refactor: migrate inline dev-deps to workspace references in basics/

[NikkiAung]

Summary

• Replaces all inline-pinned [dev-dependencies] versions with .workspace = true across 28 native, pinocchio, and asm Cargo.toml files under basics/
• Adds two new entries to the root [workspace.dependencies]: solana-rent = "4.1.0" and solana-transaction-error = "3.2.0"
• Also migrates the cross-program-invocation hand/lever programs' inline [dependencies] (borsh, borsh-derive, solana-program, solana-system-interface) to workspace references

This removes the version duplication that makes future upgrades error-prone — when a crate version bumps in root Cargo.toml, it now propagates automatically to all member crates.

Test plan

• cargo metadata --no-deps resolves cleanly with no errors
• CI build matrix passes for all affected programs

[greptile-apps]

Greptile Summary

This PR migrates inline-pinned [dev-dependencies] to *.workspace = true references across 28 Cargo.toml files under basics/, adds solana-rent and solana-transaction-error to the root [workspace.dependencies], and also modernises the realloc TypeScript client from the class-based borsh v0.7 API to the object-schema borsh v2 API.

• Workspace migration (Cargo): All migrated crates are genuine members of the root workspace, so the .workspace = true references resolve cleanly. The basics/cross-program-invocation/native programs remain in their own isolated sub-workspace and therefore keep inline versions — but solana-program was bumped from 3.0 to 4.0 (a major version) without explanation; see the inline comment.
• Realloc TypeScript rewrite: Schemas moved to as const objects, borsh ^2.0.0 added as a direct dependency, and serialization/deserialization calls updated to the v2 API. Callers only access plain data fields on deserialized results, so the as ClassName casts are safe for current usage.
• Favorites test fix: A long-standing silent-pass bug (the old assert(true) in the catch block would succeed even if no exception was thrown) is corrected, and the PDA seed for the negative test is changed to an obviously wrong value.

Confidence Score: 4/5

Safe to merge for all root-workspace members; the CPI sub-workspace programs need the solana-program 4.0 upgrade verified before merging.

The hand and lever programs in the CPI sub-workspace received an unannounced solana-program 3.0 to 4.0 major-version bump. Because that sub-workspace has no [workspace.dependencies], the crates compile independently, and a breaking API change in 4.0 would silently fail at SBF build time or produce incorrect on-chain behaviour. All other changes (28 root-workspace Cargo.toml migrations, realloc TS rewrite, favorites test fix) appear correct and low-risk.

basics/cross-program-invocation/native/programs/hand/Cargo.toml and basics/cross-program-invocation/native/programs/lever/Cargo.toml — the solana-program major version bump warrants explicit confirmation that the program source is compatible with 4.0.

Important Files Changed

Filename	Overview
Cargo.toml	Added solana-rent 4.1.0 and solana-transaction-error 3.2.0 to [workspace.dependencies] so member crates can resolve .workspace = true references for those crates
basics/cross-program-invocation/native/programs/hand/Cargo.toml	Bumps borsh/borsh-derive 1.5.7→1.6.1 and solana-program 3.0→4.0 inline (not workspace refs) — the major solana-program bump is unannounced and out of scope for the workspace migration
basics/cross-program-invocation/native/programs/lever/Cargo.toml	Same as hand: solana-program bumped 3.0→4.0 inline; PR description claims workspace migration but this remains inline-pinned because the sub-workspace has no [workspace.dependencies]
basics/realloc/native/ts/instructions/create.ts	Migrates from class-based borsh v0.7 API to object-schema borsh v2 API; target isSigner changed to true (flagged in existing thread)
basics/realloc/native/ts/state/address-info.ts	Migrates to borsh v2 object schema; fromBuffer now casts the plain-object result to AddressInfo — safe since callers only access data fields, not class methods
basics/favorites/native/tests/test.ts	Removes BN dependency, fixes a silent-pass test bug (threw flag pattern), renames PDA variable for clarity, and uses wrong seeds instead of correct ones for the failure-case test
basics/realloc/native/package.json	Adds borsh ^2.0.0 as a direct dependency to support the new object-schema API used in the realloc TS instruction and state files

