fix: Merge upstream branch

2026-10-21 19:18:22 +00:00 · 2026-07-28 13:40:06 -04:00 · 2026-07-28 13:30:00 -04:00 · 2026-07-28 13:01:50 -04:00 · 2026-07-27 12:41:27 -04:00 · 2026-07-27 12:21:08 -04:00
302 changed files with 34825 additions and 5798 deletions
@@ -7,6 +7,8 @@ ignorePaths:
  - cmake/**
  - LICENSE.md
  - .clang-tidy
+  - src/test/app/wasm_fixtures/**/*.wat
+  - src/test/app/wasm_fixtures/*.c
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -65,6 +67,7 @@ words:
  - Btrfs
  - Buildx
  - canonicality
+  - cdylib
  - canonicalised
  - changespq
  - checkme
@@ -130,7 +133,6 @@ words:
  - godexsoft
  - gpgcheck
  - gpgkey
-  - Hinnant
  - hotwallet
  - hwaddress
  - hwrap
@@ -164,7 +166,6 @@ words:
  - llection
  - LOCALGOOD
  - logwstream
-  - Lombrozo
  - lseq
  - lsmf
  - ltype
@@ -202,7 +203,6 @@ words:
  - nftokens
  - nftpage
  - nikb
-  - Nikolaos
  - nixfmt
  - nixos
  - nixpkgs
@@ -219,6 +219,7 @@ words:
  - Nyffenegger
  - onlatest
  - ostr
+  - oxalica
  - pargs
  - partitioner
  - paychan
@@ -265,6 +266,8 @@ words:
  - Rohrs
  - roundings
  - rustc
+  - rustfmt
+  - rustup
  - sahyadri
  - Satoshi
  - scons
@@ -293,6 +296,7 @@ words:
  - STATSDCOLLECTOR
  - stissue
  - stnum
+  - stnumber
  - stobj
  - stobject
  - stpath
@@ -308,6 +312,7 @@ words:
  - takerpays
  - ters
  - TMEndpointv2
+  - toolchain
  - tparam
  - trixie
  - tx
@@ -340,6 +345,7 @@ words:
  - unsquelch
  - unsquelched
  - unsquelching
+  - unsuffixed
  - unvalidated
  - unveto
  - unvetoed
@@ -357,6 +363,7 @@ words:
  - wthread
  - xbridge
  - xchain
+  - xfloat
  - ximinez
  - XMACRO
  - xrpkuwait
@@ -11,6 +11,9 @@ endfunction()
 function(create_symbolic_link target link)
 endfunction()

+function(xrpl_add_benchmark name)
+endfunction()
+
 macro(exclude_from_default target_)
 endmacro()

@@ -1,10 +1,10 @@
 <!--
-This PR template helps you to write a good pull request description.
+This PR template helps you write a good pull request description.
 Please feel free to include additional useful information even beyond what is requested below.

 If your branch is on a personal fork and has a name that allows it to
 run CI build/test jobs (e.g. "ci/foo"), remember to rename it BEFORE
-opening the PR.  This avoids unnecessary redundant test runs. Renaming
+opening the PR. This avoids redundant test runs. Renaming
 the branch after opening the PR will close the PR.
 https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
 -->
@@ -15,7 +15,7 @@ https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-
 Please include a summary of the changes.
 This may be a direct input to the release notes.
 If too broad, please consider splitting into multiple PRs.
-If a relevant task or issue, please link it here.
+If there is a relevant task or issue, please link it here.
 -->

 ### Context of Change
@@ -65,5 +65,5 @@ This section may not be needed if your change includes thoroughly commented unit

 <!--
 ## Future Tasks
-For future tasks related to PR.
+For future tasks related to this PR.
 -->
@@ -1,3 +1,6 @@
+benchmarks.libxrpl > xrpl.basics
+benchmarks.libxrpl > xrpl.config
+benchmarks.libxrpl > xrpl.nodestore
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
@@ -204,6 +207,7 @@ xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
 xrpl.config > xrpl.basics
 xrpl.core > xrpl.basics
+xrpl.core > xrpl.config
 xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
 xrpl.json > xrpl.basics
@@ -307,6 +311,7 @@ xrpld.rpc > xrpl.server
 xrpld.rpc > xrpl.shamap
 xrpld.rpc > xrpl.tx
 xrpld.shamap > xrpl.basics
+xrpld.shamap > xrpl.core
 xrpld.shamap > xrpld.core
 xrpld.shamap > xrpl.nodestore
 xrpld.shamap > xrpl.protocol
@@ -136,8 +136,7 @@ class MatrixEntry:
 class PackagingEntry:
    """One entry in the generated packaging strategy matrix."""

-    xrpld_artifact_name: str
-    validator_keys_artifact_name: str
+    artifact_name: str
    image: str
    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps

@@ -211,19 +210,14 @@ def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
    is taken from the distro's archive rather than from nixpkgs. Each config
    entry carries its own 'image'.
-
-    The artifact names must match what the build job uploads: one artifact per
-    binary, each named after the build config.
    """
    entries = []
    for distro, configs in linux.package_configs.items():
        for cfg in configs:
            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
-                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
                entries.append(
                    PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{config_name}",
-                        validator_keys_artifact_name=f"validator-keys-{config_name}",
+                        artifact_name=f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64",
                        image=cfg.image,
                        distro=distro,
                    )
@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-e29b523",
+  "image_tag": "sha-3122de8",
  "configs": {
    "ubuntu": [
      {
@@ -68,8 +68,7 @@
        "compiler": ["gcc"],
        "build_type": ["Release"],
        "arch": ["amd64"],
-        "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
+        "minimal": false
      }
    ],

@@ -78,8 +77,7 @@
        "compiler": ["gcc"],
        "build_type": ["Release"],
        "arch": ["amd64"],
-        "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
+        "minimal": false
      }
    ]
  },
@@ -1,4 +1,4 @@
-name: Build Nix Docker images
+name: Build `nix` Docker images

 on:
  push:
@@ -8,6 +8,7 @@ on:
      - ".github/workflows/build-nix-images.yml"
      - "flake.nix"
      - "flake.lock"
+      - "rust-toolchain.toml"
      - "nix/**"
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
@@ -18,6 +19,7 @@ on:
      - ".github/workflows/build-nix-images.yml"
      - "flake.nix"
      - "flake.lock"
+      - "rust-toolchain.toml"
      - "nix/**"
      - "!nix/docker/README.md"
      - "!nix/devshell.nix"
@@ -36,7 +38,7 @@ defaults:

 jobs:
  build-merge:
-    name: Build and push nix-${{ matrix.distro.name }}
+    name: Build and push `nix-${{ matrix.distro.name }}` image
    permissions:
      contents: read
      packages: write
@@ -54,7 +56,7 @@ jobs:
            base_image: debian:bookworm
          - name: rhel
            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
    with:
      image_name: xrpld/nix-${{ matrix.distro.name }}
      dockerfile: nix/docker/Dockerfile
@@ -1,4 +1,4 @@
-name: Build packaging Docker images
+name: Build `packaging` Docker images

 on:
  push:
@@ -26,7 +26,7 @@ defaults:

 jobs:
  build-merge:
-    name: Build and push packaging-${{ matrix.distro.name }}
+    name: Build and push `packaging-${{ matrix.distro.name }}` image
    permissions:
      contents: read
      packages: write
@@ -38,7 +38,7 @@ jobs:
            base_image: debian:bookworm
          - name: rhel
            base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
    with:
      image_name: xrpld/packaging-${{ matrix.distro.name }}
      dockerfile: package/Dockerfile
@@ -0,0 +1,38 @@
+name: Build `pre-commit` Docker image
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
+  pull_request:
+    paths:
+      - ".github/workflows/build-pre-commit-image.yml"
+      - "bin/pre-commit/Dockerfile"
+      - "rust-toolchain.toml"
+  workflow_dispatch:
+
+concurrency:
+  # Read `on-trigger.yml` for the rationale behind this concurrency group name.
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-merge:
+    name: Build and push `pre-commit` image
+    permissions:
+      contents: read
+      packages: write
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    with:
+      image_name: xrpld/pre-commit
+      dockerfile: bin/pre-commit/Dockerfile
+      base_image: ubuntu:26.04
+      push: ${{ github.event_name == 'push' }}
@@ -20,4 +20,4 @@ on:
 jobs:
  check_title:
    if: ${{ github.event.pull_request.draft != true }}
-    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@cba1f0891650baf1a9c88624dc2d72573be2eb81
+    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@d7c65e49225a38f6d8010eacf017bb5a98d7476c
@@ -14,7 +14,7 @@ on:
 jobs:
  # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
    with:
      runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
@@ -41,13 +41,13 @@ env:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

@@ -100,10 +100,9 @@ jobs:
      # header files are copied into separate directories by CMake, which will
      # otherwise result in cache misses.
      CCACHE_SLOPPINESS: include_file_ctime,include_file_mtime
-      # Determine if coverage, voidstar and validator-keys should be enabled.
+      # Determine if coverage and voidstar should be enabled.
      COVERAGE_ENABLED: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
      VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
-      VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
      SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
    steps:
      - name: Cleanup workspace (macOS and Windows)
@@ -114,7 +113,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: ${{ inputs.ccache_enabled }}

@@ -224,11 +223,13 @@ jobs:
          BUILD_TYPE: ${{ inputs.build_type }}
          CMAKE_TARGET: ${{ inputs.cmake_target }}
        run: |
+          set -o pipefail
          cmake \
              --build . \
              --config "${BUILD_TYPE}" \
              --parallel "${BUILD_NPROC}" \
-              --target "${CMAKE_TARGET}"
+              --target "${CMAKE_TARGET}" \
+              2>&1 | tee "${GITHUB_WORKSPACE}/build.log"

      - name: Show ccache statistics
        if: ${{ inputs.ccache_enabled }}
@@ -248,22 +249,6 @@ jobs:
          retention-days: 3
          if-no-files-found: error

-      - name: Run the validator-keys tests
-        if: ${{ env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        working-directory: ${{ env.BUILD_DIR }}
-        run: ./validator-keys --unittest
-
-      - name: Upload the validator-keys binary
-        if: ${{ github.event.repository.visibility == 'public' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: validator-keys-${{ inputs.config_name }}
-          path: |
-            ${{ env.BUILD_DIR }}/validator-keys
-            ${{ env.BUILD_DIR }}/validator-keys-LICENSE
-          retention-days: 3
-          if-no-files-found: error
-
      - name: Upload the test binary (Linux)
        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -281,7 +266,7 @@ jobs:
          ./xrpld --definitions | python3 -m json.tool >server_definitions.json

      - name: Upload server definitions
-        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'debian-gcc-release-amd64' }}
+        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: server-definitions
@@ -339,27 +324,46 @@ jobs:
              PRELOAD=""
          fi

-          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee unittest.log
+          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"

-      - name: Show test failure summary
-        if: ${{ failure() && !inputs.build_only }}
-        env:
-          WORKING_DIR: ${{ runner.os == 'Windows' && format('{0}\{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
+      # Smoke-run every benchmark module with a single repetition to confirm the
+      # benchmarks still build and execute. This is a correctness check, not a
+      # performance measurement, so it is skipped for instrumented builds
+      # (sanitizers/coverage/voidstar), where it would be slow and meaningless,
+      # and on Windows, where the `install` target does not build them.
+      - name: Run the benchmarks
+        if: ${{ !inputs.build_only && runner.os != 'Windows' && env.SANITIZERS_ENABLED == 'false' && env.COVERAGE_ENABLED != 'true' && env.VOIDSTAR_ENABLED != 'true' }}
+        working-directory: ${{ env.BUILD_DIR }}
        run: |
-          if [ ! -d "${WORKING_DIR}" ]; then
-              echo "Working directory '${WORKING_DIR}' does not exist."
-              exit 0
-          fi
+          rc=0
+          while IFS= read -r bench; do
+              echo "::group::${bench}"
+              "./${bench}" --benchmark_repetitions=1 || rc=1
+              echo "::endgroup::"
+          done < <(find src/benchmarks -type f -perm -u+x -name 'xrpl.bench.*')
+          exit "${rc}"

