ab_contracts_macros/lib.rs
1//! Macros for contracts
2#![no_std]
3
4#[doc(hidden)]
5pub mod __private;
6
7/// `#[contract]` macro to derive contract implementation.
8///
9/// This macro is supposed to be applied to an implementation of the struct that in turn
10/// implements [`IoType`] trait. [`IoType`] is most commonly obtained by deriving
11/// [`TrivialType`] ([`IoType`] is implemented for all types that implement [`TrivialType`]).
12///
13/// `#[contract]` macro will process *public* methods annotated with the following attributes:
14/// * `#[init]` - a method that can be called to produce an initial state of the contract,
15/// called once during contacts lifetime
16/// * `#[update]` - a method that can read and/or modify state and/or slots of the contact;
17/// might be called by user transaction directly or by another contract
18/// * `#[view]` - a method that can only read blockchain data, can read state or slots of the
19/// contract, but can't modify their contents
20///
21/// Each argument (except `self`) of these methods has to be annotated with one of the
22/// following attributes (must be in this order):
23/// * `#[env]` - an environment variable, used to access ephemeral execution environment, call
24/// methods on other contracts, etc.
25/// * `#[tmp]` - a temporary ephemeral value to store auxiliary data while processing a
26/// transaction
27/// * `#[slot]` - a slot corresponding to this contract
28/// * `#[input]` - a method input coming from user transaction or invocation from another
29/// contract
30/// * `#[output]` - a method output serving as an alternative to returning values from a
31/// function directly, useful to reduce stack usage, its current contents provided by the
32/// caller can be read as well, which allows updating values in-place
33///
34/// Metadata of the state type and of `#[tmp]`, `#[slot]`, `#[input]`, `#[output]` and return
35/// types must not be nested deeper than [`MAX_METADATA_DEPTH`], which is checked during
36/// compilation.
37///
38/// Contents of `#[input]` arguments and initial contents of `#[output]` arguments come from
39/// the caller, so they are not trusted: before the method is called, generated code parses
40/// them (see [`IoType::try_from_ptr()`] and [`IoType::try_from_mut_ptr()`]) and returns
41/// [`ContractError::BadInput`] if they are not valid values of their types. The method only
42/// gets valid values, and for types that accept every bit pattern (see [`AnyBitPattern`])
43/// there is nothing to check. Sizes, capacities and alignment of these arguments must match
44/// the method's metadata, which the executor guarantees: the RISC-V VM checks them, while the
45/// native executor trusts callers and only catches mismatches with debug assertions. The state
46/// and `#[tmp]` and `#[slot]` arguments are storage of the contract, which is only written by
47/// the contract itself or on its behalf, so they are not parsed.
48///
49/// A method gets [`Env`] with a lifetime that covers its call. To lend an `#[output]` to calls
50/// with [`Env::lend_output()`], the method must declare the output with that lifetime:
51/// ```ignore
52/// #[update]
53/// pub fn forward<'a>(#[env] env: &mut Env<'a>, #[output] out: &'a mut Output) {
54/// let mut out = env.lend_output(out);
55/// // ...
56/// }
57/// ```
58///
59/// A `#[view]` method does the same with `&Env<'a>`. With elided lifetimes compilation will
60/// fail with "lifetime may not live long enough", and rustc will suggest the signature above.
61/// Lifetimes of the state, `#[tmp]` and `#[slot]` arguments, and of the last `#[output]` of
62/// `#[init]` without a return value, which is the initial state, can't be named: they are
63/// trusted without being parsed, so they must not be lent.
64///
65/// # For struct implementation
66///
67/// ## #\[init]
68///
69/// Initializer's purpose is to produce the initial state of the contract.
70///
71/// The initial state is the return value (`Self` or `Result<Self, ContractError>`) or, without
72/// a return value, the last `#[output]`, which must be `MaybeData<Self>`.
73///
74/// This method type supports the following arguments (must be in this order):
75/// * `#[env]` read-only and read-write
76/// * `#[tmp]` read-only and read-write
77/// * `#[slot]` read-only and read-write
78/// * `#[input]`
79/// * `#[output]`
80///
81/// `self` argument is not supported in any way in this context since the state of the contract
82/// is just being created.
