Merge develop into ripple/confidential-transfer (#5835)

* Fix: Don't flag consensus as stalled prematurely (#5658)

Fix stalled consensus detection to prevent false positives in situations where there are no disputed transactions.

Stalled consensus detection was added to 2.5.0 in response to a network consensus halt that caused a round to run for over an hour. However, it has a flaw that makes it very easy to have false positives. Those false positives are usually mitigated by other checks that prevent them from having an effect, but there have been several instances of validators "running ahead" because there are circumstances where the other checks are "successful", allowing the stall state to be checked.

* Set version to 2.5.1

* fix: Skip processing transaction batch if the batch is empty (#5670)

Avoids an assertion failure in NetworkOPsImp::apply in the unlikely event that all incoming transactions are invalid.

* Fix: EscrowTokenV1 (#5571)

* resolves an accounting inconsistency in MPT escrows where transfer fees were not properly handled when unlocking escrowed tokens.

* refactor: Wrap GitHub CI conditionals in curly braces (#5796)

This change wraps all GitHub conditionals in `${{ .. }}`, both for consistency and to reduce unexpected failures, because it was previously noticed that not all conditionals work without those curly braces.

* Only notify clio for PRs targeting the release and master branches (#5794)

Clio should only be notified when releases are about to be made, instead of for all PR, so this change only notifies Clio when a PR targets the release or master branch.

* Support DynamicMPT XLS-94d (#5705)

* extends the functionality of the MPTokenIssuanceSet transaction, allowing the issuer to update fields or flags that were explicitly marked as mutable during creation.

* Bugfix: Adds graceful peer disconnection (#5669)

The XRPL establishes connections in three stages: first a TCP connection, then a TLS/SSL handshake to secure the connection, and finally an upgrade to the bespoke XRP Ledger peer-to-peer protocol. During connection termination, xrpld directly closes the TCP connection, bypassing the TLS/SSL shutdown handshake. This makes peer disconnection diagnostics more difficult - abrupt TCP termination appears as if the peer crashed rather than disconnected gracefully.

This change refactors the connection lifecycle with the following changes:
- Enhanced outgoing connection logic with granular timeouts for each connection stage (TCP, TLS, XRPL handshake) to improve diagnostic capabilities
- Updated both PeerImp and ConnectAttempt to use proper asynchronous TLS shutdown procedures for graceful connection termination

* Downgrade to boost 1.83

* Set version to 2.6.1-rc1

* chore: Use self hosted windows runners (#5780)

This changes switches from the GitHub-managed Windows runners to self-hosted runners to significantly reduce build time.

* Rename mutable flags (#5797)

This is a minor change on top of #5705

* fix(amendment): Add missing fields for keylets to ledger objects (#5646)

This change adds a fix amendment (`fixIncludeKeyletFields`) that adds:
* `sfSequence` to `Escrow` and `PayChannel`
* `sfOwner` to `SignerList`
* `sfOracleDocumentID` to `Oracle`

This ensures that all ledger entries hold all the information needed to determine their keylet.

* chore: Limits CI build and test parallelism to reduce resource contention (#5799)

GitHub runners have a limit on how many concurrent jobs they can actually process (even though they will try to run them all at the same time), and similarly the Conan remote cannot handle hundreds of concurrent requests. Previously, the Conan dependency uploading was already limited to max 10 jobs running in parallel, and this change makes the same change to the build+test workflow.

* chore: Build and test all configs for daily scheduled run (#5801)

This change re-enables building and testing all configurations, but only for the daily scheduled run. Previously all configurations were run for each merge into the develop branch, but that overwhelmed both the GitHub runners and the Conan remote, and thus they were limited to just a subset of configurations. Now that the number of jobs is limited via `max-parallel: 10`, we should be able to safely enable building all configurations again. However, building them all once a day instead of for each PR merge should be sufficient.

* chore: Add unit tests dir to code coverage excludes (#5803)

This change excludes unit test code from code coverage reporting.

* refactor: Modularise ledger (#5493)

This change moves the ledger code to libxrpl.

* Mark PermissionDelegation as unsupported

* Set version to 2.6.1-rc2

* Miscellaneous refactors and updates (#5590)

- Added a new Invariant: `ValidPseudoAccounts` which checks that all pseudo-accounts behave consistently through creation and updates, and that no "real" accounts look like pseudo-accounts (which means they don't have a 0 sequence). 
- `to_short_string(base_uint)`. Like `to_string`, but only returns the first 8 characters. (Similar to how a git commit ID can be abbreviated.) Used as a wrapped sink to prefix most transaction-related messages. More can be added later.
- `XRPL_ASSERT_PARTS`. Convenience wrapper for `XRPL_ASSERT`, which takes the `function` and `description` as separate parameters.
- `SField::sMD_PseudoAccount`. Metadata option for `SField` definitions to indicate that the field, if set in an `AccountRoot` indicates that account is a pseudo-account. Removes the need for hard-coded field lists all over the place. Added the flag to `AMMID` and `VaultID`.
- Added functionality to `SField` ctor to detect both code and name collisions using asserts. And require all SFields to have a name
- Convenience type aliases `STLedgerEntry::const_pointer` and `STLedgerEntry::const_ref`. (`SLE` is an alias to `STLedgerEntry`.)
- Generalized `feeunit.h` (`TaggedFee`) into `unit.h` (`ValueUnit`) and added new "BIPS"-related tags for future use. Also refactored the type restrictions to use Concepts.
- Restructured `transactions.macro` to do two big things
	1. Include the `#include` directives for transactor header files directly in the macro file. Removes the need to update `applySteps.cpp` and the resulting conflicts.
	2. Added a `privileges` parameter to the `TRANSACTION` macro, which specifies some of the operations a transaction is allowed to do. These `privileges` are enforced by invariant checks. Again, removed the need to update scattered lists of transaction types in various checks.
- Unit tests:
	1.  Moved more helper functions into `TestHelpers.h` and `.cpp`. 
	2. Cleaned up the namespaces to prevent / mitigate random collisions and ambiguous symbols, particularly in unity builds.
	3. Generalized `Env::balance` to add support for `MPTIssue` and `Asset`.
	4. Added a set of helper classes to simplify `Env` transaction parameter classes: `JTxField`, `JTxFieldWrapper`, and a bunch of classes derived or aliased from it. For an example of how awesome it is, check the changes `src/test/jtx/escrow.h` for how much simpler the definitions are for `finish_time`, `cancel_time`, `condition`, and `fulfillment`. 
	5. Generalized several of the amount-related helper classes to understand `Asset`s.
     6. `env.balance` for an MPT issuer will return a negative number (or 0) for consistency with IOUs.

* refactor: Simplify STParsedJSON with some helper functions (#5591)

- Add code coverage for STParsedJSON edge cases

Co-authored-by: Denis Angell <dangell@transia.co>

* test: Add STInteger and STParsedJSON tests (#5726)

This change is to improve code coverage (and to simplify #5720 and #5725); there is otherwise no change in functionality. The change adds basic tests for `STInteger` and `STParsedJSON`, so it becomes easier to test smaller changes to the types, as well as removes `STParsedJSONArray`, since it is not used anywhere (including in Clio).

* Revert "Update Conan dependencies: OpenSSL" (#5807)

This change reverts #5617, because it will require extensive testing that will take up more time than we have before the next scheduled release.

Reverting this change does not mean we are abandoning it. We aim to pick it back up once there's a sufficient time window to allow for testing on multiple distros running a mixture of OpenSSL 1.x and 3.x.

* docs: Add warning about using std::counting_semaphore (#5595)

This adds a comment to avoid using `std::counting_semaphore` until the minimum compiler versions of GCC and Clang have been updated to no longer contain the bug that is present in older compilers.

* Improve ValidatorList invalid UNL manifest logging (#5804)

This change raises logging severity from `INFO` to `WARN` when handling UNL manifest signed with an unexpected / invalid key. It also changes the internal error code for an invalid format of UNL manifest to `invalid` (from `untrusted`).

This is a follow up to problems experienced by an UNL node due to old manifest key configured in `validators.txt`, which would be easier to diagnose with improved logging.

It also replaces a log line with `UNREACHABLE` for an impossible situation when we match UNL manifest key against a configured key which has an invalid type (we cannot configure such a key because of checks when loading configured keys).

* chore: Pin all CI Docker tags (#5813)

To avoid surprises and ensure reproducibility, this change pins all CI Docker image tags to the latest version in the XRPLF/CI repo.

* change `fixPriceOracleOrder` to `Supported::yes` (#5749)

* fix: Address http header case sensitivity (#5767)

This change makes the regex in `HttpClient.cpp` that matches the content-length http header case insensitive to improve compatibility, as http headers are case insensitive.

* test: add more comprehensive tests for `FeeVote` (#5746)

This change adds more comprehensive tests for the `FeeVote` module, which previously only checked the basics, and not the more comprehensive flows in that class.

* ci: Call all reusable workflows reusable (#5818)

* Add `STInt32` as a new `SType` (#5788)

This change adds `STInt32` as a new `SType` under the `STInteger` umbrella, with `SType` value `12`. This is the first and only `STInteger` type that supports negative values.

* switch `fixIncludeKeyletFields` to `Supported::yes` (#5819)

* refactor: Restructure Transactor::preflight to reduce boilerplate (#5592)

* Restructures `Transactor::preflight` to create several functions that will remove the need for error-prone boilerplate code in derived classes' implementations of `preflight`.

* refactor: Add support for extra transaction signatures (#5594)

* Restructures Transactor signature checking code to be able to handle a `sigObject`, which may be the full transaction, or may be an object field containing a separate signature. Either way, the `sigObject` can be a single- or multi-sign signature.

* ci: Upload artifacts during build and test in a separate job (#5817)

* chore: Set free-form CI inputs as env vars (#5822)

This change moves CI values that could be user-provided into environment variables.

* Rename flags for DynamicMPT (#5820)

* Set version to 2.6.1

* fix: FD/handle guarding + exponential backoff (#5823)

* fix: Transaction sig checking functions do not get a full context (#5829)

Fixes a (currently harmless) bug introduced by PR #5594

* Remove bogus coverage warning (#5838)

* fix return type

---------

Co-authored-by: Ed Hennis <ed@ripple.com>
Co-authored-by: Jingchen <a1q123456@users.noreply.github.com>
Co-authored-by: Denis Angell <dangell@transia.co>
Co-authored-by: Bart <bthomee@users.noreply.github.com>
Co-authored-by: yinyiqian1 <yqian@ripple.com>
Co-authored-by: Vito Tumas <5780819+Tapanito@users.noreply.github.com>
Co-authored-by: Bronek Kozicki <brok@incorrekt.com>
Co-authored-by: Mayukha Vadari <mvadari@ripple.com>
Co-authored-by: Valentin Balaschenko <13349202+vlntb@users.noreply.github.com>
Co-authored-by: tequ <git@tequ.dev>
Co-authored-by: Ayaz Salikhov <mathbunnyru@users.noreply.github.com>

include/xrpl/basics/base_uint.h

@@ -632,6 +632,16 @@ to_string(base_uint<Bits, Tag> const& a)
     return strHex(a.cbegin(), a.cend());
 }
 
+template <std::size_t Bits, class Tag>
+inline std::string
+to_short_string(base_uint<Bits, Tag> const& a)
+{
+    static_assert(
+        base_uint<Bits, Tag>::bytes > 4,
+        "For 4 bytes or less, use a native type");
+    return strHex(a.cbegin(), a.cbegin() + 4) + "...";
+}
+
 template <std::size_t Bits, class Tag>
 inline std::ostream&
 operator<<(std::ostream& out, base_uint<Bits, Tag> const& u)

include/xrpl/basics/safe_cast.h

@@ -28,9 +28,8 @@ namespace ripple {
 // the destination can hold all values of the source.  This is particularly
 // handy when the source or destination is an enumeration type.
 
-template <class Dest, class Src>
-static constexpr bool is_safetocasttovalue_v =
-    (std::is_integral_v<Src> && std::is_integral_v<Dest>) &&
+template <class Src, class Dest>
+concept SafeToCast = (std::is_integral_v<Src> && std::is_integral_v<Dest>) &&
     (std::is_signed<Src>::value || std::is_unsigned<Dest>::value) &&
     (std::is_signed<Src>::value != std::is_signed<Dest>::value
          ? sizeof(Dest) > sizeof(Src)
@@ -78,7 +77,7 @@ inline constexpr std::
     unsafe_cast(Src s) noexcept
 {
     static_assert(
-        !is_safetocasttovalue_v<Dest, Src>,
+        !SafeToCast<Src, Dest>,
         "Only unsafe if casting signed to unsigned or "
         "destination is too small");
     return static_cast<Dest>(s);

include/xrpl/beast/utility/instrumentation.h

@@ -39,11 +39,16 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #endif
 
 #define XRPL_ASSERT ALWAYS_OR_UNREACHABLE
+#define XRPL_ASSERT_PARTS(cond, function, description, ...) \
+    XRPL_ASSERT(cond, function " : " description)
 
 // How to use the instrumentation macros:
 //
 // * XRPL_ASSERT if cond must be true but the line might not be reached during
 //   fuzzing. Same like `assert` in normal use.
+// * XRPL_ASSERT_PARTS is for convenience, and works like XRPL_ASSERT, but
+//   splits the message param into "function" and "description", then joins
+//   them with " : " before passing to XRPL_ASSERT.
 // * ALWAYS if cond must be true _and_ the line must be reached during fuzzing.
 //   Same like `assert` in normal use.
 // * REACHABLE if the line must be reached during fuzzing

include/xrpl/ledger/ApplyView.h

@@ -0,0 +1,390 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_APPLYVIEW_H_INCLUDED
+#define RIPPLE_LEDGER_APPLYVIEW_H_INCLUDED
+
+#include <xrpl/basics/safe_cast.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/ReadView.h>
+
+namespace ripple {
+
+enum ApplyFlags : std::uint32_t {
+    tapNONE = 0x00,
+
+    // This is a local transaction with the
+    // fail_hard flag set.
+    tapFAIL_HARD = 0x10,
+
+    // This is not the transaction's last pass
+    // Transaction can be retried, soft failures allowed
+    tapRETRY = 0x20,
+
+    // Transaction came from a privileged source
+    tapUNLIMITED = 0x400,
+
+    // Transaction is executing as part of a batch
+    tapBATCH = 0x800,
+
+    // Transaction shouldn't be applied
+    // Signatures shouldn't be checked
+    tapDRY_RUN = 0x1000
+};
+
+constexpr ApplyFlags
+operator|(ApplyFlags const& lhs, ApplyFlags const& rhs)
+{
+    return safe_cast<ApplyFlags>(
+        safe_cast<std::underlying_type_t<ApplyFlags>>(lhs) |
+        safe_cast<std::underlying_type_t<ApplyFlags>>(rhs));
+}
+
+static_assert(
+    (tapFAIL_HARD | tapRETRY) == safe_cast<ApplyFlags>(0x30u),
+    "ApplyFlags operator |");
+static_assert(
+    (tapRETRY | tapFAIL_HARD) == safe_cast<ApplyFlags>(0x30u),
+    "ApplyFlags operator |");
+
+constexpr ApplyFlags
+operator&(ApplyFlags const& lhs, ApplyFlags const& rhs)
+{
+    return safe_cast<ApplyFlags>(
+        safe_cast<std::underlying_type_t<ApplyFlags>>(lhs) &
+        safe_cast<std::underlying_type_t<ApplyFlags>>(rhs));
+}
+
+static_assert((tapFAIL_HARD & tapRETRY) == tapNONE, "ApplyFlags operator &");
+static_assert((tapRETRY & tapFAIL_HARD) == tapNONE, "ApplyFlags operator &");
+
+constexpr ApplyFlags
+operator~(ApplyFlags const& flags)
+{
+    return safe_cast<ApplyFlags>(
+        ~safe_cast<std::underlying_type_t<ApplyFlags>>(flags));
+}
+
+static_assert(
+    ~tapRETRY == safe_cast<ApplyFlags>(0xFFFFFFDFu),
+    "ApplyFlags operator ~");
+
+inline ApplyFlags
+operator|=(ApplyFlags& lhs, ApplyFlags const& rhs)
+{
+    lhs = lhs | rhs;
+    return lhs;
+}
+
+inline ApplyFlags
+operator&=(ApplyFlags& lhs, ApplyFlags const& rhs)
+{
+    lhs = lhs & rhs;
+    return lhs;
+}
+
+//------------------------------------------------------------------------------
+
+/** Writeable view to a ledger, for applying a transaction.
+
+    This refinement of ReadView provides an interface where
+    the SLE can be "checked out" for modifications and put
+    back in an updated or removed state. Also added is an
+    interface to provide contextual information necessary
+    to calculate the results of transaction processing,
+    including the metadata if the view is later applied to
+    the parent (using an interface in the derived class).
+    The context info also includes values from the base
+    ledger such as sequence number and the network time.
+
+    This allows implementations to journal changes made to
+    the state items in a ledger, with the option to apply
+    those changes to the base or discard the changes without
+    affecting the base.
+
+    Typical usage is to call read() for non-mutating
+    operations.
+
+    For mutating operations the sequence is as follows:
+
+        // Add a new value
+        v.insert(sle);
+
+        // Check out a value for modification
+        sle = v.peek(k);
+
+        // Indicate that changes were made
+        v.update(sle)
+
+        // Or, erase the value
+        v.erase(sle)
+
+    The invariant is that insert, update, and erase may not
+    be called with any SLE which belongs to different view.
+*/
+class ApplyView : public ReadView
+{
+private:
+    /** Add an entry to a directory using the specified insert strategy */
+    std::optional<std::uint64_t>
+    dirAdd(
+        bool preserveOrder,
+        Keylet const& directory,
+        uint256 const& key,
+        std::function<void(std::shared_ptr<SLE> const&)> const& describe);
+
+public:
+    ApplyView() = default;
+
+    /** Returns the tx apply flags.
+
+        Flags can affect the outcome of transaction
+        processing. For example, transactions applied
+        to an open ledger generate "local" failures,
+        while transactions applied to the consensus
+        ledger produce hard failures (and claim a fee).
+    */
+    virtual ApplyFlags
+    flags() const = 0;
+
+    /** Prepare to modify the SLE associated with key.
+
+        Effects:
+
+            Gives the caller ownership of a modifiable
+            SLE associated with the specified key.
+
+        The returned SLE may be used in a subsequent
+        call to erase or update.
+
+        The SLE must not be passed to any other ApplyView.
+
+        @return `nullptr` if the key is not present
+    */
+    virtual std::shared_ptr<SLE>
+    peek(Keylet const& k) = 0;
+
+    /** Remove a peeked SLE.
+
+        Requirements:
+
+            `sle` was obtained from prior call to peek()
+            on this instance of the RawView.
+
+        Effects:
+
+            The key is no longer associated with the SLE.
+    */
+    virtual void
+    erase(std::shared_ptr<SLE> const& sle) = 0;
+
+    /** Insert a new state SLE
+
+        Requirements:
+
+            `sle` was not obtained from any calls to
+            peek() on any instances of RawView.
+
+            The SLE's key must not already exist.
+
+        Effects:
+
+            The key in the state map is associated
+            with the SLE.
+
+            The RawView acquires ownership of the shared_ptr.
+
+        @note The key is taken from the SLE
+    */
+    virtual void
+    insert(std::shared_ptr<SLE> const& sle) = 0;
+
+    /** Indicate changes to a peeked SLE
+
+        Requirements:
+
+            The SLE's key must exist.
+
+            `sle` was obtained from prior call to peek()
+            on this instance of the RawView.
+
+        Effects:
+
+            The SLE is updated
+
+        @note The key is taken from the SLE
+    */
+    /** @{ */
+    virtual void
+    update(std::shared_ptr<SLE> const& sle) = 0;
+
+    //--------------------------------------------------------------------------
+
+    // Called when a credit is made to an account
+    // This is required to support PaymentSandbox
+    virtual void
+    creditHook(
+        AccountID const& from,
+        AccountID const& to,
+        STAmount const& amount,
+        STAmount const& preCreditBalance)
+    {
+    }
+
+    // Called when the owner count changes
+    // This is required to support PaymentSandbox
+    virtual void
+    adjustOwnerCountHook(
+        AccountID const& account,
+        std::uint32_t cur,
+        std::uint32_t next)
+    {
+    }
+
+    /** Append an entry to a directory
+
+        Entries in the directory will be stored in order of insertion, i.e. new
+        entries will always be added at the tail end of the last page.
+
+        @param directory the base of the directory
+        @param key the entry to insert
+        @param describe callback to add required entries to a new page
+
+        @return a \c std::optional which, if insertion was successful,
+                will contain the page number in which the item was stored.
+
+        @note this function may create a page (including a root page), if no
+              page with space is available. This function will only fail if the
+              page counter exceeds the protocol-defined maximum number of
+              allowable pages.
+    */
+    /** @{ */
+    std::optional<std::uint64_t>
+    dirAppend(
+        Keylet const& directory,
+        Keylet const& key,
+        std::function<void(std::shared_ptr<SLE> const&)> const& describe)
+    {
+        if (key.type != ltOFFER)
+        {
+            UNREACHABLE(
+                "ripple::ApplyView::dirAppend : only Offers are appended to "
+                "book directories");
+            // Only Offers are appended to book directories. Call dirInsert()
+            // instead
+            return std::nullopt;
+        }
+        return dirAdd(true, directory, key.key, describe);
+    }
+    /** @} */
+
+    /** Insert an entry to a directory
+
+        Entries in the directory will be stored in a semi-random order, but
+        each page will be maintained in sorted order.
+
+        @param directory the base of the directory
+        @param key the entry to insert
+        @param describe callback to add required entries to a new page
+
+        @return a \c std::optional which, if insertion was successful,
+                will contain the page number in which the item was stored.
+
+        @note this function may create a page (including a root page), if no
+              page with space is available.this function will only fail if the
+              page counter exceeds the protocol-defined maximum number of
+              allowable pages.
+    */
+    /** @{ */
+    std::optional<std::uint64_t>
+    dirInsert(
+        Keylet const& directory,
+        uint256 const& key,
+        std::function<void(std::shared_ptr<SLE> const&)> const& describe)
+    {
+        return dirAdd(false, directory, key, describe);
+    }
+
+    std::optional<std::uint64_t>
+    dirInsert(
+        Keylet const& directory,
+        Keylet const& key,
+        std::function<void(std::shared_ptr<SLE> const&)> const& describe)
+    {
+        return dirAdd(false, directory, key.key, describe);
+    }
+    /** @} */
+
+    /** Remove an entry from a directory
+
+        @param directory the base of the directory
+        @param page the page number for this page
+        @param key the entry to remove
+        @param keepRoot if deleting the last entry, don't
+                        delete the root page (i.e. the directory itself).
+
+        @return \c true if the entry was found and deleted and
+                \c false otherwise.
+
+        @note This function will remove zero or more pages from the directory;
+              the root page will not be deleted even if it is empty, unless
+              \p keepRoot is not set and the directory is empty.
+    */
+    /** @{ */
+    bool
+    dirRemove(
+        Keylet const& directory,
+        std::uint64_t page,
+        uint256 const& key,
+        bool keepRoot);
+
+    bool
+    dirRemove(
+        Keylet const& directory,
+        std::uint64_t page,
+        Keylet const& key,
+        bool keepRoot)
+    {
+        return dirRemove(directory, page, key.key, keepRoot);
+    }
+    /** @} */
+
+    /** Remove the specified directory, invoking the callback for every node. */
+    bool
+    dirDelete(
+        Keylet const& directory,
+        std::function<void(uint256 const&)> const&);
+
+    /** Remove the specified directory, if it is empty.
+
+        @param directory the identifier of the directory node to be deleted
+        @return \c true if the directory was found and was successfully deleted
+                \c false otherwise.
+
+        @note The function should only be called with the root entry (i.e. with
+              the first page) of a directory.
+    */
+    bool
+    emptyDirDelete(Keylet const& directory);
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/ApplyViewImpl.h

