's token holding)
+    /// - Recipient token holding (any account; auto-created if default)
+    ///
+    /// `token_program_id` is derived from `sender_ata.account.program_owner`.
+    Transfer {
+        ata_program_id: ProgramId,
+        amount: u128,
+    },
+
+    /// Burn tokens FROM owner's ATA.
+    /// Uses PDA seeds to authorize the ATA in the chained Token::Burn call.
+    ///
+    /// Required accounts (3):
+    /// - Owner account (authorized)
+    /// - Owner's ATA (the holding to burn from)
+    /// - Token definition account
+    ///
+    /// `token_program_id` is derived from `holder_ata.account.program_owner`.
+    Burn {
+        ata_program_id: ProgramId,
+        amount: u128,
+    },
+}
+
+pub fn compute_ata_seed(owner_id: AccountId, definition_id: AccountId) -> PdaSeed {
+    use risc0_zkvm::sha::{Impl, Sha256};
+    let mut bytes = [0u8; 64];
+    bytes[0..32].copy_from_slice(&owner_id.to_bytes());
+    bytes[32..64].copy_from_slice(&definition_id.to_bytes());
+    PdaSeed::new(
+        Impl::hash_bytes(&bytes)
+            .as_bytes()
+            .try_into()
+            .expect("Hash output must be exactly 32 bytes long"),
+    )
+}
+
+pub fn get_associated_token_account_id(ata_program_id: &ProgramId, seed: &PdaSeed) -> AccountId {
+    AccountId::from((ata_program_id, seed))
+}
+
+/// Verify the ATA's address matches `(ata_program_id, owner, definition)` and return
+/// the [`PdaSeed`] for use in chained calls.
+pub fn verify_ata_and_get_seed(
+    ata_account: &AccountWithMetadata,
+    owner: &AccountWithMetadata,
+    definition_id: AccountId,
+    ata_program_id: ProgramId,
+) -> PdaSeed {
+    let seed = compute_ata_seed(owner.account_id, definition_id);
+    let expected_id = get_associated_token_account_id(&ata_program_id, &seed);
+    assert_eq!(
+        ata_account.account_id, expected_id,
+        "ATA account ID does not match expected derivation"
+    );
+    seed
+}

programs/associated_token_account/src/burn.rs

@@ -0,0 +1,39 @@
+use nssa_core::{
+    account::AccountWithMetadata,
+    program::{AccountPostState, ChainedCall, ProgramId},
+};
+use token_core::TokenHolding;
+
+pub fn burn_from_associated_token_account(
+    owner: AccountWithMetadata,
+    holder_ata: AccountWithMetadata,
+    token_definition: AccountWithMetadata,
+    ata_program_id: ProgramId,
+    amount: u128,
+) -> (Vec<AccountPostState>, Vec<ChainedCall>) {
+    let token_program_id = holder_ata.account.program_owner;
+    assert!(owner.is_authorized, "Owner authorization is missing");
+    let definition_id = TokenHolding::try_from(&holder_ata.account.data)
+        .expect("Holder ATA must hold a valid token")
+        .definition_id();
+    let seed =
+        ata_core::verify_ata_and_get_seed(&holder_ata, &owner, definition_id, ata_program_id);
+
+    let post_states = vec![
+        AccountPostState::new(owner.account.clone()),
+        AccountPostState::new(holder_ata.account.clone()),
+        AccountPostState::new(token_definition.account.clone()),
+    ];
+    let mut holder_ata_auth = holder_ata.clone();
+    holder_ata_auth.is_authorized = true;
+
+    let chained_call = ChainedCall::new(
+        token_program_id,
+        vec![token_definition.clone(), holder_ata_auth],
+        &token_core::Instruction::Burn {
+            amount_to_burn: amount,
+        },
+    )
+    .with_pda_seeds(vec![seed]);
+    (post_states, vec![chained_call])
+}

