Write from a Solana Program

[package]
name = "quill-client"
version = "0.1.0"
edition = "2021"
description = "CLI that drives the quill program: reserve, delegate, write, read back."
license = "Apache-2.0"

[[bin]]
name = "quill"
path = "src/main.rs"

[dependencies]
# The same builders the program uses, off chain this time, to assemble transactions.
tape-api = "0.4.0"
tape-core = "0.4.0"
tape-crypto = "0.4.0"

# Pinned to the versions tape-api resolves against, so the Pubkey and Instruction
# types unify with no duplicate solana-program in the graph.
solana-client = "=4.0.0"
solana-program = "=4.0.0"
solana-keypair = "=3.1.0"
solana-signer = "=3.0.0"
solana-transaction = "=3.1.0"
solana-commitment-config = "=3.1.1"

//! CLI that drives the quill program end to end
//!
//! Reserve a tape, delegate writes to the program's PDA, write caller-named objects,
//! and read the tape back, using vanilla `solana-client` plus the same `tape-api`
//! builders the program uses.
//!
//! Config comes from the shared example environment:
//! `SOLANA_RPC`, `KEYPAIR_PATH`, and optionally `QUILL_PROGRAM_ID`.
//!
//! Reserve size/duration and the written object are overridable on the command
//! line: `--mb`, `--epochs`, `--name`, and either `--message <text>` for a literal
//! payload or `--file <path>` to write a file's bytes (content type inferred from
//! its extension, or forced with `--content-type <mime>`).

use std::env;
use std::fs;
use std::path::Path;
use std::str::FromStr;

use solana_client::rpc_client::RpcClient;
use solana_commitment_config::CommitmentConfig;
use solana_keypair::{read_keypair_file, Keypair};
use solana_program::instruction::{AccountMeta, Instruction};
use solana_program::pubkey::Pubkey;
use solana_program::sysvar;
use solana_signer::Signer;
use solana_transaction::Transaction;

use tape_api::instruction::{build_reserve_tape_ix, build_set_tape_delegate_ix};
use tape_api::program::tapedrive::{self, system_pda, tape_pda};
use tape_api::state::{System, Tape};
use tape_core::types::{ContentType, EpochNumber, StorageUnits};
use tape_crypto::Address;

type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>;

/// PDA seed prefix shared with the program (`["quill", tape]`)
const QUILL_SEED: &[u8] = b"quill";

const DEFAULT_MEGABYTES: u64 = 10;
const DEFAULT_EPOCHS: u64 = 100;

const DEFAULT_NAME: &str = "greetings/0001";
const DEFAULT_MESSAGE: &str = "hello, tape";

/// A whole inline write rides in a single transaction to the quill program, so it
/// is bound by the Solana packet limit, not the 10 KB CPI ceiling. Keep the framed
/// object (header + name + payload) within the SDK's proven inline budget (825 B);
/// past this you'd move to a coded write. (The sibling `loom` example collects
/// larger inline writes in a buffer account across several transactions.)
const MAX_INLINE_BYTES: usize = 825;

/// Run-time values parsed from the command line, each falling back to its default:
/// reserve size (`--mb`), reserve duration (`--epochs`), and the object written by
/// `write` / `all`: its `name`, `content_type`, and `payload` bytes (from either
/// `--message` text or a `--file`).
struct Options {
    megabytes: u64,
    epochs: u64,
    name: String,
    content_type: ContentType,
    payload: Vec<u8>,
}

fn main() -> Result<()> {
    let command = env::args().nth(1).unwrap_or_default();

    match command.as_str() {
        "reserve" | "delegate" | "write" | "show" | "all" => {}
        other => {
            println!("{}", usage(other));
            return Ok(());
        }
    }

    let options = parse_options()?;

    let rpc = RpcClient::new_with_commitment(rpc_url()?, CommitmentConfig::confirmed());
    let payer = read_keypair_file(keypair_path()?)?;
    let payer_key = pubkey_from_bytes(payer.pubkey().to_bytes());