@@ -0,0 +1,99 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_APPLYVIEWIMPL_H_INCLUDED
+#define RIPPLE_LEDGER_APPLYVIEWIMPL_H_INCLUDED
+
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/detail/ApplyViewBase.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
+
+namespace ripple {
+
+/** Editable, discardable view that can build metadata for one tx.
+
+    Iteration of the tx map is delegated to the base.
+
+    @note Presented as ApplyView to clients.
+*/
+class ApplyViewImpl final : public detail::ApplyViewBase
+{
+public:
+    ApplyViewImpl() = delete;
+    ApplyViewImpl(ApplyViewImpl const&) = delete;
+    ApplyViewImpl&
+    operator=(ApplyViewImpl&&) = delete;
+    ApplyViewImpl&
+    operator=(ApplyViewImpl const&) = delete;
+
+    ApplyViewImpl(ApplyViewImpl&&) = default;
+    ApplyViewImpl(ReadView const* base, ApplyFlags flags);
+
+    /** Apply the transaction.
+
+        After a call to `apply`, the only valid
+        operation on this object is to call the
+        destructor.
+    */
+    std::optional<TxMeta>
+    apply(
+        OpenView& to,
+        STTx const& tx,
+        TER ter,
+        std::optional<uint256> parentBatchId,
+        bool isDryRun,
+        beast::Journal j);
+
+    /** Set the amount of currency delivered.
+
+        This value is used when generating metadata
+        for payments, to set the DeliveredAmount field.
+        If the amount is not specified, the field is
+        excluded from the resulting metadata.
+    */
+    void
+    deliver(STAmount const& amount)
+    {
+        deliver_ = amount;
+    }
+
+    /** Get the number of modified entries
+     */
+    std::size_t
+    size();
+
+    /** Visit modified entries
+     */
+    void
+    visit(
+        OpenView& target,
+        std::function<void(
+            uint256 const& key,
+            bool isDelete,
+            std::shared_ptr<SLE const> const& before,
+            std::shared_ptr<SLE const> const& after)> const& func);
+
+private:
+    std::optional<STAmount> deliver_;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/BookDirs.h

@@ -0,0 +1,113 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2015 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_BOOK_DIRS_H_INCLUDED
+#define RIPPLE_LEDGER_BOOK_DIRS_H_INCLUDED
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ReadView.h>
+
+namespace ripple {
+
+class BookDirs
+{
+private:
+    ReadView const* view_ = nullptr;
+    uint256 const root_;
+    uint256 const next_quality_;
+    uint256 const key_;
+    std::shared_ptr<SLE const> sle_ = nullptr;
+    unsigned int entry_ = 0;
+    uint256 index_;
+
+public:
+    class const_iterator;
+    using value_type = std::shared_ptr<SLE const>;
+
+    BookDirs(ReadView const&, Book const&);
+
+    const_iterator
+    begin() const;
+
+    const_iterator
+    end() const;
+};
+
+class BookDirs::const_iterator
+{
+public:
+    using value_type = BookDirs::value_type;
+    using pointer = value_type const*;
+    using reference = value_type const&;
+    using difference_type = std::ptrdiff_t;
+    using iterator_category = std::forward_iterator_tag;
+
+    const_iterator() = default;
+
+    bool
+    operator==(const_iterator const& other) const;
+
+    bool
+    operator!=(const_iterator const& other) const
+    {
+        return !(*this == other);
+    }
+
+    reference
+    operator*() const;
+
+    pointer
+    operator->() const
+    {
+        return &**this;
+    }
+
+    const_iterator&
+    operator++();
+
+    const_iterator
+    operator++(int);
+
+private:
+    friend class BookDirs;
+
+    const_iterator(
+        ReadView const& view,
+        uint256 const& root,
+        uint256 const& dir_key)
+        : view_(&view), root_(root), key_(dir_key), cur_key_(dir_key)
+    {
+    }
+
+    ReadView const* view_ = nullptr;
+    uint256 root_;
+    uint256 next_quality_;
+    uint256 key_;
+    uint256 cur_key_;
+    std::shared_ptr<SLE const> sle_;
+    unsigned int entry_ = 0;
+    uint256 index_;
+    std::optional<value_type> mutable cache_;
+
+    static beast::Journal j_;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/CachedSLEs.h

@@ -0,0 +1,31 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_CACHEDSLES_H_INCLUDED
+#define RIPPLE_LEDGER_CACHEDSLES_H_INCLUDED
+
+#include <xrpl/basics/TaggedCache.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+
+namespace ripple {
+using CachedSLEs = TaggedCache<uint256, SLE const>;
+}
+
+#endif  // RIPPLE_LEDGER_CACHEDSLES_H_INCLUDED

include/xrpl/ledger/CachedView.h

@@ -0,0 +1,188 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_CACHEDVIEW_H_INCLUDED
+#define RIPPLE_LEDGER_CACHEDVIEW_H_INCLUDED
+
+#include <xrpl/basics/hardened_hash.h>
+#include <xrpl/ledger/CachedSLEs.h>
+#include <xrpl/ledger/ReadView.h>
+
+#include <mutex>
+#include <type_traits>
+
+namespace ripple {
+
+namespace detail {
+
+class CachedViewImpl : public DigestAwareReadView
+{
+private:
+    DigestAwareReadView const& base_;
+    CachedSLEs& cache_;
+    std::mutex mutable mutex_;
+    std::unordered_map<key_type, uint256, hardened_hash<>> mutable map_;
+
+public:
+    CachedViewImpl() = delete;
+    CachedViewImpl(CachedViewImpl const&) = delete;
+    CachedViewImpl&
+    operator=(CachedViewImpl const&) = delete;
+
+    CachedViewImpl(DigestAwareReadView const* base, CachedSLEs& cache)
+        : base_(*base), cache_(cache)
+    {
+    }
+
+    //
+    // ReadView
+    //
+
+    bool
+    exists(Keylet const& k) const override;
+
+    std::shared_ptr<SLE const>
+    read(Keylet const& k) const override;
+
+    bool
+    open() const override
+    {
+        return base_.open();
+    }
+
+    LedgerInfo const&
+    info() const override
+    {
+        return base_.info();
+    }
+
+    Fees const&
+    fees() const override
+    {
+        return base_.fees();
+    }
+
+    Rules const&
+    rules() const override
+    {
+        return base_.rules();
+    }
+
+    std::optional<key_type>
+    succ(
+        key_type const& key,
+        std::optional<key_type> const& last = std::nullopt) const override
+    {
+        return base_.succ(key, last);
+    }
+
+    std::unique_ptr<sles_type::iter_base>
+    slesBegin() const override
+    {
+        return base_.slesBegin();
+    }
+
+    std::unique_ptr<sles_type::iter_base>
+    slesEnd() const override
+    {
+        return base_.slesEnd();
+    }
+
+    std::unique_ptr<sles_type::iter_base>
+    slesUpperBound(uint256 const& key) const override
+    {
+        return base_.slesUpperBound(key);
+    }
+
+    std::unique_ptr<txs_type::iter_base>
+    txsBegin() const override
+    {
+        return base_.txsBegin();
+    }
+
+    std::unique_ptr<txs_type::iter_base>
+    txsEnd() const override
+    {
+        return base_.txsEnd();
+    }
+
+    bool
+    txExists(key_type const& key) const override
+    {
+        return base_.txExists(key);
+    }
+
+    tx_type
+    txRead(key_type const& key) const override
+    {
+        return base_.txRead(key);
+    }
+
+    //
+    // DigestAwareReadView
+    //
+
+    std::optional<digest_type>
+    digest(key_type const& key) const override
+    {
+        return base_.digest(key);
+    }
+};
+
+}  // namespace detail
+
+/** Wraps a DigestAwareReadView to provide caching.
+
+    @tparam Base A subclass of DigestAwareReadView
+*/
+template <class Base>
+class CachedView : public detail::CachedViewImpl
+{
+private:
+    static_assert(std::is_base_of<DigestAwareReadView, Base>::value, "");
+
+    std::shared_ptr<Base const> sp_;
+
+public:
+    using base_type = Base;
+
+    CachedView() = delete;
+    CachedView(CachedView const&) = delete;
+    CachedView&
+    operator=(CachedView const&) = delete;
+
+    CachedView(std::shared_ptr<Base const> const& base, CachedSLEs& cache)
+        : CachedViewImpl(base.get(), cache), sp_(base)
+    {
+    }
+
+    /** Returns the base type.
+
+        @note This breaks encapsulation and bypasses the cache.
+    */
+    std::shared_ptr<Base const> const&
+    base() const
+    {
+        return sp_;
+    }
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/CredentialHelpers.h

@@ -0,0 +1,117 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2024 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_APP_MISC_CREDENTIALHELPERS_H_INCLUDED
+#define RIPPLE_APP_MISC_CREDENTIALHELPERS_H_INCLUDED
+
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/STTx.h>
+#include <xrpl/protocol/TER.h>
+
+namespace ripple {
+namespace credentials {
+
+// These function will be used by the code that use DepositPreauth / Credentials
+// (and any future preauthorization modes) as part of authorization (all the
+// transfer funds transactions)
+
+// Check if credential sfExpiration field has passed ledger's parentCloseTime
+bool
+checkExpired(
+    std::shared_ptr<SLE const> const& sleCredential,
+    NetClock::time_point const& closed);
+
+// Return true if any expired credential was found in arr (and deleted)
+bool
+removeExpired(ApplyView& view, STVector256 const& arr, beast::Journal const j);
+
+// Actually remove a credentials object from the ledger
+TER
+deleteSLE(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sleCredential,
+    beast::Journal j);
+
+// Amendment and parameters checks for sfCredentialIDs field
+NotTEC
+checkFields(STTx const& tx, beast::Journal j);
+
+// Accessing the ledger to check if provided credentials are valid. Do not use
+// in doApply (only in preclaim) since it does not remove expired credentials.
+// If you call it in prelaim, you also must call verifyDepositPreauth in doApply
+TER
+valid(
+    STTx const& tx,
+    ReadView const& view,
+    AccountID const& src,
+    beast::Journal j);
+
+// Check if subject has any credential maching the given domain. If you call it
+// in preclaim and it returns tecEXPIRED, you should call verifyValidDomain in
+// doApply. This will ensure that expired credentials are deleted.
+TER
+validDomain(ReadView const& view, uint256 domainID, AccountID const& subject);
+
+// This function is only called when we about to return tecNO_PERMISSION
+// because all the checks for the DepositPreauth authorization failed.
+TER
+authorizedDepositPreauth(
+    ApplyView const& view,
+    STVector256 const& ctx,
+    AccountID const& dst);
+
+// Sort credentials array, return empty set if there are duplicates
+std::set<std::pair<AccountID, Slice>>
+makeSorted(STArray const& credentials);
+
+// Check credentials array passed to DepositPreauth/PermissionedDomainSet
+// transactions
+NotTEC
+checkArray(STArray const& credentials, unsigned maxSize, beast::Journal j);
+
+}  // namespace credentials
+
+// Check expired credentials and for credentials maching DomainID of the ledger
+// object
+TER
+verifyValidDomain(
+    ApplyView& view,
+    AccountID const& account,
+    uint256 domainID,
+    beast::Journal j);
+
+// Check expired credentials and for existing DepositPreauth ledger object
+TER
+verifyDepositPreauth(
+    STTx const& tx,
+    ApplyView& view,
+    AccountID const& src,
+    AccountID const& dst,
+    std::shared_ptr<SLE> const& sleDst,
+    beast::Journal j);
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/Dir.h

@@ -0,0 +1,132 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2015 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_DIR_H_INCLUDED
+#define RIPPLE_LEDGER_DIR_H_INCLUDED
+
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Indexes.h>
+
+namespace ripple {
+
+/** A class that simplifies iterating ledger directory pages
+
+    The Dir class provides a forward iterator for walking through
+    the uint256 values contained in ledger directories.
+
+    The Dir class also allows accelerated directory walking by
+    stepping directly from one page to the next using the next_page()
+    member function.
+
+    As of July 2024, the Dir class is only being used with NFTokenOffer
+    directories and for unit tests.
+*/
+class Dir
+{
+private:
+    ReadView const* view_ = nullptr;
+    Keylet root_;
+    std::shared_ptr<SLE const> sle_;
+    STVector256 const* indexes_ = nullptr;
+
+public:
+    class const_iterator;
+    using value_type = std::shared_ptr<SLE const>;
+
+    Dir(ReadView const&, Keylet const&);
+
+    const_iterator
+    begin() const;
+
+    const_iterator
+    end() const;
+};
+
+class Dir::const_iterator
+{
+public:
+    using value_type = Dir::value_type;
+    using pointer = value_type const*;
+    using reference = value_type const&;
+    using difference_type = std::ptrdiff_t;
+    using iterator_category = std::forward_iterator_tag;
+
+    bool
+    operator==(const_iterator const& other) const;
+
+    bool
+    operator!=(const_iterator const& other) const
+    {
+        return !(*this == other);
+    }
+
+    reference
+    operator*() const;
+
+    pointer
+    operator->() const
+    {
+        return &**this;
+    }
+
+    const_iterator&
+    operator++();
+
+    const_iterator
+    operator++(int);
+
+    const_iterator&
+    next_page();
+
+    std::size_t
+    page_size();
+
+    Keylet const&
+    page() const
+    {
+        return page_;
+    }
+
+    uint256
+    index() const
+    {
+        return index_;
+    }
+
+private:
+    friend class Dir;
+
+    const_iterator(ReadView const& view, Keylet const& root, Keylet const& page)
+        : view_(&view), root_(root), page_(page)
+    {
+    }
+
+    ReadView const* view_ = nullptr;
+    Keylet root_;
+    Keylet page_;
+    uint256 index_;
+    std::optional<value_type> mutable cache_;
+    std::shared_ptr<SLE const> sle_;
+    STVector256 const* indexes_ = nullptr;
+    std::vector<uint256>::const_iterator it_;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/OpenView.h

@@ -0,0 +1,276 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_OPENVIEW_H_INCLUDED
+#define RIPPLE_LEDGER_OPENVIEW_H_INCLUDED
+
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/detail/RawStateTable.h>
+#include <xrpl/protocol/STArray.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <boost/container/pmr/monotonic_buffer_resource.hpp>
+#include <boost/container/pmr/polymorphic_allocator.hpp>
+
+#include <functional>
+#include <utility>
+
+namespace ripple {
+
+/** Open ledger construction tag.
+
+    Views constructed with this tag will have the
+    rules of open ledgers applied during transaction
+    processing.
+ */
+inline constexpr struct open_ledger_t
+{
+    explicit constexpr open_ledger_t() = default;
+} open_ledger{};
+
+/** Batch view construction tag.
+
+    Views constructed with this tag are part of a stack of views
+    used during batch transaction applied.
+ */
+inline constexpr struct batch_view_t
+{
+    explicit constexpr batch_view_t() = default;
+} batch_view{};
+
+//------------------------------------------------------------------------------
+
+/** Writable ledger view that accumulates state and tx changes.
+
+    @note Presented as ReadView to clients.
+*/
+class OpenView final : public ReadView, public TxsRawView
+{
+private:
+    // Initial size for the monotonic_buffer_resource used for allocations
+    // The size was chosen from the old `qalloc` code (which this replaces).
+    // It is unclear how the size initially chosen in qalloc.
+    static constexpr size_t initialBufferSize = kilobytes(256);
+
+    class txs_iter_impl;
+
+    struct txData
+    {
+        std::shared_ptr<Serializer const> txn;
+        std::shared_ptr<Serializer const> meta;
+
+        // Constructor needed for emplacement in std::map
+        txData(
+            std::shared_ptr<Serializer const> const& txn_,
+            std::shared_ptr<Serializer const> const& meta_)
+            : txn(txn_), meta(meta_)
+        {
+        }
+    };
+
+    // List of tx, key order
+    // Use boost::pmr functionality instead of std::pmr
+    // functions b/c clang does not support pmr yet (as-of 9/2020)
+    using txs_map = std::map<
+        key_type,
+        txData,
+        std::less<key_type>,
+        boost::container::pmr::polymorphic_allocator<
+            std::pair<key_type const, txData>>>;
+
+    // monotonic_resource_ must outlive `items_`. Make a pointer so it may be
+    // easily moved.
+    std::unique_ptr<boost::container::pmr::monotonic_buffer_resource>
+        monotonic_resource_;
+    txs_map txs_;
+    Rules rules_;
+    LedgerInfo info_;
+    ReadView const* base_;
+    detail::RawStateTable items_;
+    std::shared_ptr<void const> hold_;
+
+    /// In batch mode, the number of transactions already executed.
+    std::size_t baseTxCount_ = 0;
+
+    bool open_ = true;
+
+public:
+    OpenView() = delete;
+    OpenView&
+    operator=(OpenView&&) = delete;
+    OpenView&
+    operator=(OpenView const&) = delete;
+
+    OpenView(OpenView&&) = default;
+
+    /** Construct a shallow copy.
+
+        Effects:
+
+            Creates a new object with a copy of
+            the modification state table.
+
+        The objects managed by shared pointers are
+        not duplicated but shared between instances.
+        Since the SLEs are immutable, calls on the
+        RawView interface cannot break invariants.
+    */
+    OpenView(OpenView const&);
+
+    /** Construct an open ledger view.
+
+        Effects:
+
+            The sequence number is set to the
+            sequence number of parent plus one.
+
+            The parentCloseTime is set to the
+            closeTime of parent.
+
+            If `hold` is not nullptr, retains
+            ownership of a copy of `hold` until
+            the MetaView is destroyed.
+
+            Calls to rules() will return the
+            rules provided on construction.
+
+        The tx list starts empty and will contain
+        all newly inserted tx.
+    */
+    OpenView(
+        open_ledger_t,
+        ReadView const* base,
+        Rules const& rules,
+        std::shared_ptr<void const> hold = nullptr);
+
+    OpenView(
+        open_ledger_t,
+        Rules const& rules,
+        std::shared_ptr<ReadView const> const& base)
+        : OpenView(open_ledger, &*base, rules, base)
+    {
+    }
+
+    OpenView(batch_view_t, OpenView& base) : OpenView(std::addressof(base))
+    {
+        baseTxCount_ = base.txCount();
+    }
+
+    /** Construct a new last closed ledger.
+
+        Effects:
+
+            The LedgerInfo is copied from the base.
+
+            The rules are inherited from the base.
+
+        The tx list starts empty and will contain
+        all newly inserted tx.
+    */
+    OpenView(ReadView const* base, std::shared_ptr<void const> hold = nullptr);
+
+    /** Returns true if this reflects an open ledger. */
+    bool
+    open() const override
+    {
+        return open_;
+    }
+
+    /** Return the number of tx inserted since creation.
+
+        This is used to set the "apply ordinal"
+        when calculating transaction metadata.
+    */
+    std::size_t
+    txCount() const;
+
+    /** Apply changes. */
+    void
+    apply(TxsRawView& to) const;
+
+    // ReadView
+
+    LedgerInfo const&
+    info() const override;
+
+    Fees const&
+    fees() const override;
+
+    Rules const&
+    rules() const override;
+
+    bool
+    exists(Keylet const& k) const override;
+
+    std::optional<key_type>
+    succ(
+        key_type const& key,
+        std::optional<key_type> const& last = std::nullopt) const override;
+
+    std::shared_ptr<SLE const>
+    read(Keylet const& k) const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesBegin() const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesEnd() const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesUpperBound(uint256 const& key) const override;
+
+    std::unique_ptr<txs_type::iter_base>
+    txsBegin() const override;
+
+    std::unique_ptr<txs_type::iter_base>
+    txsEnd() const override;
+
+    bool
+    txExists(key_type const& key) const override;
+
+    tx_type
+    txRead(key_type const& key) const override;
+
+    // RawView
+
+    void
+    rawErase(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawInsert(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawReplace(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawDestroyXRP(XRPAmount const& fee) override;
+
+    // TxsRawView
+
+    void
+    rawTxInsert(
+        key_type const& key,
+        std::shared_ptr<Serializer const> const& txn,
+        std::shared_ptr<Serializer const> const& metaData) override;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/PaymentSandbox.h

@@ -0,0 +1,212 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_PAYMENTSANDBOX_H_INCLUDED
+#define RIPPLE_LEDGER_PAYMENTSANDBOX_H_INCLUDED
+
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/Sandbox.h>
+#include <xrpl/ledger/detail/ApplyViewBase.h>
+#include <xrpl/protocol/AccountID.h>
+
+#include <map>
+
+namespace ripple {
+
+namespace detail {
+
+// VFALCO TODO Inline this implementation
+//        into the PaymentSandbox class itself
+class DeferredCredits
+{
+public:
+    struct Adjustment
+    {
+        Adjustment(STAmount const& d, STAmount const& c, STAmount const& b)
+            : debits(d), credits(c), origBalance(b)
+        {
+        }
+        STAmount debits;
+        STAmount credits;
+        STAmount origBalance;
+    };
+
+    // Get the adjustments for the balance between main and other.
+    // Returns the debits, credits and the original balance
+    std::optional<Adjustment>
+    adjustments(
+        AccountID const& main,
+        AccountID const& other,
+        Currency const& currency) const;
+
+    void
+    credit(
+        AccountID const& sender,
+        AccountID const& receiver,
+        STAmount const& amount,
+        STAmount const& preCreditSenderBalance);
+
+    void
+    ownerCount(AccountID const& id, std::uint32_t cur, std::uint32_t next);
+
+    // Get the adjusted owner count. Since DeferredCredits is meant to be used
+    // in payments, and payments only decrease owner counts, return the max
+    // remembered owner count.
+    std::optional<std::uint32_t>
+    ownerCount(AccountID const& id) const;
+
+    void
+    apply(DeferredCredits& to);
+
+private:
+    // lowAccount, highAccount
+    using Key = std::tuple<AccountID, AccountID, Currency>;
+    struct Value
+    {
+        explicit Value() = default;
+
+        STAmount lowAcctCredits;
+        STAmount highAcctCredits;
+        STAmount lowAcctOrigBalance;
+    };
+
+    static Key
+    makeKey(AccountID const& a1, AccountID const& a2, Currency const& c);
+
+    std::map<Key, Value> credits_;
+    std::map<AccountID, std::uint32_t> ownerCounts_;
+};
+
+}  // namespace detail
+
+//------------------------------------------------------------------------------
+
+/** A wrapper which makes credits unavailable to balances.
+
+    This is used for payments and pathfinding, so that consuming
+    liquidity from a path never causes portions of that path or
+    other paths to gain liquidity.
+
+    The behavior of certain free functions in the ApplyView API
+    will change via the balanceHook and creditHook overrides
+    of PaymentSandbox.
+
+    @note Presented as ApplyView to clients
+*/
+class PaymentSandbox final : public detail::ApplyViewBase
+{
+public:
+    PaymentSandbox() = delete;
+    PaymentSandbox(PaymentSandbox const&) = delete;
+    PaymentSandbox&
+    operator=(PaymentSandbox&&) = delete;
+    PaymentSandbox&
+    operator=(PaymentSandbox const&) = delete;
+
+    PaymentSandbox(PaymentSandbox&&) = default;
+
+    PaymentSandbox(ReadView const* base, ApplyFlags flags)
+        : ApplyViewBase(base, flags)
+    {
+    }
+
+    PaymentSandbox(ApplyView const* base) : ApplyViewBase(base, base->flags())
+    {
+    }
+
+    /** Construct on top of existing PaymentSandbox.
+
+        The changes are pushed to the parent when
+        apply() is called.
+
+        @param parent A non-null pointer to the parent.
+
+        @note A pointer is used to prevent confusion
+              with copy construction.
+    */
+    // VFALCO If we are constructing on top of a PaymentSandbox,
+    //        or a PaymentSandbox-derived class, we MUST go through
+    //        one of these constructors or invariants will be broken.
+    /** @{ */
+    explicit PaymentSandbox(PaymentSandbox const* base)
+        : ApplyViewBase(base, base->flags()), ps_(base)
+    {
+    }
+
+    explicit PaymentSandbox(PaymentSandbox* base)
+        : ApplyViewBase(base, base->flags()), ps_(base)
+    {
+    }
+    /** @} */
+
+    STAmount
+    balanceHook(
+        AccountID const& account,
+        AccountID const& issuer,
+        STAmount const& amount) const override;
+
+    void
+    creditHook(
+        AccountID const& from,
+        AccountID const& to,
+        STAmount const& amount,
+        STAmount const& preCreditBalance) override;
+
+    void
+    adjustOwnerCountHook(
+        AccountID const& account,
+        std::uint32_t cur,
+        std::uint32_t next) override;
+
+    std::uint32_t
+    ownerCountHook(AccountID const& account, std::uint32_t count)
+        const override;
+
+    /** Apply changes to base view.
+
+        `to` must contain contents identical to the parent
+        view passed upon construction, else undefined
+        behavior will result.
+    */
+    /** @{ */
+    void
+    apply(RawView& to);
+
+    void
+    apply(PaymentSandbox& to);
+    /** @} */
+
+    // Return a map of balance changes on trust lines. The low account is the
+    // first account in the key. If the two accounts are equal, the map contains
+    // the total changes in currency regardless of issuer. This is useful to get
+    // the total change in XRP balances.
+    std::map<std::tuple<AccountID, AccountID, Currency>, STAmount>
+    balanceChanges(ReadView const& view) const;
+
+    XRPAmount
+    xrpDestroyed() const;
+
+private:
+    detail::DeferredCredits tab_;
+    PaymentSandbox const* ps_ = nullptr;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/RawView.h