programs/associated_token_account/src/create.rs

@@ -0,0 +1,50 @@
+use nssa_core::{
+    account::{Account, AccountWithMetadata},
+    program::{AccountPostState, ChainedCall, Claim, ProgramId},
+};
+
+pub fn create_associated_token_account(
+    owner: AccountWithMetadata,
+    token_definition: AccountWithMetadata,
+    ata_account: AccountWithMetadata,
+    ata_program_id: ProgramId,
+) -> (Vec<AccountPostState>, Vec<ChainedCall>) {
+    // No authorization check needed: create is idempotent, so anyone can call it safely.
+    let token_program_id = token_definition.account.program_owner;
+    let ata_seed = ata_core::verify_ata_and_get_seed(
+        &ata_account,
+        &owner,
+        token_definition.account_id,
+        ata_program_id,
+    );
+
+    // Idempotent: already initialized → no-op
+    if ata_account.account != Account::default() {
+        return (
+            vec![
+                AccountPostState::new_claimed_if_default(owner.account.clone(), Claim::Authorized),
+                AccountPostState::new(token_definition.account.clone()),
+                AccountPostState::new(ata_account.account.clone()),
+            ],
+            vec![],
+        );
+    }
+
+    let post_states = vec![
+        AccountPostState::new_claimed_if_default(owner.account.clone(), Claim::Authorized),
+        AccountPostState::new(token_definition.account.clone()),
+        AccountPostState::new(ata_account.account.clone()),
+    ];
+    let ata_account_auth = AccountWithMetadata {
+        is_authorized: true,
+        ..ata_account.clone()
+    };
+    let chained_call = ChainedCall::new(
+        token_program_id,
+        vec![token_definition.clone(), ata_account_auth],
+        &token_core::Instruction::InitializeAccount,
+    )
+    .with_pda_seeds(vec![ata_seed]);
+
+    (post_states, vec![chained_call])
+}

programs/associated_token_account/src/lib.rs

@@ -0,0 +1,10 @@
+//! The Associated Token Account Program implementation.
+
+pub use ata_core as core;
+
+pub mod burn;
+pub mod create;
+pub mod transfer;
+
+#[cfg(test)]
+mod tests;