    let quill_id = program_id()?;
    let tape = to_pubkey(&tape_pda(to_address(&payer_key)).0);
    let (writer, _) = Pubkey::find_program_address(&[QUILL_SEED, tape.as_ref()], &quill_id);

    println!("Quill: writing to Tapedrive from a program\n");
    println!("  payer / tape owner    {payer_key}");
    println!("  tape                  {tape}");
    println!("  writer PDA (delegate) {writer}");
    println!("  quill program         {quill_id}");
    println!();

    match command.as_str() {
        "reserve" => reserve(&rpc, &payer, &payer_key, &options)?,
        "delegate" => delegate(&rpc, &payer, &payer_key, &tape, &writer)?,
        "write" => write(&rpc, &payer, &payer_key, &tape, &quill_id, &writer, &options)?,
        "show" => show(&rpc, &tape)?,
        "all" => run_all(&rpc, &payer, &payer_key, &tape, &quill_id, &writer, &options)?,
        other => return Err(usage(other).into()),
    }

    Ok(())
}

/// Reserve, delegate, write one object, then print the tape
fn run_all(
    rpc: &RpcClient,
    payer: &Keypair,
    payer_key: &Pubkey,
    tape: &Pubkey,
    quill_id: &Pubkey,
    writer: &Pubkey,
    options: &Options,
) -> Result<()> {
    reserve(rpc, payer, payer_key, options)?;
    delegate(rpc, payer, payer_key, tape, writer)?;
    write(rpc, payer, payer_key, tape, quill_id, writer, options)?;
    show(rpc, tape)
}

/// Reserve a tape owned by the payer, active from the current epoch
fn reserve(rpc: &RpcClient, payer: &Keypair, payer_key: &Pubkey, options: &Options) -> Result<()> {
    let system = fetch_system(rpc)?;
    let activation = system.current_epoch;
    let expiry = EpochNumber(activation.0 + options.epochs);

    let instruction = build_reserve_tape_ix(
        to_address(payer_key),
        to_address(payer_key),
        StorageUnits::mb(options.megabytes),
        activation,
        expiry,
    );

    println!("Reserve a tape you own");
    println!(
        "  Tapedrive reserves [\"cassette\", payer], {} MB, active from this epoch",
        options.megabytes
    );
    send(rpc, payer, payer_key, &[instruction])
}

/// Delegate tape writes to the program's `["quill", tape]` PDA
fn delegate(
    rpc: &RpcClient,
    payer: &Keypair,
    payer_key: &Pubkey,
    tape: &Pubkey,
    writer: &Pubkey,
) -> Result<()> {
    let instruction = build_set_tape_delegate_ix(
        to_address(payer_key),
        to_address(payer_key),
        to_address(tape),
        to_address(writer),
    );

    println!("Delegate writes to the program");
    println!("  SetTapeDelegate(delegate = writer PDA), the program may now append tracks");
    send(rpc, payer, payer_key, &[instruction])
}

/// Write one caller-named object to the tape via the program's delegate-signed CPI
fn write(
    rpc: &RpcClient,
    payer: &Keypair,
    payer_key: &Pubkey,
    tape: &Pubkey,
    quill_id: &Pubkey,
    writer: &Pubkey,
    options: &Options,
) -> Result<()> {
    let tapedrive_system = to_pubkey(&system_pda().0);
    let data = wire(options.content_type, options.name.as_bytes(), &options.payload);

    let instruction = Instruction {
        program_id: *quill_id,
        accounts: vec![
            AccountMeta::new(*payer_key, true),
            AccountMeta::new_readonly(*writer, false),
            AccountMeta::new(*tape, false),
            AccountMeta::new_readonly(tapedrive_system, false),
            AccountMeta::new_readonly(sysvar::slot_hashes::ID, false),
            AccountMeta::new_readonly(tapedrive::ID, false),
        ],
        data,
    };

    println!(
        "Write object {:?} ({}, {} bytes)",
        options.name,
        options.content_type,
        options.payload.len()
    );
    println!("  the program calls TrackWrite as the delegate PDA (named, inline, certified at once)");
    send(rpc, payer, payer_key, &[instruction])
}