@@ -0,0 +1,111 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_RAWVIEW_H_INCLUDED
+#define RIPPLE_LEDGER_RAWVIEW_H_INCLUDED
+
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/Serializer.h>
+
+namespace ripple {
+
+/** Interface for ledger entry changes.
+
+    Subclasses allow raw modification of ledger entries.
+*/
+class RawView
+{
+public:
+    virtual ~RawView() = default;
+    RawView() = default;
+    RawView(RawView const&) = default;
+    RawView&
+    operator=(RawView const&) = delete;
+
+    /** Delete an existing state item.
+
+        The SLE is provided so the implementation
+        can calculate metadata.
+    */
+    virtual void
+    rawErase(std::shared_ptr<SLE> const& sle) = 0;
+
+    /** Unconditionally insert a state item.
+
+        Requirements:
+            The key must not already exist.
+
+        Effects:
+
+            The key is associated with the SLE.
+
+        @note The key is taken from the SLE
+    */
+    virtual void
+    rawInsert(std::shared_ptr<SLE> const& sle) = 0;
+
+    /** Unconditionally replace a state item.
+
+        Requirements:
+
+            The key must exist.
+
+        Effects:
+
+            The key is associated with the SLE.
+
+        @note The key is taken from the SLE
+    */
+    virtual void
+    rawReplace(std::shared_ptr<SLE> const& sle) = 0;
+
+    /** Destroy XRP.
+
+        This is used to pay for transaction fees.
+    */
+    virtual void
+    rawDestroyXRP(XRPAmount const& fee) = 0;
+};
+
+//------------------------------------------------------------------------------
+
+/** Interface for changing ledger entries with transactions.
+
+    Allows raw modification of ledger entries and insertion
+    of transactions into the transaction map.
+*/
+class TxsRawView : public RawView
+{
+public:
+    /** Add a transaction to the tx map.
+
+        Closed ledgers must have metadata,
+        while open ledgers omit metadata.
+    */
+    virtual void
+    rawTxInsert(
+        ReadView::key_type const& key,
+        std::shared_ptr<Serializer const> const& txn,
+        std::shared_ptr<Serializer const> const& metaData) = 0;
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/ReadView.h

@@ -0,0 +1,284 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_READVIEW_H_INCLUDED
+#define RIPPLE_LEDGER_READVIEW_H_INCLUDED
+
+#include <xrpl/basics/chrono.h>
+#include <xrpl/beast/hash/uhash.h>
+#include <xrpl/ledger/detail/ReadViewFwdRange.h>
+#include <xrpl/protocol/Fees.h>
+#include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerHeader.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Rules.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STTx.h>
+
+#include <cstdint>
+#include <optional>
+#include <unordered_set>
+
+namespace ripple {
+
+//------------------------------------------------------------------------------
+
+/** A view into a ledger.
+
+    This interface provides read access to state
+    and transaction items. There is no checkpointing
+    or calculation of metadata.
+*/
+class ReadView
+{
+public:
+    using tx_type =
+        std::pair<std::shared_ptr<STTx const>, std::shared_ptr<STObject const>>;
+
+    using key_type = uint256;
+
+    using mapped_type = std::shared_ptr<SLE const>;
+
+    struct sles_type : detail::ReadViewFwdRange<std::shared_ptr<SLE const>>
+    {
+        explicit sles_type(ReadView const& view);
+        iterator
+        begin() const;
+        iterator
+        end() const;
+        iterator
+        upper_bound(key_type const& key) const;
+    };
+
+    struct txs_type : detail::ReadViewFwdRange<tx_type>
+    {
+        explicit txs_type(ReadView const& view);
+        bool
+        empty() const;
+        iterator
+        begin() const;
+        iterator
+        end() const;
+    };
+
+    virtual ~ReadView() = default;
+
+    ReadView&
+    operator=(ReadView&& other) = delete;
+    ReadView&
+    operator=(ReadView const& other) = delete;
+
+    ReadView() : sles(*this), txs(*this)
+    {
+    }
+
+    ReadView(ReadView const& other) : sles(*this), txs(*this)
+    {
+    }
+
+    ReadView(ReadView&& other) : sles(*this), txs(*this)
+    {
+    }
+
+    /** Returns information about the ledger. */
+    virtual LedgerInfo const&
+    info() const = 0;
+
+    /** Returns true if this reflects an open ledger. */
+    virtual bool
+    open() const = 0;
+
+    /** Returns the close time of the previous ledger. */
+    NetClock::time_point
+    parentCloseTime() const
+    {
+        return info().parentCloseTime;
+    }
+
+    /** Returns the sequence number of the base ledger. */
+    LedgerIndex
+    seq() const
+    {
+        return info().seq;
+    }
+
+    /** Returns the fees for the base ledger. */
+    virtual Fees const&
+    fees() const = 0;
+
+    /** Returns the tx processing rules. */
+    virtual Rules const&
+    rules() const = 0;
+
+    /** Determine if a state item exists.
+
+        @note This can be more efficient than calling read.
+
+        @return `true` if a SLE is associated with the
+                specified key.
+    */
+    virtual bool
+    exists(Keylet const& k) const = 0;
+
+    /** Return the key of the next state item.
+
+        This returns the key of the first state item
+        whose key is greater than the specified key. If
+        no such key is present, std::nullopt is returned.
+
+        If `last` is engaged, returns std::nullopt when
+        the key returned would be outside the open
+        interval (key, last).
+    */
+    virtual std::optional<key_type>
+    succ(
+        key_type const& key,
+        std::optional<key_type> const& last = std::nullopt) const = 0;
+
+    /** Return the state item associated with a key.
+
+        Effects:
+            If the key exists, gives the caller ownership
+            of the non-modifiable corresponding SLE.
+
+        @note While the returned SLE is `const` from the
+              perspective of the caller, it can be changed
+              by other callers through raw operations.
+
+        @return `nullptr` if the key is not present or
+                if the type does not match.
+    */
+    virtual std::shared_ptr<SLE const>
+    read(Keylet const& k) const = 0;
+
+    // Accounts in a payment are not allowed to use assets acquired during that
+    // payment. The PaymentSandbox tracks the debits, credits, and owner count
+    // changes that accounts make during a payment. `balanceHook` adjusts
+    // balances so newly acquired assets are not counted toward the balance.
+    // This is required to support PaymentSandbox.
+    virtual STAmount
+    balanceHook(
+        AccountID const& account,
+        AccountID const& issuer,
+        STAmount const& amount) const
+    {
+        return amount;
+    }
+
+    // Accounts in a payment are not allowed to use assets acquired during that
+    // payment. The PaymentSandbox tracks the debits, credits, and owner count
+    // changes that accounts make during a payment. `ownerCountHook` adjusts the
+    // ownerCount so it returns the max value of the ownerCount so far.
+    // This is required to support PaymentSandbox.
+    virtual std::uint32_t
+    ownerCountHook(AccountID const& account, std::uint32_t count) const
+    {
+        return count;
+    }
+
+    // used by the implementation
+    virtual std::unique_ptr<sles_type::iter_base>
+    slesBegin() const = 0;
+
+    // used by the implementation
+    virtual std::unique_ptr<sles_type::iter_base>
+    slesEnd() const = 0;
+
+    // used by the implementation
+    virtual std::unique_ptr<sles_type::iter_base>
+    slesUpperBound(key_type const& key) const = 0;
+
+    // used by the implementation
+    virtual std::unique_ptr<txs_type::iter_base>
+    txsBegin() const = 0;
+
+    // used by the implementation
+    virtual std::unique_ptr<txs_type::iter_base>
+    txsEnd() const = 0;
+
+    /** Returns `true` if a tx exists in the tx map.
+
+        A tx exists in the map if it is part of the
+        base ledger, or if it is a newly inserted tx.
+    */
+    virtual bool
+    txExists(key_type const& key) const = 0;
+
+    /** Read a transaction from the tx map.
+
+        If the view represents an open ledger,
+        the metadata object will be empty.
+
+        @return A pair of nullptr if the
+                key is not found in the tx map.
+    */
+    virtual tx_type
+    txRead(key_type const& key) const = 0;
+
+    //
+    // Memberspaces
+    //
+
+    /** Iterable range of ledger state items.
+
+        @note Visiting each state entry in the ledger can
+              become quite expensive as the ledger grows.
+    */
+    sles_type sles;
+
+    // The range of transactions
+    txs_type txs;
+};
+
+//------------------------------------------------------------------------------
+
+/** ReadView that associates keys with digests. */
+class DigestAwareReadView : public ReadView
+{
+public:
+    using digest_type = uint256;
+
+    DigestAwareReadView() = default;
+    DigestAwareReadView(DigestAwareReadView const&) = default;
+
+    /** Return the digest associated with the key.
+
+        @return std::nullopt if the item does not exist.
+    */
+    virtual std::optional<digest_type>
+    digest(key_type const& key) const = 0;
+};
+
+//------------------------------------------------------------------------------
+
+Rules
+makeRulesGivenLedger(DigestAwareReadView const& ledger, Rules const& current);
+
+Rules
+makeRulesGivenLedger(
+    DigestAwareReadView const& ledger,
+    std::unordered_set<uint256, beast::uhash<>> const& presets);
+
+}  // namespace ripple
+
+#include <xrpl/ledger/detail/ReadViewFwdRange.ipp>
+
+#endif

include/xrpl/ledger/Sandbox.h

@@ -0,0 +1,63 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_SANDBOX_H_INCLUDED
+#define RIPPLE_LEDGER_SANDBOX_H_INCLUDED
+
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/detail/ApplyViewBase.h>
+
+namespace ripple {
+
+/** Discardable, editable view to a ledger.
+
+    The sandbox inherits the flags of the base.
+
+    @note Presented as ApplyView to clients.
+*/
+class Sandbox : public detail::ApplyViewBase
+{
+public:
+    Sandbox() = delete;
+    Sandbox(Sandbox const&) = delete;
+    Sandbox&
+    operator=(Sandbox&&) = delete;
+    Sandbox&
+    operator=(Sandbox const&) = delete;
+
+    Sandbox(Sandbox&&) = default;
+
+    Sandbox(ReadView const* base, ApplyFlags flags) : ApplyViewBase(base, flags)
+    {
+    }
+
+    Sandbox(ApplyView const* base) : Sandbox(base, base->flags())
+    {
+    }
+
+    void
+    apply(RawView& to)
+    {
+        items_.apply(to);
+    }
+};
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/View.h