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    RootWS["Root Cargo.toml\n[workspace.dependencies]\n+ solana-rent 4.1.0\n+ solana-transaction-error 3.2.0"]

    subgraph basics["basics/ member crates (root workspace)"]
        Native["native/program Cargo.toml\n*.workspace = true"]
        Pinocchio["pinocchio/program Cargo.toml\n*.workspace = true"]
        ASM["asm/Cargo.toml\n*.workspace = true"]
    end

    subgraph cpi["CPI sub-workspace (isolated)"]
        SubWS["basics/cross-program-invocation/native/Cargo.toml\n(no workspace.dependencies)"]
        Hand["hand/Cargo.toml\nborsh 1.6.1 inline\nsolana-program 4.0"]
        Lever["lever/Cargo.toml\nborsh 1.6.1 inline\nsolana-program 4.0"]
        SubWS --> Hand
        SubWS --> Lever
    end

    RootWS --> Native
    RootWS --> Pinocchio
    RootWS --> ASM
    RootWS -. "NOT linked\n(isolated sub-workspace)" .-> cpi

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    RootWS["Root Cargo.toml\n[workspace.dependencies]\n+ solana-rent 4.1.0\n+ solana-transaction-error 3.2.0"]

    subgraph basics["basics/ member crates (root workspace)"]
        Native["native/program Cargo.toml\n*.workspace = true"]
        Pinocchio["pinocchio/program Cargo.toml\n*.workspace = true"]
        ASM["asm/Cargo.toml\n*.workspace = true"]
    end

    subgraph cpi["CPI sub-workspace (isolated)"]
        SubWS["basics/cross-program-invocation/native/Cargo.toml\n(no workspace.dependencies)"]
        Hand["hand/Cargo.toml\nborsh 1.6.1 inline\nsolana-program 4.0"]
        Lever["lever/Cargo.toml\nborsh 1.6.1 inline\nsolana-program 4.0"]
        SubWS --> Hand
        SubWS --> Lever
    end

    RootWS --> Native
    RootWS --> Pinocchio
    RootWS --> ASM
    RootWS -. "NOT linked\n(isolated sub-workspace)" .-> cpi

Loading

_{Reviews (3): Last reviewed commit: "fix: revert CPI hand/lever to inline dep..." | Re-trigger Greptile}

[greptile-apps]

Workspace references in a non-root workspace member

The hand and lever programs live inside their own isolated sub-workspace declared at basics/cross-program-invocation/native/Cargo.toml, which has no [workspace.dependencies] section. Every borsh.workspace = true, borsh-derive.workspace = true, solana-program.workspace = true, litesvm.workspace = true, etc. added here will resolve against that local workspace, not the root workspace. Because the local workspace defines no [workspace.dependencies], Cargo will error: `workspace.borsh` was not found in the root manifest's `workspace.dependencies`. Building the CPI native example directly (or any CI job that targets it) will fail. Either add the needed entries to basics/cross-program-invocation/native/Cargo.toml's [workspace.dependencies], or keep the versions inline for these two crates.

[greptile-apps]

Same sub-workspace issue as hand

lever is also a member of basics/cross-program-invocation/native/Cargo.toml (not the root workspace). All four *.workspace = true references here (borsh, borsh-derive, solana-program, solana-system-interface) will fail to resolve for the same reason described on hand/Cargo.toml.

[greptile-apps]

isSigner flipped for target account

The target account changed from isSigner: false to isSigner: true. If target is a program-derived address, the runtime will reject the transaction because PDAs cannot provide a traditional signature. If target is a regular keypair, the transaction must include that keypair as a signer — but this change is unrelated to the stated scope of this PR (workspace dep migration), and the realloc test files were not updated to supply the extra signature. Please confirm the intended semantics and update the test accordingly.

[NikkiAung]

Thanks for the review @greptile-apps!

CPI hand/lever — fixed in the latest push (commit d801098). Those programs live in basics/cross-program-invocation/native/ which is its own sub-workspace with no [workspace.dependencies], so I've reverted them back to inline versions.

realloc/native/ts/instructions/create.ts — this change is not part of this PR. The isSigner: true fix for the target account is in a separate PR (#631) that was already opened before this branch was created. This PR only touches Cargo.toml files and the root Cargo.toml.

[greptile-apps]

Thanks for the clarification on both points!

CPI hand/lever — confirmed, the revert in d801098 looks correct. basics/cross-program-invocation/native/ has its own root [workspace] table without a [workspace.dependencies] section, so .workspace = true would fail to resolve there. Keeping those deps inline is the right call.

realloc/native/ts/instructions/create.ts — understood, that's tracked in #631. No action needed here.

The PR looks good from a correctness standpoint. Once CI confirms cargo metadata --no-deps resolves cleanly across all 28 affected members, this should be ready to merge.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.

[dev-jodee]

needs signed commits

[NikkiAung]

@dev-jodee All commits have been re-signed with an SSH signing key and now show as Verified on GitHub. Thanks for the heads up!