83///
84/// ## #\[update]
85///
86/// Generic method contract that can both update the contract's own state and contents of
87/// slots.
88///
89/// This method type supports the following arguments (must be in this order):
90/// * `&self` or `&mut self` depending on whether state reads and/or modification are required
91/// * `#[env]` read-only and read-write
92/// * `#[tmp]` read-only and read-write
93/// * `#[slot]` read-only and read-write
94/// * `#[input]`
95/// * `#[output]`
96///
97/// ## #\[view]
98///
99/// Similar to `#[update]`, but can only access read-only view of the state and slots, can be
100/// called outside of the block context and can only call other `#[view]` methods.
101///
102/// This method type supports the following arguments (must be in this order):
103/// * `&self`
104/// * `#[env]` read-only
105/// * `#[slot]` read-only
106/// * `#[input]`
107/// * `#[output]`
108///
109/// # For trait definition and trait implementation
110///
111/// ## #\[update]
112///
113/// Generic method contract that can (in case of trait indirectly) both update the contract's
114/// own state and contents of slots.
115///
116/// This method type supports the following arguments in the trait context (must be in this
117/// order):
118/// * `#[env]` read-only and read-write
119/// * `#[input]`
120/// * `#[output]`
121///
122/// ## #\[view]
123///
124/// Similar to `#[update]`, but can only access (in case of trait indirectly) read-only view of
125/// the state and slots, can be called outside of the block context and can only call other
126/// `#[view]` methods.
127///
128/// This method type supports the following arguments in the trait context (must be in this
129/// order):
130/// * `#[env]` read-only
131/// * `#[input]`
132/// * `#[output]`
133///
134/// # Generated code
135///
136/// This macro will produce several key outputs:
137/// * [`Contract`] trait implementation (for struct implementation)
138/// * FFI function for every method, which can be used by the host to call into the guest
139/// environment (for struct and trait implementation)
140/// * `InternalArgs` struct corresponding to each method, used as its sole input for FFI
141/// function
142/// * Struct implementing [`ExternalArgs`] trait for each method, usable by other contracts to
143/// call into this contract through the host, host will interpret it based on metadata and
144/// generate `InternalArgs` (for struct and trait implementation, trait definitions)
145/// * Extension trait (for struct and trait implementation) that simplifies interaction with
146/// host and removes the need to construct [`ExternalArgs`] manually, providing nice strongly
147/// typed methods instead, implemented for [`Env`] struct (for struct and trait
148/// implementation, trait definitions)
149/// * Metadata as defined in [`ContractMetadataKind`] stored in the `ab-contract-metadata` link
150/// section when compiled with `guest` feature enabled (for method, struct, and trait
151/// implementation)
152///
153/// ## [`Contract`] trait implementation
154///
155/// [`Contract`] trait is required by a few other components in the system, so it is
156/// automatically implemented by the macro, see trait details.
157///
158/// ## FFI function
159///
160/// Macro generates an FFI function with C ABI that looks like this:
161/// ```ignore
162/// #[cfg_attr(feature = "guest", unsafe(no_mangle))]
163/// pub unsafe extern "C" fn {prefix}_{method}(
164/// args: &mut InternalArgs,
165/// ) -> ExitCode {
166/// // ...
167/// }
168/// ```
169///
170/// Where `{prefix}` is derived from struct or trait name and `{method}` is the original method
171/// name from struct or trait implementation.
172///
173/// Example with struct implementation:
174/// ```ignore
175/// // This
176/// #[contract]
177/// impl Example {
178/// #[view]
179/// pub fn hello() {}
180/// }
181///
182/// // Will generate this
183/// #[cfg_attr(feature = "guest", unsafe(no_mangle))]
184/// pub unsafe extern "C" fn example_hello(
185/// args: &mut InternalArgs,
186/// ) -> ExitCode {
187/// // ...
188/// }
189/// ```
190///
191/// Example with trait implementation:
192/// ```ignore
193/// // This
194/// #[contract]
195/// impl Fungible for Token {
196/// #[view]
197/// pub fn balance(#[slot] address: &Address) -> Balance {}
198/// }
199///
200/// // Will generate this
201/// #[cfg_attr(feature = "guest", unsafe(no_mangle))]
202/// pub unsafe extern "C" fn fungible_balance(
203/// args: &mut InternalArgs,
204/// ) -> ExitCode {
205/// // ...