-          cd "${WORKING_DIR}"
+      - name: Show build/test failure summary
+        if: ${{ failure() }}
+        run: |
+          cd "${GITHUB_WORKSPACE}"

-          if [ ! -f unittest.log ]; then
-              echo "unittest.log not found; embedded tests may not have run."
-              exit 0
-          fi
-
-          if ! grep -E "failed" unittest.log; then
-              echo "Log present but no failure lines found in unittest.log."
+          if [ -f unittest.log ]; then
+              if ! grep -E "failed" unittest.log | grep -vE "^I[0-9]|^[0-9]+> (ERR:|FTL:)"; then
+                  echo "unittest.log present but no failure lines found."
+              fi
+          elif [ -f build.log ]; then
+              # GCC/Clang emit "error:" (covers "fatal error:"); MSVC emits
+              # "error C####:", "error LNK####:", and "fatal error LNK####:".
+              # -A6 prints the lines that follow each match (source line, caret,
+              # notes, and the "N errors generated" tally) to capture the whole
+              # diagnostic block.
+              if ! grep -E -A6 "error:|error C[0-9]{4}|error LNK[0-9]{4}|fatal error" build.log; then
+                  echo "build.log present but no compile errors found."
+              fi
+          else
+              echo "unittest.log/build.log not found; something went wrong."
+              exit 1
          fi
      - name: Debug failure (Linux)
        if: ${{ failure() && runner.os == 'Linux' && !inputs.build_only }}
@@ -383,7 +387,7 @@ jobs:
              --target coverage

      - name: Upload coverage report
-        if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
+        if: ${{ github.repository == 'XRPLF/rippled' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          disable_search: true
@@ -34,7 +34,7 @@ jobs:
    needs: [determine-files]
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3122de8"
    permissions:
      contents: read
      issues: write
@@ -43,7 +43,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

@@ -1,7 +1,7 @@
-# Build Linux packages (DEB and RPM) from pre-built binary artifacts (xrpld and
-# validator-keys). Discovers which configurations to package from linux.json
-# (configs in "package_configs") and fans out one job per distro. Only
-# linux/amd64 is supported; the runner is hardcoded in the job below.
+# Build Linux packages (DEB and RPM) from pre-built binary artifacts.
+# Discovers which configurations to package from linux.json (configs in
+# "package_configs") and fans out one job per distro. Only linux/amd64 is
+# supported; the runner is hardcoded in the job below.
 name: Package

 on:
@@ -30,7 +30,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

@@ -45,7 +45,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "${{ matrix.xrpld_artifact_name }}"
+    name: "${{ matrix.artifact_name }}"
    permissions:
      contents: read
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
@@ -56,20 +56,14 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

-      - name: Download pre-built xrpld binary
+      - name: Download pre-built binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
-          name: ${{ matrix.xrpld_artifact_name }}
+          name: ${{ matrix.artifact_name }}
          path: ${{ env.BUILD_DIR }}

-      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ matrix.validator_keys_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
-
-      - name: Make binaries executable
-        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
+      - name: Make binary executable
+        run: chmod +x "${BUILD_DIR}/xrpld"

      - name: Build package
        env:
@@ -79,7 +73,7 @@ jobs:
      - name: Upload package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg
+          name: ${{ matrix.artifact_name }}-pkg
          path: |
            ${{ env.BUILD_DIR }}/debbuild/*.deb
            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
@@ -26,7 +26,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

@@ -40,7 +40,7 @@ defaults:
 jobs:
  upload:
    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
    env:
      REMOTE_NAME: ${{ inputs.remote_name }}
      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -68,7 +68,7 @@ jobs:
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
        with:
          enable_ccache: false

@@ -81,6 +81,9 @@ DerivedData
 # Python
 __pycache__

+# Rust build artifacts.
+target/
+
 # Direnv's directory
 /.direnv

@@ -55,7 +55,7 @@ repos:
        types_or: [c++, c]

  - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
+    rev: f4d7745e17a28aad7eed2f4874ca8d1568c11c4c # frozen: v22.1.8
    hooks:
      - id: clang-format
        args: [--style=file]
@@ -68,7 +68,7 @@ repos:
      - id: gersemi

  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
+    rev: 9337a74165b178ae2c766f60bee7252a0f06f3e8 # frozen: v3.9.5
    hooks:
      - id: prettier
        args: [--end-of-line=auto]
@@ -96,6 +96,7 @@ find_package(OpenSSL REQUIRED)
 find_package(secp256k1 REQUIRED)
 find_package(SOCI REQUIRED)
 find_package(SQLite3 REQUIRED)
+find_package(wasmi REQUIRED)
 find_package(xxHash REQUIRED)

 target_link_libraries(
@@ -131,6 +132,10 @@ else()
 endif()
 target_link_libraries(xrpl_libs INTERFACE ${nudb})

+if(benchmark)
+    find_package(benchmark REQUIRED)
+endif()
+
 if(coverage)
    include(XrplCov)
 endif()
@@ -138,12 +143,14 @@ endif()
 include(XrplCore)
 include(XrplProtocolAutogen)
 include(XrplInstall)
-include(XrplValidatorKeys)
-# Must come after XrplValidatorKeys: the 'package' target depends on the
-# validator-keys target existing.
 include(XrplPackaging)
+include(XrplValidatorKeys)

 if(tests)
    include(CTest)
    add_subdirectory(src/tests/libxrpl)
 endif()
+
+if(benchmark)
+    add_subdirectory(src/benchmarks/libxrpl)
+endif()
@@ -0,0 +1,4 @@
+# By default, anyone can review changes.
+
+# The CI tooling team should review changes to the CI configuration.
+/.github/ @XRPLF/ci-tooling
@@ -83,6 +83,7 @@ If you create new source files, they must be organized as follows:
  `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
+- All benchmark source files must go under `src/benchmarks`.

 The source must be formatted according to the style guide below. The easiest
 way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
@@ -0,0 +1,55 @@
+ARG BASE_IMAGE=ubuntu:26.04
+
+FROM ${BASE_IMAGE}
+
+SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
+ENTRYPOINT ["/bin/bash"]
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN <<EOF
+pkgs=()
+pkgs+=(curl)         # Required to install nix.
+pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
+pkgs+=(git)          # Required for prepare-runner.
+pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
+pkgs+=(python3)      # Python 3 interpreter.
+pkgs+=(python3-pip)  # Package manager for Python applications.
+pkgs+=(xz-utils)     # Required to install nix
+
+apt-get update
+apt-get install -y --no-install-recommends "${pkgs[@]}"
+apt-get clean
+rm -rf /var/lib/apt/lists/*
+EOF
+
+ARG PRE_COMMIT_VERSION=4.6.0
+RUN pip install --no-cache --break-system-packages \
+    pre-commit==${PRE_COMMIT_VERSION}
+
+RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes
+
+# Add nix to PATH and set NIX environment variables,
+# so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+ENV NIX_PROFILES="/nix/var/nix/profiles/default"
+ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
+
+# Verify nix installation
+RUN nix --version
+
+ENV RUSTUP_HOME="/opt/rust/rustup"
+ENV CARGO_HOME="/opt/rust/cargo"
+ENV PATH="/opt/rust/cargo/bin:${PATH}"
+
+WORKDIR /tmp
+COPY rust-toolchain.toml /tmp/rust-toolchain.toml
+RUN <<EOF
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+    | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
+rustup toolchain install
+rustup show
+cargo fmt --version
+EOF
+
+WORKDIR /
@@ -91,14 +91,19 @@ def main():
    if not os.environ.get("TIDY"):
        return 0

-    repo_root = Path(
-        subprocess.check_output(
-            ["git", "rev-parse", "--show-toplevel"],
-            cwd=Path(__file__).parent,
-            text=True,
-        ).strip()
+    # Derive the repo root from git so this keeps working regardless of where
+    # under the tree this script lives. Fall back to the script location
+    # (bin/pre-commit/ is two levels below the repo root) if git is unavailable.
+    result = subprocess.run(
+        ["git", "rev-parse", "--show-toplevel"],
+        capture_output=True,
+        text=True,
+        cwd=Path(__file__).parent,
    )
-
+    if result.returncode == 0:
+        repo_root = Path(result.stdout.strip())
+    else:
+        repo_root = Path(__file__).parent.parent.parent
    files = staged_files(repo_root)
    if not files:
        return 0
@@ -488,17 +488,6 @@
 #   Must be a number between 100 and 1000, defaults to 250
 #
 #
-# [max_subscriptions_per_connection]
-#
-#   Maximum number of account, real-time account, and account-history
-#   subscriptions a single client connection may hold at once. Bounds the
-#   per-connection state torn down when the connection disconnects. Book
-#   subscriptions are tracked separately and are not counted here.
-#
-#   Defaults to 100000 if not set; large enough for legitimate power users
-#   such as block explorers.
-#
-#
 # [overlay]
 #
 #   Controls settings related to the peer to peer overlay.
@@ -549,45 +538,6 @@
 #       only be used for local testing and debugging. Do not disable
 #       on mainnet.
 #
-#   max_untrusted_count = <number>
-#
-#       The number of manifests the server keeps for validators it does not
-#       list, and the number it sends and processes in a single peer protocol
-#       message. Once the server holds this many, a manifest for a new
-#       unlisted validator is rejected, so peer gossip cannot grow the cache
-#       without end.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#   max_trusted_count = <number>
-#
-#       The number of manifests for listed validators to allow for when
-#       sizing peer protocol messages. Manifests for listed validators are
-#       never dropped, whether sending or receiving, because doing so would
-#       delay a validator key change reaching this server. Set this above the
-#       number of validators the server lists.
-#
-#       Together the two counts above set the largest manifest message the
-#       server accepts: bigger messages are discarded without reading them,
-#       and without penalising the sender. Raising either means the server
-#       accepts and sends bigger messages than a peer using the defaults, and
-#       those peers will discard what this server sends. Lowering either below
-#       what peers send makes this server discard their manifest messages,
-#       which it does without recording anything.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#       NOTE: These two options (max_untrusted_count and max_trusted_count)
-#       are transitional. They exist to bound manifest-message size and cache
-#       growth during the network upgrade. They may be removed in a future
-#       release once the fleet has upgraded, and should not be relied upon as
-#       stable configuration.
 #
 # [transaction_queue] EXPERIMENTAL
 #
@@ -1348,6 +1298,39 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
+#   gas_limit = <gas>
+#
+#       The gas limit is the maximum amount of gas that can be
+#       consumed by a single transaction. The gas limit is used to prevent
+#       transactions from consuming too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_limit = 1000000      # 1 million gas
+#
+#   bytecode_size_limit = <bytes>
+#
+#       The bytecode size limit is the maximum size of a WASM extension in
+#       bytes. The size limit is used to prevent extensions from consuming
+#       too many resources.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           bytecode_size_limit = 100000      # 100 kb
+#
+#   gas_price = <micro-drops>
+#
+#       The gas price is the conversion between WASM gas and its price in drops.
+#
+#       If this parameter is unspecified, xrpld will use an internal
+#       default. Don't change this without understanding the consequences.
+#
+#       Example:
+#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings
@@ -3,9 +3,9 @@

   The Nix-based CI image links binaries against an ELF interpreter (loader)
   that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` resets
-   the interpreter to the system default loader and drops the rpath, once the
-   binary has been linked.
+   (including once installed from the .deb package). `patch_nix_binary` adds a
+   POST_BUILD step that resets the interpreter to the system default loader and
+   drops the rpath.

