merge main into feat-caller-program-id-and-flash-swap

test_program_methods/guest/src/bin/clock_chain_caller.rs

@@ -0,0 +1,39 @@
+use nssa_core::{
+    Timestamp,
+    program::{
+        AccountPostState, ChainedCall, ProgramId, ProgramInput, ProgramOutput, read_nssa_inputs,
+    },
+};
+use risc0_zkvm::serde::to_vec;
+
+type Instruction = (ProgramId, Timestamp); // (clock_program_id, timestamp)
+
+/// A program that chain-calls the clock program with the clock accounts it received as pre-states.
+/// Used in tests to verify that user transactions cannot modify clock accounts, even indirectly
+/// via chain calls.
+fn main() {
+    let (
+        ProgramInput {
+            self_program_id,
+            pre_states,
+            instruction: (clock_program_id, timestamp),
+        },
+        instruction_words,
+    ) = read_nssa_inputs::<Instruction>();
+
+    let post_states: Vec<_> = pre_states
+        .iter()
+        .map(|pre| AccountPostState::new(pre.account.clone()))
+        .collect();
+
+    let chained_call = ChainedCall {
+        program_id: clock_program_id,
+        instruction_data: to_vec(&timestamp).unwrap(),
+        pre_states: pre_states.clone(),
+        pda_seeds: vec![],
+    };
+
+    ProgramOutput::new(self_program_id, instruction_words, pre_states, post_states)
+        .with_chained_calls(vec![chained_call])
+        .write();
+}

test_program_methods/guest/src/bin/pinata_cooldown.rs

@@ -0,0 +1,114 @@
+//! Cooldown-based pinata program.
+//!
+//! A Piñata program that uses the on-chain clock to prevent abuse.
+//! After each prize claim the program records the current timestamp; the next claim is only
+//! allowed once a configurable cooldown period has elapsed.
+//!
+//! Expected pre-states (in order):
+//!   0 - pinata account (authorized, owned by this program)
+//!   1 - winner account
+//!   2 - clock account `CLOCK_01`.
+//!
+//! Pinata account data layout (24 bytes):
+//!   [prize: u64 LE | `cooldown_ms`: u64 LE | `last_claim_timestamp`: u64 LE].
+
+use clock_core::{CLOCK_01_PROGRAM_ACCOUNT_ID, ClockAccountData};
+use nssa_core::program::{AccountPostState, Claim, ProgramInput, ProgramOutput, read_nssa_inputs};
+
+type Instruction = ();
+
+struct PinataState {
+    prize: u128,
+    cooldown_ms: u64,
+    last_claim_timestamp: u64,
+}
+
+impl PinataState {
+    fn from_bytes(bytes: &[u8]) -> Self {
+        assert!(bytes.len() >= 32, "Pinata account data too short");
+        let prize = u128::from_le_bytes(bytes[..16].try_into().unwrap());
+        let cooldown_ms = u64::from_le_bytes(bytes[16..24].try_into().unwrap());
+        let last_claim_timestamp = u64::from_le_bytes(bytes[24..32].try_into().unwrap());
+        Self {
+            prize,
+            cooldown_ms,
+            last_claim_timestamp,
+        }
+    }
+
+    fn to_bytes(&self) -> Vec<u8> {
+        let mut buf = Vec::with_capacity(32);
+        buf.extend_from_slice(&self.prize.to_le_bytes());
+        buf.extend_from_slice(&self.cooldown_ms.to_le_bytes());
+        buf.extend_from_slice(&self.last_claim_timestamp.to_le_bytes());
+        buf
+    }
+}
+
+fn main() {
+    let (
+        ProgramInput {
+            self_program_id,
+            pre_states,
+            instruction: (),
+        },
+        instruction_words,
+    ) = read_nssa_inputs::<Instruction>();
+
+    let Ok([pinata, winner, clock_pre]) = <[_; 3]>::try_from(pre_states) else {
+        panic!("Expected exactly 3 input accounts: pinata, winner, clock");
+    };
+
+    // Check the clock account is the system clock account
+    assert_eq!(clock_pre.account_id, CLOCK_01_PROGRAM_ACCOUNT_ID);
+
+    let clock_data = ClockAccountData::from_bytes(&clock_pre.account.data.clone().into_inner());
+    let current_timestamp = clock_data.timestamp;
+
+    let pinata_state = PinataState::from_bytes(&pinata.account.data.clone().into_inner());
+
+    // Enforce cooldown: the elapsed time since the last claim must exceed the cooldown period.
+    let elapsed = current_timestamp.saturating_sub(pinata_state.last_claim_timestamp);
+    assert!(
+        elapsed >= pinata_state.cooldown_ms,
+        "Cooldown not elapsed: {elapsed}ms since last claim, need {}ms",
+        pinata_state.cooldown_ms,
+    );
+
+    let mut pinata_post = pinata.account.clone();
+    let mut winner_post = winner.account.clone();
+
+    pinata_post.balance = pinata_post
+        .balance
+        .checked_sub(pinata_state.prize)
+        .expect("Not enough balance in the pinata");
+    winner_post.balance = winner_post
+        .balance
+        .checked_add(pinata_state.prize)
+        .expect("Overflow when adding prize to winner");
+
+    // Update the last claim timestamp.
+    let updated_state = PinataState {
+        last_claim_timestamp: current_timestamp,
+        ..pinata_state
+    };
+    pinata_post.data = updated_state
+        .to_bytes()
+        .try_into()
+        .expect("Pinata state should fit in account data");
+
+    // Clock account is read-only.
+    let clock_post = clock_pre.account.clone();
+
+    ProgramOutput::new(
+        self_program_id,
+        instruction_words,
+        vec![pinata, winner, clock_pre],
+        vec![
+            AccountPostState::new_claimed_if_default(pinata_post, Claim::Authorized),
+            AccountPostState::new(winner_post),
+            AccountPostState::new(clock_post),
+        ],
+    )
+    .write();
+}