@@ -0,0 +1,982 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_VIEW_H_INCLUDED
+#define RIPPLE_LEDGER_VIEW_H_INCLUDED
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TER.h>
+
+#include <functional>
+#include <initializer_list>
+#include <map>
+#include <utility>
+
+namespace ripple {
+
+enum class WaiveTransferFee : bool { No = false, Yes };
+enum class SkipEntry : bool { No = false, Yes };
+
+//------------------------------------------------------------------------------
+//
+// Observers
+//
+//------------------------------------------------------------------------------
+
+/** Determines whether the given expiration time has passed.
+
+    In the XRP Ledger, expiration times are defined as the number of whole
+    seconds after the "Ripple Epoch" which, for historical reasons, is set
+    to January 1, 2000 (00:00 UTC).
+
+    This is like the way the Unix epoch works, except the Ripple Epoch is
+    precisely 946,684,800 seconds after the Unix Epoch.
+
+    See https://xrpl.org/basic-data-types.html#specifying-time
+
+    Expiration is defined in terms of the close time of the parent ledger,
+    because we definitively know the time that it closed (since consensus
+    agrees on time) but we do not know the closing time of the ledger that
+    is under construction.
+
+    @param view The ledger whose parent time is used as the clock.
+    @param exp The optional expiration time we want to check.
+
+    @returns `true` if `exp` is in the past; `false` otherwise.
+ */
+[[nodiscard]] bool
+hasExpired(ReadView const& view, std::optional<std::uint32_t> const& exp);
+
+/** Controls the treatment of frozen account balances */
+enum FreezeHandling { fhIGNORE_FREEZE, fhZERO_IF_FROZEN };
+
+/** Controls the treatment of unauthorized MPT balances */
+enum AuthHandling { ahIGNORE_AUTH, ahZERO_IF_UNAUTHORIZED };
+
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, AccountID const& issuer);
+
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue);
+
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, Asset const& asset);
+
+// Note, depth parameter is used to limit the recursion depth
+[[nodiscard]] bool
+isVaultPseudoAccountFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptShare,
+    int depth);
+
+[[nodiscard]] bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] inline bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& issue)
+{
+    return isIndividualFrozen(view, account, issue.currency, issue.account);
+}
+
+[[nodiscard]] bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue);
+
+[[nodiscard]] inline bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Asset const& asset)
+{
+    return std::visit(
+        [&](auto const& issue) {
+            return isIndividualFrozen(view, account, issue);
+        },
+        asset.value());
+}
+
+[[nodiscard]] bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] inline bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& issue,
+    int = 0 /*ignored*/)
+{
+    return isFrozen(view, account, issue.currency, issue.account);
+}
+
+[[nodiscard]] bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue,
+    int depth = 0);
+
+/**
+ *   isFrozen check is recursive for MPT shares in a vault, descending to
+ *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ *   purely defensive, as we currently do not allow such vaults to be created.
+ */
+[[nodiscard]] inline bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Asset const& asset,
+    int depth = 0)
+{
+    return std::visit(
+        [&](auto const& issue) {
+            return isFrozen(view, account, issue, depth);
+        },
+        asset.value());
+}
+
+[[nodiscard]] inline TER
+checkFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
+{
+    return isFrozen(view, account, issue) ? (TER)tecFROZEN : (TER)tesSUCCESS;
+}
+
+[[nodiscard]] inline TER
+checkFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue)
+{
+    return isFrozen(view, account, mptIssue) ? (TER)tecLOCKED : (TER)tesSUCCESS;
+}
+
+[[nodiscard]] inline TER
+checkFrozen(ReadView const& view, AccountID const& account, Asset const& asset)
+{
+    return std::visit(
+        [&](auto const& issue) { return checkFrozen(view, account, issue); },
+        asset.value());
+}
+
+[[nodiscard]] bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    MPTIssue const& mptIssue,
+    int depth = 0);
+
+[[nodiscard]] inline bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    Issue const& issue)
+{
+    for (auto const& account : accounts)
+    {
+        if (isFrozen(view, account, issue.currency, issue.account))
+            return true;
+    }
+    return false;
+}
+
+[[nodiscard]] inline bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    Asset const& asset,
+    int depth = 0)
+{
+    return std::visit(
+        [&]<ValidIssueType TIss>(TIss const& issue) {
+            if constexpr (std::is_same_v<TIss, Issue>)
+                return isAnyFrozen(view, accounts, issue);
+            else
+                return isAnyFrozen(view, accounts, issue, depth);
+        },
+        asset.value());
+}
+
+[[nodiscard]] bool
+isDeepFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] bool
+isLPTokenFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& asset,
+    Issue const& asset2);
+
+// Returns the amount an account can spend without going into debt.
+//
+// <-- saAmount: amount of currency held by account. May be negative.
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer,
+    FreezeHandling zeroIfFrozen,
+    beast::Journal j);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& issue,
+    FreezeHandling zeroIfFrozen,
+    beast::Journal j);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue,
+    FreezeHandling zeroIfFrozen,
+    AuthHandling zeroIfUnauthorized,
+    beast::Journal j);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Asset const& asset,
+    FreezeHandling zeroIfFrozen,
+    AuthHandling zeroIfUnauthorized,
+    beast::Journal j);
+
+// Returns the amount an account can spend of the currency type saDefault, or
+// returns saDefault if this account is the issuer of the currency in
+// question. Should be used in favor of accountHolds when questioning how much
+// an account can spend while also allowing currency issuers to spend
+// unlimited amounts of their own currency (since they can always issue more).
+[[nodiscard]] STAmount
+accountFunds(
+    ReadView const& view,
+    AccountID const& id,
+    STAmount const& saDefault,
+    FreezeHandling freezeHandling,
+    beast::Journal j);
+
+// Return the account's liquid (not reserved) XRP.  Generally prefer
+// calling accountHolds() over this interface.  However, this interface
+// allows the caller to temporarily adjust the owner count should that be
+// necessary.
+//
+// @param ownerCountAdj positive to add to count, negative to reduce count.
+[[nodiscard]] XRPAmount
+xrpLiquid(
+    ReadView const& view,
+    AccountID const& id,
+    std::int32_t ownerCountAdj,
+    beast::Journal j);
+
+/** Iterate all items in the given directory. */
+void
+forEachItem(
+    ReadView const& view,
+    Keylet const& root,
+    std::function<void(std::shared_ptr<SLE const> const&)> const& f);
+
+/** Iterate all items after an item in the given directory.
+    @param after The key of the item to start after
+    @param hint The directory page containing `after`
+    @param limit The maximum number of items to return
+    @return `false` if the iteration failed
+*/
+bool
+forEachItemAfter(
+    ReadView const& view,
+    Keylet const& root,
+    uint256 const& after,
+    std::uint64_t const hint,
+    unsigned int limit,
+    std::function<bool(std::shared_ptr<SLE const> const&)> const& f);
+
+/** Iterate all items in an account's owner directory. */
+inline void
+forEachItem(
+    ReadView const& view,
+    AccountID const& id,
+    std::function<void(std::shared_ptr<SLE const> const&)> const& f)
+{
+    return forEachItem(view, keylet::ownerDir(id), f);
+}
+
+/** Iterate all items after an item in an owner directory.
+    @param after The key of the item to start after
+    @param hint The directory page containing `after`
+    @param limit The maximum number of items to return
+    @return `false` if the iteration failed
+*/
+inline bool
+forEachItemAfter(
+    ReadView const& view,
+    AccountID const& id,
+    uint256 const& after,
+    std::uint64_t const hint,
+    unsigned int limit,
+    std::function<bool(std::shared_ptr<SLE const> const&)> const& f)
+{
+    return forEachItemAfter(view, keylet::ownerDir(id), after, hint, limit, f);
+}
+
+/** Returns IOU issuer transfer fee as Rate. Rate specifies
+ * the fee as fractions of 1 billion. For example, 1% transfer rate
+ * is represented as 1,010,000,000.
+ * @param issuer The IOU issuer
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, AccountID const& issuer);
+
+/** Returns MPT transfer fee as Rate. Rate specifies
+ * the fee as fractions of 1 billion. For example, 1% transfer rate
+ * is represented as 1,010,000,000.
+ * @param issuanceID MPTokenIssuanceID of MPTTokenIssuance object
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, MPTID const& issuanceID);
+
+/** Returns the transfer fee as Rate based on the type of token
+ * @param view The ledger view
+ * @param amount The amount to transfer
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, STAmount const& amount);
+
+/** Returns `true` if the directory is empty
+    @param key The key of the directory
+*/
+[[nodiscard]] bool
+dirIsEmpty(ReadView const& view, Keylet const& k);
+
+// Return the list of enabled amendments
+[[nodiscard]] std::set<uint256>
+getEnabledAmendments(ReadView const& view);
+
+// Return a map of amendments that have achieved majority
+using majorityAmendments_t = std::map<uint256, NetClock::time_point>;
+[[nodiscard]] majorityAmendments_t
+getMajorityAmendments(ReadView const& view);
+
+/** Return the hash of a ledger by sequence.
+    The hash is retrieved by looking up the "skip list"
+    in the passed ledger. As the skip list is limited
+    in size, if the requested ledger sequence number is
+    out of the range of ledgers represented in the skip
+    list, then std::nullopt is returned.
+    @return The hash of the ledger with the
+            given sequence number or std::nullopt.
+*/
+[[nodiscard]] std::optional<uint256>
+hashOfSeq(ReadView const& ledger, LedgerIndex seq, beast::Journal journal);
+
+/** Find a ledger index from which we could easily get the requested ledger
+
+    The index that we return should meet two requirements:
+        1) It must be the index of a ledger that has the hash of the ledger
+            we are looking for. This means that its sequence must be equal to
+            greater than the sequence that we want but not more than 256 greater
+            since each ledger contains the hashes of the 256 previous ledgers.
+
+        2) Its hash must be easy for us to find. This means it must be 0 mod 256
+            because every such ledger is permanently enshrined in a LedgerHashes
+            page which we can easily retrieve via the skip list.
+*/
+inline LedgerIndex
+getCandidateLedger(LedgerIndex requested)
+{
+    return (requested + 255) & (~255);
+}
+
+/** Return false if the test ledger is provably incompatible
+    with the valid ledger, that is, they could not possibly
+    both be valid. Use the first form if you have both ledgers,
+    use the second form if you have not acquired the valid ledger yet
+*/
+[[nodiscard]] bool
+areCompatible(
+    ReadView const& validLedger,
+    ReadView const& testLedger,
+    beast::Journal::Stream& s,
+    char const* reason);
+
+[[nodiscard]] bool
+areCompatible(
+    uint256 const& validHash,
+    LedgerIndex validIndex,
+    ReadView const& testLedger,
+    beast::Journal::Stream& s,
+    char const* reason);
+
+//------------------------------------------------------------------------------
+//
+// Modifiers
+//
+//------------------------------------------------------------------------------
+
+/** Adjust the owner count up or down. */
+void
+adjustOwnerCount(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sle,
+    std::int32_t amount,
+    beast::Journal j);
+
+/** @{ */
+/** Returns the first entry in the directory, advancing the index
+
+    @deprecated These are legacy function that are considered deprecated
+                and will soon be replaced with an iterator-based model
+                that is easier to use. You should not use them in new code.
+
+    @param view The view against which to operate
+    @param root The root (i.e. first page) of the directory to iterate
+    @param page The current page
+    @param index The index inside the current page
+    @param entry The entry at the current index
+
+    @return true if the directory isn't empty; false otherwise
+ */
+bool
+cdirFirst(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry);
+
+bool
+dirFirst(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry);
+/** @} */
+
+/** @{ */
+/** Returns the next entry in the directory, advancing the index
+
+    @deprecated These are legacy function that are considered deprecated
+                and will soon be replaced with an iterator-based model
+                that is easier to use. You should not use them in new code.
+
+    @param view The view against which to operate
+    @param root The root (i.e. first page) of the directory to iterate
+    @param page The current page
+    @param index The index inside the current page
+    @param entry The entry at the current index
+
+    @return true if the directory isn't empty; false otherwise
+ */
+bool
+cdirNext(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry);
+
+bool
+dirNext(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry);
+/** @} */
+
+[[nodiscard]] std::function<void(SLE::ref)>
+describeOwnerDir(AccountID const& account);
+
+[[nodiscard]] TER
+dirLink(ApplyView& view, AccountID const& owner, std::shared_ptr<SLE>& object);
+
+AccountID
+pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
+
+/**
+ *
+ * Create pseudo-account, storing pseudoOwnerKey into ownerField.
+ *
+ * The list of valid ownerField is maintained in View.cpp and the caller to
+ * this function must perform necessary amendment check(s) before using a
+ * field. The amendment check is **not** performed in createPseudoAccount.
+ */
+[[nodiscard]] Expected<std::shared_ptr<SLE>, TER>
+createPseudoAccount(
+    ApplyView& view,
+    uint256 const& pseudoOwnerKey,
+    SField const& ownerField);
+
+// Returns true iff sleAcct is a pseudo-account.
+//
+// Returns false if sleAcct is
+// * NOT a pseudo-account OR
+// * NOT a ltACCOUNT_ROOT OR
+// * null pointer
+[[nodiscard]] bool
+isPseudoAccount(std::shared_ptr<SLE const> sleAcct);
+
+// Returns the list of fields that define an ACCOUNT_ROOT as a pseudo-account if
+// set
+// Pseudo-account designator fields MUST be maintained by including the
+// SField::sMD_PseudoAccount flag in the SField definition. (Don't forget to
+// "| SField::sMD_Default"!) The fields do NOT need to be amendment-gated,
+// since a non-active amendment will not set any field, by definition.
+// Specific properties of a pseudo-account are NOT checked here, that's what
+// InvariantCheck is for.
+[[nodiscard]] std::vector<SField const*> const&
+getPseudoAccountFields();
+
+[[nodiscard]] inline bool
+isPseudoAccount(ReadView const& view, AccountID accountId)
+{
+    return isPseudoAccount(view.read(keylet::account(accountId)));
+}
+
+[[nodiscard]] TER
+canAddHolding(ReadView const& view, Asset const& asset);
+
+/// Any transactors that call addEmptyHolding() in doApply must call
+/// canAddHolding() in preflight with the same View and Asset
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    Issue const& issue,
+    beast::Journal journal);
+
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    MPTIssue const& mptIssue,
+    beast::Journal journal);
+
+[[nodiscard]] inline TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    Asset const& asset,
+    beast::Journal journal)
+{
+    return std::visit(
+        [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
+            return addEmptyHolding(
+                view, accountID, priorBalance, issue, journal);
+        },
+        asset.value());
+}
+
+[[nodiscard]] TER
+authorizeMPToken(
+    ApplyView& view,
+    XRPAmount const& priorBalance,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    beast::Journal journal,
+    std::uint32_t flags = 0,
+    std::optional<AccountID> holderID = std::nullopt);
+
+// VFALCO NOTE Both STAmount parameters should just
+//             be "Amount", a unit-less number.
+//
+/** Create a trust line
+
+    This can set an initial balance.
+*/
+[[nodiscard]] TER
+trustCreate(
+    ApplyView& view,
+    bool const bSrcHigh,
+    AccountID const& uSrcAccountID,
+    AccountID const& uDstAccountID,
+    uint256 const& uIndex,      // --> ripple state entry
+    SLE::ref sleAccount,        // --> the account being set.
+    bool const bAuth,           // --> authorize account.
+    bool const bNoRipple,       // --> others cannot ripple through
+    bool const bFreeze,         // --> funds cannot leave
+    bool bDeepFreeze,           // --> can neither receive nor send funds
+    STAmount const& saBalance,  // --> balance of account being set.
+                                // Issuer should be noAccount()
+    STAmount const& saLimit,    // --> limit for account being set.
+                                // Issuer should be the account being set.
+    std::uint32_t uSrcQualityIn,
+    std::uint32_t uSrcQualityOut,
+    beast::Journal j);
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    Issue const& issue,
+    beast::Journal journal);
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    MPTIssue const& mptIssue,
+    beast::Journal journal);
+
+[[nodiscard]] inline TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    Asset const& asset,
+    beast::Journal journal)
+{
+    return std::visit(
+        [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
+            return removeEmptyHolding(view, accountID, issue, journal);
+        },
+        asset.value());
+}
+
+[[nodiscard]] TER
+trustDelete(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sleRippleState,
+    AccountID const& uLowAccountID,
+    AccountID const& uHighAccountID,
+    beast::Journal j);
+
+/** Delete an offer.
+
+    Requirements:
+        The passed `sle` be obtained from a prior
+        call to view.peek()
+*/
+// [[nodiscard]] // nodiscard commented out so Flow, BookTip and others compile.
+TER
+offerDelete(ApplyView& view, std::shared_ptr<SLE> const& sle, beast::Journal j);
+
+//------------------------------------------------------------------------------
+
+//
+// Money Transfers
+//
+
+// Direct send w/o fees:
+// - Redeeming IOUs and/or sending sender's own IOUs.
+// - Create trust line of needed.
+// --> bCheckIssuer : normally require issuer to be involved.
+// [[nodiscard]] // nodiscard commented out so DirectStep.cpp compiles.
+
+/** Calls static rippleCreditIOU if saAmount represents Issue.
+ * Calls static rippleCreditMPT if saAmount represents MPTIssue.
+ */
+TER
+rippleCredit(
+    ApplyView& view,
+    AccountID const& uSenderID,
+    AccountID const& uReceiverID,
+    STAmount const& saAmount,
+    bool bCheckIssuer,
+    beast::Journal j);
+
+TER
+rippleLockEscrowMPT(
+    ApplyView& view,
+    AccountID const& uGrantorID,
+    STAmount const& saAmount,
+    beast::Journal j);
+
+TER
+rippleUnlockEscrowMPT(
+    ApplyView& view,
+    AccountID const& uGrantorID,
+    AccountID const& uGranteeID,
+    STAmount const& netAmount,
+    STAmount const& grossAmount,
+    beast::Journal j);
+
+/** Calls static accountSendIOU if saAmount represents Issue.
+ * Calls static accountSendMPT if saAmount represents MPTIssue.
+ */
+[[nodiscard]] TER
+accountSend(
+    ApplyView& view,
+    AccountID const& from,
+    AccountID const& to,
+    STAmount const& saAmount,
+    beast::Journal j,
+    WaiveTransferFee waiveFee = WaiveTransferFee::No);
+
+[[nodiscard]] TER
+issueIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j);
+
+[[nodiscard]] TER
+redeemIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j);
+
+[[nodiscard]] TER
+transferXRP(
+    ApplyView& view,
+    AccountID const& from,
+    AccountID const& to,
+    STAmount const& amount,
+    beast::Journal j);
+
+/* Check if MPToken (for MPT) or trust line (for IOU) exists:
+ * - StrongAuth - before checking if authorization is required
+ * - WeakAuth
+ *    for MPT - after checking lsfMPTRequireAuth flag
+ *    for IOU - do not check if trust line exists
+ * - Legacy
+ *    for MPT - before checking lsfMPTRequireAuth flag i.e. same as StrongAuth
+ *    for IOU - do not check if trust line exists i.e. same as WeakAuth
+ */
+enum class AuthType { StrongAuth, WeakAuth, Legacy };
+
+/** Check if the account lacks required authorization.
+ *
+ * Return tecNO_AUTH or tecNO_LINE if it does
+ * and tesSUCCESS otherwise.
+ *
+ * If StrongAuth then return tecNO_LINE if the RippleState doesn't exist. Return
+ * tecNO_AUTH if lsfRequireAuth is set on the issuer's AccountRoot, and the
+ * RippleState does exist, and the RippleState is not authorized.
+ *
+ * If WeakAuth then return tecNO_AUTH if lsfRequireAuth is set, and the
+ * RippleState exists, and is not authorized. Return tecNO_LINE if
+ * lsfRequireAuth is set and the RippleState doesn't exist. Consequently, if
+ * WeakAuth and lsfRequireAuth is *not* set, this function will return
+ * tesSUCCESS even if RippleState does *not* exist.
+ *
+ * The default "Legacy" auth type is equivalent to WeakAuth.
+ */
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    Issue const& issue,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy);
+
+/** Check if the account lacks required authorization.
+ *
+ * This will also check for expired credentials. If it is called directly
+ * from preclaim, the user should convert result tecEXPIRED to tesSUCCESS and
+ * proceed to also check permissions with enforceMPTokenAuthorization inside
+ * doApply. This will ensure that any expired credentials are deleted.
+ *
+ * requireAuth check is recursive for MPT shares in a vault, descending to
+ * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ * purely defensive, as we currently do not allow such vaults to be created.
+ *
+ * If StrongAuth then return tecNO_AUTH if MPToken doesn't exist or
+ * lsfMPTRequireAuth is set and MPToken is not authorized.
+ *
+ * If WeakAuth then return tecNO_AUTH if lsfMPTRequireAuth is set and MPToken
+ * doesn't exist or is not authorized (explicitly or via credentials, if
+ * DomainID is set in MPTokenIssuance). Consequently, if WeakAuth and
+ * lsfMPTRequireAuth is *not* set, this function will return true even if
+ * MPToken does *not* exist.
+ *
+ * The default "Legacy" auth type is equivalent to StrongAuth.
+ */
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy,
+    int depth = 0);
+
+[[nodiscard]] TER inline requireAuth(
+    ReadView const& view,
+    Asset const& asset,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy)
+{
+    return std::visit(
+        [&]<ValidIssueType TIss>(TIss const& issue_) {
+            return requireAuth(view, issue_, account, authType);
+        },
+        asset.value());
+}
+
+/** Enforce account has MPToken to match its authorization.
+ *
+ *   Called from doApply - it will check for expired (and delete if found any)
+ *   credentials matching DomainID set in MPTokenIssuance. Must be called if
+ *   requireAuth(...MPTIssue...) returned tesSUCCESS or tecEXPIRED in preclaim,
+ *   which implies that preclaim should replace `tecEXPIRED` with `tesSUCCESS`
+ *   in order for the transactor to proceed to doApply.
+ *
+ *   This function will create MPToken (if needed) on the basis of any
+ *   non-expired credentials and will delete any expired credentials, indirectly
+ *   via verifyValidDomain, as per DomainID (if set in MPTokenIssuance).
+ *
+ *   The caller does NOT need to ensure that DomainID is actually set - this
+ *   function handles gracefully both cases when DomainID is set and when not.
+ *
+ *   The caller does NOT need to look for existing MPToken to match
+ *   mptIssue/account - this function checks lsfMPTAuthorized of an existing
+ *   MPToken iff DomainID is not set.
+ *
+ *   Do not use for accounts which hold implied permission e.g. object owners or
+ *   if MPTokenIssuance does not require authorization. In both cases use
+ *   MPTokenAuthorize::authorize if MPToken does not yet exist.
+ */
+[[nodiscard]] TER
+enforceMPTokenAuthorization(
+    ApplyView& view,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    XRPAmount const& priorBalance,
+    beast::Journal j);
+
+/** Check if the destination account is allowed
+ *  to receive MPT. Return tecNO_AUTH if it doesn't
+ *  and tesSUCCESS otherwise.
+ */
+[[nodiscard]] TER
+canTransfer(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& from,
+    AccountID const& to);
+
+/** Deleter function prototype. Returns the status of the entry deletion
+ * (if should not be skipped) and if the entry should be skipped. The status
+ * is always tesSUCCESS if the entry should be skipped.
+ */
+using EntryDeleter = std::function<std::pair<TER, SkipEntry>(
+    LedgerEntryType,
+    uint256 const&,
+    std::shared_ptr<SLE>&)>;
+/** Cleanup owner directory entries on account delete.
+ * Used for a regular and AMM accounts deletion. The caller
+ * has to provide the deleter function, which handles details of
+ * specific account-owned object deletion.
+ * @return tecINCOMPLETE indicates maxNodesToDelete
+ * are deleted and there remains more nodes to delete.
+ */
+[[nodiscard]] TER
+cleanupOnAccountDelete(
+    ApplyView& view,
+    Keylet const& ownerDirKeylet,
+    EntryDeleter const& deleter,
+    beast::Journal j,
+    std::optional<std::uint16_t> maxNodesToDelete = std::nullopt);
+
+/** Delete trustline to AMM. The passed `sle` must be obtained from a prior
+ * call to view.peek(). Fail if neither side of the trustline is AMM or
+ * if ammAccountID is seated and is not one of the trustline's side.
+ */
+[[nodiscard]] TER
+deleteAMMTrustLine(
+    ApplyView& view,
+    std::shared_ptr<SLE> sleState,
+    std::optional<AccountID> const& ammAccountID,
+    beast::Journal j);
+
+// From the perspective of a vault, return the number of shares to give the
+// depositor when they deposit a fixed amount of assets. Since shares are MPT
+// this number is integral and always truncated in this calculation.
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets);
+
+// From the perspective of a vault, return the number of assets to take from
+// depositor when they receive a fixed amount of shares. Note, since shares are
+// MPT, they are always an integral number.
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares);
+
+enum class TruncateShares : bool { no = false, yes = true };
+
+// From the perspective of a vault, return the number of shares to demand from
+// the depositor when they ask to withdraw a fixed amount of assets. Since
+// shares are MPT this number is integral, and it will be rounded to nearest
+// unless explicitly requested to be truncated instead.
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets,
+    TruncateShares truncate = TruncateShares::no);
+
+// From the perspective of a vault, return the number of assets to give the
+// depositor when they redeem a fixed amount of shares. Note, since shares are
+// MPT, they are always an integral number.
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares);
+
+/** Has the specified time passed?
+
+    @param now  the current time
+    @param mark the cutoff point
+    @return true if \a now refers to a time strictly after \a mark, else false.
+*/
+bool
+after(NetClock::time_point now, std::uint32_t mark);
+
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/detail/ApplyStateTable.h

@@ -0,0 +1,163 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_APPLYSTATETABLE_H_INCLUDED
+#define RIPPLE_LEDGER_APPLYSTATETABLE_H_INCLUDED
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/OpenView.h>
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxMeta.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+#include <memory>
+
+namespace ripple {
+namespace detail {
+
+// Helper class that buffers modifications
+class ApplyStateTable
+{
+public:
+    using key_type = ReadView::key_type;
+
+private:
+    enum class Action {
+        cache,
+        erase,
+        insert,
+        modify,
+    };
+
+    using items_t = std::map<key_type, std::pair<Action, std::shared_ptr<SLE>>>;
+
+    items_t items_;
+    XRPAmount dropsDestroyed_{0};
+
+public:
+    ApplyStateTable() = default;
+    ApplyStateTable(ApplyStateTable&&) = default;
+
+    ApplyStateTable(ApplyStateTable const&) = delete;
+    ApplyStateTable&
+    operator=(ApplyStateTable&&) = delete;
+    ApplyStateTable&
+    operator=(ApplyStateTable const&) = delete;
+
+    void
+    apply(RawView& to) const;
+
+    std::optional<TxMeta>
+    apply(
+        OpenView& to,
+        STTx const& tx,
+        TER ter,
+        std::optional<STAmount> const& deliver,
+        std::optional<uint256 const> const& parentBatchId,
+        bool isDryRun,
+        beast::Journal j);
+
+    bool
+    exists(ReadView const& base, Keylet const& k) const;
+
+    std::optional<key_type>
+    succ(
+        ReadView const& base,
+        key_type const& key,
+        std::optional<key_type> const& last) const;
+
+    std::shared_ptr<SLE const>
+    read(ReadView const& base, Keylet const& k) const;
+
+    std::shared_ptr<SLE>
+    peek(ReadView const& base, Keylet const& k);
+
+    std::size_t
+    size() const;
+
+    void
+    visit(
+        ReadView const& base,
+        std::function<void(
+            uint256 const& key,
+            bool isDelete,
+            std::shared_ptr<SLE const> const& before,
+            std::shared_ptr<SLE const> const& after)> const& func) const;
+
+    void
+    erase(ReadView const& base, std::shared_ptr<SLE> const& sle);
+
+    void
+    rawErase(ReadView const& base, std::shared_ptr<SLE> const& sle);
+
+    void
+    insert(ReadView const& base, std::shared_ptr<SLE> const& sle);
+
+    void
+    update(ReadView const& base, std::shared_ptr<SLE> const& sle);
+
+    void
+    replace(ReadView const& base, std::shared_ptr<SLE> const& sle);
+
+    void
+    destroyXRP(XRPAmount const& fee);
+
+    // For debugging
+    XRPAmount const&
+    dropsDestroyed() const
+    {
+        return dropsDestroyed_;
+    }
+
+private:
+    using Mods = hash_map<key_type, std::shared_ptr<SLE>>;
+
+    static void
+    threadItem(TxMeta& meta, std::shared_ptr<SLE> const& to);
+
+    std::shared_ptr<SLE>
+    getForMod(
+        ReadView const& base,
+        key_type const& key,
+        Mods& mods,
+        beast::Journal j);
+
+    void
+    threadTx(
+        ReadView const& base,
+        TxMeta& meta,
+        AccountID const& to,
+        Mods& mods,
+        beast::Journal j);
+
+    void
+    threadOwners(
+        ReadView const& base,
+        TxMeta& meta,
+        std::shared_ptr<SLE const> const& sle,
+        Mods& mods,
+        beast::Journal j);
+};
+
+}  // namespace detail
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/detail/ApplyViewBase.h

@@ -0,0 +1,130 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_APPLYVIEWBASE_H_INCLUDED
+#define RIPPLE_LEDGER_APPLYVIEWBASE_H_INCLUDED
+
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/detail/ApplyStateTable.h>
+#include <xrpl/protocol/XRPAmount.h>
+
+namespace ripple {
+namespace detail {
+
+class ApplyViewBase : public ApplyView, public RawView
+{
+public:
+    ApplyViewBase() = delete;
+    ApplyViewBase(ApplyViewBase const&) = delete;
+    ApplyViewBase&
+    operator=(ApplyViewBase&&) = delete;
+    ApplyViewBase&
+    operator=(ApplyViewBase const&) = delete;
+
+    ApplyViewBase(ApplyViewBase&&) = default;
+
+    ApplyViewBase(ReadView const* base, ApplyFlags flags);
+
+    // ReadView
+    bool
+    open() const override;
+
+    LedgerInfo const&
+    info() const override;
+
+    Fees const&
+    fees() const override;
+
+    Rules const&
+    rules() const override;
+
+    bool
+    exists(Keylet const& k) const override;
+
+    std::optional<key_type>
+    succ(
+        key_type const& key,
+        std::optional<key_type> const& last = std::nullopt) const override;
+
+    std::shared_ptr<SLE const>
+    read(Keylet const& k) const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesBegin() const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesEnd() const override;
+
+    std::unique_ptr<sles_type::iter_base>
+    slesUpperBound(uint256 const& key) const override;
+
+    std::unique_ptr<txs_type::iter_base>
+    txsBegin() const override;
+
+    std::unique_ptr<txs_type::iter_base>
+    txsEnd() const override;
+
+    bool
+    txExists(key_type const& key) const override;
+
+    tx_type
+    txRead(key_type const& key) const override;
+
+    // ApplyView
+
+    ApplyFlags
+    flags() const override;
+
+    std::shared_ptr<SLE>
+    peek(Keylet const& k) override;
+
+    void
+    erase(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    insert(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    update(std::shared_ptr<SLE> const& sle) override;
+
+    // RawView
+
+    void
+    rawErase(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawInsert(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawReplace(std::shared_ptr<SLE> const& sle) override;
+
+    void
+    rawDestroyXRP(XRPAmount const& feeDrops) override;
+
+protected:
+    ApplyFlags flags_;
+    ReadView const* base_;
+    detail::ApplyStateTable items_;
+};
+
+}  // namespace detail
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/detail/RawStateTable.h

@@ -0,0 +1,142 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_RAWSTATETABLE_H_INCLUDED
+#define RIPPLE_LEDGER_RAWSTATETABLE_H_INCLUDED
+
+#include <xrpl/ledger/RawView.h>
+#include <xrpl/ledger/ReadView.h>
+
+#include <boost/container/pmr/monotonic_buffer_resource.hpp>
+#include <boost/container/pmr/polymorphic_allocator.hpp>
+
+#include <map>
+#include <utility>
+
+namespace ripple {
+namespace detail {
+
+// Helper class that buffers raw modifications
+class RawStateTable
+{
+public:
+    using key_type = ReadView::key_type;
+    // Initial size for the monotonic_buffer_resource used for allocations
+    // The size was chosen from the old `qalloc` code (which this replaces).
+    // It is unclear how the size initially chosen in qalloc.
+    static constexpr size_t initialBufferSize = kilobytes(256);
+
+    RawStateTable()
+        : monotonic_resource_{std::make_unique<
+              boost::container::pmr::monotonic_buffer_resource>(
+              initialBufferSize)}
+        , items_{monotonic_resource_.get()} {};
+
+    RawStateTable(RawStateTable const& rhs)
+        : monotonic_resource_{std::make_unique<
+              boost::container::pmr::monotonic_buffer_resource>(
+              initialBufferSize)}
+        , items_{rhs.items_, monotonic_resource_.get()}
+        , dropsDestroyed_{rhs.dropsDestroyed_} {};
+
+    RawStateTable(RawStateTable&&) = default;
+
+    RawStateTable&
+    operator=(RawStateTable&&) = delete;
+    RawStateTable&
+    operator=(RawStateTable const&) = delete;
+
+    void
+    apply(RawView& to) const;
+
+    bool
+    exists(ReadView const& base, Keylet const& k) const;
+
+    std::optional<key_type>
+    succ(
+        ReadView const& base,
+        key_type const& key,
+        std::optional<key_type> const& last) const;
+
+    void
+    erase(std::shared_ptr<SLE> const& sle);
+
+    void
+    insert(std::shared_ptr<SLE> const& sle);
+
+    void
+    replace(std::shared_ptr<SLE> const& sle);
+
+    std::shared_ptr<SLE const>
+    read(ReadView const& base, Keylet const& k) const;
+
+    void
+    destroyXRP(XRPAmount const& fee);
+
+    std::unique_ptr<ReadView::sles_type::iter_base>
+    slesBegin(ReadView const& base) const;
+
+    std::unique_ptr<ReadView::sles_type::iter_base>
+    slesEnd(ReadView const& base) const;
+
+    std::unique_ptr<ReadView::sles_type::iter_base>
+    slesUpperBound(ReadView const& base, uint256 const& key) const;
+
+private:
+    enum class Action {
+        erase,
+        insert,
+        replace,
+    };
+
+    class sles_iter_impl;
+
+    struct sleAction
+    {
+        Action action;
+        std::shared_ptr<SLE> sle;
+
+        // Constructor needed for emplacement in std::map
+        sleAction(Action action_, std::shared_ptr<SLE> const& sle_)
+            : action(action_), sle(sle_)
+        {
+        }
+    };
+
+    // Use boost::pmr functionality instead of the std::pmr
+    // functions b/c clang does not support pmr yet (as-of 9/2020)
+    using items_t = std::map<
+        key_type,
+        sleAction,
+        std::less<key_type>,
+        boost::container::pmr::polymorphic_allocator<
+            std::pair<key_type const, sleAction>>>;
+    // monotonic_resource_ must outlive `items_`. Make a pointer so it may be
+    // easily moved.
+    std::unique_ptr<boost::container::pmr::monotonic_buffer_resource>
+        monotonic_resource_;
+    items_t items_;
+
+    XRPAmount dropsDestroyed_{0};
+};
+
+}  // namespace detail
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/detail/ReadViewFwdRange.h