/// Read the tape account and print its authority, delegate, and track count
fn show(rpc: &RpcClient, tape: &Pubkey) -> Result<()> {
    let account = rpc.get_account(tape)?;
    let state = Tape::unpack_with_discriminator(&account.data).map_err(|error| format!("unpack tape: {error:?}"))?;

    println!("Read the tape back");
    println!("  authority {}", to_pubkey(&state.authority));
    println!("  delegate  {}", to_pubkey(&state.delegate));
    println!("  used      {} MB of {} MB", state.used.to_mb(), state.capacity.to_mb());
    println!("  tracks    {} (next #{})", state.tracks.num_tracks, state.tracks.next_number.as_u64());
    Ok(())
}

/// Fixed framing ahead of the name: `content_type (u16 LE)` + `name_len (u16 LE)`
const WIRE_HEADER_LEN: usize = 4;

/// Frame instruction data: `[content_type u16 LE][name_len u16 LE][name][payload]`
fn wire(content_type: ContentType, name: &[u8], payload: &[u8]) -> Vec<u8> {
    let mut data = Vec::with_capacity(WIRE_HEADER_LEN + name.len() + payload.len());
    data.extend_from_slice(&u16::from(content_type).to_le_bytes());
    data.extend_from_slice(&(name.len() as u16).to_le_bytes());
    data.extend_from_slice(name);
    data.extend_from_slice(payload);
    data
}

/// Sign and submit a transaction, printing the confirmed signature
fn send(rpc: &RpcClient, payer: &Keypair, payer_key: &Pubkey, instructions: &[Instruction]) -> Result<()> {
    let blockhash = rpc.get_latest_blockhash()?;
    let transaction =
        Transaction::new_signed_with_payer(instructions, Some(payer_key), &[payer], blockhash);

    let signature = rpc.send_and_confirm_transaction(&transaction)?;
    println!("  confirmed  {signature}\n");
    Ok(())
}

/// Fetch and decode the Tapedrive System account
fn fetch_system(rpc: &RpcClient) -> Result<System> {
    let account = rpc.get_account(&to_pubkey(&system_pda().0))?;
    let system = System::unpack_with_discriminator(&account.data).map_err(|error| format!("unpack system: {error:?}"))?;
    Ok(*system)
}

fn to_address(pubkey: &Pubkey) -> Address {
    Address::new(pubkey.to_bytes())
}

fn to_pubkey(address: &Address) -> Pubkey {
    Pubkey::new_from_array((*address).into())
}

fn pubkey_from_bytes(bytes: [u8; 32]) -> Pubkey {
    Pubkey::new_from_array(bytes)
}

fn rpc_url() -> Result<String> {
    Ok(env::var("SOLANA_RPC").unwrap_or_else(|_| "http://127.0.0.1:8899".to_string()))
}

fn keypair_path() -> Result<String> {
    env::var("KEYPAIR_PATH").map_err(|_| "set KEYPAIR_PATH to your keypair file".into())
}

/// Parse the flags after the command, resolving the object to write from either
/// `--message` text or a `--file`, and defaulting anything unset:
/// `--mb`, `--epochs`, `--name`, `--message`, `--file`, `--content-type`.
fn parse_options() -> Result<Options> {
    let mut megabytes = DEFAULT_MEGABYTES;
    let mut epochs = DEFAULT_EPOCHS;
    let mut name: Option<String> = None;
    let mut message: Option<String> = None;
    let mut file: Option<String> = None;
    let mut content_type: Option<ContentType> = None;