   This is only active inside the Nix-based image, detected by the presence of
   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
@@ -41,38 +41,13 @@ function(patch_nix_binary target)
    if(NOT PATCH_NIX_BINARIES)
        return()
    endif()
-
-    set(patch_command
-        "${PATCHELF_COMMAND}"
-        --set-interpreter
-        "${DEFAULT_LOADER_PATH}"
-        --remove-rpath
-        "$<TARGET_FILE:${target}>"
+    add_custom_command(
+        TARGET ${target}
+        POST_BUILD
+        COMMAND
+            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
+            --remove-rpath "$<TARGET_FILE:${target}>"
+        COMMENT "Patching ${target}: set default loader, remove rpath"
+        VERBATIM
    )
-    set(comment "Patching ${target}: set default loader, remove rpath")
-
-    # POST_BUILD is the cheap way to do this: it runs only when the binary is
-    # relinked. It is also only available in the directory that defined the
-    # target, so for a target from elsewhere (e.g. a FetchContent subproject)
-    # fall back to a custom target that runs after the binary is linked. That
-    # one runs on every build, which is harmless because patchelf is idempotent.
-    get_target_property(target_source_dir ${target} SOURCE_DIR)
-    if("${target_source_dir}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
-        add_custom_command(
-            TARGET ${target}
-            POST_BUILD
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-    else()
-        add_custom_target(
-            ${target}-patch-nix
-            ALL
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-        add_dependencies(${target}-patch-nix ${target})
-    endif()
 endfunction()
@@ -0,0 +1,36 @@
+include(isolate_headers)
+
+# Define a benchmark executable for the module `name`.
+#
+# This follows the same general pattern as other build helpers in this repo
+# (e.g. `add_module`): create a target and isolate headers, but here the target
+# is a benchmark executable and no `add_test(...)` is registered.
+#
+# `isolate_headers` exposes only `${CMAKE_CURRENT_SOURCE_DIR}/${name}` on the
+# include path, rooted at `src`, so a benchmark's own headers are reached as
+# `<benchmarks/.../${name}/...>` and nothing else in the tree leaks in.
+function(xrpl_add_benchmark name)
+    set(target ${PROJECT_NAME}.bench.${name})
+
+    file(
+        GLOB_RECURSE sources
+        CONFIGURE_DEPENDS
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}/*.cpp"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}.cpp"
+    )
+    add_executable(${target} ${ARGN} ${sources})
+
+    # Benchmark sources register cases through Google Benchmark's static
+    # registrars (anonymous-namespace lambdas). Merging several such files into
+    # one unity translation unit collides those internal-linkage entities, so
+    # keep benchmarks out of the unity build - mirroring xrpl.libpb in
+    # XrplCore.cmake. Each file compiles fine on its own.
+    set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
+
+    isolate_headers(
+        ${target}
+        "${CMAKE_SOURCE_DIR}/src"
+        "${CMAKE_CURRENT_SOURCE_DIR}/${name}"
+        PRIVATE
+    )
+endfunction()
@@ -67,6 +67,7 @@ target_link_libraries(
        Xrpl::opts
        Xrpl::syslibs
        secp256k1::secp256k1
+        wasmi::wasmi
        xrpl.libpb
        xxHash::xxhash
        $<$<BOOL:${voidstar}>:antithesis-sdk-cpp>
@@ -25,19 +25,6 @@ if(NOT (RPMBUILD_EXECUTABLE OR DPKG_BUILDPACKAGE_EXECUTABLE))
    return()
 endif()

-if(NOT TARGET xrpld)
-    message(STATUS "xrpld=ON is required; 'package' target not available")
-    return()
-endif()
-
-if(NOT TARGET validator-keys)
-    message(
-        STATUS
-        "validator_keys=ON is required; 'package' target not available"
-    )
-    return()
-endif()
-
 set(package_env
    SRC_DIR=${CMAKE_SOURCE_DIR}
    BUILD_DIR=${CMAKE_BINARY_DIR}
@@ -50,7 +37,7 @@ add_custom_target(
        ${CMAKE_COMMAND} -E env ${package_env}
        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-    DEPENDS xrpld validator-keys
+    DEPENDS xrpld
    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
    VERBATIM
 )
@@ -30,6 +30,8 @@ if(tests)
    endif()
 endif()

+option(benchmark "Build benchmarks" ON)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are
@@ -5,39 +5,22 @@ option(
 )

 if(validator_keys)
-    # Own the install destination below rather than relying on another module
-    # having pulled this in first.
-    include(GNUInstallDirs)
-
-    # Pinned to an exact commit, not a branch: the tool ships inside our
-    # packages, so the same xrpld version must always package the same
-    # validator-keys. Bump this deliberately.
-    set(validator_keys_commit "4c0fb75eec9601c711645998c904507e87e910ae")
-    message(STATUS "Using ValidatorKeys commit: ${validator_keys_commit}")
+    git_branch(current_branch)
+    # default to tracking VK master branch unless we are on release
+    if(NOT (current_branch STREQUAL "release"))
+        set(current_branch "master")
+    endif()
+    message(STATUS "Tracking ValidatorKeys branch: ${current_branch}")

    FetchContent_Declare(
        validator_keys
        GIT_REPOSITORY https://github.com/ripple/validator-keys-tool.git
-        GIT_TAG "${validator_keys_commit}"
+        GIT_TAG "${current_branch}"
    )
    FetchContent_MakeAvailable(validator_keys)
-    # The tool's own CMakeLists excludes the target from 'all' when it is built
-    # as a subproject. Undo that, so validator_keys=ON really does build it.
    set_target_properties(
        validator-keys
-        PROPERTIES
-            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-            EXCLUDE_FROM_ALL OFF
-            EXCLUDE_FROM_DEFAULT_BUILD OFF
-    )
-    # We ship this binary, so like xrpld it must not keep the Nix store's ELF
-    # loader, or it cannot run on the target distro at all.
-    patch_nix_binary(validator-keys)
-
-    configure_file(
-        "${validator_keys_SOURCE_DIR}/LICENSE"
-        "${CMAKE_BINARY_DIR}/validator-keys-LICENSE"
-        COPYONLY
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
    )
    install(TARGETS validator-keys RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()
@@ -3,6 +3,7 @@
    "requires": [
        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
+        "wasmi/1.0.9#1fecdab9b90c96698eb35ea99ca4f5cb%1782307153.343419",
        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -12,7 +13,7 @@
        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/1.0.2#b313cef0c1a493eb970ad185b2e9bab7%1784285108.866483",
+        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
@@ -25,6 +26,7 @@
        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
+        "benchmark/1.9.5#b885dc73ad67b40a55d45684d1c88ad1%1782736613.864841",
        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
    ],
    "build_requires": [
@@ -20,6 +20,22 @@ compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}

 [conf]
+{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
+{# Instead it hand-rolls the compiler for user-config.jam, #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and picks the system compiler, which is mismatched with the Nix libraries #}
+{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
+{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
+{# resolve the same compiler. #}
+{# Not part of the package ID, so binaries stay shareable. #}
+{% if os != "Windows" %}
+{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
+{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
+tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
+{% endif %}
+
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
@@ -15,6 +15,7 @@ class Xrpl(ConanFile):
    settings = "os", "compiler", "build_type", "arch"
    options = {
        "assertions": [True, False],
+        "benchmark": [True, False],
        "coverage": [True, False],
        "fPIC": [True, False],
        "jemalloc": [True, False],
@@ -33,6 +34,7 @@ class Xrpl(ConanFile):
        "nudb/2.0.9",
        "openssl/3.6.3",
        "soci/4.0.3",
+        "wasmi/1.0.9",
        "zlib/1.3.2",
    ]

@@ -46,6 +48,7 @@ class Xrpl(ConanFile):

    default_options = {
        "assertions": False,
+        "benchmark": True,
        "coverage": False,
        "fPIC": True,
        "jemalloc": False,
@@ -129,12 +132,14 @@ class Xrpl(ConanFile):
            self.options["boost"].without_cobalt = True

    def requirements(self):
+        if self.options.benchmark:
+            self.requires("benchmark/1.9.5")
        self.requires("boost/1.91.0", force=True, transitive_headers=True)
        self.requires("date/3.0.4", transitive_headers=True)
        if self.options.jemalloc:
            self.requires("jemalloc/5.3.1")
        self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/1.0.2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
        self.requires("protobuf/6.33.5", force=True)
        if self.options.rocksdb:
            self.requires("rocksdb/10.5.1")
@@ -162,6 +167,7 @@ class Xrpl(ConanFile):
    def generate(self):
        tc = CMakeToolchain(self)
        tc.variables["tests"] = self.options.tests
+        tc.variables["benchmark"] = self.options.benchmark
        tc.variables["assert"] = self.options.assertions
        tc.variables["coverage"] = self.options.coverage
        tc.variables["jemalloc"] = self.options.jemalloc
@@ -216,6 +222,7 @@ class Xrpl(ConanFile):
            "soci::soci",
            "secp256k1::secp256k1",
            "sqlite3::sqlite",
+            "wasmi::wasmi",
            "xxhash::xxhash",
            "zlib::zlib",
        ]
@@ -36,7 +36,28 @@
    "root": {
      "inputs": {
        "nixpkgs": "nixpkgs",
-        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc"
+        "nixpkgs-custom-glibc": "nixpkgs-custom-glibc",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784611586,
+        "narHash": "sha256-OfqgY+0hp/zseZB7uyH0U8kIDPS4scZZCyAurEplvG0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "14f58845249f3552a89b07772626b8d3c632fa86",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
      }
    }
  },
@@ -10,12 +10,25 @@
      url = "github:NixOS/nixpkgs/9cd98386a38891d1074fc18036b842dc4416f562";
      flake = false;
    };
+    # Pinned Rust toolchains, delivered from the Nix store. Lets the Nix CI
+    # image and dev shell honour the single `rust-toolchain.toml` pin (shared
+    # with the rustup-based non-Nix runners) while staying hermetic — the
+    # toolchain lands in the image's Nix closure and is locked by flake.lock.
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs =
-    { nixpkgs, nixpkgs-custom-glibc, ... }:
+    {
+      nixpkgs,
+      nixpkgs-custom-glibc,
+      rust-overlay,
+      ...
+    }:
    let
-      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc; };
+      forEachSystem = import ./nix/utils.nix { inherit nixpkgs nixpkgs-custom-glibc rust-overlay; };
    in
    {
      devShells = forEachSystem (import ./nix/devshell.nix);
@@ -549,8 +549,21 @@ public:
    setround(RoundingMode inMode);

    /**
-     * Returns which mantissa scale is currently in use for normalization.
+     * Convert an integer to a RoundingMode, validating that it is in range.
     *
+     * Returns std::nullopt if the value does not correspond to a valid
+     * RoundingMode.
+     */
+    static std::optional<RoundingMode>
+    checkedRoundingMode(int mode) noexcept
+    {
+        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
+            mode > static_cast<int>(RoundingMode::Upward))
+            return std::nullopt;
+        return static_cast<RoundingMode>(mode);
+    }
+
+    /**
     * If you think you need to call this outside of unit tests, no you don't.
     */
    static MantissaRange::MantissaScale
@@ -41,35 +41,6 @@

 namespace xrpl {

-namespace base64 {
-
-/**
- * Returns the maximum number of characters needed to base64-encode @p nBytes bytes.
- *
- * @param nBytes Number of input bytes.
- * @return Size of the encoded string, including padding.
- */
-constexpr std::size_t
-encodedSize(std::size_t const nBytes)
-{
-    return 4 * ((nBytes + 2) / 3);
-}
-
-/**
- * Returns the maximum number of bytes a base64 string of @p numChars characters
- * decodes to.
- *
- * @param numChars Number of base64 characters.
- * @return Upper bound on the number of decoded bytes.
- */
-constexpr std::size_t
-decodedSize(std::size_t const numChars)
-{
-    return ((numChars / 4) * 3) + 2;
-}
-
-}  // namespace base64
-
 std::string
 base64Encode(std::uint8_t const* data, std::size_t len);