206/// }
207/// ```
208///
209/// These generated functions are public and available in generated submodules, but there
210/// should generally be no need to call them directly.
211///
212/// ## `InternalArgs` struct
213///
214/// `InternalArgs` is generated for each method and is used as input to the above FFI
215/// functions. Its fields are generated based on function arguments, processing them in the
216/// same order as in function signature. It is possible for the host to build this data
217/// structure dynamically using available contact metadata.
218///
219/// Fields in the data structure are pointers, along with sizes and capacities where needed,
220/// some are read-only, some can be written to if changes need to be communicated back to the
221/// host. `read-only` here means that the host will not read the value, even if the contract
222/// modifies it.
223///
224/// ### `&self`
225///
226/// `&self` is a read-only state of the contract and generates three fields, all of which are
227/// read-only:
228/// ```ignore
229/// #[repr(C)]
230/// pub struct InternalArgs<'internal_args> {
231/// pub self_ptr: NonNull<<StructName as IoType>::PointerType>,
232/// pub self_size: u32,
233/// pub self_capacity: u32,
234/// // ...
235/// }
236/// ```
237///
238/// This allows a contract to read the current state of the contract.
239///
240/// ### `&mut self`
241///
242/// `&mut self` is a read-write state of the contract and generates three fields, `self_ptr`
243/// and `self_size` can be written to, while `self_capacity` is read-only:
244/// ```ignore
245/// #[repr(C)]
246/// pub struct InternalArgs<'internal_args> {
247/// pub self_ptr: NonNull<<StructName as IoType>::PointerType>,
248/// pub self_size: u32,
249/// pub self_capacity: u32,
250/// // ...
251/// }
252/// ```
253///
254/// This allows a contract to not only read, but also change the current state of the contract.
255/// `self_capacity` is defined by both the type used and the size of the value used (whichever
256/// is bigger in the case of variable-sized types) and corresponds to the amount of memory that
257/// host allocated for the guest behind `self_ptr`. In the case of variable-sized types, guest
258/// can replace `self_ptr` with a pointer to a guest-allocated region of memory that the host
259/// must read updated value from. This is helpful in case an increase of the value size beyond
260/// allocated capacity is needed.
261///
262/// ### `#[env] env: &Env`
263///
264/// `#[env] env: &Env` is for accessing an ephemeral environment with method calls restricted
265/// to `#[view]`. Since this is a system-provided data structure with a known layout, only
266/// read-only field is generated:
267/// ```ignore
268/// #[repr(C)]
269/// pub struct InternalArgs<'internal_args> {
270/// // ...
271/// pub env: &'internal_args Env<'internal_args>,
272/// // ...
273/// }
274/// ```
275///
276/// ### `#[env] env: &mut Env`
277///
278/// `#[env] env: &mut Env` is for accessing ephemeral environment without method calls
279/// restrictions. Since this is a system-provided data structure with a known layout, only
280/// read-write field is generated:
281/// ```ignore
282/// #[repr(C)]
283/// pub struct InternalArgs<'internal_args> {
284/// // ...
285/// pub env: &'internal_args mut Env<'internal_args>,
286/// // ...
287/// }
288/// ```
289///
290/// ### `#[tmp] tmp: &MaybeData<Tmp>`
291///
292/// `#[tmp] tmp: &MaybeData<Tmp>` is for accessing ephemeral value with auxiliary data and
293/// generates three fields, all of which are read-only:
294/// ```ignore
295/// #[repr(C)]
296/// pub struct InternalArgs<'internal_args> {
297/// // ...
298/// pub tmp_ptr: NonNull<
299/// <
300/// <StructName as Contract>::Tmp as IoType
301/// >::PointerType,
302/// >,
303/// pub tmp_size: u32,
304/// pub tmp_capacity: u32,
305/// // ...
306/// }
307/// ```
308///
309/// This allows a contract to read the current ephemeral value of the contract.