    let mut args = env::args().skip(2);
    while let Some(flag) = args.next() {
        match flag.as_str() {
            "--mb" | "--megabytes" => {
                megabytes = next_value(&mut args, &flag)?
                    .parse()
                    .map_err(|_| format!("invalid value for {flag}: expected a number"))?;
            }
            "--epochs" => {
                epochs = next_value(&mut args, &flag)?
                    .parse()
                    .map_err(|_| format!("invalid value for {flag}: expected a number"))?;
            }
            "--name" => name = Some(next_value(&mut args, &flag)?),
            "--message" => message = Some(next_value(&mut args, &flag)?),
            "--file" => file = Some(next_value(&mut args, &flag)?),
            "--content-type" => {
                content_type = Some(ContentType::from_str(&next_value(&mut args, &flag)?));
            }
            other => return Err(format!("unknown option {other:?}").into()),
        }
    }

    if file.is_some() && message.is_some() {
        return Err("pass either --message or --file, not both".into());
    }

    // A file supplies raw bytes (name/content-type inferred from the path); otherwise
    // the payload is `--message` text, sent as text/plain. Explicit flags win either way.
    let (name, content_type, payload) = match file {
        Some(path) => {
            let payload = fs::read(&path).map_err(|error| format!("read {path}: {error}"))?;
            let name = name.unwrap_or_else(|| file_name(&path));
            let content_type = content_type.unwrap_or_else(|| content_type_for(&path));
            (name, content_type, payload)
        }
        None => {
            let text = message.unwrap_or_else(|| DEFAULT_MESSAGE.to_string());
            let name = name.unwrap_or_else(|| DEFAULT_NAME.to_string());
            let content_type = content_type.unwrap_or(ContentType::TextPlain);
            (name, content_type, text.into_bytes())
        }
    };

    let framed = WIRE_HEADER_LEN + name.len() + payload.len();
    if framed > MAX_INLINE_BYTES {
        return Err(format!(
            "object is {framed} B framed (name {} + payload {}), over the {MAX_INLINE_BYTES} B \
             inline limit for a single transaction, use a smaller payload or a coded write",
            name.len(),
            payload.len(),
        )
        .into());
    }

    Ok(Options { megabytes, epochs, name, content_type, payload })
}

/// Take the next argument as a flag's value, or error naming the flag
fn next_value(args: &mut impl Iterator<Item = String>, flag: &str) -> Result<String> {
    args.next().ok_or_else(|| format!("missing value for {flag}").into())
}

/// Object name for a file payload: the path's final component (e.g. `photo.png`)
fn file_name(path: &str) -> String {
    Path::new(path)
        .file_name()
        .map(|name| name.to_string_lossy().into_owned())
        .unwrap_or_else(|| path.to_string())
}

/// Guess a `ContentType` from a file's extension, defaulting to binary (octet-stream)
fn content_type_for(path: &str) -> ContentType {
    let extension = Path::new(path)
        .extension()
        .map(|ext| ext.to_string_lossy().to_ascii_lowercase())
        .unwrap_or_default();

    match extension.as_str() {
        "txt" => ContentType::TextPlain,
        "html" | "htm" => ContentType::TextHtml,
        "css" => ContentType::TextCss,
        "js" => ContentType::TextJavascript,
        "csv" => ContentType::TextCsv,
        "md" | "markdown" => ContentType::TextMarkdown,
        "json" => ContentType::ApplicationJson,
        "xml" => ContentType::ApplicationXml,
        "yaml" | "yml" => ContentType::ApplicationYaml,
        "pdf" => ContentType::ApplicationPdf,
        "zip" => ContentType::ApplicationZip,
        "gz" => ContentType::ApplicationGzip,
        "tar" => ContentType::ApplicationTar,
        "png" => ContentType::ImagePng,
        "jpg" | "jpeg" => ContentType::ImageJpeg,
        "gif" => ContentType::ImageGif,
        "webp" => ContentType::ImageWebp,
        _ => ContentType::Unknown,
    }
}