@@ -25,7 +25,6 @@ struct Sections
    static constexpr auto kLedgerHistory = "ledger_history";
    static constexpr auto kLedgerReplay = "ledger_replay";
    static constexpr auto kLedgerTxTables = "ledger_tx_tables";
-    static constexpr auto kMaxSubscriptionsPerConnection = "max_subscriptions_per_connection";
    static constexpr auto kMaxTransactions = "max_transactions";
    static constexpr auto kNetworkId = "network_id";
    static constexpr auto kNetworkQuorum = "network_quorum";
@@ -94,6 +93,7 @@ struct Keys
    static constexpr auto kBbtOptions = "bbt_options";
    static constexpr auto kBgThreads = "bg_threads";
    static constexpr auto kBlockSize = "block_size";
+    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
    static constexpr auto kCacheAge = "cache_age";
    static constexpr auto kCacheMb = "cache_mb";
    static constexpr auto kCacheSize = "cache_size";
@@ -108,6 +108,8 @@ struct Keys
    static constexpr auto kFileSizeMult = "file_size_mult";
    static constexpr auto kFilterBits = "filter_bits";
    static constexpr auto kFilterFull = "filter_full";
+    static constexpr auto kGasLimit = "gas_limit";
+    static constexpr auto kGasPrice = "gas_price";
    static constexpr auto kHardSet = "hard_set";
    static constexpr auto kHighThreads = "high_threads";
    static constexpr auto kHoldTime = "hold_time";
@@ -119,9 +121,7 @@ struct Keys
    static constexpr auto kLogInterval = "log_interval";
    static constexpr auto kMaxDivergedTime = "max_diverged_time";
    static constexpr auto kMaxLedgerCountsToStore = "max_ledger_counts_to_store";
-    static constexpr auto kMaxTrustedCount = "max_trusted_count";
    static constexpr auto kMaxUnknownTime = "max_unknown_time";
-    static constexpr auto kMaxUntrustedCount = "max_untrusted_count";
    static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
    static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
    static constexpr auto kMemoryLevel = "memory_level";
@@ -6,6 +6,7 @@
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/Fees.h>

 #include <boost/asio.hpp>

@@ -246,6 +247,9 @@ public:
    virtual DatabaseCon&
    getWalletDB() = 0;

+    [[nodiscard]] virtual Fees
+    getFees() const = 0;
+
    // Temporary: Get the underlying Application for functions that haven't
    // been migrated yet. This should be removed once all code is migrated.
    virtual Application&
@@ -13,6 +13,7 @@
 #include <xrpl/protocol/TxMeta.h>

 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <optional>

@@ -68,6 +69,18 @@ public:
        deliver_ = amount;
    }

+    void
+    setGasUsed(std::optional<std::uint32_t> const gasUsed)
+    {
+        gasUsed_ = gasUsed;
+    }
+
+    void
+    setVMReturnCode(std::int32_t const vmReturnCode)
+    {
+        vmReturnCode_ = vmReturnCode;
+    }
+
    /**
     * Get the number of modified entries
     */
@@ -88,6 +101,8 @@ public:

 private:
    std::optional<STAmount> deliver_;
+    std::optional<std::uint32_t> gasUsed_;
+    std::optional<std::int32_t> vmReturnCode_;
 };

 }  // namespace xrpl
@@ -16,6 +16,7 @@
 #include <xrpl/protocol/XRPAmount.h>

 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <map>
 #include <optional>
@@ -62,6 +63,8 @@ public:
        TER ter,
        std::optional<STAmount> const& deliver,
        std::optional<uint256 const> const& parentBatchId,
+        std::optional<std::uint32_t> const& gasUsed,
+        std::optional<std::int32_t> const& vmReturnCode,
        bool isDryRun,
        beast::Journal j);

@@ -23,6 +23,8 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>

+#include <cstdint>
+
 namespace xrpl {

 template <ValidIssueType T>
@@ -255,4 +257,15 @@ escrowUnlockApplyHelper<MPTIssue>(
        journal);
 }

+template <class T>
+static int32_t
+calculateAdditionalReserve(T const& finishFunction)
+{
+    if (!finishFunction)
+        return 1;
+    // First 500 bytes included in the normal reserve
+    // Each additional 500 bytes requires an additional reserve
+    return 1 + (finishFunction->size() / 500);
+}
+
 }  // namespace xrpl
@@ -263,10 +263,11 @@ constructLoanState(
    Number const& principalOutstanding,
    Number const& managementFeeOutstanding);

-// Constructs a valid LoanState object from a Loan object, which always has
-// rounded values
+// Overload of constructLoanState() that reads the three tracked fields
+// directly from a Loan ledger object, which always holds rounded values,
+// rather than taking them as separate Number arguments.
 LoanState
-constructRoundedLoanState(SLE::const_ref loan);
+constructLoanState(SLE::const_ref loan);

 Number
 computeManagementFee(
@@ -293,15 +293,14 @@ message TMLedgerData {
 }

 message TMPing {
-  // Previously used - don't reuse.
-  reserved 3, 4;
-
  enum pingType {
    ptPING = 0;  // we want a reply
    ptPONG = 1;  // this is a reply
  }
  required pingType type = 1;
-  optional uint32 seq = 2;  // detect stale replies, ensure other side is reading
+  optional uint32 seq = 2;       // detect stale replies, ensure other side is reading
+  optional uint64 pingTime = 3;  // know when we think we sent the ping
+  optional uint64 netTime = 4;
 }

 message TMSquelch {
@@ -10,6 +10,15 @@ namespace xrpl {
 // This was the reference fee units used in the old fee calculation.
 inline constexpr std::uint32_t kFeeUnitsDeprecated = 10;

+// Number of micro-drops in one drop.
+constexpr std::uint32_t microDropsPerDrop{1'000'000};
+
+/**
+ * Maximum Feature Extension fee settings.
+ */
+inline constexpr std::uint32_t kMaxGasLimit{2'000'000};
+inline constexpr std::uint32_t kMaxBytecodeSizeLimit{200'000};
+
 /**
 * Reflects the fee settings for a particular ledger.
 *
@@ -33,6 +42,21 @@ struct Fees
     */
    XRPAmount increment{0};

+    /**
+     * @brief Gas limit for Feature Extensions (instructions).
+     */
+    std::uint32_t gasLimit{0};
+
+    /**
+     * @brief Bytecode size limit for Feature Extensions (bytes).
+     */
+    std::uint32_t bytecodeSizeLimit{0};
+
+    /**
+     * @brief Price of WASM gas (micro-drops).
+     */
+    std::uint32_t gasPrice{0};
+
    explicit Fees() = default;
    Fees(Fees const&) = default;
    Fees&
@@ -241,6 +241,12 @@ page(Keylet const& root, std::uint64_t index = 0) noexcept
 Keylet
 escrow(AccountID const& src, std::uint32_t seq) noexcept;

+inline Keylet
+escrow(uint256 const& key) noexcept
+{
+    return {ltESCROW, key};
+}
+
 /**
 * A PaymentChannel
 */
@@ -190,6 +190,17 @@ enum LedgerEntryType : std::uint16_t {
        LSF_FLAG(lsfMPTCanClawback, 0x00000040)                                                                                    \
        LSF_FLAG(lsfMPTCanHoldConfidentialBalance, 0x00000080))                                                                         \
                                                                                                                                   \
+    LEDGER_OBJECT(MPTokenIssuanceMutable,                                                                                          \
+        LSF_FLAG(lsmfMPTCanEnableCanLock, 0x00000002)                                                                              \
+        LSF_FLAG(lsmfMPTCanEnableRequireAuth, 0x00000004)                                                                          \
+        LSF_FLAG(lsmfMPTCanEnableCanEscrow, 0x00000008)                                                                            \
+        LSF_FLAG(lsmfMPTCanEnableCanTrade, 0x00000010)                                                                             \
+        LSF_FLAG(lsmfMPTCanEnableCanTransfer, 0x00000020)                                                                          \
+        LSF_FLAG(lsmfMPTCanEnableCanClawback, 0x00000040)                                                                          \
+        LSF_FLAG(lsmfMPTCannotEnableCanHoldConfidentialBalance, 0x00000080)                                                                          \
+        LSF_FLAG(lsmfMPTCanMutateMetadata, 0x00010000)                                                                             \
+        LSF_FLAG(lsmfMPTCanMutateTransferFee, 0x00020000))                                                            \
+                                                                                                                                   \
    LEDGER_OBJECT(MPToken,                                                                                                         \
        LSF_FLAG2(lsfMPTLocked, 0x00000001)                                                                                        \
        LSF_FLAG(lsfMPTAuthorized, 0x00000002)                                                                                     \
@@ -283,17 +294,6 @@ getAllLedgerFlags()
 #pragma pop_macro("TO_MAP")
 #pragma pop_macro("ALL_LEDGER_FLAGS")

-// MPTokenIssuance ImmutableFlags (sfImmutableFlags)
-inline constexpr std::uint32_t lsifMPTCanLock = 0x00000002;
-inline constexpr std::uint32_t lsifMPTRequireAuth = 0x00000004;
-inline constexpr std::uint32_t lsifMPTCanEscrow = 0x00000008;
-inline constexpr std::uint32_t lsifMPTCanTrade = 0x00000010;
-inline constexpr std::uint32_t lsifMPTCanTransfer = 0x00000020;
-inline constexpr std::uint32_t lsifMPTCanClawback = 0x00000040;
-inline constexpr std::uint32_t lsifMPTCanHoldConfidentialBalance = 0x00000080;
-inline constexpr std::uint32_t lsifMPTMetadata = 0x00010000;
-inline constexpr std::uint32_t lsifMPTTransferFee = 0x00020000;
-
 //------------------------------------------------------------------------------

 /**
@@ -322,6 +322,16 @@ constexpr std::uint8_t kVaultMaximumIouScale = 18;
 */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;

+/**
+ * Maximum length of a Data field in Escrow object that can be updated by WASM code.
+ */
+constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB
+
+/**
+ * Maximum amount of data transfer across hostfunction<->wasm border.
+ */
+constexpr std::size_t kWasmTransferLimit = 1 << 20;  // 1MB
+
 /**
 * A ledger index.
 */
@@ -90,11 +90,7 @@ public:
    operator=(STObject&& other);

    STObject(SOTemplate const& type, SField const& name);
-    STObject(
-        SOTemplate const& type,
-        SerialIter& sit,
-        SField const& name,
-        bool requireCanonicalOrder = false);
+    STObject(SOTemplate const& type, SerialIter& sit, SField const& name);
    STObject(SerialIter& sit, SField const& name, int depth = 0);
    STObject(SerialIter&& sit, SField const& name);
    explicit STObject(SField const& name);
@@ -127,7 +123,7 @@ public:
    set(SOTemplate const&);

    bool
-    set(SerialIter& u, int depth = 0, bool requireCanonicalOrder = false);
+    set(SerialIter& u, int depth = 0);

    [[nodiscard]] SerializedTypeID
    getSType() const override;
@@ -1,7 +1,6 @@
 #pragma once

 #include <xrpl/basics/CountedObject.h>
-#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
@@ -109,9 +108,6 @@ public:
    [[nodiscard]] bool
    isType(Type const& pe) const;

-    [[nodiscard]] size_t
-    getHash() const;
-
    bool
    operator==(STPathElement const& t) const;

@@ -175,23 +171,12 @@ public:
    reserve(size_t s);
 };

-template <class Hasher>
-void
-hash_append(Hasher& h, STPath const& p) noexcept
-{
-    for (auto const& e : p)
-    {
-        beast::hash_append(h, e.getHash());
-    }
-}
-
 //------------------------------------------------------------------------------