310///
311/// ### `#[tmp] tmp: &mut MaybeData<Tmp>`
312///
313/// `#[tmp] tmp: &mut MaybeData<Tmp>` is for accessing ephemeral value with auxiliary data and
314/// generates three fields, `tmp_ptr` and `tmp_size` can be written to, while `tmp_capacity` is
315/// read-only:
316/// ```ignore
317/// #[repr(C)]
318/// pub struct InternalArgs<'internal_args> {
319/// // ...
320/// pub tmp_ptr: NonNull<
321/// <
322/// <StructName as Contract>::Tmp as IoType
323/// >::PointerType,
324/// >,
325/// pub tmp_size: u32,
326/// pub tmp_capacity: u32,
327/// // ...
328/// }
329/// ```
330///
331/// This allows a contract to not only read, but also change the ephemeral value of the
332/// contract. `tmp_capacity` is defined by both the type used and the size of the value used
333/// (whichever is bigger in the case of variable-sized types) and corresponds to the amount of
334/// memory that host allocated for the guest behind `tmp_ptr`. In the case of variable-sized
335/// types, guest can replace `tmp_ptr` with a pointer to a guest-allocated region of memory
336/// that the host must read updated value from. This is helpful in case an increase of the
337/// value size beyond allocated capacity is needed.
338///
339/// ### `#[slot] slot: &MaybeData<Slot>` and `#[slot] (address, slot): (&Address, &MaybeData<Slot>)`
340///
341/// `#[slot] slot: &MaybeData<Slot>` and its variant with explicit address argument is for
342/// accessing slot data (that corresponds to an optional `address` argument) and generates four
343/// fields, all of which are read-only:
344/// ```ignore
345/// #[repr(C)]
346/// pub struct InternalArgs<'internal_args> {
347/// // ...
348/// pub slot_address: &'internal_args Address,
349/// pub slot_ptr: NonNull<
350/// <
351/// <StructName as Contract>::Slot as IoType
352/// >::PointerType,
353/// >,
354/// pub slot_size: u32,
355/// pub slot_capacity: u32,
356/// // ...
357/// }
358/// ```
359///
360/// This allows a contract to read slot data.
361///
362/// ### `#[slot] slot: &mut MaybeData<Slot>` and `#[slot] (address, slot): (&Address, &mut MaybeData<Slot>)`
363///
364/// `#[slot] slot: &mut MaybeData<Slot>` and its variant with explicit address argument are for
365/// accessing slot data (that corresponds to optional `address` argument) and generates four
366/// fields, `slot_ptr` and `slot_size` can be written to, while `slot_address` and
367/// `slot_capacity` are read-only:
368/// ```ignore
369/// #[repr(C)]
370/// pub struct InternalArgs<'internal_args> {
371/// // ...
372/// pub slot_address: &'internal_args Address,
373/// pub slot_ptr: NonNull<
374/// <
375/// <StructName as Contract>::Slot as IoType
376/// >::PointerType,
377/// >,
378/// pub slot_size: u32,
379/// pub slot_capacity: u32,
380/// // ...
381/// }
382/// ```
383///
384/// This allows a contract to not only read, but also change slot data.
385/// `slot_capacity` is defined by both the type used and the size of the value used (whichever
386/// is bigger in the case of variable-sized types) and corresponds to the amount of memory that
387/// host allocated for the guest behind `slot_ptr`. In the case of variable-sized types,
388/// guest can replace `slot_ptr` with a pointer to a guest-allocated region of memory that the
389/// host must read updated value from. This is helpful in case an increase of the value size
390/// beyond allocated capacity is needed.
391///
392/// Slot changes done by the method call will not be persisted if it returns an error or the
393/// host rejects its results (like an invalid slot size), including changes done by methods it
394/// called, even if those calls succeeded.
395///
396/// ### `#[input] input: &InputValue`
397///
398/// `#[input] input: &InputValue` is a read-only input to the contract call and generates three
399/// fields, all of which are read-only:
400/// ```ignore
401/// #[repr(C)]
402/// pub struct InternalArgs<'internal_args> {
403/// // ...
404/// pub input_ptr: NonNull<<InputValue as IoType>::PointerType>,
405/// pub input_size: u32,
406/// pub input_capacity: u32,
407/// // ...