/// Resolve the deployed program id from `QUILL_PROGRAM_ID`, or the build keypair
fn program_id() -> Result<Pubkey> {
    if let Ok(value) = env::var("QUILL_PROGRAM_ID") {
        return Ok(Pubkey::from_str(&value)?);
    }

    let keypair = read_keypair_file("../program/target/deploy/quill-keypair.json")
        .map_err(|_| "set QUILL_PROGRAM_ID or build the program first (cargo build-sbf)")?;
    Ok(pubkey_from_bytes(keypair.pubkey().to_bytes()))
}

fn usage(command: &str) -> String {
    let prefix = if command.is_empty() {
        String::from("usage")
    } else {
        format!("unknown command {command:?}")
    };
    format!(
        "{prefix}: reserve | delegate | write | show | all\
        \n  --mb <n>            reserve size in MB (default {DEFAULT_MEGABYTES})\
        \n  --epochs <n>        reserve duration in epochs (default {DEFAULT_EPOCHS})\
        \n  --name <s>          object name (default {DEFAULT_NAME:?}, or the file name)\
        \n  --message <s>       object payload as text (default {DEFAULT_MESSAGE:?})\
        \n  --file <path>       object payload from a file (bytes; overrides --message)\
        \n  --content-type <m>  MIME type override, e.g. image/png (default: inferred)"
    )
}

[package]
name = "bundle-tests"
version = "0.1.0"
edition = "2021"
publish = false

# Standalone: host-built Mollusk tests, resolved independently of the on-chain
# program crate (which builds under a different, SBF, toolchain).
[workspace]

[lib]
path = "src/lib.rs"

[dev-dependencies]
# Tapedrive types for building the on-chain fixtures the CPI writes into.
tape-api = { version = "0.4.0", features = ["solana"] }
tape-core = { version = "0.4.0", features = ["solana"] }
tape-crypto = "0.4.0"

# Versions pinned to the monorepo's lockfile so tapedrive.so loads cleanly.
mollusk-svm = "0.13.4"
bincode = "1.3.3"
solana-account = "3.4.0"
solana-instruction = "3.2.0"
solana-packet = "4.1.0"
solana-program-error = "3.0.1"
solana-pubkey = "3.0.0"
solana-rent = "3.1.0"
solana-system-interface = "2.0.0"
solana-transaction = { version = "3.1.0", features = ["bincode"] }

//! Host-side Mollusk tests for the bundle program
#![cfg(test)]

// bundle buffers a large payload and writes it to Tapedrive with one CPI,
// proving a payload bigger than one transaction can go inline.

use mollusk_svm::program::create_program_account_loader_v2;
use mollusk_svm::program::keyed_account_for_system_program;
use mollusk_svm::program::loader_keys::LOADER_V3;
use mollusk_svm::result::Check;
use mollusk_svm::sysvar::Sysvars;
use mollusk_svm::Mollusk;

use solana_account::Account;
use solana_instruction::{AccountMeta, Instruction};
use solana_packet::PACKET_DATA_SIZE;
use solana_program_error::ProgramError;
use solana_pubkey::Pubkey;
use solana_transaction::Transaction;

use tape_api::program::prelude::*;
use tape_core::track::archive::TrackArchive;
use tape_core::track::TRACK_TREE_HEIGHT;
use tape_crypto::merkle::MerkleTree;

const BUNDLE_ELF: &[u8] = include_bytes!(concat!(
    env!("CARGO_MANIFEST_DIR"),
    "/../program/target/deploy/bundle.so"
));
const TAPEDRIVE_ELF: &[u8] =
    include_bytes!(concat!(env!("CARGO_MANIFEST_DIR"), "/fixtures/tapedrive.so"));

const APPEND: u8 = 0;
const FLUSH: u8 = 1;

const SEED: &[u8] = b"bundle";

// the largest piece that keeps an append within one packet (see the size test)
const PIECE: usize = 928;

// wire prefix that sits before the payload in a buffer account
const BUFFER_OVERHEAD: usize = 4;