 // A set of zero or more payment paths
 class STPathSet final : public STBase, public CountedObject<STPathSet>
 {
    std::vector<STPath> value_;
-    xrpl::hardened_hash_set<STPath> seenHashes_;

 public:
    STPathSet() = default;
@@ -220,6 +205,9 @@ public:
    std::vector<STPath>::const_reference
    operator[](std::vector<STPath>::size_type n) const;

+    std::vector<STPath>::reference
+    operator[](std::vector<STPath>::size_type n);
+
    [[nodiscard]] std::vector<STPath>::const_iterator
    begin() const;

@@ -239,9 +227,6 @@ public:
    void
    emplaceBack(Args&&... args);

-    [[nodiscard]] bool
-    contains(STPath const& path) const;
-
 private:
    STBase*
    copy(std::size_t n, void* buf) const override;
@@ -530,6 +515,12 @@ STPathSet::operator[](std::vector<STPath>::size_type n) const
    return value_[n];
 }

+inline std::vector<STPath>::reference
+STPathSet::operator[](std::vector<STPath>::size_type n)
+{
+    return value_[n];
+}
+
 inline std::vector<STPath>::const_iterator
 STPathSet::begin() const
 {
@@ -558,7 +549,6 @@ inline void
 STPathSet::pushBack(STPath const& e)
 {
    value_.push_back(e);
-    seenHashes_.emplace(value_.back());
 }

 template <typename... Args>
@@ -566,13 +556,6 @@ inline void
 STPathSet::emplaceBack(Args&&... args)
 {
    value_.emplace_back(std::forward<Args>(args)...);
-    seenHashes_.emplace(value_.back());
-}
-
-inline bool
-STPathSet::contains(STPath const& path) const
-{
-    return seenHashes_.contains(path);
 }

 }  // namespace xrpl
@@ -54,22 +54,6 @@ class STValidation final : public STObject, public CountedObject<STValidation>
    NetClock::time_point seenTime_;

 public:
-    /**
-     * @struct DeserializeOptions
-     * @brief Options controlling deserialization of a STValidation.
-
-     * @var DeserializeOptions::checkSignature
-     * Whether to verify the data was signed properly
-     *
-     * @var DeserializeOptions::requireCanonicalOrder
-     * Whether to require the fields to be in canonical order
-     */
-    struct DeserializeOptions
-    {
-        bool checkSignature;
-        bool requireCanonicalOrder;
-    };
-
    /**
     * Construct a STValidation from a peer from serialized data.
     *
@@ -80,12 +64,12 @@ public:
     *                     that signed the validation. For manifest based
     *                     validators, this should be the NodeID of the master
     *                     public key.
-     * @param options Options controlling deserialization
+     * @param checkSignature Whether to verify the data was signed properly
     *
     * @note Throws if the object is not valid
     */
    template <class LookupNodeID>
-    STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, DeserializeOptions options);
+    STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, bool checkSignature);

    /**
     * Construct, sign and trust a new STValidation issued by this node.
@@ -179,8 +163,8 @@ private:
 };

 template <class LookupNodeID>
-STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, DeserializeOptions options)
-    : STObject(validationFormat(), sit, sfValidation, options.requireCanonicalOrder)
+STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, bool checkSignature)
+    : STObject(validationFormat(), sit, sfValidation)
    , signingPubKey_([this]() {
        auto const spk = getFieldVL(sfSigningPubKey);

@@ -191,7 +175,7 @@ STValidation::STValidation(SerialIter& sit, LookupNodeID&& lookupNodeID, Deseria
    }())
    , nodeID_(lookupNodeID(signingPubKey_))
 {
-    if (options.checkSignature && !isValid())
+    if (checkSignature && !isValid())
    {
        JLOG(debugLog().error()) << "Invalid signature in validation: "
                                 << getJson(JsonOptions::Values::None);
@@ -129,8 +129,12 @@ enum TEMcodes : TERUnderlyingType {
    temARRAY_TOO_LARGE,
    temBAD_TRANSFER_FEE,
    temINVALID_INNER_BATCH,
+
    temBAD_MPT,
    temBAD_CIPHERTEXT,
+    temBAD_WASM,
+    temINVALID_BYTECODE,
+    temTEMP_DISABLED,
 };

 //------------------------------------------------------------------------------
@@ -179,6 +183,8 @@ enum TEFcodes : TERUnderlyingType {
    tefINVALID_LEDGER_FIX_TYPE,
    tefNO_DST_PARTIAL,
    tefBAD_PATH_COUNT,
+    tefNO_BYTECODE,
+    tefBYTECODE_NOT_INCLUDED,
 };

 //------------------------------------------------------------------------------
@@ -370,6 +376,8 @@ enum TECcodes : TERUnderlyingType {
    tecNO_DELEGATE_PERMISSION = 198,
    tecBAD_PROOF = 199,
    tecNO_SPONSOR_PERMISSION = 200,
+    tecOUT_OF_GAS = 201,
+    tecBYTECODE_REJECTED = 202,
 };

 //------------------------------------------------------------------------------
@@ -152,14 +152,7 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
                                                                                                                                                               \
    TRANSACTION(MPTokenIssuanceSet,                                                                                                                            \
        TF_FLAG(tfMPTLock, 0x00000001)                                                                                                                         \
-        TF_FLAG(tfMPTUnlock, 0x00000002)                                                                                                                       \
-        TF_FLAG(tfMPTSetCanLock, 0x00000004)                                                                                                                   \
-        TF_FLAG(tfMPTSetRequireAuth, 0x00000008)                                                                                                               \
-        TF_FLAG(tfMPTSetCanEscrow, 0x00000010)                                                                                                                 \
-        TF_FLAG(tfMPTSetCanTrade, 0x00000020)                                                                                                                  \
-        TF_FLAG(tfMPTSetCanTransfer, 0x00000040)                                                                                                               \
-        TF_FLAG(tfMPTSetCanClawback, 0x00000080)                                                                                                               \
-        TF_FLAG(tfMPTSetCanHoldConfidentialBalance, 0x00000100),                                                                                               \
+        TF_FLAG(tfMPTUnlock, 0x00000002),                                                                                                                      \
        MASK_ADJ(0))                                                                                                                                           \
                                                                                                                                                               \
    TRANSACTION(NFTokenCreateOffer,                                                                                                                            \
@@ -363,26 +356,38 @@ inline constexpr FlagValue tfMPTPaymentMask = ~(tfUniversal | tfPartialPayment);
 inline constexpr FlagValue tfTrustSetPermissionMask =
    ~(tfUniversal | tfSetfAuth | tfSetFreeze | tfClearFreeze);

-// MPTokenIssuanceCreate / MPTokenIssuanceSet ImmutableFlags:
-// Defines the immutable fields and flags specific to MPTokenIssuance.
-inline constexpr FlagValue tifMPTCanLock = lsifMPTCanLock;
-inline constexpr FlagValue tifMPTRequireAuth = lsifMPTRequireAuth;
-inline constexpr FlagValue tifMPTCanEscrow = lsifMPTCanEscrow;
-inline constexpr FlagValue tifMPTCanTrade = lsifMPTCanTrade;
-inline constexpr FlagValue tifMPTCanTransfer = lsifMPTCanTransfer;
-inline constexpr FlagValue tifMPTCanClawback = lsifMPTCanClawback;
-inline constexpr FlagValue tifMPTMetadata = lsifMPTMetadata;
-inline constexpr FlagValue tifMPTTransferFee = lsifMPTTransferFee;
-inline constexpr FlagValue tifMPTCanHoldConfidentialBalance = lsifMPTCanHoldConfidentialBalance;
-inline constexpr FlagValue tifMPTokenIssuanceImmutableMask =
-    ~(tifMPTCanLock | tifMPTRequireAuth | tifMPTCanEscrow | tifMPTCanTrade | tifMPTCanTransfer |
-      tifMPTCanClawback | tifMPTMetadata | tifMPTTransferFee | tifMPTCanHoldConfidentialBalance);
+// MPTokenIssuanceCreate MutableFlags:
+// Indicating specific fields or flags may be changed after issuance.
+inline constexpr FlagValue tmfMPTCanEnableCanLock = lsmfMPTCanEnableCanLock;
+inline constexpr FlagValue tmfMPTCanEnableRequireAuth = lsmfMPTCanEnableRequireAuth;
+inline constexpr FlagValue tmfMPTCanEnableCanEscrow = lsmfMPTCanEnableCanEscrow;
+inline constexpr FlagValue tmfMPTCanEnableCanTrade = lsmfMPTCanEnableCanTrade;
+inline constexpr FlagValue tmfMPTCanEnableCanTransfer = lsmfMPTCanEnableCanTransfer;
+inline constexpr FlagValue tmfMPTCanEnableCanClawback = lsmfMPTCanEnableCanClawback;
+inline constexpr FlagValue tmfMPTCanMutateMetadata = lsmfMPTCanMutateMetadata;
+inline constexpr FlagValue tmfMPTCanMutateTransferFee = lsmfMPTCanMutateTransferFee;
+inline constexpr FlagValue tmfMPTCannotEnableCanHoldConfidentialBalance =
+    lsmfMPTCannotEnableCanHoldConfidentialBalance;
+inline constexpr FlagValue tmfMPTokenIssuanceCreateMutableMask =
+    ~(tmfMPTCanEnableCanLock | tmfMPTCanEnableRequireAuth | tmfMPTCanEnableCanEscrow |
+      tmfMPTCanEnableCanTrade | tmfMPTCanEnableCanTransfer | tmfMPTCanEnableCanClawback |
+      tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee |
+      tmfMPTCannotEnableCanHoldConfidentialBalance);

-// MPTokenIssuanceSet set of flags that is used to enable capabilities on an MPTokenIssuance.
-// Used as `txFlags & tfMPTokenIssuanceSetEnableFlagMask` to extract the capability-enabling bits.
-inline constexpr FlagValue tfMPTokenIssuanceSetEnableFlagMask = tfMPTSetCanLock |
-    tfMPTSetRequireAuth | tfMPTSetCanEscrow | tfMPTSetCanTrade | tfMPTSetCanTransfer |
-    tfMPTSetCanClawback | tfMPTSetCanHoldConfidentialBalance;
+// MPTokenIssuanceSet MutableFlags:
+// Enable mutable capability flags. These flags are one-way: once enabled,
+// the corresponding capability cannot be disabled by MPTokenIssuanceSet.
+
+inline constexpr FlagValue tmfMPTSetCanLock = 0x00000001;
+inline constexpr FlagValue tmfMPTSetRequireAuth = 0x00000002;
+inline constexpr FlagValue tmfMPTSetCanEscrow = 0x00000004;
+inline constexpr FlagValue tmfMPTSetCanTrade = 0x00000008;
+inline constexpr FlagValue tmfMPTSetCanTransfer = 0x00000010;
+inline constexpr FlagValue tmfMPTSetCanClawback = 0x00000020;
+inline constexpr FlagValue tmfMPTSetCanHoldConfidentialBalance = 0x00000040;
+inline constexpr FlagValue tmfMPTokenIssuanceSetMutableMask =
+    ~(tmfMPTSetCanLock | tmfMPTSetRequireAuth | tmfMPTSetCanEscrow | tmfMPTSetCanTrade |
+      tmfMPTSetCanTransfer | tmfMPTSetCanClawback | tmfMPTSetCanHoldConfidentialBalance);

 // Prior to fixRemoveNFTokenAutoTrustLine, transfer of an NFToken between accounts allowed a
 // TrustLine to be added to the issuer of that token without explicit permission from that issuer.
@@ -95,6 +95,12 @@ public:

        if (obj.isFieldPresent(sfParentBatchID))
            parentBatchID_ = obj.getFieldH256(sfParentBatchID);
+
+        if (obj.isFieldPresent(sfGasUsed))
+            gasUsed_ = obj.getFieldU32(sfGasUsed);
+
+        if (obj.isFieldPresent(sfVMReturnCode))
+            vmReturnCode_ = obj.getFieldI32(sfVMReturnCode);
    }

    [[nodiscard]] std::optional<STAmount> const&
@@ -115,6 +121,30 @@ public:
        parentBatchID_ = id;
    }

+    void
+    setGasUsed(std::optional<std::uint32_t> const gasUsed)
+    {
+        gasUsed_ = gasUsed;
+    }
+
+    [[nodiscard]] std::optional<std::uint32_t> const&
+    getGasUsed() const
+    {
+        return gasUsed_;
+    }
+
+    void
+    setVMReturnCode(std::optional<std::int32_t> const vmReturnCode)
+    {
+        vmReturnCode_ = vmReturnCode;
+    }
+
+    [[nodiscard]] std::optional<std::int32_t> const&
+    getVMReturnCode() const
+    {
+        return vmReturnCode_;
+    }
+
 private:
    uint256 transactionID_;
    std::uint32_t ledgerSeq_;
@@ -123,6 +153,8 @@ private:

    std::optional<STAmount> deliveredAmount_;
    std::optional<uint256> parentBatchID_;
+    std::optional<std::uint32_t> gasUsed_;
+    std::optional<std::int32_t> vmReturnCode_;

    STArray nodes_;
 };
@@ -15,6 +15,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.

+XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
@@ -309,6 +309,11 @@ LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
    {sfBaseFeeDrops,           SoeOptional},
    {sfReserveBaseDrops,       SoeOptional},
    {sfReserveIncrementDrops,  SoeOptional},
+    // Smart Escrow fields
+    {sfGasLimit,               SoeOptional},
+    {sfBytecodeSizeLimit,      SoeOptional},
+    {sfGasPrice,               SoeOptional},
+
    {sfPreviousTxnID,          SoeOptional},
    {sfPreviousTxnLgrSeq,      SoeOptional},
 }))
@@ -339,6 +344,8 @@ LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
    {sfCondition,            SoeOptional},
    {sfCancelAfter,          SoeOptional},
    {sfFinishAfter,          SoeOptional},
+    {sfBytecode,             SoeOptional},
+    {sfData,                 SoeOptional},
    {sfSourceTag,            SoeOptional},
    {sfDestinationTag,       SoeOptional},
    {sfOwnerNode,            SoeRequired},
@@ -404,7 +411,7 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
    {sfPreviousTxnID,            SoeRequired},
    {sfPreviousTxnLgrSeq,        SoeRequired},
    {sfDomainID,                 SoeOptional},
-    {sfImmutableFlags,           SoeDefault},
+    {sfMutableFlags,             SoeDefault},
    {sfReferenceHolding,         SoeOptional},
    {sfIssuerEncryptionKey,      SoeOptional},
    {sfAuditorEncryptionKey,     SoeOptional},
@@ -97,7 +97,7 @@ TYPED_SFIELD(sfVoteWeight,               UINT32,    48)
 TYPED_SFIELD(sfFirstNFTokenSequence,     UINT32,    50)
 TYPED_SFIELD(sfOracleDocumentID,         UINT32,    51)
 TYPED_SFIELD(sfPermissionValue,          UINT32,    52)
-TYPED_SFIELD(sfImmutableFlags,           UINT32,    53)
+TYPED_SFIELD(sfMutableFlags,             UINT32,    53)
 TYPED_SFIELD(sfStartDate,                UINT32,    54)
 TYPED_SFIELD(sfPaymentInterval,          UINT32,    55)
 TYPED_SFIELD(sfGracePeriod,              UINT32,    56)
@@ -119,6 +119,11 @@ TYPED_SFIELD(sfSponsoringOwnerCount,     UINT32,    71)
 TYPED_SFIELD(sfSponsoringAccountCount,   UINT32,    72)
 TYPED_SFIELD(sfRemainingOwnerCount,      UINT32,    73)
 TYPED_SFIELD(sfSponsorFlags,             UINT32,    74)
+TYPED_SFIELD(sfGasLimit,                 UINT32,    75)
+TYPED_SFIELD(sfBytecodeSizeLimit,        UINT32,    76)
+TYPED_SFIELD(sfGasPrice,                 UINT32,    77)
+TYPED_SFIELD(sfGas,                      UINT32,    78)
+TYPED_SFIELD(sfGasUsed,                  UINT32,    79)

 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -236,9 +241,9 @@ TYPED_SFIELD(sfTotalValueOutstanding,    NUMBER,     15, SField::kSmdNeedsAsset
 TYPED_SFIELD(sfPeriodicPayment,          NUMBER,     16)
 TYPED_SFIELD(sfManagementFeeOutstanding, NUMBER,     17, SField::kSmdNeedsAsset | SField::kSmdDefault)

-// int32
+// 32-bit signed (common)
 TYPED_SFIELD(sfLoanScale,                INT32,      1)
-TYPED_SFIELD(sfRemainingOwnerCountDelta, INT32,      2)
+TYPED_SFIELD(sfVMReturnCode,             INT32,      2)

 // currency amount (common)
 TYPED_SFIELD(sfAmount,                   AMOUNT,     1)
@@ -268,7 +273,7 @@ TYPED_SFIELD(sfBaseFeeDrops,             AMOUNT,    22)
 TYPED_SFIELD(sfReserveBaseDrops,         AMOUNT,    23)
 TYPED_SFIELD(sfReserveIncrementDrops,    AMOUNT,    24)

-// currency amount (AMM)
+// currency amount (more)
 TYPED_SFIELD(sfLPTokenOut,               AMOUNT,    25)
 TYPED_SFIELD(sfLPTokenIn,                AMOUNT,    26)
 TYPED_SFIELD(sfEPrice,                   AMOUNT,    27)
@@ -278,7 +283,6 @@ TYPED_SFIELD(sfMinAccountCreateAmount,   AMOUNT,    30)
 TYPED_SFIELD(sfLPTokenBalance,           AMOUNT,    31)
 TYPED_SFIELD(sfFeeAmount,                AMOUNT,    32)
 TYPED_SFIELD(sfMaxFee,                   AMOUNT,    33)
-TYPED_SFIELD(sfFeeAmountDelta,           AMOUNT,    34)

 // variable length (common)
 TYPED_SFIELD(sfPublicKey,                VL,         1)
@@ -328,6 +332,7 @@ TYPED_SFIELD(sfAuditorEncryptedAmount,      VL,     43)
 TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
 TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
+TYPED_SFIELD(sfBytecode,                    VL,     47)

 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)
@@ -50,11 +50,13 @@ TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate,
    NoPriv,
    ({
    {sfDestination, SoeRequired},
+    {sfDestinationTag, SoeOptional},
    {sfAmount, SoeRequired, SoeMptSupported},
    {sfCondition, SoeOptional},
    {sfCancelAfter, SoeOptional},
    {sfFinishAfter, SoeOptional},
-    {sfDestinationTag, SoeOptional},
+    {sfBytecode, SoeOptional},
+    {sfData,           SoeOptional},
 }))

 /** This transaction type completes an existing escrow. */
@@ -71,6 +73,7 @@ TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish,
    {sfFulfillment, SoeOptional},
    {sfCondition, SoeOptional},
    {sfCredentialIDs, SoeOptional},
+    {sfGas, SoeOptional},
 }))


@@ -705,7 +708,7 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_CREATE, 54, MPTokenIssuanceCreate,
    {sfMaximumAmount, SoeOptional},
    {sfMPTokenMetadata, SoeOptional},
    {sfDomainID, SoeOptional},
-    {sfImmutableFlags, SoeOptional},
+    {sfMutableFlags, SoeOptional},
 }))

 /** This transaction type destroys a MPTokensIssuance instance */
@@ -734,7 +737,7 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 56, MPTokenIssuanceSet,
    {sfDomainID, SoeOptional},
    {sfMPTokenMetadata, SoeOptional},
    {sfTransferFee, SoeOptional},
-    {sfImmutableFlags, SoeOptional},
+    {sfMutableFlags, SoeOptional},
    {sfIssuerEncryptionKey, SoeOptional},
    {sfAuditorEncryptionKey, SoeOptional},
 }))
@@ -1085,7 +1088,7 @@ TRANSACTION(ttLOAN_PAY, 84, LoanPay,
 #   include <xrpl/tx/transactors/token/ConfidentialMPTConvert.h>
 #endif
 TRANSACTION(ttCONFIDENTIAL_MPT_CONVERT, 85, ConfidentialMPTConvert,
-    Delegation::NotDelegable,
+    Delegation::Delegable,
    featureConfidentialTransfer,
    NoPriv,
    ({
@@ -1189,9 +1192,9 @@ TRANSACTION(ttSPONSORSHIP_SET, 91, SponsorshipSet,
    ({
    {sfCounterpartySponsor, SoeOptional},
    {sfSponsee, SoeOptional},
-    {sfFeeAmountDelta, SoeOptional},
+    {sfFeeAmount, SoeOptional},
    {sfMaxFee, SoeOptional},
-    {sfRemainingOwnerCountDelta, SoeOptional},
+    {sfRemainingOwnerCount, SoeOptional},
 }))

 /** This system-generated transaction type is used to update the status of the various amendments.
@@ -1228,6 +1231,10 @@ TRANSACTION(ttFEE, 101, SetFee,
    {sfBaseFeeDrops, SoeOptional},
    {sfReserveBaseDrops, SoeOptional},
    {sfReserveIncrementDrops, SoeOptional},
+    // Smart Escrow fields
+    {sfGasLimit, SoeOptional},
+    {sfBytecodeSizeLimit, SoeOptional},
+    {sfGasPrice, SoeOptional},
 }))

 /** This system-generated transaction type is used to update the network's negative UNL
@@ -252,6 +252,9 @@ JSS(expected_date);                  // out: any (warnings)
 JSS(expected_date_UTC);              // out: any (warnings)
 JSS(expected_ledger_size);           // out: TxQ
 JSS(expiration);                     // out: AccountOffers, AccountChannels, ValidatorList, amm_info
+JSS(gas_limit);                      // out: NetworkOPs
+JSS(bytecode_size_limit);            // out: NetworkOPs
+JSS(gas_price);                      // out: NetworkOPs
 JSS(fail_hard);                      // in: Sign, Submit
 JSS(failed);                         // out: InboundLedger
 JSS(feature);                        // in: Feature
@@ -174,6 +174,54 @@ public:
        return this->sle_->isFieldPresent(sfFinishAfter);
    }

+    /**
+     * @brief Get sfBytecode (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getBytecode() const
+    {
+        if (hasBytecode())
+            return this->sle_->at(sfBytecode);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfBytecode is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasBytecode() const
+    {
+        return this->sle_->isFieldPresent(sfBytecode);
+    }
+
+    /**
+     * @brief Get sfData (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getData() const
+    {
+        if (hasData())
+            return this->sle_->at(sfData);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfData is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasData() const
+    {
+        return this->sle_->isFieldPresent(sfData);
+    }
+
    /**
     * @brief Get sfSourceTag (SoeOptional)
     * @return The field value, or std::nullopt if not present.
@@ -453,6 +501,28 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfBytecode (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    EscrowBuilder&
+    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfBytecode] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfData (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    EscrowBuilder&
+    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfData] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfSourceTag (SoeOptional)
     * @return Reference to this builder for method chaining.
@@ -213,6 +213,78 @@ public:
        return this->sle_->isFieldPresent(sfReserveIncrementDrops);
    }