@@ -0,0 +1,154 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_READVIEWFWDRANGE_H_INCLUDED
+#define RIPPLE_LEDGER_READVIEWFWDRANGE_H_INCLUDED
+
+#include <cstddef>
+#include <memory>
+#include <optional>
+
+namespace ripple {
+
+class ReadView;
+
+namespace detail {
+
+// A type-erased ForwardIterator
+//
+template <class ValueType>
+class ReadViewFwdIter
+{
+public:
+    using base_type = ReadViewFwdIter;
+
+    using value_type = ValueType;
+
+    ReadViewFwdIter() = default;
+    ReadViewFwdIter(ReadViewFwdIter const&) = default;
+    ReadViewFwdIter&
+    operator=(ReadViewFwdIter const&) = default;
+
+    virtual ~ReadViewFwdIter() = default;
+
+    virtual std::unique_ptr<ReadViewFwdIter>
+    copy() const = 0;
+
+    virtual bool
+    equal(ReadViewFwdIter const& impl) const = 0;
+
+    virtual void
+    increment() = 0;
+
+    virtual value_type
+    dereference() const = 0;
+};
+
+// A range using type-erased ForwardIterator
+//
+template <class ValueType>
+class ReadViewFwdRange
+{
+public:
+    using iter_base = ReadViewFwdIter<ValueType>;
+
+    static_assert(
+        std::is_nothrow_move_constructible<ValueType>{},
+        "ReadViewFwdRange move and move assign constructors should be "
+        "noexcept");
+
+    class iterator
+    {
+    public:
+        using value_type = ValueType;
+
+        using pointer = value_type const*;
+
+        using reference = value_type const&;
+
+        using difference_type = std::ptrdiff_t;
+
+        using iterator_category = std::forward_iterator_tag;
+
+        iterator() = default;
+
+        iterator(iterator const& other);
+        iterator(iterator&& other) noexcept;
+
+        // Used by the implementation
+        explicit iterator(
+            ReadView const* view,
+            std::unique_ptr<iter_base> impl);
+
+        iterator&
+        operator=(iterator const& other);
+
+        iterator&
+        operator=(iterator&& other) noexcept;
+
+        bool
+        operator==(iterator const& other) const;
+
+        bool
+        operator!=(iterator const& other) const;
+
+        // Can throw
+        reference
+        operator*() const;
+
+        // Can throw
+        pointer
+        operator->() const;
+
+        iterator&
+        operator++();
+
+        iterator
+        operator++(int);
+
+    private:
+        ReadView const* view_ = nullptr;
+        std::unique_ptr<iter_base> impl_;
+        std::optional<value_type> mutable cache_;
+    };
+
+    static_assert(std::is_nothrow_move_constructible<iterator>{}, "");
+    static_assert(std::is_nothrow_move_assignable<iterator>{}, "");
+
+    using const_iterator = iterator;
+
+    using value_type = ValueType;
+
+    ReadViewFwdRange() = delete;
+    ReadViewFwdRange(ReadViewFwdRange const&) = default;
+    ReadViewFwdRange&
+    operator=(ReadViewFwdRange const&) = default;
+
+    explicit ReadViewFwdRange(ReadView const& view) : view_(&view)
+    {
+    }
+
+protected:
+    ReadView const* view_;
+};
+
+}  // namespace detail
+}  // namespace ripple
+
+#endif

include/xrpl/ledger/detail/ReadViewFwdRange.ipp

@@ -0,0 +1,139 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2012, 2013 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef RIPPLE_LEDGER_READVIEWFWDRANGEINL_H_INCLUDED
+#define RIPPLE_LEDGER_READVIEWFWDRANGEINL_H_INCLUDED
+
+namespace ripple {
+namespace detail {
+
+template <class ValueType>
+ReadViewFwdRange<ValueType>::iterator::iterator(iterator const& other)
+    : view_(other.view_)
+    , impl_(other.impl_ ? other.impl_->copy() : nullptr)
+    , cache_(other.cache_)
+{
+}
+
+template <class ValueType>
+ReadViewFwdRange<ValueType>::iterator::iterator(iterator&& other) noexcept
+    : view_(other.view_)
+    , impl_(std::move(other.impl_))
+    , cache_(std::move(other.cache_))
+{
+}
+
+template <class ValueType>
+ReadViewFwdRange<ValueType>::iterator::iterator(
+    ReadView const* view,
+    std::unique_ptr<iter_base> impl)
+    : view_(view), impl_(std::move(impl))
+{
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator=(iterator const& other)
+    -> iterator&
+{
+    if (this != &other)
+    {
+        view_ = other.view_;
+        impl_ = other.impl_ ? other.impl_->copy() : nullptr;
+        cache_ = other.cache_;
+    }
+    return *this;
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator=(iterator&& other) noexcept
+    -> iterator&
+{
+    if (this != &other)
+    {
+        view_ = other.view_;
+        impl_ = std::move(other.impl_);
+        cache_ = std::move(other.cache_);
+    }
+
+    return *this;
+}
+
+template <class ValueType>
+bool
+ReadViewFwdRange<ValueType>::iterator::operator==(iterator const& other) const
+{
+    XRPL_ASSERT(
+        view_ == other.view_,
+        "ripple::detail::ReadViewFwdRange::iterator::operator==(iterator) "
+        "const : input view match");
+
+    if (impl_ != nullptr && other.impl_ != nullptr)
+        return impl_->equal(*other.impl_);
+
+    return impl_ == other.impl_;
+}
+
+template <class ValueType>
+bool
+ReadViewFwdRange<ValueType>::iterator::operator!=(iterator const& other) const
+{
+    return !(*this == other);
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator*() const -> reference
+{
+    if (!cache_)
+        cache_ = impl_->dereference();
+    return *cache_;
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator->() const -> pointer
+{
+    return &**this;
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator++() -> iterator&
+{
+    impl_->increment();
+    cache_.reset();
+    return *this;
+}
+
+template <class ValueType>
+auto
+ReadViewFwdRange<ValueType>::iterator::operator++(int) -> iterator
+{
+    iterator prev(view_, impl_->copy());
+    prev.cache_ = std::move(cache_);
+    ++(*this);
+    return prev;
+}
+
+}  // namespace detail
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/FeeUnits.h

@@ -1,565 +0,0 @@
-//------------------------------------------------------------------------------
-/*
-    This file is part of rippled: https://github.com/ripple/rippled
-    Copyright (c) 2019 Ripple Labs Inc.
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose  with  or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
-    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-*/
-
-#ifndef BASICS_FEES_H_INCLUDED
-#define BASICS_FEES_H_INCLUDED
-
-#include <xrpl/basics/safe_cast.h>
-#include <xrpl/beast/utility/Zero.h>
-#include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/json/json_value.h>
-
-#include <boost/multiprecision/cpp_int.hpp>
-#include <boost/operators.hpp>
-
-#include <iosfwd>
-#include <limits>
-#include <optional>
-
-namespace ripple {
-
-namespace feeunit {
-
-/** "drops" are the smallest divisible amount of XRP. This is what most
-    of the code uses. */
-struct dropTag;
-/** "fee units" calculations are a not-really-unitless value that is used
-    to express the cost of a given transaction vs. a reference transaction.
-    They are primarily used by the Transactor classes. */
-struct feeunitTag;
-/** "fee levels" are used by the transaction queue to compare the relative
-    cost of transactions that require different levels of effort to process.
-    See also: src/ripple/app/misc/FeeEscalation.md#fee-level */
-struct feelevelTag;
-/** unitless values are plain scalars wrapped in a TaggedFee. They are
-    used for calculations in this header. */
-struct unitlessTag;
-
-template <class T>
-using enable_if_unit_t = typename std::enable_if_t<
-    std::is_class_v<T> && std::is_object_v<typename T::unit_type> &&
-    std::is_object_v<typename T::value_type>>;
-
-/** `is_usable_unit_v` is checked to ensure that only values with
-    known valid type tags can be used (sometimes transparently) in
-    non-fee contexts. At the time of implementation, this includes
-    all known tags, but more may be added in the future, and they
-    should not be added automatically unless determined to be
-    appropriate.
-*/
-template <class T, class = enable_if_unit_t<T>>
-constexpr bool is_usable_unit_v =
-    std::is_same_v<typename T::unit_type, feeunitTag> ||
-    std::is_same_v<typename T::unit_type, feelevelTag> ||
-    std::is_same_v<typename T::unit_type, unitlessTag> ||
-    std::is_same_v<typename T::unit_type, dropTag>;
-
-template <class UnitTag, class T>
-class TaggedFee : private boost::totally_ordered<TaggedFee<UnitTag, T>>,
-                  private boost::additive<TaggedFee<UnitTag, T>>,
-                  private boost::equality_comparable<TaggedFee<UnitTag, T>, T>,
-                  private boost::dividable<TaggedFee<UnitTag, T>, T>,
-                  private boost::modable<TaggedFee<UnitTag, T>, T>,
-                  private boost::unit_steppable<TaggedFee<UnitTag, T>>
-{
-public:
-    using unit_type = UnitTag;
-    using value_type = T;
-
-private:
-    value_type fee_;
-
-protected:
-    template <class Other>
-    static constexpr bool is_compatible_v =
-        std::is_arithmetic_v<Other> && std::is_arithmetic_v<value_type> &&
-        std::is_convertible_v<Other, value_type>;
-
-    template <class OtherFee, class = enable_if_unit_t<OtherFee>>
-    static constexpr bool is_compatiblefee_v =
-        is_compatible_v<typename OtherFee::value_type> &&
-        std::is_same_v<UnitTag, typename OtherFee::unit_type>;
-
-    template <class Other>
-    using enable_if_compatible_t =
-        typename std::enable_if_t<is_compatible_v<Other>>;
-
-    template <class OtherFee>
-    using enable_if_compatiblefee_t =
-        typename std::enable_if_t<is_compatiblefee_v<OtherFee>>;
-
-public:
-    TaggedFee() = default;
-    constexpr TaggedFee(TaggedFee const& other) = default;
-    constexpr TaggedFee&
-    operator=(TaggedFee const& other) = default;
-
-    constexpr explicit TaggedFee(beast::Zero) : fee_(0)
-    {
-    }
-
-    constexpr TaggedFee&
-    operator=(beast::Zero)
-    {
-        fee_ = 0;
-        return *this;
-    }
-
-    constexpr explicit TaggedFee(value_type fee) : fee_(fee)
-    {
-    }
-
-    TaggedFee&
-    operator=(value_type fee)
-    {
-        fee_ = fee;
-        return *this;
-    }
-
-    /** Instances with the same unit, and a type that is
-        "safe" to convert to this one can be converted
-        implicitly */
-    template <
-        class Other,
-        class = std::enable_if_t<
-            is_compatible_v<Other> &&
-            is_safetocasttovalue_v<value_type, Other>>>
-    constexpr TaggedFee(TaggedFee<unit_type, Other> const& fee)
-        : TaggedFee(safe_cast<value_type>(fee.fee()))
-    {
-    }
-
-    constexpr TaggedFee
-    operator*(value_type const& rhs) const
-    {
-        return TaggedFee{fee_ * rhs};
-    }
-
-    friend constexpr TaggedFee
-    operator*(value_type lhs, TaggedFee const& rhs)
-    {
-        // multiplication is commutative
-        return rhs * lhs;
-    }
-
-    constexpr value_type
-    operator/(TaggedFee const& rhs) const
-    {
-        return fee_ / rhs.fee_;
-    }
-
-    TaggedFee&
-    operator+=(TaggedFee const& other)
-    {
-        fee_ += other.fee();
-        return *this;
-    }
-
-    TaggedFee&
-    operator-=(TaggedFee const& other)
-    {
-        fee_ -= other.fee();
-        return *this;
-    }
-
-    TaggedFee&
-    operator++()
-    {
-        ++fee_;
-        return *this;
-    }
-
-    TaggedFee&
-    operator--()
-    {
-        --fee_;
-        return *this;
-    }
-
-    TaggedFee&
-    operator*=(value_type const& rhs)
-    {
-        fee_ *= rhs;
-        return *this;
-    }
-
-    TaggedFee&
-    operator/=(value_type const& rhs)
-    {
-        fee_ /= rhs;
-        return *this;
-    }
-
-    template <class transparent = value_type>
-    std::enable_if_t<std::is_integral_v<transparent>, TaggedFee&>
-    operator%=(value_type const& rhs)
-    {
-        fee_ %= rhs;
-        return *this;
-    }
-
-    TaggedFee
-    operator-() const
-    {
-        static_assert(
-            std::is_signed_v<T>, "- operator illegal on unsigned fee types");
-        return TaggedFee{-fee_};
-    }
-
-    bool
-    operator==(TaggedFee const& other) const
-    {
-        return fee_ == other.fee_;
-    }
-
-    template <class Other, class = enable_if_compatible_t<Other>>
-    bool
-    operator==(TaggedFee<unit_type, Other> const& other) const
-    {
-        return fee_ == other.fee();
-    }
-
-    bool
-    operator==(value_type other) const
-    {
-        return fee_ == other;
-    }
-
-    template <class Other, class = enable_if_compatible_t<Other>>
-    bool
-    operator!=(TaggedFee<unit_type, Other> const& other) const
-    {
-        return !operator==(other);
-    }
-
-    bool
-    operator<(TaggedFee const& other) const
-    {
-        return fee_ < other.fee_;
-    }
-
-    /** Returns true if the amount is not zero */
-    explicit constexpr
-    operator bool() const noexcept
-    {
-        return fee_ != 0;
-    }
-
-    /** Return the sign of the amount */
-    constexpr int
-    signum() const noexcept
-    {
-        return (fee_ < 0) ? -1 : (fee_ ? 1 : 0);
-    }
-
-    /** Returns the number of drops */
-    constexpr value_type
-    fee() const
-    {
-        return fee_;
-    }
-
-    template <class Other>
-    constexpr double
-    decimalFromReference(TaggedFee<unit_type, Other> reference) const
-    {
-        return static_cast<double>(fee_) / reference.fee();
-    }
-
-    // `is_usable_unit_v` is checked to ensure that only values with
-    // known valid type tags can be converted to JSON. At the time
-    // of implementation, that includes all known tags, but more may
-    // be added in the future.
-    std::enable_if_t<is_usable_unit_v<TaggedFee>, Json::Value>
-    jsonClipped() const
-    {
-        if constexpr (std::is_integral_v<value_type>)
-        {
-            using jsontype = std::conditional_t<
-                std::is_signed_v<value_type>,
-                Json::Int,
-                Json::UInt>;
-
-            constexpr auto min = std::numeric_limits<jsontype>::min();
-            constexpr auto max = std::numeric_limits<jsontype>::max();
-
-            if (fee_ < min)
-                return min;
-            if (fee_ > max)
-                return max;
-            return static_cast<jsontype>(fee_);
-        }
-        else
-        {
-            return fee_;
-        }
-    }
-
-    /** Returns the underlying value. Code SHOULD NOT call this
-        function unless the type has been abstracted away,
-        e.g. in a templated function.
-    */
-    constexpr value_type
-    value() const
-    {
-        return fee_;
-    }
-
-    friend std::istream&
-    operator>>(std::istream& s, TaggedFee& val)
-    {
-        s >> val.fee_;
-        return s;
-    }
-};
-
-// Output Fees as just their numeric value.
-template <class Char, class Traits, class UnitTag, class T>
-std::basic_ostream<Char, Traits>&
-operator<<(std::basic_ostream<Char, Traits>& os, TaggedFee<UnitTag, T> const& q)
-{
-    return os << q.value();
-}
-
-template <class UnitTag, class T>
-std::string
-to_string(TaggedFee<UnitTag, T> const& amount)
-{
-    return std::to_string(amount.fee());
-}
-
-template <class Source, class = enable_if_unit_t<Source>>
-constexpr bool can_muldiv_source_v =
-    std::is_convertible_v<typename Source::value_type, std::uint64_t>;
-
-template <class Dest, class = enable_if_unit_t<Dest>>
-constexpr bool can_muldiv_dest_v =
-    can_muldiv_source_v<Dest> &&  // Dest is also a source
-    std::is_convertible_v<std::uint64_t, typename Dest::value_type> &&
-    sizeof(typename Dest::value_type) >= sizeof(std::uint64_t);
-
-template <
-    class Source1,
-    class Source2,
-    class = enable_if_unit_t<Source1>,
-    class = enable_if_unit_t<Source2>>
-constexpr bool can_muldiv_sources_v =
-    can_muldiv_source_v<Source1> && can_muldiv_source_v<Source2> &&
-    std::is_same_v<typename Source1::unit_type, typename Source2::unit_type>;
-
-template <
-    class Source1,
-    class Source2,
-    class Dest,
-    class = enable_if_unit_t<Source1>,
-    class = enable_if_unit_t<Source2>,
-    class = enable_if_unit_t<Dest>>
-constexpr bool can_muldiv_v =
-    can_muldiv_sources_v<Source1, Source2> && can_muldiv_dest_v<Dest>;
-// Source and Dest can be the same by default
-
-template <
-    class Source1,
-    class Source2,
-    class Dest,
-    class = enable_if_unit_t<Source1>,
-    class = enable_if_unit_t<Source2>,
-    class = enable_if_unit_t<Dest>>
-constexpr bool can_muldiv_commute_v = can_muldiv_v<Source1, Source2, Dest> &&
-    !std::is_same_v<typename Source1::unit_type, typename Dest::unit_type>;
-
-template <class T>
-using enable_muldiv_source_t =
-    typename std::enable_if_t<can_muldiv_source_v<T>>;
-
-template <class T>
-using enable_muldiv_dest_t = typename std::enable_if_t<can_muldiv_dest_v<T>>;
-
-template <class Source1, class Source2>
-using enable_muldiv_sources_t =
-    typename std::enable_if_t<can_muldiv_sources_v<Source1, Source2>>;
-
-template <class Source1, class Source2, class Dest>
-using enable_muldiv_t =
-    typename std::enable_if_t<can_muldiv_v<Source1, Source2, Dest>>;
-
-template <class Source1, class Source2, class Dest>
-using enable_muldiv_commute_t =
-    typename std::enable_if_t<can_muldiv_commute_v<Source1, Source2, Dest>>;
-
-template <class T>
-TaggedFee<unitlessTag, T>
-scalar(T value)
-{
-    return TaggedFee<unitlessTag, T>{value};
-}
-
-template <
-    class Source1,
-    class Source2,
-    class Dest,
-    class = enable_muldiv_t<Source1, Source2, Dest>>
-std::optional<Dest>
-mulDivU(Source1 value, Dest mul, Source2 div)
-{
-    // Fees can never be negative in any context.
-    if (value.value() < 0 || mul.value() < 0 || div.value() < 0)
-    {
-        // split the asserts so if one hits, the user can tell which
-        // without a debugger.
-        XRPL_ASSERT(
-            value.value() >= 0,
-            "ripple::feeunit::mulDivU : minimum value input");
-        XRPL_ASSERT(
-            mul.value() >= 0, "ripple::feeunit::mulDivU : minimum mul input");
-        XRPL_ASSERT(
-            div.value() >= 0, "ripple::feeunit::mulDivU : minimum div input");
-        return std::nullopt;
-    }
-
-    using desttype = typename Dest::value_type;
-    constexpr auto max = std::numeric_limits<desttype>::max();
-
-    // Shortcuts, since these happen a lot in the real world
-    if (value == div)
-        return mul;
-    if (mul.value() == div.value())
-    {
-        if (value.value() > max)
-            return std::nullopt;
-        return Dest{static_cast<desttype>(value.value())};
-    }
-
-    using namespace boost::multiprecision;
-
-    uint128_t product;
-    product = multiply(
-        product,
-        static_cast<std::uint64_t>(value.value()),
-        static_cast<std::uint64_t>(mul.value()));
-
-    auto quotient = product / div.value();
-
-    if (quotient > max)
-        return std::nullopt;
-
-    return Dest{static_cast<desttype>(quotient)};
-}
-
-}  // namespace feeunit
-
-template <class T>
-using FeeLevel = feeunit::TaggedFee<feeunit::feelevelTag, T>;
-using FeeLevel64 = FeeLevel<std::uint64_t>;
-using FeeLevelDouble = FeeLevel<double>;
-
-template <
-    class Source1,
-    class Source2,
-    class Dest,
-    class = feeunit::enable_muldiv_t<Source1, Source2, Dest>>
-std::optional<Dest>
-mulDiv(Source1 value, Dest mul, Source2 div)
-{
-    return feeunit::mulDivU(value, mul, div);
-}
-
-template <
-    class Source1,
-    class Source2,
-    class Dest,
-    class = feeunit::enable_muldiv_commute_t<Source1, Source2, Dest>>
-std::optional<Dest>
-mulDiv(Dest value, Source1 mul, Source2 div)
-{
-    // Multiplication is commutative
-    return feeunit::mulDivU(mul, value, div);
-}
-
-template <class Dest, class = feeunit::enable_muldiv_dest_t<Dest>>
-std::optional<Dest>
-mulDiv(std::uint64_t value, Dest mul, std::uint64_t div)
-{
-    // Give the scalars a non-tag so the
-    // unit-handling version gets called.
-    return feeunit::mulDivU(feeunit::scalar(value), mul, feeunit::scalar(div));
-}
-
-template <class Dest, class = feeunit::enable_muldiv_dest_t<Dest>>
-std::optional<Dest>
-mulDiv(Dest value, std::uint64_t mul, std::uint64_t div)
-{
-    // Multiplication is commutative
-    return mulDiv(mul, value, div);
-}
-
-template <
-    class Source1,
-    class Source2,
-    class = feeunit::enable_muldiv_sources_t<Source1, Source2>>
-std::optional<std::uint64_t>
-mulDiv(Source1 value, std::uint64_t mul, Source2 div)
-{
-    // Give the scalars a dimensionless unit so the
-    // unit-handling version gets called.
-    auto unitresult = feeunit::mulDivU(value, feeunit::scalar(mul), div);
-
-    if (!unitresult)
-        return std::nullopt;
-
-    return unitresult->value();
-}
-
-template <
-    class Source1,
-    class Source2,
-    class = feeunit::enable_muldiv_sources_t<Source1, Source2>>
-std::optional<std::uint64_t>
-mulDiv(std::uint64_t value, Source1 mul, Source2 div)
-{
-    // Multiplication is commutative
-    return mulDiv(mul, value, div);
-}
-
-template <class Dest, class Src>
-constexpr std::enable_if_t<
-    std::is_same_v<typename Dest::unit_type, typename Src::unit_type> &&
-        std::is_integral_v<typename Dest::value_type> &&
-        std::is_integral_v<typename Src::value_type>,
-    Dest>
-safe_cast(Src s) noexcept
-{
-    // Dest may not have an explicit value constructor
-    return Dest{safe_cast<typename Dest::value_type>(s.value())};
-}
-
-template <class Dest, class Src>
-constexpr std::enable_if_t<
-    std::is_same_v<typename Dest::unit_type, typename Src::unit_type> &&
-        std::is_integral_v<typename Dest::value_type> &&
-        std::is_integral_v<typename Src::value_type>,
-    Dest>
-unsafe_cast(Src s) noexcept
-{
-    // Dest may not have an explicit value constructor
-    return Dest{unsafe_cast<typename Dest::value_type>(s.value())};
-}
-
-}  // namespace ripple
-
-#endif  // BASICS_FEES_H_INCLUDED

include/xrpl/protocol/Indexes.h

@@ -287,9 +287,11 @@ delegate(AccountID const& account, AccountID const& authorizedAccount) noexcept;
 Keylet
 bridge(STXChainBridge const& bridge, STXChainBridge::ChainType chainType);
 
+// `seq` is stored as `sfXChainClaimID` in the object
 Keylet
 xChainClaimID(STXChainBridge const& bridge, std::uint64_t seq);
 
+// `seq` is stored as `sfXChainAccountCreateCount` in the object
 Keylet
 xChainCreateAccountClaimID(STXChainBridge const& bridge, std::uint64_t seq);
 

include/xrpl/protocol/LedgerFormats.h

@@ -56,7 +56,7 @@ enum LedgerEntryType : std::uint16_t
 #pragma push_macro("LEDGER_ENTRY")
 #undef LEDGER_ENTRY
 
-#define LEDGER_ENTRY(tag, value, name, rpcName, fields) tag = value,
+#define LEDGER_ENTRY(tag, value, ...) tag = value,
 
 #include <xrpl/protocol/detail/ledger_entries.macro>
 
@@ -189,6 +189,15 @@ enum LedgerSpecificFlags {
     lsfMPTCanClawback = 0x00000040,
     lsfMPTNoConfidentialTransfer = 0x00000080,
 