// custom error code for Empty, the second variant in the program error enum
const EMPTY_ERROR: u32 = 1;

fn bundle_id() -> Pubkey {
    "4RepWD31ARA7QTqmm3u3weNUR2v6uUX3vAMPjkk5U9Wo"
        .parse()
        .expect("valid pubkey")
}

// a system-owned wallet holding lamports
fn wallet(key: Pubkey, lamports: u64) -> (Pubkey, Account) {
    (
        key,
        Account {
            lamports,
            data: vec![],
            owner: solana_system_interface::program::ID,
            executable: false,
            rent_epoch: 0,
        },
    )
}

// a Tapedrive-owned account holding packed state
fn owned(key: Pubkey, data: Vec<u8>) -> (Pubkey, Account) {
    let lamports = solana_rent::Rent::default().minimum_balance(data.len());
    (
        key,
        Account {
            lamports,
            data,
            owner: tapedrive::ID,
            executable: false,
            rent_epoch: 0,
        },
    )
}

// the slot hashes sysvar with a single entry
fn slot_hashes() -> (Pubkey, Account) {
    let mut data = vec![0u8; 48];
    data[0] = 1;
    (
        sysvar::slot_hashes::ID,
        Account {
            lamports: 1,
            data,
            owner: sysvar::ID,
            executable: false,
            rent_epoch: 0,
        },
    )
}

// the shared fixtures every test starts from
struct Env {
    payer: Pubkey,
    tape_key: Pubkey,
    buffer: Pubkey,
    system_key: Pubkey,
    rent_id: Pubkey,
    system_program_id: Pubkey,
    accounts: Vec<(Pubkey, Account)>,
    initial_tape: Vec<u8>,
}

fn setup() -> (Mollusk, Env) {
    let mut mollusk = Mollusk::default();
    mollusk.add_program_with_loader_and_elf(&bundle_id(), &LOADER_V3, BUNDLE_ELF);
    mollusk.add_program_with_loader_and_elf(&tapedrive::ID, &LOADER_V3, TAPEDRIVE_ELF);

    let payer = Pubkey::new_unique();
    let authority = Pubkey::new_unique();

    let (tape_addr, _) = tape_pda(authority.into());
    let tape_key: Pubkey = tape_addr.into();
    let (buffer, _) =
        Pubkey::find_program_address(&[SEED, tape_key.as_ref(), payer.as_ref()], &bundle_id());
    let (system_addr, _) = system_pda();
    let system_key: Pubkey = system_addr.into();

    // the tape delegates to the buffer so bundle can sign the write
    let tape = Tape {
        id: TapeNumber(1),
        authority: authority.into(),
        delegate: buffer.into(),
        capacity: StorageUnits::mb(1000),
        active_epoch: EpochNumber(0),
        expiry_epoch: EpochNumber(100),
        tracks: TrackArchive {
            tree: MerkleTree::<TRACK_TREE_HEIGHT>::new(),
            next_number: TrackNumber(0),
            num_tracks: 0,
        },
        ..Tape::zeroed()
    };
    let system = System {
        current_epoch: EpochNumber(0),
        live_group_count: 50,
        ..System::zeroed()
    };
    let initial_tape = tape.pack();

    let rent = Sysvars::default().keyed_account_for_rent_sysvar();
    let rent_id = rent.0;
    let system_program = keyed_account_for_system_program();
    let system_program_id = system_program.0;

    let accounts = vec![
        wallet(payer, 100_000_000_000),
        owned(tape_key, initial_tape.clone()),
        (buffer, Account::default()),
        owned(system_key, system.pack()),
        rent,
        system_program,
        slot_hashes(),
        (tapedrive::ID, create_program_account_loader_v2(TAPEDRIVE_ELF)),
    ];