programs/associated_token_account/src/tests.rs

@@ -0,0 +1,153 @@
+#![cfg(test)]
+
+use ata_core::{compute_ata_seed, get_associated_token_account_id};
+use nssa_core::account::{Account, AccountId, AccountWithMetadata, Data};
+use token_core::{TokenDefinition, TokenHolding};
+
+const ATA_PROGRAM_ID: nssa_core::program::ProgramId = [1u32; 8];
+const TOKEN_PROGRAM_ID: nssa_core::program::ProgramId = [2u32; 8];
+
+fn owner_id() -> AccountId {
+    AccountId::new([0x01u8; 32])
+}
+
+fn definition_id() -> AccountId {
+    AccountId::new([0x02u8; 32])
+}
+
+fn ata_id() -> AccountId {
+    get_associated_token_account_id(
+        &ATA_PROGRAM_ID,
+        &compute_ata_seed(owner_id(), definition_id()),
+    )
+}
+
+fn owner_account() -> AccountWithMetadata {
+    AccountWithMetadata {
+        account: Account::default(),
+        is_authorized: true,
+        account_id: owner_id(),
+    }
+}
+
+fn definition_account() -> AccountWithMetadata {
+    AccountWithMetadata {
+        account: Account {
+            program_owner: TOKEN_PROGRAM_ID,
+            balance: 0,
+            data: Data::from(&TokenDefinition::Fungible {
+                name: "TEST".to_string(),
+                total_supply: 1000,
+                metadata_id: None,
+            }),
+            nonce: nssa_core::account::Nonce(0),
+        },
+        is_authorized: false,
+        account_id: definition_id(),
+    }
+}
+
+fn uninitialized_ata_account() -> AccountWithMetadata {
+    AccountWithMetadata {
+        account: Account::default(),
+        is_authorized: false,
+        account_id: ata_id(),
+    }
+}
+
+fn initialized_ata_account() -> AccountWithMetadata {
+    AccountWithMetadata {
+        account: Account {
+            program_owner: TOKEN_PROGRAM_ID,
+            balance: 0,
+            data: Data::from(&TokenHolding::Fungible {
+                definition_id: definition_id(),
+                balance: 100,
+            }),
+            nonce: nssa_core::account::Nonce(0),
+        },
+        is_authorized: false,
+        account_id: ata_id(),
+    }
+}
+
+#[test]
+fn create_emits_chained_call_for_uninitialized_ata() {
+    let (post_states, chained_calls) = crate::create::create_associated_token_account(
+        owner_account(),
+        definition_account(),
+        uninitialized_ata_account(),
+        ATA_PROGRAM_ID,
+    );
+
+    assert_eq!(post_states.len(), 3);
+    assert_eq!(chained_calls.len(), 1);
+    assert_eq!(chained_calls[0].program_id, TOKEN_PROGRAM_ID);
+}
+
+#[test]
+fn create_is_idempotent_for_initialized_ata() {
+    let (post_states, chained_calls) = crate::create::create_associated_token_account(
+        owner_account(),
+        definition_account(),
+        initialized_ata_account(),
+        ATA_PROGRAM_ID,
+    );
+
+    assert_eq!(post_states.len(), 3);
+    assert!(
+        chained_calls.is_empty(),
+        "Should emit no chained call for already-initialized ATA"
+    );
+}
+
+#[test]
+#[should_panic(expected = "ATA account ID does not match expected derivation")]
+fn create_panics_on_wrong_ata_address() {
+    let wrong_ata = AccountWithMetadata {
+        account: Account::default(),
+        is_authorized: false,
+        account_id: AccountId::new([0xFFu8; 32]),
+    };
+
+    crate::create::create_associated_token_account(
+        owner_account(),
+        definition_account(),
+        wrong_ata,
+        ATA_PROGRAM_ID,
+    );
+}
+
+#[test]
+fn get_associated_token_account_id_is_deterministic() {
+    let seed = compute_ata_seed(owner_id(), definition_id());
+    let id1 = get_associated_token_account_id(&ATA_PROGRAM_ID, &seed);
+    let id2 = get_associated_token_account_id(&ATA_PROGRAM_ID, &seed);
+    assert_eq!(id1, id2);
+}
+
+#[test]
+fn get_associated_token_account_id_differs_by_owner() {
+    let other_owner = AccountId::new([0x99u8; 32]);
+    let id1 = get_associated_token_account_id(
+        &ATA_PROGRAM_ID,
+        &compute_ata_seed(owner_id(), definition_id()),
+    );
+    let id2 = get_associated_token_account_id(
+        &ATA_PROGRAM_ID,
+        &compute_ata_seed(other_owner, definition_id()),
+    );
+    assert_ne!(id1, id2);
+}
+
+#[test]
+fn get_associated_token_account_id_differs_by_definition() {
+    let other_def = AccountId::new([0x99u8; 32]);
+    let id1 = get_associated_token_account_id(
+        &ATA_PROGRAM_ID,
+        &compute_ata_seed(owner_id(), definition_id()),
+    );
+    let id2 =
+        get_associated_token_account_id(&ATA_PROGRAM_ID, &compute_ata_seed(owner_id(), other_def));
+    assert_ne!(id1, id2);
+}