+    lsmfMPTCanMutateCanLock = 0x00000002,
+    lsmfMPTCanMutateRequireAuth = 0x00000004,
+    lsmfMPTCanMutateCanEscrow = 0x00000008,
+    lsmfMPTCanMutateCanTrade = 0x00000010,
+    lsmfMPTCanMutateCanTransfer = 0x00000020,
+    lsmfMPTCanMutateCanClawback = 0x00000040,
+    lsmfMPTCanMutateMetadata = 0x00010000,
+    lsmfMPTCanMutateTransferFee = 0x00020000,
+
     // ltMPTOKEN
     lsfMPTAuthorized = 0x00000002,
 

include/xrpl/protocol/Permissions.h

@@ -74,6 +74,9 @@ public:
     Permission&
     operator=(Permission const&) = delete;
 
+    std::optional<std::string>
+    getPermissionName(std::uint32_t const value) const;
+
     std::optional<std::uint32_t>
     getGranularValue(std::string const& name) const;
 
@@ -83,6 +86,9 @@ public:
     std::optional<TxType>
     getGranularTxType(GranularPermissionType const& gpType) const;
 
+    std::optional<std::reference_wrapper<uint256 const>> const
+    getTxFeature(TxType txType) const;
+
     bool
     isDelegatable(std::uint32_t const& permissionValue, Rules const& rules)
         const;

include/xrpl/protocol/Protocol.h

@@ -22,7 +22,6 @@
 
 #include <xrpl/basics/ByteUtilities.h>
 #include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/partitioned_unordered_map.h>
 
 #include <cstdint>
 

include/xrpl/protocol/SField.h

@@ -22,6 +22,7 @@
 
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/json/json_value.h>
+#include <xrpl/protocol/Units.h>
 
 #include <cstdint>
 #include <map>
@@ -71,8 +72,10 @@ class STCurrency;
     STYPE(STI_VL, 7)                              \
     STYPE(STI_ACCOUNT, 8)                         \
     STYPE(STI_NUMBER, 9)                          \
+    STYPE(STI_INT32, 10)                          \
+    STYPE(STI_INT64, 11)                          \
                                                   \
-    /* 10-13 are reserved */                      \
+    /* 12-13 are reserved */                      \
     STYPE(STI_OBJECT, 14)                         \
     STYPE(STI_ARRAY, 15)                          \
                                                   \
@@ -148,8 +151,10 @@ public:
         sMD_ChangeNew = 0x02,    // new value when it changes
         sMD_DeleteFinal = 0x04,  // final value when it is deleted
         sMD_Create = 0x08,       // value when it's created
-        sMD_Always = 0x10,  // value when node containing it is affected at all
-        sMD_BaseTen = 0x20,
+        sMD_Always = 0x10,   // value when node containing it is affected at all
+        sMD_BaseTen = 0x20,  // value is treated as base 10, overriding behavior
+        sMD_PseudoAccount = 0x40,  // if this field is set in an ACCOUNT_ROOT
+        // _only_, then it is a pseudo-account
         sMD_Default =
             sMD_ChangeOrig | sMD_ChangeNew | sMD_DeleteFinal | sMD_Create
     };
@@ -184,7 +189,7 @@ public:
         char const* fn,
         int meta = sMD_Default,
         IsSigning signing = IsSigning::yes);
-    explicit SField(private_access_tag_t, int fc);
+    explicit SField(private_access_tag_t, int fc, char const* fn);
 
     static SField const&
     getField(int fieldCode);
@@ -297,7 +302,7 @@ public:
     static int
     compare(SField const& f1, SField const& f2);
 
-    static std::map<int, SField const*> const&
+    static std::unordered_map<int, SField const*> const&
     getKnownCodeToField()
     {
         return knownCodeToField;
@@ -305,7 +310,8 @@ public:
 
 private:
     static int num;
-    static std::map<int, SField const*> knownCodeToField;
+    static std::unordered_map<int, SField const*> knownCodeToField;
+    static std::unordered_map<std::string, SField const*> knownNameToField;
 };
 
 /** A field with a type known at compile time. */
@@ -352,6 +358,9 @@ using SF_UINT256 = TypedField<STBitString<256>>;
 using SF_UINT384 = TypedField<STBitString<384>>;
 using SF_UINT512 = TypedField<STBitString<512>>;
 
+using SF_INT32 = TypedField<STInteger<std::int32_t>>;
+using SF_INT64 = TypedField<STInteger<std::int64_t>>;
+
 using SF_ACCOUNT = TypedField<STAccount>;
 using SF_AMOUNT = TypedField<STAmount>;
 using SF_ISSUE = TypedField<STIssue>;

include/xrpl/protocol/STInteger.h

@@ -81,6 +81,8 @@ using STUInt16 = STInteger<std::uint16_t>;
 using STUInt32 = STInteger<std::uint32_t>;
 using STUInt64 = STInteger<std::uint64_t>;
 
+using STInt32 = STInteger<std::int32_t>;
+
 template <typename Integer>
 inline STInteger<Integer>::STInteger(Integer v) : value_(v)
 {

include/xrpl/protocol/STLedgerEntry.h

@@ -26,7 +26,9 @@
 namespace ripple {
 
 class Rules;
+namespace test {
 class Invariants_test;
+}
 
 class STLedgerEntry final : public STObject, public CountedObject<STLedgerEntry>
 {
@@ -36,6 +38,8 @@ class STLedgerEntry final : public STObject, public CountedObject<STLedgerEntry>
 public:
     using pointer = std::shared_ptr<STLedgerEntry>;
     using ref = std::shared_ptr<STLedgerEntry> const&;
+    using const_pointer = std::shared_ptr<STLedgerEntry const>;
+    using const_ref = std::shared_ptr<STLedgerEntry const> const&;
 
     /** Create an empty object with the given key and type. */
     explicit STLedgerEntry(Keylet const& k);
@@ -54,7 +58,7 @@ public:
     getText() const override;
 
     Json::Value
-    getJson(JsonOptions options) const override;
+    getJson(JsonOptions options = JsonOptions::none) const override;
 
     /** Returns the 'key' (or 'index') of this item.
         The key identifies this entry's position in
@@ -84,7 +88,8 @@ private:
     void
     setSLEType();
 
-    friend Invariants_test;  // this test wants access to the private type_
+    friend test::Invariants_test;  // this test wants access to the private
+                                   // type_
 
     STBase*
     copy(std::size_t n, void* buf) const override;

include/xrpl/protocol/STObject.h

@@ -25,7 +25,6 @@
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/FeeUnits.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/STAmount.h>
@@ -34,6 +33,7 @@
 #include <xrpl/protocol/STIssue.h>
 #include <xrpl/protocol/STPathSet.h>
 #include <xrpl/protocol/STVector256.h>
+#include <xrpl/protocol/Units.h>
 #include <xrpl/protocol/detail/STVar.h>
 
 #include <boost/iterator/transform_iterator.hpp>
@@ -231,6 +231,8 @@ public:
     getFieldH192(SField const& field) const;
     uint256
     getFieldH256(SField const& field) const;
+    std::int32_t
+    getFieldI32(SField const& field) const;
     AccountID
     getAccountID(SField const& field) const;
 
@@ -365,6 +367,8 @@ public:
     void
     setFieldH256(SField const& field, uint256 const&);
     void
+    setFieldI32(SField const& field, std::int32_t);
+    void
     setFieldVL(SField const& field, Blob const&);
     void
     setFieldVL(SField const& field, Slice const&);

include/xrpl/protocol/STParsedJSON.h

@@ -54,34 +54,6 @@ public:
     Json::Value error;
 };
 
-/** Holds the serialized result of parsing an input JSON array.
-    This does validation and checking on the provided JSON.
-*/
-class STParsedJSONArray
-{
-public:
-    /** Parses and creates an STParsedJSON array.
-        The result of the parsing is stored in array and error.
-        Exceptions:
-            Does not throw.
-        @param name The name of the JSON field, used in diagnostics.
-        @param json The JSON-RPC to parse.
-    */
-    STParsedJSONArray(std::string const& name, Json::Value const& json);
-
-    STParsedJSONArray() = delete;
-    STParsedJSONArray(STParsedJSONArray const&) = delete;
-    STParsedJSONArray&
-    operator=(STParsedJSONArray const&) = delete;
-    ~STParsedJSONArray() = default;
-
-    /** The STArray if the parse was successful. */
-    std::optional<STArray> array;
-
-    /** On failure, an appropriate set of error values. */
-    Json::Value error;
-};
-
 }  // namespace ripple
 
 #endif

include/xrpl/protocol/STValidation.h

@@ -22,10 +22,10 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/FeeUnits.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
+#include <xrpl/protocol/Units.h>
 
 #include <cstdint>
 #include <optional>

include/xrpl/protocol/TER.h

@@ -673,7 +673,8 @@ isTerRetry(TER x) noexcept
 inline bool
 isTesSuccess(TER x) noexcept
 {
-    return (x == tesSUCCESS);
+    // Makes use of TERSubset::operator bool()
+    return !(x);
 }
 
 inline bool

include/xrpl/protocol/TxFlags.h

@@ -127,6 +127,8 @@ constexpr std::uint32_t tfTrustSetPermissionMask = ~(tfUniversal | tfSetfAuth |
 // EnableAmendment flags:
 constexpr std::uint32_t tfGotMajority                      = 0x00010000;
 constexpr std::uint32_t tfLostMajority                     = 0x00020000;
+constexpr std::uint32_t tfChangeMask =
+    ~( tfUniversal | tfGotMajority | tfLostMajority);
 
 // PaymentChannelClaim flags:
 constexpr std::uint32_t tfRenew                            = 0x00010000;
@@ -141,7 +143,8 @@ constexpr std::uint32_t const tfTransferable               = 0x00000008;
 constexpr std::uint32_t const tfMutable                    = 0x00000010;
 
 // MPTokenIssuanceCreate flags:
-// NOTE - there is intentionally no flag here for lsfMPTLocked, which this transaction cannot mutate.
+// Note: tf/lsfMPTLocked is intentionally omitted, since this transaction
+// is not allowed to modify it.
 constexpr std::uint32_t const tfMPTCanLock                 = lsfMPTCanLock;
 constexpr std::uint32_t const tfMPTRequireAuth             = lsfMPTRequireAuth;
 constexpr std::uint32_t const tfMPTCanEscrow               = lsfMPTCanEscrow;
@@ -152,6 +155,20 @@ constexpr std::uint32_t const tfMPTNoConfidentialTransfer  = lsfMPTNoConfidentia
 constexpr std::uint32_t const tfMPTokenIssuanceCreateMask  =
   ~(tfUniversal | tfMPTCanLock | tfMPTRequireAuth | tfMPTCanEscrow | tfMPTCanTrade | tfMPTCanTransfer | tfMPTCanClawback | tfMPTNoConfidentialTransfer);
 
+// MPTokenIssuanceCreate MutableFlags:
+// Indicating specific fields or flags may be changed after issuance.
+constexpr std::uint32_t const tmfMPTCanMutateCanLock = lsmfMPTCanMutateCanLock;
+constexpr std::uint32_t const tmfMPTCanMutateRequireAuth = lsmfMPTCanMutateRequireAuth;
+constexpr std::uint32_t const tmfMPTCanMutateCanEscrow = lsmfMPTCanMutateCanEscrow;
+constexpr std::uint32_t const tmfMPTCanMutateCanTrade = lsmfMPTCanMutateCanTrade;
+constexpr std::uint32_t const tmfMPTCanMutateCanTransfer = lsmfMPTCanMutateCanTransfer;
+constexpr std::uint32_t const tmfMPTCanMutateCanClawback = lsmfMPTCanMutateCanClawback;
+constexpr std::uint32_t const tmfMPTCanMutateMetadata = lsmfMPTCanMutateMetadata;
+constexpr std::uint32_t const tmfMPTCanMutateTransferFee = lsmfMPTCanMutateTransferFee;
+constexpr std::uint32_t const tmfMPTokenIssuanceCreateMutableMask =
+  ~(tmfMPTCanMutateCanLock | tmfMPTCanMutateRequireAuth | tmfMPTCanMutateCanEscrow | tmfMPTCanMutateCanTrade
+    | tmfMPTCanMutateCanTransfer | tmfMPTCanMutateCanClawback | tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee);
+
 // MPTokenAuthorize flags:
 constexpr std::uint32_t const tfMPTUnauthorize             = 0x00000001;
 constexpr std::uint32_t const tfMPTokenAuthorizeMask  = ~(tfUniversal | tfMPTUnauthorize);
@@ -162,6 +179,25 @@ constexpr std::uint32_t const tfMPTUnlock                 = 0x00000002;
 constexpr std::uint32_t const tfMPTokenIssuanceSetMask  = ~(tfUniversal | tfMPTLock | tfMPTUnlock);
 constexpr std::uint32_t const tfMPTokenIssuanceSetPermissionMask = ~(tfUniversal | tfMPTLock | tfMPTUnlock);
 
+// MPTokenIssuanceSet MutableFlags:
+// Set or Clear flags.
+constexpr std::uint32_t const tmfMPTSetCanLock             = 0x00000001;
+constexpr std::uint32_t const tmfMPTClearCanLock           = 0x00000002;
+constexpr std::uint32_t const tmfMPTSetRequireAuth         = 0x00000004;
+constexpr std::uint32_t const tmfMPTClearRequireAuth       = 0x00000008;
+constexpr std::uint32_t const tmfMPTSetCanEscrow           = 0x00000010;
+constexpr std::uint32_t const tmfMPTClearCanEscrow         = 0x00000020;
+constexpr std::uint32_t const tmfMPTSetCanTrade            = 0x00000040;
+constexpr std::uint32_t const tmfMPTClearCanTrade          = 0x00000080;
+constexpr std::uint32_t const tmfMPTSetCanTransfer         = 0x00000100;
+constexpr std::uint32_t const tmfMPTClearCanTransfer       = 0x00000200;
+constexpr std::uint32_t const tmfMPTSetCanClawback         = 0x00000400;
+constexpr std::uint32_t const tmfMPTClearCanClawback       = 0x00000800;
+constexpr std::uint32_t const tmfMPTokenIssuanceSetMutableMask = ~(tmfMPTSetCanLock | tmfMPTClearCanLock |
+    tmfMPTSetRequireAuth | tmfMPTClearRequireAuth | tmfMPTSetCanEscrow | tmfMPTClearCanEscrow |
+    tmfMPTSetCanTrade | tmfMPTClearCanTrade | tmfMPTSetCanTransfer | tmfMPTClearCanTransfer |
+    tmfMPTSetCanClawback | tmfMPTClearCanClawback);
+
 // MPTokenIssuanceDestroy flags:
 constexpr std::uint32_t const tfMPTokenIssuanceDestroyMask  = ~tfUniversal;
 

include/xrpl/protocol/Units.h

@@ -0,0 +1,555 @@
+//------------------------------------------------------------------------------
+/*
+    This file is part of rippled: https://github.com/ripple/rippled
+    Copyright (c) 2019 Ripple Labs Inc.
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose  with  or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+
+    THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+    MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#ifndef PROTOCOL_UNITS_H_INCLUDED
+#define PROTOCOL_UNITS_H_INCLUDED
+
+#include <xrpl/basics/safe_cast.h>
+#include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/json/json_value.h>
+
+#include <boost/multiprecision/cpp_int.hpp>
+#include <boost/operators.hpp>
+
+#include <iosfwd>
+#include <limits>
+#include <optional>
+
+namespace ripple {
+
+namespace unit {
+
+/** "drops" are the smallest divisible amount of XRP. This is what most
+    of the code uses. */
+struct dropTag;
+/** "fee levels" are used by the transaction queue to compare the relative
+    cost of transactions that require different levels of effort to process.
+    See also: src/ripple/app/misc/FeeEscalation.md#fee-level */
+struct feelevelTag;
+/** unitless values are plain scalars wrapped in a ValueUnit. They are
+    used for calculations in this header. */
+struct unitlessTag;
+
+/** Units to represent basis points (bips) and 1/10 basis points */
+class BipsTag;
+class TenthBipsTag;
+
+// These names don't have to be too descriptive, because we're in the "unit"
+// namespace.
+
+template <class T>
+concept Valid = std::is_class_v<T> && std::is_object_v<typename T::unit_type> &&
+    std::is_object_v<typename T::value_type>;
+
+/** `Usable` is checked to ensure that only values with
+    known valid type tags can be used (sometimes transparently) in
+    non-unit contexts. At the time of implementation, this includes
+    all known tags, but more may be added in the future, and they
+    should not be added automatically unless determined to be
+    appropriate.
+*/
+template <class T>
+concept Usable = Valid<T> &&
+    (std::is_same_v<typename T::unit_type, feelevelTag> ||
+     std::is_same_v<typename T::unit_type, unitlessTag> ||
+     std::is_same_v<typename T::unit_type, dropTag> ||
+     std::is_same_v<typename T::unit_type, BipsTag> ||
+     std::is_same_v<typename T::unit_type, TenthBipsTag>);
+
+template <class Other, class VU>
+concept Compatible = Valid<VU> && std::is_arithmetic_v<Other> &&
+    std::is_arithmetic_v<typename VU::value_type> &&
+    std::is_convertible_v<Other, typename VU::value_type>;
+
+template <class T>
+concept Integral = std::is_integral_v<T>;
+
+template <class VU>
+concept IntegralValue = Integral<typename VU::value_type>;
+
+template <class VU1, class VU2>
+concept CastableValue = IntegralValue<VU1> && IntegralValue<VU2> &&
+    std::is_same_v<typename VU1::unit_type, typename VU2::unit_type>;
+
+template <class UnitTag, class T>
+class ValueUnit : private boost::totally_ordered<ValueUnit<UnitTag, T>>,
+                  private boost::additive<ValueUnit<UnitTag, T>>,
+                  private boost::equality_comparable<ValueUnit<UnitTag, T>, T>,
+                  private boost::dividable<ValueUnit<UnitTag, T>, T>,
+                  private boost::modable<ValueUnit<UnitTag, T>, T>,
+                  private boost::unit_steppable<ValueUnit<UnitTag, T>>
+{
+public:
+    using unit_type = UnitTag;
+    using value_type = T;
+
+private:
+    value_type value_;
+
+public:
+    ValueUnit() = default;
+    constexpr ValueUnit(ValueUnit const& other) = default;
+    constexpr ValueUnit&
+    operator=(ValueUnit const& other) = default;
+
+    constexpr explicit ValueUnit(beast::Zero) : value_(0)
+    {
+    }
+
+    constexpr ValueUnit&
+    operator=(beast::Zero)
+    {
+        value_ = 0;
+        return *this;
+    }
+
+    constexpr explicit ValueUnit(value_type value) : value_(value)
+    {
+    }
+
+    constexpr ValueUnit&
+    operator=(value_type value)
+    {
+        value_ = value;
+        return *this;
+    }
+
+    /** Instances with the same unit, and a type that is
+        "safe" to convert to this one can be converted
+        implicitly */
+    template <Compatible<ValueUnit> Other>
+    constexpr ValueUnit(ValueUnit<unit_type, Other> const& value)
+        requires SafeToCast<Other, value_type>
+        : ValueUnit(safe_cast<value_type>(value.value()))
+    {
+    }
+
+    constexpr ValueUnit
+    operator+(value_type const& rhs) const
+    {
+        return ValueUnit{value_ + rhs};
+    }
+
+    friend constexpr ValueUnit
+    operator+(value_type lhs, ValueUnit const& rhs)
+    {
+        // addition is commutative
+        return rhs + lhs;
+    }
+
+    constexpr ValueUnit
+    operator-(value_type const& rhs) const
+    {
+        return ValueUnit{value_ - rhs};
+    }
+
+    friend constexpr ValueUnit
+    operator-(value_type lhs, ValueUnit const& rhs)
+    {
+        // subtraction is NOT commutative, but (lhs + (-rhs)) is addition, which
+        // is
+        return -rhs + lhs;
+    }
+
+    constexpr ValueUnit
+    operator*(value_type const& rhs) const
+    {
+        return ValueUnit{value_ * rhs};
+    }
+
+    friend constexpr ValueUnit
+    operator*(value_type lhs, ValueUnit const& rhs)
+    {
+        // multiplication is commutative
+        return rhs * lhs;
+    }
+
+    constexpr value_type
+    operator/(ValueUnit const& rhs) const
+    {
+        return value_ / rhs.value_;
+    }
+
+    ValueUnit&
+    operator+=(ValueUnit const& other)
+    {
+        value_ += other.value();
+        return *this;
+    }
+
+    ValueUnit&
+    operator-=(ValueUnit const& other)
+    {
+        value_ -= other.value();
+        return *this;
+    }
+
+    ValueUnit&
+    operator++()
+    {
+        ++value_;
+        return *this;
+    }
+
+    ValueUnit&
+    operator--()
+    {
+        --value_;
+        return *this;
+    }
+
+    ValueUnit&
+    operator*=(value_type const& rhs)
+    {
+        value_ *= rhs;
+        return *this;
+    }
+
+    ValueUnit&
+    operator/=(value_type const& rhs)
+    {
+        value_ /= rhs;
+        return *this;
+    }
+
+    template <Integral transparent = value_type>
+    ValueUnit&
+    operator%=(value_type const& rhs)
+    {
+        value_ %= rhs;
+        return *this;
+    }
+
+    ValueUnit
+    operator-() const
+    {
+        static_assert(
+            std::is_signed_v<T>, "- operator illegal on unsigned value types");
+        return ValueUnit{-value_};
+    }
+
+    constexpr bool
+    operator==(ValueUnit const& other) const
+    {
+        return value_ == other.value_;
+    }
+
+    template <Compatible<ValueUnit> Other>
+    constexpr bool
+    operator==(ValueUnit<unit_type, Other> const& other) const
+    {
+        return value_ == other.value();
+    }
+
+    constexpr bool
+    operator==(value_type other) const
+    {
+        return value_ == other;
+    }
+
+    template <Compatible<ValueUnit> Other>
+    constexpr bool
+    operator!=(ValueUnit<unit_type, Other> const& other) const
+    {
+        return !operator==(other);
+    }
+
+    constexpr bool
+    operator<(ValueUnit const& other) const
+    {
+        return value_ < other.value_;
+    }
+
+    /** Returns true if the amount is not zero */
+    explicit constexpr
+    operator bool() const noexcept
+    {
+        return value_ != 0;
+    }
+
+    /** Return the sign of the amount */
+    constexpr int
+    signum() const noexcept
+    {
+        return (value_ < 0) ? -1 : (value_ ? 1 : 0);
+    }
+
+    /** Returns the number of drops */
+    // TODO: Move this to a new class, maybe with the old "TaggedFee" name
+    constexpr value_type
+    fee() const
+    {
+        return value_;
+    }
+
+    template <class Other>
+    constexpr double
+    decimalFromReference(ValueUnit<unit_type, Other> reference) const
+    {
+        return static_cast<double>(value_) / reference.value();
+    }
+
+    // `Usable` is checked to ensure that only values with
+    // known valid type tags can be converted to JSON. At the time
+    // of implementation, that includes all known tags, but more may
+    // be added in the future.
+    Json::Value
+    jsonClipped() const
+        requires Usable<ValueUnit>
+    {
+        if constexpr (std::is_integral_v<value_type>)
+        {
+            using jsontype = std::conditional_t<
+                std::is_signed_v<value_type>,
+                Json::Int,
+                Json::UInt>;
+
+            constexpr auto min = std::numeric_limits<jsontype>::min();
+            constexpr auto max = std::numeric_limits<jsontype>::max();
+
+            if (value_ < min)
+                return min;
+            if (value_ > max)
+                return max;
+            return static_cast<jsontype>(value_);
+        }
+        else
+        {
+            return value_;
+        }
+    }
+
+    /** Returns the underlying value. Code SHOULD NOT call this
+        function unless the type has been abstracted away,
+        e.g. in a templated function.
+    */
+    constexpr value_type
+    value() const
+    {
+        return value_;
+    }
+
+    friend std::istream&
+    operator>>(std::istream& s, ValueUnit& val)
+    {
+        s >> val.value_;
+        return s;
+    }
+};
+
+// Output Values as just their numeric value.
+template <class Char, class Traits, class UnitTag, class T>
+std::basic_ostream<Char, Traits>&
+operator<<(std::basic_ostream<Char, Traits>& os, ValueUnit<UnitTag, T> const& q)
+{
+    return os << q.value();
+}
+
+template <class UnitTag, class T>
+std::string
+to_string(ValueUnit<UnitTag, T> const& amount)
+{
+    return std::to_string(amount.value());
+}
+
+template <class Source>
+concept muldivSource = Valid<Source> &&
+    std::is_convertible_v<typename Source::value_type, std::uint64_t>;
+
+template <class Dest>
+concept muldivDest = muldivSource<Dest> &&  // Dest is also a source
+    std::is_convertible_v<std::uint64_t, typename Dest::value_type> &&
+    sizeof(typename Dest::value_type) >= sizeof(std::uint64_t);
+
+template <class Source2, class Source1>
+concept muldivSources = muldivSource<Source1> && muldivSource<Source2> &&
+    std::is_same_v<typename Source1::unit_type, typename Source2::unit_type>;
+
+template <class Dest, class Source1, class Source2>
+concept muldivable = muldivSources<Source1, Source2> && muldivDest<Dest>;
+// Source and Dest can be the same by default
+
+template <class Dest, class Source1, class Source2>
+concept muldivCommutable = muldivable<Dest, Source1, Source2> &&
+    !std::is_same_v<typename Source1::unit_type, typename Dest::unit_type>;
+
+template <class T>
+ValueUnit<unitlessTag, T>
+scalar(T value)
+{
+    return ValueUnit<unitlessTag, T>{value};
+}
+
+template <class Source1, class Source2, unit::muldivable<Source1, Source2> Dest>
+std::optional<Dest>
+mulDivU(Source1 value, Dest mul, Source2 div)
+{
+    // values can never be negative in any context.
+    if (value.value() < 0 || mul.value() < 0 || div.value() < 0)
+    {
+        // split the asserts so if one hits, the user can tell which
+        // without a debugger.
+        XRPL_ASSERT(
+            value.value() >= 0, "ripple::unit::mulDivU : minimum value input");
+        XRPL_ASSERT(
+            mul.value() >= 0, "ripple::unit::mulDivU : minimum mul input");
+        XRPL_ASSERT(
+            div.value() > 0, "ripple::unit::mulDivU : minimum div input");
+        return std::nullopt;
+    }
+
+    using desttype = typename Dest::value_type;
+    constexpr auto max = std::numeric_limits<desttype>::max();
+
+    // Shortcuts, since these happen a lot in the real world
+    if (value == div)
+        return mul;
+    if (mul.value() == div.value())
+    {
+        if (value.value() > max)
+            return std::nullopt;
+        return Dest{static_cast<desttype>(value.value())};
+    }
+
+    using namespace boost::multiprecision;
+
+    uint128_t product;
+    product = multiply(
+        product,
+        static_cast<std::uint64_t>(value.value()),
+        static_cast<std::uint64_t>(mul.value()));
+
+    auto quotient = product / div.value();
+
+    if (quotient > max)
+        return std::nullopt;
+
+    return Dest{static_cast<desttype>(quotient)};
+}
+
+}  // namespace unit
+
+// Fee Levels
+template <class T>
+using FeeLevel = unit::ValueUnit<unit::feelevelTag, T>;
+using FeeLevel64 = FeeLevel<std::uint64_t>;
+using FeeLevelDouble = FeeLevel<double>;
+
+// Basis points (Bips)
+template <class T>
+using Bips = unit::ValueUnit<unit::BipsTag, T>;
+using Bips16 = Bips<std::uint16_t>;
+using Bips32 = Bips<std::uint32_t>;
+template <class T>
+using TenthBips = unit::ValueUnit<unit::TenthBipsTag, T>;
+using TenthBips16 = TenthBips<std::uint16_t>;
+using TenthBips32 = TenthBips<std::uint32_t>;
+
+template <class Source1, class Source2, unit::muldivable<Source1, Source2> Dest>
+std::optional<Dest>
+mulDiv(Source1 value, Dest mul, Source2 div)
+{
+    return unit::mulDivU(value, mul, div);
+}
+
+template <
+    class Source1,
+    class Source2,
+    unit::muldivCommutable<Source1, Source2> Dest>
+std::optional<Dest>
+mulDiv(Dest value, Source1 mul, Source2 div)
+{
+    // Multiplication is commutative
+    return unit::mulDivU(mul, value, div);
+}
+
+template <unit::muldivDest Dest>
+std::optional<Dest>
+mulDiv(std::uint64_t value, Dest mul, std::uint64_t div)
+{
+    // Give the scalars a non-tag so the
+    // unit-handling version gets called.
+    return unit::mulDivU(unit::scalar(value), mul, unit::scalar(div));
+}
+
+template <unit::muldivDest Dest>
+std::optional<Dest>
+mulDiv(Dest value, std::uint64_t mul, std::uint64_t div)
+{
+    // Multiplication is commutative
+    return mulDiv(mul, value, div);
+}
+
+template <unit::muldivSource Source1, unit::muldivSources<Source1> Source2>
+std::optional<std::uint64_t>
+mulDiv(Source1 value, std::uint64_t mul, Source2 div)
+{
+    // Give the scalars a dimensionless unit so the
+    // unit-handling version gets called.
+    auto unitresult = unit::mulDivU(value, unit::scalar(mul), div);
+
+    if (!unitresult)
+        return std::nullopt;
+
+    return unitresult->value();
+}
+
+template <unit::muldivSource Source1, unit::muldivSources<Source1> Source2>
+std::optional<std::uint64_t>
+mulDiv(std::uint64_t value, Source1 mul, Source2 div)
+{
+    // Multiplication is commutative
+    return mulDiv(mul, value, div);
+}
+
+template <unit::IntegralValue Dest, unit::CastableValue<Dest> Src>
+constexpr Dest
+safe_cast(Src s) noexcept
+{
+    // Dest may not have an explicit value constructor
+    return Dest{safe_cast<typename Dest::value_type>(s.value())};
+}
+
+template <unit::IntegralValue Dest, unit::Integral Src>
+constexpr Dest
+safe_cast(Src s) noexcept
+{
+    // Dest may not have an explicit value constructor
+    return Dest{safe_cast<typename Dest::value_type>(s)};
+}
+
+template <unit::IntegralValue Dest, unit::CastableValue<Dest> Src>
+constexpr Dest
+unsafe_cast(Src s) noexcept
+{
+    // Dest may not have an explicit value constructor
+    return Dest{unsafe_cast<typename Dest::value_type>(s.value())};
+}
+
+template <unit::IntegralValue Dest, unit::Integral Src>
+constexpr Dest
+unsafe_cast(Src s) noexcept
+{
+    // Dest may not have an explicit value constructor
+    return Dest{unsafe_cast<typename Dest::value_type>(s)};
+}
+
+}  // namespace ripple
+
+#endif  // PROTOCOL_UNITS_H_INCLUDED