408/// }
409/// ```
410///
411/// The contents are parsed before the method is called, [`ContractError::BadInput`] is
412/// returned if they are not a valid `InputValue`.
413///
414/// ### `#[output] output: &mut OutputValue`
415///
416/// `#[output] output: &mut OutputValue` is a read-write output of the contract call, where
417/// `OutputValue` is any type implementing [`IoType`], like `MaybeData<T>`, `VariableBytes<N>`
418/// or a [`TrivialType`]. It generates three fields, `output_size` can be written to, while
419/// `output_ptr` and `output_capacity` are read-only (see the exception for `#[init]` below):
420/// ```ignore
421/// #[repr(C)]
422/// pub struct InternalArgs<'internal_args> {
423/// // ...
424/// pub output_ptr: NonNull<<OutputValue as IoType>::PointerType>,
425/// pub output_size: u32,
426/// pub output_capacity: u32,
427/// // ...
428/// }
429/// ```
430///
431/// The caller provides `output_size` bytes of current contents of the output (bytes beyond the
432/// size are not initialized), the contract can both read and modify them, and the modified
433/// value will be propagated back to the caller to observe. The current contents are parsed
434/// like those of `#[input]` before the method is called. The size of a [`TrivialType`] output
435/// is always the size of the type, while `MaybeData<T>` and `VariableElements<T>` (like
436/// `VariableBytes<N>`) can be empty when they are only used to return a value. Unlike an
437/// input, an empty `MaybeData<T>` output must still have capacity for `T`, since the contract
438/// can write a value into it.
439/// `output_ptr` pointer *must not be changed* as the host will not follow it to the new
440/// address, the output size is fully constrained by capacity specified in `output_capacity`.
441/// The only exception is the last `#[output]` of `#[init]` method without a return value,
442/// which is the contract's initial state. In this case, its pointer can be changed to point to
443/// a different memory location, which is not limited by `output_capacity` allocation from the
444/// host, while the capacity the host provides must still be at least the size of the state,
445/// like that of other `MaybeData<T>` outputs. With a return value, the return value is the
446/// initial state, and all `#[output]` arguments are regular outputs.
447///
448/// `#[output]` may be used as an alternative to `-> ReturnValue` and
449/// `-> Result<ReturnValue, ContractError>` in case the data structure is large and allocation
450/// on the stack is undesirable, which is especially helpful in case of a variable-sized
451/// contract state.
452///
453/// ### `-> ReturnValue` and `-> Result<ReturnValue, ContractError>`
454///
455/// Return values (wrapped in `Result` or not) are only possible with [`TrivialType`] types,
456/// hence they don't need size and capacity as separate fields:
457/// ```ignore
458/// #[repr(C)]
459/// pub struct InternalArgs<'internal_args> {
460/// // ...
461/// pub ok_result: &'internal_args mut MaybeUninit<ReturnValue>,
462/// }
463/// ```
464///
465/// NOTE: In case `ReturnValue` in `-> ReturnValue` or `-> Result<ReturnValue, ContractError>`
466/// is `()`, it will be omitted in `InternalArgs`.
467///
468///
469/// ## [`ExternalArgs`] implementation
470///
471/// Macro generates a struct that implements [`ExternalArgs`] for each method that other
472/// contracts give to the host when they want to call into another (or even the same) contract.
473///
474/// Here is an example with struct implementation, but it works the same way with trait
475/// definition and implementation too:
476/// ```ignore
477/// // This
478/// #[contract]
479/// impl Example {
480/// #[view]
481/// pub fn hello() {}
482/// }
483///
484/// #[repr(C)]
485/// pub struct ExampleHelloArgs<'external_args> {
486/// // ...
487/// }
488///
489/// #[automatically_derived]
490/// unsafe impl ExternalArgs for ExampleHelloArgs {
491/// // ...
492/// }
493///
494/// impl ExternalArgs<'external_args> {
495/// pub fn new(
496/// // ...
497/// ) -> Self {
498/// // ...
499/// }
500/// }
501/// ```
502///
503/// Struct name if generated by concatenating struct or trait name on which name was generated,
504/// method name, and `Args` suffix, which is done to make it more convenient to use externally.