programs/associated_token_account/src/transfer.rs

@@ -0,0 +1,39 @@
+use nssa_core::{
+    account::AccountWithMetadata,
+    program::{AccountPostState, ChainedCall, ProgramId},
+};
+use token_core::TokenHolding;
+
+pub fn transfer_from_associated_token_account(
+    owner: AccountWithMetadata,
+    sender_ata: AccountWithMetadata,
+    recipient: AccountWithMetadata,
+    ata_program_id: ProgramId,
+    amount: u128,
+) -> (Vec<AccountPostState>, Vec<ChainedCall>) {
+    let token_program_id = sender_ata.account.program_owner;
+    assert!(owner.is_authorized, "Owner authorization is missing");
+    let definition_id = TokenHolding::try_from(&sender_ata.account.data)
+        .expect("Sender ATA must hold a valid token")
+        .definition_id();
+    let seed =
+        ata_core::verify_ata_and_get_seed(&sender_ata, &owner, definition_id, ata_program_id);
+
+    let post_states = vec![
+        AccountPostState::new(owner.account.clone()),
+        AccountPostState::new(sender_ata.account.clone()),
+        AccountPostState::new(recipient.account.clone()),
+    ];
+    let mut sender_ata_auth = sender_ata.clone();
+    sender_ata_auth.is_authorized = true;
+
+    let chained_call = ChainedCall::new(
+        token_program_id,
+        vec![sender_ata_auth, recipient.clone()],
+        &token_core::Instruction::Transfer {
+            amount_to_transfer: amount,
+        },
+    )
+    .with_pda_seeds(vec![seed]);
+    (post_states, vec![chained_call])
+}

programs/token/core/src/lib.rs

@@ -10,23 +10,23 @@ pub enum Instruction {
     /// Transfer tokens from sender to recipient.
     ///
     /// Required accounts:
-    /// - Sender's Token Holding account (authorized),
-    /// - Recipient's Token Holding account.
+    /// - Sender's Token Holding account (initialized, authorized),
+    /// - Recipient's Token Holding account (initialized or authorized and uninitialized).
     Transfer { amount_to_transfer: u128 },
 
     /// Create a new fungible token definition without metadata.
     ///
     /// Required accounts:
-    /// - Token Definition account (uninitialized),
-    /// - Token Holding account (uninitialized).
+    /// - Token Definition account (uninitialized, authorized),
+    /// - Token Holding account (uninitialized, authorized).
     NewFungibleDefinition { name: String, total_supply: u128 },
 
     /// Create a new fungible or non-fungible token definition with metadata.
     ///
     /// Required accounts:
-    /// - Token Definition account (uninitialized),
-    /// - Token Holding account (uninitialized),
-    /// - Token Metadata account (uninitialized).
+    /// - Token Definition account (uninitialized, authorized),
+    /// - Token Holding account (uninitialized, authorized),
+    /// - Token Metadata account (uninitialized, authorized).
     NewDefinitionWithMetadata {
         new_definition: NewTokenDefinition,
         /// Boxed to avoid large enum variant size.
@@ -36,29 +36,29 @@ pub enum Instruction {
     /// Initialize a token holding account for a given token definition.
     ///
     /// Required accounts:
-    /// - Token Definition account (initialized),
-    /// - Token Holding account (uninitialized),
+    /// - Token Definition account (initialized, any authorization),
+    /// - Token Holding account (uninitialized, authorized),
     InitializeAccount,
 
     /// Burn tokens from the holder's account.
     ///
     /// Required accounts:
-    /// - Token Definition account (initialized),
-    /// - Token Holding account (authorized).
+    /// - Token Definition account (initialized, any authorization),
+    /// - Token Holding account (initialized, authorized).
     Burn { amount_to_burn: u128 },
 
     /// Mint new tokens to the holder's account.
     ///
     /// Required accounts:
-    /// - Token Definition account (authorized),
-    /// - Token Holding account (uninitialized or initialized).
+    /// - Token Definition account (initialized, authorized),
+    /// - Token Holding account (uninitialized or authorized and initialized).
     Mint { amount_to_mint: u128 },
 
     /// Print a new NFT from the master copy.
     ///
     /// Required accounts:
     /// - NFT Master Token Holding account (authorized),
-    /// - NFT Printed Copy Token Holding account (uninitialized).
+    /// - NFT Printed Copy Token Holding account (uninitialized, authorized).
     PrintNft,
 }
 

programs/token/src/initialize.rs

@@ -1,6 +1,6 @@
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::AccountPostState,
+    program::{AccountPostState, Claim},
 };
 use token_core::{TokenDefinition, TokenHolding};
 