include/xrpl/protocol/XRPAmount.h

@@ -24,7 +24,7 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/json/json_value.h>
-#include <xrpl/protocol/FeeUnits.h>
+#include <xrpl/protocol/Units.h>
 
 #include <boost/multiprecision/cpp_int.hpp>
 #include <boost/operators.hpp>
@@ -42,7 +42,7 @@ class XRPAmount : private boost::totally_ordered<XRPAmount>,
                   private boost::additive<XRPAmount, std::int64_t>
 {
 public:
-    using unit_type = feeunit::dropTag;
+    using unit_type = unit::dropTag;
     using value_type = std::int64_t;
 
 private:

include/xrpl/protocol/detail/features.macro

@@ -33,8 +33,11 @@
 // in include/xrpl/protocol/Feature.h.
 
 XRPL_FEATURE(ConfidentialTransfer,       Supported::no,  VoteBehavior::DefaultNo)
+XRPL_FIX    (IncludeKeyletFields,        Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(DynamicMPT,                 Supported::no,  VoteBehavior::DefaultNo)
+XRPL_FIX    (TokenEscrowV1,              Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (DelegateV1_1,               Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FIX    (PriceOracleOrder,           Supported::no,  VoteBehavior::DefaultNo)
+XRPL_FIX    (PriceOracleOrder,           Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (MPTDeliveredAmount,         Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (AMMClawbackRounding,        Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(TokenEscrow,                Supported::yes, VoteBehavior::DefaultNo)
@@ -43,7 +46,7 @@ XRPL_FIX    (AMMv1_3,                    Supported::yes, VoteBehavior::DefaultNo
 XRPL_FEATURE(PermissionedDEX,            Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Batch,                      Supported::yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(SingleAssetVault,           Supported::no,  VoteBehavior::DefaultNo)
-XRPL_FEATURE(PermissionDelegation,       Supported::yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(PermissionDelegation,       Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (PayChanCancelAfter,         Supported::yes, VoteBehavior::DefaultNo)
 // Check flags in Credential transactions
 XRPL_FIX    (InvalidTxFlags,             Supported::yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -120,6 +120,7 @@ LEDGER_ENTRY(ltNFTOKEN_PAGE, 0x0050, NFTokenPage, nft_page, ({
 // All fields are soeREQUIRED because there is always a SignerEntries.
 // If there are no SignerEntries the node is deleted.
 LEDGER_ENTRY(ltSIGNER_LIST, 0x0053, SignerList, signer_list, ({
+    {sfOwner,                soeOPTIONAL},
     {sfOwnerNode,            soeREQUIRED},
     {sfSignerQuorum,         soeREQUIRED},
     {sfSignerEntries,        soeREQUIRED},
@@ -188,7 +189,7 @@ LEDGER_ENTRY(ltDIR_NODE, 0x0064, DirectoryNode, directory, ({
     {sfNFTokenID,            soeOPTIONAL},
     {sfPreviousTxnID,        soeOPTIONAL},
     {sfPreviousTxnLgrSeq,    soeOPTIONAL},
-    {sfDomainID,             soeOPTIONAL}
+    {sfDomainID,             soeOPTIONAL}   // order book directories
 }))
 
 /** The ledger object which lists details about amendments on the network.
@@ -343,6 +344,7 @@ LEDGER_ENTRY(ltXCHAIN_OWNED_CREATE_ACCOUNT_CLAIM_ID, 0x0074, XChainOwnedCreateAc
  */
 LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
     {sfAccount,              soeREQUIRED},
+    {sfSequence,             soeOPTIONAL},
     {sfDestination,          soeREQUIRED},
     {sfAmount,               soeREQUIRED},
     {sfCondition,            soeOPTIONAL},
@@ -365,6 +367,7 @@ LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
 LEDGER_ENTRY(ltPAYCHAN, 0x0078, PayChannel, payment_channel, ({
     {sfAccount,              soeREQUIRED},
     {sfDestination,          soeREQUIRED},
+    {sfSequence,             soeOPTIONAL},
     {sfAmount,               soeREQUIRED},
     {sfBalance,              soeREQUIRED},
     {sfPublicKey,            soeREQUIRED},
@@ -412,6 +415,7 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfPreviousTxnID,            soeREQUIRED},
     {sfPreviousTxnLgrSeq,        soeREQUIRED},
     {sfDomainID,                 soeOPTIONAL},
+    {sfMutableFlags,             soeDEFAULT},
     {sfIssuerElGamalPublicKey,   soeOPTIONAL},
     {sfConfidentialOutstandingAmount, soeOPTIONAL},
 }))
@@ -439,6 +443,7 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
  */
 LEDGER_ENTRY(ltORACLE, 0x0080, Oracle, oracle, ({
     {sfOwner,                soeREQUIRED},
+    {sfOracleDocumentID,     soeOPTIONAL},
     {sfProvider,             soeREQUIRED},
     {sfPriceDataSeries,      soeREQUIRED},
     {sfAssetClass,           soeREQUIRED},

include/xrpl/protocol/detail/sfields.macro

@@ -114,7 +114,8 @@ TYPED_SFIELD(sfVoteWeight,               UINT32,    48)
 TYPED_SFIELD(sfFirstNFTokenSequence,     UINT32,    50)
 TYPED_SFIELD(sfOracleDocumentID,         UINT32,    51)
 TYPED_SFIELD(sfPermissionValue,          UINT32,    52)
-TYPED_SFIELD(sfConfidentialBalanceVersion, UINT32,  53)
+TYPED_SFIELD(sfMutableFlags,             UINT32,    53)
+TYPED_SFIELD(sfConfidentialBalanceVersion, UINT32, 54)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -175,7 +176,8 @@ TYPED_SFIELD(sfNFTokenID,                UINT256,   10)
 TYPED_SFIELD(sfEmitParentTxnID,          UINT256,   11)
 TYPED_SFIELD(sfEmitNonce,                UINT256,   12)
 TYPED_SFIELD(sfEmitHookHash,             UINT256,   13)
-TYPED_SFIELD(sfAMMID,                    UINT256,   14)
+TYPED_SFIELD(sfAMMID,                    UINT256,   14,
+    SField::sMD_PseudoAccount | SField::sMD_Default)
 
 // 256-bit (uncommon)
 TYPED_SFIELD(sfBookDirectory,            UINT256,   16)
@@ -197,7 +199,8 @@ TYPED_SFIELD(sfHookHash,                 UINT256,   31)
 TYPED_SFIELD(sfHookNamespace,            UINT256,   32)
 TYPED_SFIELD(sfHookSetTxnID,             UINT256,   33)
 TYPED_SFIELD(sfDomainID,                 UINT256,   34)
-TYPED_SFIELD(sfVaultID,                  UINT256,   35)
+TYPED_SFIELD(sfVaultID,                  UINT256,   35,
+    SField::sMD_PseudoAccount | SField::sMD_Default)
 TYPED_SFIELD(sfParentBatchID,            UINT256,   36)
 
 // number (common)
@@ -207,6 +210,12 @@ TYPED_SFIELD(sfAssetsMaximum,            NUMBER,     3)
 TYPED_SFIELD(sfAssetsTotal,              NUMBER,     4)
 TYPED_SFIELD(sfLossUnrealized,           NUMBER,     5)
 
+// int32
+// NOTE: Do not use `sfDummyInt32`. It's so far the only use of INT32
+// in this file and has been defined here for test only.
+// TODO: Replace `sfDummyInt32` with actually useful field.
+TYPED_SFIELD(sfDummyInt32,               INT32,      1) // for tests only
+
 // currency amount (common)
 TYPED_SFIELD(sfAmount,                   AMOUNT,     1)
 TYPED_SFIELD(sfBalance,                  AMOUNT,     2)

include/xrpl/protocol/detail/transactions.macro

@@ -22,16 +22,31 @@
 #endif
 
 /**
- * TRANSACTION(tag, value, name, delegatable, amendments, fields)
+ * TRANSACTION(tag, value, name, delegatable, amendments, privileges, fields)
+ *
+ * To ease maintenance, you may replace any unneeded values with "..."
+ * e.g. #define TRANSACTION(tag, value, name, ...)
  *
  * You must define a transactor class in the `ripple` namespace named `name`,
- * and include its header in `src/xrpld/app/tx/detail/applySteps.cpp`.
+ * and include its header alongside the TRANSACTOR definition using this
+ * format:
+ * #if TRANSACTION_INCLUDE
+ * #   include <xrpld/app/tx/detail/HEADER.h>
+ * #endif
+ *
+ * The `privileges` parameter of the TRANSACTION macro is a bitfield
+ * defining which operations the transaction can perform.
+ * The values are defined and used in InvariantCheck.cpp
  */
 
 /** This transaction type executes a payment. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Payment.h>
+#endif
 TRANSACTION(ttPAYMENT, 0, Payment,
     Delegation::delegatable,
     uint256{},
+    createAcct,
     ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
@@ -45,9 +60,13 @@ TRANSACTION(ttPAYMENT, 0, Payment,
 }))
 
 /** This transaction type creates an escrow object. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Escrow.h>
+#endif
 TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
@@ -61,6 +80,7 @@ TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate,
 TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfOwner, soeREQUIRED},
     {sfOfferSequence, soeREQUIRED},
@@ -71,9 +91,13 @@ TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish,
 
 
 /** This transaction type adjusts various account settings. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetAccount.h>
+#endif
 TRANSACTION(ttACCOUNT_SET, 3, AccountSet,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfEmailHash, soeOPTIONAL},
     {sfWalletLocator, soeOPTIONAL},
@@ -88,18 +112,26 @@ TRANSACTION(ttACCOUNT_SET, 3, AccountSet,
 }))
 
 /** This transaction type cancels an existing escrow. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Escrow.h>
+#endif
 TRANSACTION(ttESCROW_CANCEL, 4, EscrowCancel,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfOwner, soeREQUIRED},
     {sfOfferSequence, soeREQUIRED},
 }))
 
 /** This transaction type sets or clears an account's "regular key". */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetRegularKey.h>
+#endif
 TRANSACTION(ttREGULAR_KEY_SET, 5, SetRegularKey,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfRegularKey, soeOPTIONAL},
 }))
@@ -107,9 +139,13 @@ TRANSACTION(ttREGULAR_KEY_SET, 5, SetRegularKey,
 // 6 deprecated
 
 /** This transaction type creates an offer to trade one asset for another. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateOffer.h>
+#endif
 TRANSACTION(ttOFFER_CREATE, 7, OfferCreate,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfTakerPays, soeREQUIRED},
     {sfTakerGets, soeREQUIRED},
@@ -119,9 +155,13 @@ TRANSACTION(ttOFFER_CREATE, 7, OfferCreate,
 }))
 
 /** This transaction type cancels existing offers to trade one asset for another. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CancelOffer.h>
+#endif
 TRANSACTION(ttOFFER_CANCEL, 8, OfferCancel,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfOfferSequence, soeREQUIRED},
 }))
@@ -129,9 +169,13 @@ TRANSACTION(ttOFFER_CANCEL, 8, OfferCancel,
 // 9 deprecated
 
 /** This transaction type creates a new set of tickets. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateTicket.h>
+#endif
 TRANSACTION(ttTICKET_CREATE, 10, TicketCreate,
     Delegation::delegatable,
     featureTicketBatch,
+    noPriv,
     ({
     {sfTicketCount, soeREQUIRED},
 }))
@@ -141,18 +185,26 @@ TRANSACTION(ttTICKET_CREATE, 10, TicketCreate,
 /** This transaction type modifies the signer list associated with an account. */
 // The SignerEntries are optional because a SignerList is deleted by
 // setting the SignerQuorum to zero and omitting SignerEntries.
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetSignerList.h>
+#endif
 TRANSACTION(ttSIGNER_LIST_SET, 12, SignerListSet,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfSignerQuorum, soeREQUIRED},
     {sfSignerEntries, soeOPTIONAL},
 }))
 
 /** This transaction type creates a new unidirectional XRP payment channel. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PayChan.h>
+#endif
 TRANSACTION(ttPAYCHAN_CREATE, 13, PaymentChannelCreate,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfDestination, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -166,6 +218,7 @@ TRANSACTION(ttPAYCHAN_CREATE, 13, PaymentChannelCreate,
 TRANSACTION(ttPAYCHAN_FUND, 14, PaymentChannelFund,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfChannel, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -176,6 +229,7 @@ TRANSACTION(ttPAYCHAN_FUND, 14, PaymentChannelFund,
 TRANSACTION(ttPAYCHAN_CLAIM, 15, PaymentChannelClaim,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfChannel, soeREQUIRED},
     {sfAmount, soeOPTIONAL},
@@ -186,9 +240,13 @@ TRANSACTION(ttPAYCHAN_CLAIM, 15, PaymentChannelClaim,
 }))
 
 /** This transaction type creates a new check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CreateCheck.h>
+#endif
 TRANSACTION(ttCHECK_CREATE, 16, CheckCreate,
     Delegation::delegatable,
     featureChecks,
+    noPriv,
     ({
     {sfDestination, soeREQUIRED},
     {sfSendMax, soeREQUIRED},
@@ -198,9 +256,13 @@ TRANSACTION(ttCHECK_CREATE, 16, CheckCreate,
 }))
 
 /** This transaction type cashes an existing check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CashCheck.h>
+#endif
 TRANSACTION(ttCHECK_CASH, 17, CheckCash,
     Delegation::delegatable,
     featureChecks,
+    noPriv,
     ({
     {sfCheckID, soeREQUIRED},
     {sfAmount, soeOPTIONAL},
@@ -208,17 +270,25 @@ TRANSACTION(ttCHECK_CASH, 17, CheckCash,
 }))
 
 /** This transaction type cancels an existing check. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/CancelCheck.h>
+#endif
 TRANSACTION(ttCHECK_CANCEL, 18, CheckCancel,
     Delegation::delegatable,
     featureChecks,
+    noPriv,
     ({
     {sfCheckID, soeREQUIRED},
 }))
 
 /** This transaction type grants or revokes authorization to transfer funds. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DepositPreauth.h>
+#endif
 TRANSACTION(ttDEPOSIT_PREAUTH, 19, DepositPreauth,
     Delegation::delegatable,
     featureDepositPreauth,
+    noPriv,
     ({
     {sfAuthorize, soeOPTIONAL},
     {sfUnauthorize, soeOPTIONAL},
@@ -227,9 +297,13 @@ TRANSACTION(ttDEPOSIT_PREAUTH, 19, DepositPreauth,
 }))
 
 /** This transaction type modifies a trustline between two accounts. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetTrust.h>
+#endif
 TRANSACTION(ttTRUST_SET, 20, TrustSet,
     Delegation::delegatable,
     uint256{},
+    noPriv,
     ({
     {sfLimitAmount, soeOPTIONAL},
     {sfQualityIn, soeOPTIONAL},
@@ -237,9 +311,13 @@ TRANSACTION(ttTRUST_SET, 20, TrustSet,
 }))
 
 /** This transaction type deletes an existing account. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DeleteAccount.h>
+#endif
 TRANSACTION(ttACCOUNT_DELETE, 21, AccountDelete,
     Delegation::notDelegatable,
     uint256{},
+    mustDeleteAcct,
     ({
     {sfDestination, soeREQUIRED},
     {sfDestinationTag, soeOPTIONAL},
@@ -249,9 +327,13 @@ TRANSACTION(ttACCOUNT_DELETE, 21, AccountDelete,
 // 22 reserved
 
 /** This transaction mints a new NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenMint.h>
+#endif
 TRANSACTION(ttNFTOKEN_MINT, 25, NFTokenMint,
     Delegation::delegatable,
     featureNonFungibleTokensV1,
+    changeNFTCounts,
     ({
     {sfNFTokenTaxon, soeREQUIRED},
     {sfTransferFee, soeOPTIONAL},
@@ -263,18 +345,26 @@ TRANSACTION(ttNFTOKEN_MINT, 25, NFTokenMint,
 }))
 
 /** This transaction burns (i.e. destroys) an existing NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenBurn.h>
+#endif
 TRANSACTION(ttNFTOKEN_BURN, 26, NFTokenBurn,
     Delegation::delegatable,
     featureNonFungibleTokensV1,
+    changeNFTCounts,
     ({
     {sfNFTokenID, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
 }))
 
 /** This transaction creates a new offer to buy or sell an NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenCreateOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_CREATE_OFFER, 27, NFTokenCreateOffer,
     Delegation::delegatable,
     featureNonFungibleTokensV1,
+    noPriv,
     ({
     {sfNFTokenID, soeREQUIRED},
     {sfAmount, soeREQUIRED},
@@ -284,17 +374,25 @@ TRANSACTION(ttNFTOKEN_CREATE_OFFER, 27, NFTokenCreateOffer,
 }))
 
 /** This transaction cancels an existing offer to buy or sell an existing NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenCancelOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_CANCEL_OFFER, 28, NFTokenCancelOffer,
     Delegation::delegatable,
     featureNonFungibleTokensV1,
+    noPriv,
     ({
     {sfNFTokenOffers, soeREQUIRED},
 }))
 