+    /**
+     * @brief Get sfGasLimit (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getGasLimit() const
+    {
+        if (hasGasLimit())
+            return this->sle_->at(sfGasLimit);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfGasLimit is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasGasLimit() const
+    {
+        return this->sle_->isFieldPresent(sfGasLimit);
+    }
+
+    /**
+     * @brief Get sfBytecodeSizeLimit (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getBytecodeSizeLimit() const
+    {
+        if (hasBytecodeSizeLimit())
+            return this->sle_->at(sfBytecodeSizeLimit);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfBytecodeSizeLimit is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasBytecodeSizeLimit() const
+    {
+        return this->sle_->isFieldPresent(sfBytecodeSizeLimit);
+    }
+
+    /**
+     * @brief Get sfGasPrice (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getGasPrice() const
+    {
+        if (hasGasPrice())
+            return this->sle_->at(sfGasPrice);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfGasPrice is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasGasPrice() const
+    {
+        return this->sle_->isFieldPresent(sfGasPrice);
+    }
+
    /**
     * @brief Get sfPreviousTxnID (SoeOptional)
     * @return The field value, or std::nullopt if not present.
@@ -375,6 +447,39 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfGasLimit (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    FeeSettingsBuilder&
+    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfGasLimit] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBytecodeSizeLimit (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    FeeSettingsBuilder&
+    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfBytecodeSizeLimit] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfGasPrice (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    FeeSettingsBuilder&
+    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfGasPrice] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfPreviousTxnID (SoeOptional)
     * @return Reference to this builder for method chaining.
@@ -256,27 +256,27 @@ public:
    }

    /**
-     * @brief Get sfImmutableFlags (SoeDefault)
+     * @brief Get sfMutableFlags (SoeDefault)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getImmutableFlags() const
+    getMutableFlags() const
    {
-        if (hasImmutableFlags())
-            return this->sle_->at(sfImmutableFlags);
+        if (hasMutableFlags())
+            return this->sle_->at(sfMutableFlags);
        return std::nullopt;
    }

    /**
-     * @brief Check if sfImmutableFlags is present.
+     * @brief Check if sfMutableFlags is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasImmutableFlags() const
+    hasMutableFlags() const
    {
-        return this->sle_->isFieldPresent(sfImmutableFlags);
+        return this->sle_->isFieldPresent(sfMutableFlags);
    }

    /**
@@ -557,13 +557,13 @@ public:
    }

    /**
-     * @brief Set sfImmutableFlags (SoeDefault)
+     * @brief Set sfMutableFlags (SoeDefault)
     * @return Reference to this builder for method chaining.
     */
    MPTokenIssuanceBuilder&
-    setImmutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    setMutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
    {
-        object_[sfImmutableFlags] = value;
+        object_[sfMutableFlags] = value;
        return *this;
    }

@@ -19,7 +19,7 @@ class ConfidentialMPTConvertBuilder;
 * @brief Transaction: ConfidentialMPTConvert
 *
 * Type: ttCONFIDENTIAL_MPT_CONVERT (85)
- * Delegable: Delegation::NotDelegable
+ * Delegable: Delegation::Delegable
 * Amendment: featureConfidentialTransfer
 * Privileges: NoPriv
 *
@@ -58,6 +58,32 @@ public:
        return this->tx_->at(sfDestination);
    }

+    /**
+     * @brief Get sfDestinationTag (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getDestinationTag() const
+    {
+        if (hasDestinationTag())
+        {
+            return this->tx_->at(sfDestinationTag);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfDestinationTag is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasDestinationTag() const
+    {
+        return this->tx_->isFieldPresent(sfDestinationTag);
+    }
+
    /**
     * @brief Get sfAmount (SoeRequired)
     * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -149,29 +175,55 @@ public:
    }

    /**
-     * @brief Get sfDestinationTag (SoeOptional)
+     * @brief Get sfBytecode (SoeOptional)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getDestinationTag() const
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getBytecode() const
    {
-        if (hasDestinationTag())
+        if (hasBytecode())
        {
-            return this->tx_->at(sfDestinationTag);
+            return this->tx_->at(sfBytecode);
        }
        return std::nullopt;
    }

    /**
-     * @brief Check if sfDestinationTag is present.
+     * @brief Check if sfBytecode is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasDestinationTag() const
+    hasBytecode() const
    {
-        return this->tx_->isFieldPresent(sfDestinationTag);
+        return this->tx_->isFieldPresent(sfBytecode);
+    }
+
+    /**
+     * @brief Get sfData (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VL::type::value_type>
+    getData() const
+    {
+        if (hasData())
+        {
+            return this->tx_->at(sfData);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfData is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasData() const
+    {
+        return this->tx_->isFieldPresent(sfData);
    }
 };

@@ -232,6 +284,17 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfDestinationTag (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    EscrowCreateBuilder&
+    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfDestinationTag] = value;
+        return *this;
+    }
+
    /**
     * @brief Set sfAmount (SoeRequired)
     * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -278,13 +341,24 @@ public:
    }

    /**
-     * @brief Set sfDestinationTag (SoeOptional)
+     * @brief Set sfBytecode (SoeOptional)
     * @return Reference to this builder for method chaining.
     */
    EscrowCreateBuilder&
-    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
    {
-        object_[sfDestinationTag] = value;
+        object_[sfBytecode] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfData (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    EscrowCreateBuilder&
+    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
+    {
+        object_[sfData] = value;
        return *this;
    }

@@ -146,6 +146,32 @@ public:
    {
        return this->tx_->isFieldPresent(sfCredentialIDs);
    }
+
+    /**
+     * @brief Get sfGas (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getGas() const
+    {
+        if (hasGas())
+        {
+            return this->tx_->at(sfGas);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfGas is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasGas() const
+    {
+        return this->tx_->isFieldPresent(sfGas);
+    }
 };

 /**
@@ -249,6 +275,17 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfGas (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    EscrowFinishBuilder&
+    setGas(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfGas] = value;
+        return *this;
+    }
+
    /**
     * @brief Build and return the EscrowFinish wrapper.
     * @param publicKey The public key for signing.
@@ -178,29 +178,29 @@ public:
    }

    /**
-     * @brief Get sfImmutableFlags (SoeOptional)
+     * @brief Get sfMutableFlags (SoeOptional)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getImmutableFlags() const
+    getMutableFlags() const
    {
-        if (hasImmutableFlags())
+        if (hasMutableFlags())
        {
-            return this->tx_->at(sfImmutableFlags);
+            return this->tx_->at(sfMutableFlags);
        }
        return std::nullopt;
    }

    /**
-     * @brief Check if sfImmutableFlags is present.
+     * @brief Check if sfMutableFlags is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasImmutableFlags() const
+    hasMutableFlags() const
    {
-        return this->tx_->isFieldPresent(sfImmutableFlags);
+        return this->tx_->isFieldPresent(sfMutableFlags);
    }
 };

@@ -302,13 +302,13 @@ public:
    }

    /**
-     * @brief Set sfImmutableFlags (SoeOptional)
+     * @brief Set sfMutableFlags (SoeOptional)
     * @return Reference to this builder for method chaining.
     */
    MPTokenIssuanceCreateBuilder&
-    setImmutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    setMutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
    {
-        object_[sfImmutableFlags] = value;
+        object_[sfMutableFlags] = value;
        return *this;
    }

@@ -163,29 +163,29 @@ public:
    }

    /**
-     * @brief Get sfImmutableFlags (SoeOptional)
+     * @brief Get sfMutableFlags (SoeOptional)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getImmutableFlags() const
+    getMutableFlags() const
    {
-        if (hasImmutableFlags())
+        if (hasMutableFlags())
        {
-            return this->tx_->at(sfImmutableFlags);
+            return this->tx_->at(sfMutableFlags);
        }
        return std::nullopt;
    }

    /**
-     * @brief Check if sfImmutableFlags is present.
+     * @brief Check if sfMutableFlags is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasImmutableFlags() const
+    hasMutableFlags() const
    {
-        return this->tx_->isFieldPresent(sfImmutableFlags);
+        return this->tx_->isFieldPresent(sfMutableFlags);
    }

    /**
@@ -341,13 +341,13 @@ public:
    }

    /**
-     * @brief Set sfImmutableFlags (SoeOptional)
+     * @brief Set sfMutableFlags (SoeOptional)
     * @return Reference to this builder for method chaining.
     */
    MPTokenIssuanceSetBuilder&
-    setImmutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    setMutableFlags(std::decay_t<typename SF_UINT32::type::value_type> const& value)
    {
-        object_[sfImmutableFlags] = value;
+        object_[sfMutableFlags] = value;
        return *this;
    }

@@ -254,6 +254,84 @@ public:
    {
        return this->tx_->isFieldPresent(sfReserveIncrementDrops);
    }
+
+    /**
+     * @brief Get sfGasLimit (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getGasLimit() const
+    {
+        if (hasGasLimit())
+        {
+            return this->tx_->at(sfGasLimit);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfGasLimit is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasGasLimit() const
+    {
+        return this->tx_->isFieldPresent(sfGasLimit);
+    }
+
+    /**
+     * @brief Get sfBytecodeSizeLimit (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getBytecodeSizeLimit() const
+    {
+        if (hasBytecodeSizeLimit())
+        {
+            return this->tx_->at(sfBytecodeSizeLimit);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfBytecodeSizeLimit is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasBytecodeSizeLimit() const
+    {
+        return this->tx_->isFieldPresent(sfBytecodeSizeLimit);
+    }
+
+    /**
+     * @brief Get sfGasPrice (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getGasPrice() const
+    {
+        if (hasGasPrice())
+        {
+            return this->tx_->at(sfGasPrice);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfGasPrice is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasGasPrice() const
+    {
+        return this->tx_->isFieldPresent(sfGasPrice);
+    }
 };

 /**
@@ -386,6 +464,39 @@ public:
        return *this;
    }

+    /**
+     * @brief Set sfGasLimit (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SetFeeBuilder&
+    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfGasLimit] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfBytecodeSizeLimit (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SetFeeBuilder&
+    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfBytecodeSizeLimit] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfGasPrice (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    SetFeeBuilder&
+    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfGasPrice] = value;
+        return *this;
+    }
+
    /**
     * @brief Build and return the SetFee wrapper.
     * @param publicKey The public key for signing.
@@ -100,29 +100,29 @@ public:
    }

    /**
-     * @brief Get sfFeeAmountDelta (SoeOptional)
+     * @brief Get sfFeeAmount (SoeOptional)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
    protocol_autogen::Optional<SF_AMOUNT::type::value_type>
-    getFeeAmountDelta() const
+    getFeeAmount() const
    {
-        if (hasFeeAmountDelta())
+        if (hasFeeAmount())
        {
-            return this->tx_->at(sfFeeAmountDelta);
+            return this->tx_->at(sfFeeAmount);
        }
        return std::nullopt;
    }

    /**
-     * @brief Check if sfFeeAmountDelta is present.
+     * @brief Check if sfFeeAmount is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasFeeAmountDelta() const
+    hasFeeAmount() const
    {
-        return this->tx_->isFieldPresent(sfFeeAmountDelta);
+        return this->tx_->isFieldPresent(sfFeeAmount);
    }

    /**
@@ -152,29 +152,29 @@ public:
    }

    /**
-     * @brief Get sfRemainingOwnerCountDelta (SoeOptional)
+     * @brief Get sfRemainingOwnerCount (SoeOptional)
     * @return The field value, or std::nullopt if not present.
     */
    [[nodiscard]]
-    protocol_autogen::Optional<SF_INT32::type::value_type>
-    getRemainingOwnerCountDelta() const
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getRemainingOwnerCount() const
    {
-        if (hasRemainingOwnerCountDelta())
+        if (hasRemainingOwnerCount())
        {
-            return this->tx_->at(sfRemainingOwnerCountDelta);
+            return this->tx_->at(sfRemainingOwnerCount);
        }
        return std::nullopt;
    }

    /**
-     * @brief Check if sfRemainingOwnerCountDelta is present.
+     * @brief Check if sfRemainingOwnerCount is present.
     * @return True if the field is present, false otherwise.
     */
    [[nodiscard]]
    bool
-    hasRemainingOwnerCountDelta() const
+    hasRemainingOwnerCount() const
    {
-        return this->tx_->isFieldPresent(sfRemainingOwnerCountDelta);
+        return this->tx_->isFieldPresent(sfRemainingOwnerCount);
    }
 };

@@ -243,13 +243,13 @@ public:
    }

    /**
-     * @brief Set sfFeeAmountDelta (SoeOptional)
+     * @brief Set sfFeeAmount (SoeOptional)
     * @return Reference to this builder for method chaining.
     */
    SponsorshipSetBuilder&
-    setFeeAmountDelta(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
+    setFeeAmount(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
    {
-        object_[sfFeeAmountDelta] = value;
+        object_[sfFeeAmount] = value;
        return *this;
    }

@@ -265,13 +265,13 @@ public:
    }

    /**
-     * @brief Set sfRemainingOwnerCountDelta (SoeOptional)
+     * @brief Set sfRemainingOwnerCount (SoeOptional)
     * @return Reference to this builder for method chaining.
     */
    SponsorshipSetBuilder&
-    setRemainingOwnerCountDelta(std::decay_t<typename SF_INT32::type::value_type> const& value)
+    setRemainingOwnerCount(std::decay_t<typename SF_UINT32::type::value_type> const& value)
    {
-        object_[sfRemainingOwnerCountDelta] = value;
+        object_[sfRemainingOwnerCount] = value;
        return *this;
    }

@@ -13,7 +13,6 @@ extern Charge const kFeeRequestNoReply;    // A request that we cannot satisfy.
 extern Charge const kFeeInvalidSignature;  // An object whose signature we had to check that failed.
 extern Charge const kFeeUselessData;       // Data we have no use for.
 extern Charge const kFeeInvalidData;       // Data we have to verify before rejecting.
-extern Charge const kFeeMalformedData;     // Data that no honest peer would send.