test_program_methods/guest/src/bin/time_locked_transfer.rs

@@ -0,0 +1,70 @@
+//! Time-locked transfer program.
+//!
+//! Demonstrates how a program can include a clock account among its inputs and use the on-chain
+//! timestamp in its logic. The transfer only executes when the clock timestamp is at or past a
+//! caller-supplied deadline; otherwise the program panics.
+//!
+//! Expected pre-states (in order):
+//!   0 - sender account (authorized)
+//!   1 - receiver account
+//!   2 - clock account (read-only, e.g. `CLOCK_01`).
+
+use clock_core::{CLOCK_01_PROGRAM_ACCOUNT_ID, ClockAccountData};
+use nssa_core::program::{AccountPostState, ProgramInput, ProgramOutput, read_nssa_inputs};
+
+/// (`amount`, `deadline_timestamp`).
+type Instruction = (u128, u64);
+
+fn main() {
+    let (
+        ProgramInput {
+            self_program_id,
+            pre_states,
+            instruction: (amount, deadline),
+        },
+        instruction_words,
+    ) = read_nssa_inputs::<Instruction>();
+
+    let Ok([sender_pre, receiver_pre, clock_pre]) = <[_; 3]>::try_from(pre_states) else {
+        panic!("Expected exactly 3 input accounts: sender, receiver, clock");
+    };
+
+    // Check the clock account is the system clock account
+    assert_eq!(clock_pre.account_id, CLOCK_01_PROGRAM_ACCOUNT_ID);
+
+    // Read the current timestamp from the clock account.
+    let clock_data = ClockAccountData::from_bytes(&clock_pre.account.data.clone().into_inner());
+
+    assert!(
+        clock_data.timestamp >= deadline,
+        "Transfer is time-locked until timestamp {deadline}, current is {}",
+        clock_data.timestamp,
+    );
+
+    let mut sender_post = sender_pre.account.clone();
+    let mut receiver_post = receiver_pre.account.clone();
+
+    sender_post.balance = sender_post
+        .balance
+        .checked_sub(amount)
+        .expect("Insufficient balance");
+    receiver_post.balance = receiver_post
+        .balance
+        .checked_add(amount)
+        .expect("Balance overflow");
+
+    // Clock account is read-only: post state equals pre state.
+    let clock_post = clock_pre.account.clone();
+
+    ProgramOutput::new(
+        self_program_id,
+        instruction_words,
+        vec![sender_pre, receiver_pre, clock_pre],
+        vec![
+            AccountPostState::new(sender_post),
+            AccountPostState::new(receiver_post),
+            AccountPostState::new(clock_post),
+        ],
+    )
+    .write();
+}