505///
506/// `&self`, `&mut self`, `#[env]` and `#[tmp]` arguments of the method are controlled fully by
507/// the host and not present in `ExternalArgs`.
508///
509/// `ExternalArgs::new()` method is generated for convenient construction of the instance,
510/// though in most cases [Extension trait] is used with a more convenient API. Fields are
511/// private and are only set by `ExternalArgs::new()`, since the host dereferences pointers in
512/// them according to the method signature. Each `#[output]` is given as `&mut impl
513/// OutputArg<OutputValue>` (see [Extension trait] for why), and its updated size can be read
514/// with an `output_size()` getter after the method call.
515///
516/// [Extension trait]: #extension-trait
517///
518/// ### `#[slot]`
519///
520/// Each `#[slot]` argument in `ExternalArgs` is represented by a single read-only address
521/// pointer:
522/// ```ignore
523/// #[repr(C)]
524/// pub struct ExternalArgs<'external_args> {
525/// // ...
526/// slot_ptr: NonNull<Address>,
527/// // ...
528/// }
529/// ```
530///
531/// ### `#[input]`
532///
533/// Each `#[input]` argument in `ExternalArgs` is represented by three read-only fields,
534/// a pointer to data, and size + capacity:
535/// ```ignore
536/// #[repr(C)]
537/// pub struct ExternalArgs<'external_args> {
538/// // ...
539/// input_ptr: NonNull<<InputValue as IoType>::PointerType>,
540/// input_size: u32,
541/// input_capacity: u32,
542/// // ...
543/// }
544/// ```
545///
546/// ### `#[output]`, `-> ReturnValue` and `-> Result<ReturnValue, ContractError>`
547///
548/// Each `#[output]` argument in `ExternalArgs` is represented by three fields, `output_ptr`
549/// and `output_capacity` are read-only, while `output_size` is updated by the host after the
550/// method call:
551/// ```ignore
552/// #[repr(C)]
553/// pub struct ExternalArgs<'external_args> {
554/// // ...
555/// output_ptr: NonNull<<OutputValue as IoType>::PointerType>,
556/// output_size: u32,
557/// output_capacity: u32,
558/// // ...
559/// }
560/// ```
561///
562/// Each return value is represented by just a pointer since return type is [`TrivialType`] and
563/// don't need separate size and capacity fields:
564/// ```ignore
565/// #[repr(C)]
566/// pub struct ExternalArgs<'external_args> {
567/// // ...
568/// ok_result: &'external_args mut MaybeUninit<ReturnValue>,
569/// }
570/// ```
571///
572/// Some arguments are omitted in `ExternalArgs`:
573/// * the contract's initial state produced by `#[init]` method, which is processed by the
574/// execution environment itself: `ReturnValue` or, when it is `()`, the last `#[output]`
575/// * `ReturnValue` when it is `()`, since there is no point in having a pointer for it
576///
577/// The host passes the current `output_size` to the callee as is, so that the callee can both
578/// read and modify the output, and updates `output_size` after the call.
579///
580/// ## Extension trait
581///
582/// Extension trait is just a convenient wrapper, whose safe methods take strongly typed
583/// arguments, construct `ExternalArgs` while respecting Rust safety invariants, and call
584/// [`Env::call()`] with it. Extension trait usage is not mandatory, but it does make method
585/// calls much more convenient in most simple cases.
586///
587/// Generated methods are named like FFI functions and take `&self` for `#[view]` methods and
588/// `&mut self` otherwise. Their arguments reflect `ExternalArgs` fields, preceded by the
589/// method context (except when calling a `#[view]` method, where context is not applicable)
590/// and the address of the contract being called:
591/// ```ignore
592/// // This
593/// #[contract]
594/// impl Token {
595/// #[view]
596/// pub fn balance(#[slot] target: &MaybeData<Slot>) -> Balance {
597/// // ...
598/// }
599///
600/// #[view]
601/// pub fn balances(
602/// #[slot] target: &MaybeData<Slot>,
603/// #[output] balances: &mut VariableElements<Balance>,
604/// ) {
605/// // ...