@@ -30,6 +30,6 @@ pub fn initialize_account(
 
     vec![
         AccountPostState::new(definition_post),
-        AccountPostState::new_claimed(account_to_initialize),
+        AccountPostState::new_claimed(account_to_initialize, Claim::Authorized),
     ]
 }

programs/token/src/mint.rs

@@ -1,6 +1,6 @@
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::AccountPostState,
+    program::{AccountPostState, Claim},
 };
 use token_core::{TokenDefinition, TokenHolding};
 
@@ -67,6 +67,6 @@ pub fn mint(
 
     vec![
         AccountPostState::new(definition_post),
-        AccountPostState::new_claimed_if_default(holding_post),
+        AccountPostState::new_claimed_if_default(holding_post, Claim::Authorized),
     ]
 }

programs/token/src/new_definition.rs

@@ -1,6 +1,6 @@
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::AccountPostState,
+    program::{AccountPostState, Claim},
 };
 use token_core::{
     NewTokenDefinition, NewTokenMetadata, TokenDefinition, TokenHolding, TokenMetadata,
@@ -42,8 +42,8 @@ pub fn new_fungible_definition(
     holding_target_account_post.data = Data::from(&token_holding);
 
     vec![
-        AccountPostState::new_claimed(definition_target_account_post),
-        AccountPostState::new_claimed(holding_target_account_post),
+        AccountPostState::new_claimed(definition_target_account_post, Claim::Authorized),
+        AccountPostState::new_claimed(holding_target_account_post, Claim::Authorized),
     ]
 }
 
@@ -119,8 +119,8 @@ pub fn new_definition_with_metadata(
     metadata_target_account_post.data = Data::from(&token_metadata);
 
     vec![
-        AccountPostState::new_claimed(definition_target_account_post),
-        AccountPostState::new_claimed(holding_target_account_post),
-        AccountPostState::new_claimed(metadata_target_account_post),
+        AccountPostState::new_claimed(definition_target_account_post, Claim::Authorized),
+        AccountPostState::new_claimed(holding_target_account_post, Claim::Authorized),
+        AccountPostState::new_claimed(metadata_target_account_post, Claim::Authorized),
     ]
 }

programs/token/src/print_nft.rs

@@ -1,6 +1,6 @@
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::AccountPostState,
+    program::{AccountPostState, Claim},
 };
 use token_core::TokenHolding;
 
@@ -50,6 +50,6 @@ pub fn print_nft(
 
     vec![
         AccountPostState::new(master_account_post),
-        AccountPostState::new_claimed(printed_account_post),
+        AccountPostState::new_claimed(printed_account_post, Claim::Authorized),
     ]
 }

programs/token/src/tests.rs

@@ -5,7 +5,10 @@
     reason = "We don't care about it in tests"
 )]
 
-use nssa_core::account::{Account, AccountId, AccountWithMetadata, Data};
+use nssa_core::{
+    account::{Account, AccountId, AccountWithMetadata, Data},
+    program::Claim,
+};
 use token_core::{
     MetadataStandard, NewTokenDefinition, NewTokenMetadata, TokenDefinition, TokenHolding,
 };
@@ -851,7 +854,7 @@ fn mint_uninit_holding_success() {
         *holding_post.account(),
         AccountForTests::init_mint().account
     );
-    assert!(holding_post.requires_claim());
+    assert_eq!(holding_post.required_claim(), Some(Claim::Authorized));
 }
 
 #[test]

programs/token/src/transfer.rs

@@ -1,6 +1,6 @@
 use nssa_core::{
     account::{Account, AccountWithMetadata, Data},
-    program::AccountPostState,
+    program::{AccountPostState, Claim},
 };
 use token_core::TokenHolding;
 
@@ -106,6 +106,6 @@ pub fn transfer(
 
     vec![
         AccountPostState::new(sender_post),
-        AccountPostState::new_claimed_if_default(recipient_post),
+        AccountPostState::new_claimed_if_default(recipient_post, Claim::Authorized),
     ]
 }