    (
        mollusk,
        Env {
            payer,
            tape_key,
            buffer,
            system_key,
            rent_id,
            system_program_id,
            accounts,
            initial_tape,
        },
    )
}

fn append_ix(env: &Env, piece: &[u8]) -> Instruction {
    let mut data = vec![APPEND];
    data.extend_from_slice(piece);
    Instruction {
        program_id: bundle_id(),
        accounts: vec![
            AccountMeta::new(env.payer, true),
            AccountMeta::new_readonly(env.tape_key, false),
            AccountMeta::new(env.buffer, false),
            AccountMeta::new_readonly(env.rent_id, false),
            AccountMeta::new_readonly(env.system_program_id, false),
        ],
        data,
    }
}

fn flush_ix(env: &Env) -> Instruction {
    Instruction {
        program_id: bundle_id(),
        accounts: vec![
            AccountMeta::new(env.payer, true),
            AccountMeta::new(env.tape_key, false),
            AccountMeta::new_readonly(env.buffer, false),
            AccountMeta::new_readonly(env.system_key, false),
            AccountMeta::new_readonly(sysvar::slot_hashes::ID, false),
            AccountMeta::new_readonly(tapedrive::ID, false),
        ],
        data: vec![FLUSH],
    }
}

// a 4 KB payload collected over several appends lands as one inline track
#[test]
fn collect_large_payload() {
    let (mollusk, env) = setup();
    let payload = vec![0xABu8; 4096];

    let mut instructions = vec![];
    let mut offset = 0;
    while offset < payload.len() {
        let end = (offset + PIECE).min(payload.len());
        instructions.push(append_ix(&env, &payload[offset..end]));
        offset = end;
    }
    instructions.push(flush_ix(&env));

    let success = [Check::success()];
    let steps: Vec<(&Instruction, &[Check])> =
        instructions.iter().map(|ix| (ix, success.as_slice())).collect();

    let result = mollusk.process_and_validate_instruction_chain(&steps, &env.accounts);

    // every step succeeded, including the flush CPI into Tapedrive
    let final_tape = result
        .get_account(&env.tape_key)
        .expect("tape account present after flush");
    assert_ne!(
        final_tape.data, env.initial_tape,
        "the tape should have gained a track"
    );
}

// the first append creates the buffer and each later append grows it
#[test]
fn buffer_grows() {
    let (mollusk, env) = setup();

    let first = mollusk.process_and_validate_instruction(
        &append_ix(&env, &[0u8; 1000]),
        &env.accounts,
        &[Check::success()],
    );
    let buffer = first.get_account(&env.buffer).expect("buffer after first append");
    assert_eq!(buffer.data.len(), BUFFER_OVERHEAD + 1000);

    let second = mollusk.process_and_validate_instruction(
        &append_ix(&env, &[0u8; 500]),
        &first.resulting_accounts,
        &[Check::success()],
    );
    let buffer = second.get_account(&env.buffer).expect("buffer after second append");
    assert_eq!(buffer.data.len(), BUFFER_OVERHEAD + 1500);
}

// flush with nothing appended fails instead of writing an empty track
#[test]
fn flush_before_append() {
    let (mollusk, env) = setup();

    mollusk.process_and_validate_instruction(
        &flush_ix(&env),
        &env.accounts,
        &[Check::err(ProgramError::Custom(EMPTY_ERROR))],
    );
}

// the serialized size of an append transaction carrying a piece of this length
fn append_tx_size(env: &Env, piece_len: usize) -> usize {
    let ix = append_ix(env, &vec![0u8; piece_len]);
    let tx = Transaction::new_with_payer(&[ix], Some(&env.payer));
    bincode::serialize(&tx).expect("serialize transaction").len()
}

// an append transaction must fit one packet: a realistic piece fits, 1024 does not
#[test]
fn append_fits_one_packet() {
    let (_, env) = setup();

    let mut max_piece = 0;
    while append_tx_size(&env, max_piece + 1) <= PACKET_DATA_SIZE {
        max_piece += 1;
    }

    println!("append overhead: {} bytes", append_tx_size(&env, 0));
    println!("largest piece in one packet: {} bytes", max_piece);

    assert!(append_tx_size(&env, 900) <= PACKET_DATA_SIZE);
    assert!(append_tx_size(&env, 1024) > PACKET_DATA_SIZE);
}