606/// }
607///
608/// #[update]
609/// pub fn transfer(
610/// #[env] env: &mut Env<'_>,
611/// #[slot] (from_address, from): (&Address, &mut MaybeData<Slot>),
612/// #[slot] to: &mut MaybeData<Slot>,
613/// #[input] &amount: &Balance,
614/// ) -> Result<(), ContractError> {
615/// // ...
616/// }
617/// }
618///
619/// // Will generate this
620/// pub trait TokenExt {
621/// fn token_balance(
622/// &self,
623/// contract: Address,
624/// target: &Address,
625/// ) -> Result<Balance, ContractError>;
626///
627/// fn token_balances(
628/// &self,
629/// contract: Address,
630/// target: &Address,
631/// balances: &mut impl OutputArg<VariableElements<Balance>>,
632/// ) -> Result<(), ContractError>;
633///
634/// fn token_transfer(
635/// &mut self,
636/// method_context: MethodContext,
637/// contract: Address,
638/// from: &Address,
639/// to: &Address,
640/// amount: &Balance,
641/// ) -> Result<(), ContractError>;
642/// }
643///
644/// impl TokenExt for Env<'_> {
645/// // ...
646/// }
647/// ```
648///
649/// Each `#[output]` is given as [`OutputArg`]. A call can leave contents behind in it that are
650/// not valid values, for example when it fails halfway. Memory whose contents accept every bit
651/// pattern (see [`AnyBitPattern`]) is given directly, like `&mut value` for a `u64` or
652/// `&mut VariableElements::from_uninit(..).expect(..)` for `VariableElements<Balance>`. Memory
653/// of other types is given in a [`Lent`], which parses the contents before they are accessed.
654/// After a successful call, the size of each output is set to the one the callee reported. The
655/// return value is parsed, and [`ContractError::BadOutput`] is returned if it is not a valid
656/// value of its type, with sizes of outputs already set.
657///
658/// The name of the extension trait is created as struct or trait name followed by `Ext`
659/// suffix.
660///
661/// ## Metadata
662///
663/// There are several places where metadata is being generated, see [`ContractMetadataKind`]
664/// for details.
665///
666/// First, the `#[contract]` macro generates a public `METADATA` constant for each method
667/// individually.
668///
669/// Second, for each trait that contract can implement `#[contract]` macro generates an
670/// associated constant `METADATA` that essentially aggregates metadata of all annotated
671/// methods.
672///
673/// Third, [`Contract`] trait implementation generated by `#[contract]` macro contains
674/// `MAIN_CONTRACT_METADATA` associated constant, which is similar in nature to `METADATA`
675/// constant for traits described above.
676///
677/// Lastly, for the whole contract as a project, both trait and contract metadata is
678/// concatenated and stored in the `ab-contract-metadata` link section that can later be
679/// inspected externally to understand everything about the contract's interfaces,
680/// auto-generate UI, etc.
681///
682/// [`Contract`]: ab_contracts_common::Contract
683/// [`ContractError::BadInput`]: ab_contracts_common::ContractError::BadInput
684/// [`ContractError::BadOutput`]: ab_contracts_common::ContractError::BadOutput
685/// [`OutputArg`]: ab_contracts_common::output::OutputArg
686/// [`Lent`]: ab_contracts_common::output::Lent
687/// [`TrivialType`]: ab_io_type::trivial_type::TrivialType
688/// [`AnyBitPattern`]: ab_io_type::trivial_type::AnyBitPattern
689/// [`IoType::try_from_ptr()`]: ab_io_type::IoType::try_from_ptr()
690/// [`IoType::try_from_mut_ptr()`]: ab_io_type::IoType::try_from_mut_ptr()
691/// [`IoType`]: ab_io_type::IoType
692/// [`ExternalArgs`]: ab_contracts_common::method::ExternalArgs
693/// [`Env`]: ab_contracts_common::env::Env
694/// [`Env::call()`]: ab_contracts_common::env::Env::call()
695/// [`Env::lend_output()`]: ab_contracts_common::env::Env::lend_output()
696/// [`ContractMetadataKind`]: ab_contracts_common::metadata::ContractMetadataKind
697/// [`MAX_METADATA_DEPTH`]: ab_contracts_common::metadata::MAX_METADATA_DEPTH
698pub use ab_contracts_macros_impl::contract;