 /** This transaction accepts an existing offer to buy or sell an existing  NFT. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenAcceptOffer.h>
+#endif
 TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer,
     Delegation::delegatable,
     featureNonFungibleTokensV1,
+    noPriv,
     ({
     {sfNFTokenBuyOffer, soeOPTIONAL},
     {sfNFTokenSellOffer, soeOPTIONAL},
@@ -302,18 +400,26 @@ TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer,
 }))
 
 /** This transaction claws back issued tokens. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Clawback.h>
+#endif
 TRANSACTION(ttCLAWBACK, 30, Clawback,
     Delegation::delegatable,
     featureClawback,
+    noPriv,
     ({
     {sfAmount, soeREQUIRED, soeMPTSupported},
     {sfHolder, soeOPTIONAL},
 }))
 
 /** This transaction claws back tokens from an AMM pool. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMClawback.h>
+#endif
 TRANSACTION(ttAMM_CLAWBACK, 31, AMMClawback,
     Delegation::delegatable,
     featureAMMClawback,
+    mayDeleteAcct | overrideFreeze,
     ({
     {sfHolder, soeREQUIRED},
     {sfAsset, soeREQUIRED},
@@ -322,9 +428,13 @@ TRANSACTION(ttAMM_CLAWBACK, 31, AMMClawback,
 }))
 
 /** This transaction type creates an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMCreate.h>
+#endif
 TRANSACTION(ttAMM_CREATE, 35, AMMCreate,
     Delegation::delegatable,
     featureAMM,
+    createPseudoAcct,
     ({
     {sfAmount, soeREQUIRED},
     {sfAmount2, soeREQUIRED},
@@ -332,9 +442,13 @@ TRANSACTION(ttAMM_CREATE, 35, AMMCreate,
 }))
 
 /** This transaction type deposits into an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMDeposit.h>
+#endif
 TRANSACTION(ttAMM_DEPOSIT, 36, AMMDeposit,
     Delegation::delegatable,
     featureAMM,
+    noPriv,
     ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -346,9 +460,13 @@ TRANSACTION(ttAMM_DEPOSIT, 36, AMMDeposit,
 }))
 
 /** This transaction type withdraws from an AMM instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMWithdraw.h>
+#endif
 TRANSACTION(ttAMM_WITHDRAW, 37, AMMWithdraw,
     Delegation::delegatable,
     featureAMM,
+    mayDeleteAcct,
     ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -359,9 +477,13 @@ TRANSACTION(ttAMM_WITHDRAW, 37, AMMWithdraw,
 }))
 
 /** This transaction type votes for the trading fee */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMVote.h>
+#endif
 TRANSACTION(ttAMM_VOTE, 38, AMMVote,
     Delegation::delegatable,
     featureAMM,
+    noPriv,
     ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -369,9 +491,13 @@ TRANSACTION(ttAMM_VOTE, 38, AMMVote,
 }))
 
 /** This transaction type bids for the auction slot */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMBid.h>
+#endif
 TRANSACTION(ttAMM_BID, 39, AMMBid,
     Delegation::delegatable,
     featureAMM,
+    noPriv,
     ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
@@ -381,18 +507,26 @@ TRANSACTION(ttAMM_BID, 39, AMMBid,
 }))
 
 /** This transaction type deletes AMM in the empty state */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/AMMDelete.h>
+#endif
 TRANSACTION(ttAMM_DELETE, 40, AMMDelete,
     Delegation::delegatable,
     featureAMM,
+    mustDeleteAcct,
     ({
     {sfAsset, soeREQUIRED},
     {sfAsset2, soeREQUIRED},
 }))
 
 /** This transactions creates a crosschain sequence number */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/XChainBridge.h>
+#endif
 TRANSACTION(ttXCHAIN_CREATE_CLAIM_ID, 41, XChainCreateClaimID,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfSignatureReward, soeREQUIRED},
@@ -403,6 +537,7 @@ TRANSACTION(ttXCHAIN_CREATE_CLAIM_ID, 41, XChainCreateClaimID,
 TRANSACTION(ttXCHAIN_COMMIT, 42, XChainCommit,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfXChainClaimID, soeREQUIRED},
@@ -414,6 +549,7 @@ TRANSACTION(ttXCHAIN_COMMIT, 42, XChainCommit,
 TRANSACTION(ttXCHAIN_CLAIM, 43, XChainClaim,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfXChainClaimID, soeREQUIRED},
@@ -426,6 +562,7 @@ TRANSACTION(ttXCHAIN_CLAIM, 43, XChainClaim,
 TRANSACTION(ttXCHAIN_ACCOUNT_CREATE_COMMIT, 44, XChainAccountCreateCommit,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfDestination, soeREQUIRED},
@@ -437,6 +574,7 @@ TRANSACTION(ttXCHAIN_ACCOUNT_CREATE_COMMIT, 44, XChainAccountCreateCommit,
 TRANSACTION(ttXCHAIN_ADD_CLAIM_ATTESTATION, 45, XChainAddClaimAttestation,
     Delegation::delegatable,
     featureXChainBridge,
+    createAcct,
     ({
     {sfXChainBridge, soeREQUIRED},
 
@@ -453,9 +591,11 @@ TRANSACTION(ttXCHAIN_ADD_CLAIM_ATTESTATION, 45, XChainAddClaimAttestation,
 }))
 
 /** This transaction adds an attestation to an account */
-TRANSACTION(ttXCHAIN_ADD_ACCOUNT_CREATE_ATTESTATION, 46, XChainAddAccountCreateAttestation,
+TRANSACTION(ttXCHAIN_ADD_ACCOUNT_CREATE_ATTESTATION, 46,
+    XChainAddAccountCreateAttestation,
     Delegation::delegatable,
     featureXChainBridge,
+    createAcct,
     ({
     {sfXChainBridge, soeREQUIRED},
 
@@ -476,6 +616,7 @@ TRANSACTION(ttXCHAIN_ADD_ACCOUNT_CREATE_ATTESTATION, 46, XChainAddAccountCreateA
 TRANSACTION(ttXCHAIN_MODIFY_BRIDGE, 47, XChainModifyBridge,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfSignatureReward, soeOPTIONAL},
@@ -486,6 +627,7 @@ TRANSACTION(ttXCHAIN_MODIFY_BRIDGE, 47, XChainModifyBridge,
 TRANSACTION(ttXCHAIN_CREATE_BRIDGE, 48, XChainCreateBridge,
     Delegation::delegatable,
     featureXChainBridge,
+    noPriv,
     ({
     {sfXChainBridge, soeREQUIRED},
     {sfSignatureReward, soeREQUIRED},
@@ -493,9 +635,13 @@ TRANSACTION(ttXCHAIN_CREATE_BRIDGE, 48, XChainCreateBridge,
 }))
 
 /** This transaction type creates or updates a DID */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DID.h>
+#endif
 TRANSACTION(ttDID_SET, 49, DIDSet,
     Delegation::delegatable,
     featureDID,
+    noPriv,
     ({
     {sfDIDDocument, soeOPTIONAL},
     {sfURI, soeOPTIONAL},
@@ -506,12 +652,17 @@ TRANSACTION(ttDID_SET, 49, DIDSet,
 TRANSACTION(ttDID_DELETE, 50, DIDDelete,
     Delegation::delegatable,
     featureDID,
+    noPriv,
     ({}))
 
 /** This transaction type creates an Oracle instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/SetOracle.h>
+#endif
 TRANSACTION(ttORACLE_SET, 51, OracleSet,
     Delegation::delegatable,
     featurePriceOracle,
+    noPriv,
     ({
     {sfOracleDocumentID, soeREQUIRED},
     {sfProvider, soeOPTIONAL},
@@ -522,65 +673,97 @@ TRANSACTION(ttORACLE_SET, 51, OracleSet,
 }))
 
 /** This transaction type deletes an Oracle instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DeleteOracle.h>
+#endif
 TRANSACTION(ttORACLE_DELETE, 52, OracleDelete,
     Delegation::delegatable,
     featurePriceOracle,
+    noPriv,
     ({
     {sfOracleDocumentID, soeREQUIRED},
 }))
 
 /** This transaction type fixes a problem in the ledger state */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/LedgerStateFix.h>
+#endif
 TRANSACTION(ttLEDGER_STATE_FIX, 53, LedgerStateFix,
     Delegation::delegatable,
     fixNFTokenPageLinks,
+    noPriv,
     ({
     {sfLedgerFixType, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
 }))
 
 /** This transaction type creates a MPTokensIssuance instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceCreate.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_CREATE, 54, MPTokenIssuanceCreate,
     Delegation::delegatable,
     featureMPTokensV1,
+    createMPTIssuance,
     ({
     {sfAssetScale, soeOPTIONAL},
     {sfTransferFee, soeOPTIONAL},
     {sfMaximumAmount, soeOPTIONAL},
     {sfMPTokenMetadata, soeOPTIONAL},
     {sfDomainID, soeOPTIONAL},
+    {sfMutableFlags, soeOPTIONAL},
 }))
 
 /** This transaction type destroys a MPTokensIssuance instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceDestroy.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_DESTROY, 55, MPTokenIssuanceDestroy,
     Delegation::delegatable,
     featureMPTokensV1,
+    destroyMPTIssuance,
     ({
     {sfMPTokenIssuanceID, soeREQUIRED},
 }))
 
 /** This transaction type sets flags on a MPTokensIssuance or MPToken instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenIssuanceSet.h>
+#endif
 TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 56, MPTokenIssuanceSet,
     Delegation::delegatable,
     featureMPTokensV1,
+    noPriv,
     ({
     {sfMPTokenIssuanceID, soeREQUIRED},
     {sfHolder, soeOPTIONAL},
     {sfDomainID, soeOPTIONAL},
+    {sfMPTokenMetadata, soeOPTIONAL},
+    {sfTransferFee, soeOPTIONAL},
+    {sfMutableFlags, soeOPTIONAL},
 }))
 
 /** This transaction type authorizes a MPToken instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/MPTokenAuthorize.h>
+#endif
 TRANSACTION(ttMPTOKEN_AUTHORIZE, 57, MPTokenAuthorize,
     Delegation::delegatable,
     featureMPTokensV1,
+    mustAuthorizeMPT,
     ({
     {sfMPTokenIssuanceID, soeREQUIRED},
     {sfHolder, soeOPTIONAL},
 }))
 
 /** This transaction type create an Credential instance */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Credentials.h>
+#endif
 TRANSACTION(ttCREDENTIAL_CREATE, 58, CredentialCreate,
     Delegation::delegatable,
     featureCredentials,
+    noPriv,
     ({
     {sfSubject, soeREQUIRED},
     {sfCredentialType, soeREQUIRED},
@@ -592,6 +775,7 @@ TRANSACTION(ttCREDENTIAL_CREATE, 58, CredentialCreate,
 TRANSACTION(ttCREDENTIAL_ACCEPT, 59, CredentialAccept,
     Delegation::delegatable,
     featureCredentials,
+    noPriv,
     ({
     {sfIssuer, soeREQUIRED},
     {sfCredentialType, soeREQUIRED},
@@ -601,6 +785,7 @@ TRANSACTION(ttCREDENTIAL_ACCEPT, 59, CredentialAccept,
 TRANSACTION(ttCREDENTIAL_DELETE, 60, CredentialDelete,
     Delegation::delegatable,
     featureCredentials,
+    noPriv,
     ({
     {sfSubject, soeOPTIONAL},
     {sfIssuer, soeOPTIONAL},
@@ -608,9 +793,13 @@ TRANSACTION(ttCREDENTIAL_DELETE, 60, CredentialDelete,
 }))
 
 /** This transaction type modify a NFToken */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/NFTokenModify.h>
+#endif
 TRANSACTION(ttNFTOKEN_MODIFY, 61, NFTokenModify,
     Delegation::delegatable,
     featureDynamicNFT,
+    noPriv,
     ({
     {sfNFTokenID, soeREQUIRED},
     {sfOwner, soeOPTIONAL},
@@ -618,35 +807,51 @@ TRANSACTION(ttNFTOKEN_MODIFY, 61, NFTokenModify,
 }))
 
 /** This transaction type creates or modifies a Permissioned Domain */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PermissionedDomainSet.h>
+#endif
 TRANSACTION(ttPERMISSIONED_DOMAIN_SET, 62, PermissionedDomainSet,
     Delegation::delegatable,
     featurePermissionedDomains,
+    noPriv,
     ({
     {sfDomainID, soeOPTIONAL},
     {sfAcceptedCredentials, soeREQUIRED},
 }))
 
 /** This transaction type deletes a Permissioned Domain */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/PermissionedDomainDelete.h>
+#endif
 TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 63, PermissionedDomainDelete,
     Delegation::delegatable,
     featurePermissionedDomains,
+    noPriv,
     ({
     {sfDomainID, soeREQUIRED},
 }))
 
 /** This transaction type delegates authorized account specified permissions */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/DelegateSet.h>
+#endif
 TRANSACTION(ttDELEGATE_SET, 64, DelegateSet,
     Delegation::notDelegatable,
     featurePermissionDelegation,
+    noPriv,
     ({
     {sfAuthorize, soeREQUIRED},
     {sfPermissions, soeREQUIRED},
 }))
 
 /** This transaction creates a single asset vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultCreate.h>
+#endif
 TRANSACTION(ttVAULT_CREATE, 65, VaultCreate,
     Delegation::delegatable,
     featureSingleAssetVault,
+    createPseudoAcct | createMPTIssuance,
     ({
     {sfAsset, soeREQUIRED, soeMPTSupported},
     {sfAssetsMaximum, soeOPTIONAL},
@@ -658,9 +863,13 @@ TRANSACTION(ttVAULT_CREATE, 65, VaultCreate,
 }))
 
 /** This transaction updates a single asset vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultSet.h>
+#endif
 TRANSACTION(ttVAULT_SET, 66, VaultSet,
     Delegation::delegatable,
     featureSingleAssetVault,
+    noPriv,
     ({
     {sfVaultID, soeREQUIRED},
     {sfAssetsMaximum, soeOPTIONAL},
@@ -669,26 +878,38 @@ TRANSACTION(ttVAULT_SET, 66, VaultSet,
 }))
 
 /** This transaction deletes a single asset vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultDelete.h>
+#endif
 TRANSACTION(ttVAULT_DELETE, 67, VaultDelete,
     Delegation::delegatable,
     featureSingleAssetVault,
+    mustDeleteAcct | destroyMPTIssuance,
     ({
     {sfVaultID, soeREQUIRED},
 }))
 
 /** This transaction trades assets for shares with a vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultDeposit.h>
+#endif
 TRANSACTION(ttVAULT_DEPOSIT, 68, VaultDeposit,
     Delegation::delegatable,
     featureSingleAssetVault,
+    mayAuthorizeMPT,
     ({
     {sfVaultID, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
 }))
 
 /** This transaction trades shares for assets with a vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultWithdraw.h>
+#endif
 TRANSACTION(ttVAULT_WITHDRAW, 69, VaultWithdraw,
     Delegation::delegatable,
     featureSingleAssetVault,
+    mayDeleteMPT,
     ({
     {sfVaultID, soeREQUIRED},
     {sfAmount, soeREQUIRED, soeMPTSupported},
@@ -697,9 +918,13 @@ TRANSACTION(ttVAULT_WITHDRAW, 69, VaultWithdraw,
 }))
 
 /** This transaction claws back tokens from a vault. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/VaultClawback.h>
+#endif
 TRANSACTION(ttVAULT_CLAWBACK, 70, VaultClawback,
     Delegation::delegatable,
     featureSingleAssetVault,
+    mayDeleteMPT,
     ({
     {sfVaultID, soeREQUIRED},
     {sfHolder, soeREQUIRED},
@@ -707,9 +932,13 @@ TRANSACTION(ttVAULT_CLAWBACK, 70, VaultClawback,
 }))
 
 /** This transaction type batches together transactions. */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Batch.h>
+#endif
 TRANSACTION(ttBATCH, 71, Batch,
     Delegation::notDelegatable,
     featureBatch,
+    noPriv,
     ({
     {sfRawTransactions, soeREQUIRED},
     {sfBatchSigners, soeOPTIONAL},
@@ -732,9 +961,13 @@ TRANSACTION(ttBATCH, 71, Batch,
 
     For details, see: https://xrpl.org/amendments.html
  */
+#if TRANSACTION_INCLUDE
+#   include <xrpld/app/tx/detail/Change.h>
+#endif
 TRANSACTION(ttAMENDMENT, 100, EnableAmendment,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfLedgerSequence, soeREQUIRED},
     {sfAmendment, soeREQUIRED},
@@ -746,6 +979,7 @@ TRANSACTION(ttAMENDMENT, 100, EnableAmendment,
 TRANSACTION(ttFEE, 101, SetFee,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfLedgerSequence, soeOPTIONAL},
     // Old version uses raw numbers
@@ -766,6 +1000,7 @@ TRANSACTION(ttFEE, 101, SetFee,
 TRANSACTION(ttUNL_MODIFY, 102, UNLModify,
     Delegation::notDelegatable,
     uint256{},
+    noPriv,
     ({
     {sfUNLModifyDisabling, soeREQUIRED},
     {sfLedgerSequence, soeREQUIRED},

include/xrpl/protocol/jss.h

@@ -722,11 +722,11 @@ JSS(write_load);              // out: GetCounts
 #pragma push_macro("LEDGER_ENTRY_DUPLICATE")
 #undef LEDGER_ENTRY_DUPLICATE
 
-#define LEDGER_ENTRY(tag, value, name, rpcName, fields) \
-    JSS(name);                                          \
+#define LEDGER_ENTRY(tag, value, name, rpcName, ...) \
+    JSS(name);                                       \
     JSS(rpcName);
 
-#define LEDGER_ENTRY_DUPLICATE(tag, value, name, rpcName, fields) JSS(rpcName);
+#define LEDGER_ENTRY_DUPLICATE(tag, value, name, rpcName, ...) JSS(rpcName);
 
 #include <xrpl/protocol/detail/ledger_entries.macro>
 

include/xrpl/server/detail/Door.h

@@ -30,15 +30,29 @@
 #include <boost/asio/buffer.hpp>
 #include <boost/asio/io_context.hpp>
 #include <boost/asio/ip/tcp.hpp>
+#include <boost/asio/post.hpp>
 #include <boost/asio/spawn.hpp>
+#include <boost/asio/steady_timer.hpp>
 #include <boost/beast/core/detect_ssl.hpp>
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/core/tcp_stream.hpp>
 #include <boost/container/flat_map.hpp>
+#include <boost/predef.h>
 
+#if !BOOST_OS_WINDOWS
+#include <sys/resource.h>
+
+#include <dirent.h>
+#include <unistd.h>
+#endif
+
+#include <algorithm>
 #include <chrono>
+#include <cstdint>
 #include <functional>
 #include <memory>
+#include <optional>
+#include <sstream>
 
 namespace ripple {
 
@@ -98,10 +112,27 @@ private:
     boost::asio::strand<boost::asio::io_context::executor_type> strand_;
     bool ssl_;
     bool plain_;
+    static constexpr std::chrono::milliseconds INITIAL_ACCEPT_DELAY{50};
+    static constexpr std::chrono::milliseconds MAX_ACCEPT_DELAY{2000};
+    std::chrono::milliseconds accept_delay_{INITIAL_ACCEPT_DELAY};
+    boost::asio::steady_timer backoff_timer_;
+    static constexpr double FREE_FD_THRESHOLD = 0.70;
+
+    struct FDStats
+    {
+        std::uint64_t used{0};
+        std::uint64_t limit{0};
+    };
 
     void
     reOpen();
 
+    std::optional<FDStats>
+    query_fd_stats() const;
+
+    bool
+    should_throttle_for_fds();
+
 public:
     Door(
         Handler& handler,
@@ -299,6 +330,7 @@ Door<Handler>::Door(
     , plain_(
           port_.protocol.count("http") > 0 || port_.protocol.count("ws") > 0 ||
           port_.protocol.count("ws2"))
+    , backoff_timer_(io_context)
 {
     reOpen();
 }
@@ -323,6 +355,7 @@ Door<Handler>::close()
         return boost::asio::post(
             strand_,
             std::bind(&Door<Handler>::close, this->shared_from_this()));
+    backoff_timer_.cancel();
     error_code ec;
     acceptor_.close(ec);
 }
@@ -368,6 +401,17 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
 {
     while (acceptor_.is_open())
     {
+        if (should_throttle_for_fds())
+        {
+            backoff_timer_.expires_after(accept_delay_);
+            boost::system::error_code tec;
+            backoff_timer_.async_wait(do_yield[tec]);
+            accept_delay_ = std::min(accept_delay_ * 2, MAX_ACCEPT_DELAY);
+            JLOG(j_.warn()) << "Throttling do_accept for "
+                            << accept_delay_.count() << "ms.";
+            continue;
+        }
+
         error_code ec;
         endpoint_type remote_address;
         stream_type stream(ioc_);
@@ -377,15 +421,28 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
         {
             if (ec == boost::asio::error::operation_aborted)
                 break;
-            JLOG(j_.error()) << "accept: " << ec.message();
-            if (ec == boost::asio::error::no_descriptors)
+
+            if (ec == boost::asio::error::no_descriptors ||
+                ec == boost::asio::error::no_buffer_space)
             {
-                JLOG(j_.info()) << "re-opening acceptor";
-                reOpen();
+                JLOG(j_.warn()) << "accept: Too many open files. Pausing for "
+                                << accept_delay_.count() << "ms.";
+
+                backoff_timer_.expires_after(accept_delay_);
+                boost::system::error_code tec;
+                backoff_timer_.async_wait(do_yield[tec]);
+
+                accept_delay_ = std::min(accept_delay_ * 2, MAX_ACCEPT_DELAY);
+            }
+            else
+            {
+                JLOG(j_.error()) << "accept error: " << ec.message();
             }
             continue;
         }
 
+        accept_delay_ = INITIAL_ACCEPT_DELAY;
+
         if (ssl_ && plain_)
         {
             if (auto sp = ios().template emplace<Detector>(
@@ -408,6 +465,60 @@ Door<Handler>::do_accept(boost::asio::yield_context do_yield)
     }
 }
 
+template <class Handler>
+std::optional<typename Door<Handler>::FDStats>
+Door<Handler>::query_fd_stats() const
+{
+#if BOOST_OS_WINDOWS
+    return std::nullopt;
+#else
+    FDStats s;
+    struct rlimit rl;
+    if (getrlimit(RLIMIT_NOFILE, &rl) != 0 || rl.rlim_cur == RLIM_INFINITY)
+        return std::nullopt;
+    s.limit = static_cast<std::uint64_t>(rl.rlim_cur);
+#if BOOST_OS_LINUX
+    constexpr char const* kFdDir = "/proc/self/fd";
+#else
+    constexpr char const* kFdDir = "/dev/fd";
+#endif
+    if (DIR* d = ::opendir(kFdDir))
+    {
+        std::uint64_t cnt = 0;
+        while (::readdir(d) != nullptr)
+            ++cnt;
+        ::closedir(d);
+        // readdir counts '.', '..', and the DIR* itself shows in the list
+        s.used = (cnt >= 3) ? (cnt - 3) : 0;
+        return s;
+    }
+    return std::nullopt;
+#endif
+}
+
+template <class Handler>
+bool
+Door<Handler>::should_throttle_for_fds()
+{
+#if BOOST_OS_WINDOWS
+    return false;
+#else
+    auto const stats = query_fd_stats();
+    if (!stats || stats->limit == 0)
+        return false;
+
+    auto const& s = *stats;
+    auto const free = (s.limit > s.used) ? (s.limit - s.used) : 0ull;
+    double const free_ratio =
+        static_cast<double>(free) / static_cast<double>(s.limit);
+    if (free_ratio < FREE_FD_THRESHOLD)
+    {
+        return true;
+    }
+    return false;
+#endif
+}
+
 }  // namespace ripple
 
 #endif