 // RPC loads
 extern Charge const kFeeMalformedRpc;     // An RPC request that we can immediately tell is invalid.
@@ -11,7 +11,6 @@
 #include <xrpl/server/Manifest.h>

 #include <atomic>
-#include <cstddef>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -23,39 +22,6 @@ namespace xrpl {
 // Operations that clients may wish to perform against the network
 // Master operational handler, server sequencer, network tracker

-/**
- * Maximum number of subscriptions a single client connection may hold at once.
- *
- * Applies to the account, real-time account, and account-history subscriptions
- * tracked on one InfoSub (the sets counted by totalSubscriptionCount), bounding
- * the disconnect-time cleanup of those sets. Book subscriptions are tracked
- * separately (OrderBookDB) and are not counted here. Generous enough for
- * legitimate power users such as block explorers.
- */
-constexpr std::size_t kMaxSubscriptionsPerConnection = 100'000;
-
-/**
- * Whether adding @p additional subscriptions to a connection already holding
- * @p current would exceed the cap.
- *
- * Pure arithmetic split out so it can be unit-tested without a live
- * connection. The first term avoids underflow in the subtraction.
- *
- * @param current    Subscriptions already tracked on the connection.
- * @param additional Subscriptions a request would add.
- * @param cap        The effective per-connection cap. Defaults to the
- * built-in limit; callers may pass a configured override.
- * @return true if the request must be rejected to stay within the cap.
- */
-[[nodiscard]] constexpr bool
-exceedsSubscriptionCap(
-    std::size_t current,
-    std::size_t additional,
-    std::size_t cap = kMaxSubscriptionsPerConnection)
-{
-    return additional > cap || current > cap - additional;
-}
-
 class InfoSubRequest : public CountedObject<InfoSubRequest>
 {
 public:
@@ -78,12 +44,12 @@ public:
 * map.
 *
 * @note Lifetime contract: every `InfoSub` instance MUST be destroyed
- * before the backing `Source`. NetworkOPsImp shutdown drops all
- * subscriber strong refs before its own teardown to satisfy this.
+ *       before the backing `Source`. NetworkOPsImp shutdown drops all
+ *       subscriber strong refs before its own teardown to satisfy this.
 * @note Thread-safety: per-instance state is guarded by `lock_`. The
- * destructor reads tracking sets without taking `lock_` because
- * the strong-pointer ref-count is zero at destruction time, so
- * no other thread can be calling the public mutators.
+ *       destructor reads tracking sets without taking `lock_` because
+ *       the strong-pointer ref-count is zero at destruction time, so
+ *       no other thread can be calling the public mutators.
 */
 class InfoSub : public CountedObject<InfoSub>
 {
@@ -151,34 +117,6 @@ public:
            AccountID const& account,
            bool historyOnly) = 0;

-        /**
-         * Schedule the server-side teardown of a disconnecting connection's
-         * account subscriptions off the destructor thread.
-         *
-         * The implementation posts a low-priority JobQueue task that erases the
-         * entries in bounded chunks, so `~InfoSub` returns immediately instead
-         * of running the erase loop inline. The sets are taken by value so the
-         * job owns its copies and never references the destroyed `InfoSub`.
-         * Cleanup is keyed on `seq` (unique per connection), so deferring it
-         * cannot disturb a reconnected client reusing the same accounts.
-         *
-         * @param seq The disconnecting connection's unique subscription id.
-         * @param rtAccounts Real-time account subscriptions to remove.
-         * @param normalAccounts Normal account subscriptions to remove.
-         * @param historyAccounts Account-history subscriptions to remove.
-         *
-         * @note The implementing `Source` must outlive any job it posts. If the
-         * JobQueue is already stopping (process shutdown), the job is not
-         * enqueued; the cleanup is skipped because the server-side maps
-         * are about to be destroyed and no publishing can run.
-         */
-        virtual void
-        scheduleAccountCleanup(
-            std::uint64_t seq,
-            hash_set<AccountID> rtAccounts,
-            hash_set<AccountID> normalAccounts,
-            hash_set<AccountID> historyAccounts) = 0;
-
        // VFALCO TODO Document the bool return value
        virtual bool
        subLedger(ref ispListener, json::Value& jvResult) = 0;
@@ -215,12 +153,12 @@ public:
         * @param ispListener The subscriber requesting removal.
         * @param book        The order book to unsubscribe from.
         * @return true if the entry was present and removed, false if the
-         * subscriber was not subscribed to @p book.
+         *         subscriber was not subscribed to @p book.
         *
-         * @note Thread-safety: acquires bookLock_ internally.
+         * @note Thread-safety: acquires subLock_ internally.
         * @note Do NOT call from ~InfoSub(). Use unsubBookInternal instead
-         * to avoid a redundant write-back to bookSubscriptions_ on a
-         * partially-destroyed object.
+         *       to avoid a redundant write-back to bookSubscriptions_ on a
+         *       partially-destroyed object.
         */
        virtual bool
        unsubBook(ref ispListener, Book const&) = 0;
@@ -235,9 +173,9 @@ public:
         * @param uListener The sequence number of the subscriber being torn down.
         * @param book      The order book entry to remove.
         * @return true if the entry was present and removed, false otherwise
-         * (e.g., already removed by a concurrent RPC unsubscribe).
+         *         (e.g., already removed by a concurrent RPC unsubscribe).
         *
-         * @note Thread-safety: acquires bookLock_ internally.
+         * @note Thread-safety: acquires subLock_ internally.
         */
        virtual bool
        unsubBookInternal(std::uint64_t uListener, Book const&) = 0;
@@ -283,8 +221,8 @@ public:

        /**
         * Journal used by InfoSub for diagnostics that occur after the
-         * owning subsystem (e.g. application-level Logs) is the only
-         * surviving sink — primarily destructor-time cleanup failures.
+         *  owning subsystem (e.g. application-level Logs) is the only
+         *  surviving sink — primarily destructor-time cleanup failures.
         */
        [[nodiscard]] virtual beast::Journal const&
        journal() const = 0;
@@ -305,56 +243,6 @@ public:
    [[nodiscard]] std::uint64_t
    getSeq() const;

-    /**
-     * Return the number of subscriptions currently tracked on this
-     * connection.
-     *
-     * The combined size of the per-connection account, real-time account, and
-     * account-history subscription sets. `doSubscribe` reads this to enforce
-     * the per-connection subscription cap before admitting more.
-     *
-     * @return The total tracked subscription count for this connection.
-     *
-     * @note Thread-safe: takes `lock_` for the read; read-only.
-     */
-    [[nodiscard]] std::size_t
-    totalSubscriptionCount() const;
-
-    /**
-     * Enforce the cap and reserve a request's net-new accounts, atomically.
-     *
-     * Under one hold of `lock_`: count the net-new entries in the two sets,
-     * check the total against @p cap, and insert them only if it fits.
-     * All-or-nothing. Doing check and insert together stops two concurrent
-     * requests sharing an InfoSub (the admin subscribe-by-url path) from both
-     * passing the check before either records its accounts. The server-side
-     * maps are populated afterwards by subAccount, whose re-insert is a no-op.
-     *
-     * @param proposedAccounts Real-time (accounts_proposed) ids to reserve.
-     * @param normalAccounts   Normal (accounts) ids to reserve.
-     * @param cap              The effective per-connection cap.
-     * @return true if reserved; false if the request must be rejected.
-     * @note Thread-safe: takes `lock_`.
-     */
-    [[nodiscard]] bool
-    tryReserveAccountSubscriptions(
-        hash_set<AccountID> const& proposedAccounts,
-        hash_set<AccountID> const& normalAccounts,
-        std::size_t cap);
-
-    /**
-     * Whether this connection already tracks an account-history for @p account.
-     *
-     * `doSubscribe` reads this to charge the cap for an account_history_tx_stream
-     * only when it is net-new, matching the account branches.
-     *
-     * @param account The account an account_history_tx_stream would add.
-     * @return true if @p account is already in the account-history set.
-     * @note Thread-safe: takes `lock_`; read-only.
-     */
-    [[nodiscard]] bool
-    hasAccountHistorySubscription(AccountID const& account) const;
-
    void
    onSendEmpty();

@@ -414,9 +302,7 @@ public:
    getApiVersion() const noexcept;

 protected:
-    // Mutable so the read-only totalSubscriptionCount() accessor can lock it
-    // from a const method; locking semantics are otherwise unchanged.
-    mutable std::mutex lock_;
+    std::mutex lock_;

 private:
    Consumer consumer_;
@@ -3,14 +3,12 @@
 #include <xrpl/basics/Blob.h>
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/UnorderedContainers.h>
-#include <xrpl/basics/base64.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/SecretKey.h>

 #include <atomic>
-#include <cstddef>
 #include <cstdint>
 #include <functional>
 #include <optional>
@@ -45,15 +43,12 @@ namespace xrpl {
    dynamically generates the signatureless form when it needs to verify
    the signature.

-    An instance of ManifestCache stores, for each known validator, (a) its
+    An instance of ManifestCache stores, for each trusted validator, (a) its
    master public key, and (b) the most senior of all valid manifests it has
    seen for that validator, if any.  On startup, the [validator_token] config
    entry (which contains the manifest for this validator) is decoded and
    added to the manifest cache.  Other manifests are added as "gossip"
-    received from xrpld peers, including ones for validators this node does not
-    trust. Manifests for untrusted validators are capped (kMaxUntrustedCount)
-    so peer gossip cannot grow the cache without bound; trusted validators are
-    not capped. Entries are never evicted, so a stored revocation is permanent.
+    received from xrpld peers.

    When an ephemeral key is compromised, a new signing key pair is created,
    along with a new manifest vouching for it (with a higher sequence number),
@@ -169,100 +164,6 @@ struct Manifest
 std::string
 to_string(Manifest const& m);

-/**
- * Largest a valid manifest can be, in decoded bytes.
- *
- *   A manifest has a fixed set of fields. Each is serialized as a field header
- *   (1-2 bytes), an optional length prefix (1 byte for these sizes), and the
- *   field body. Taking every field at its largest gives the maximum below, so
- *   anything larger cannot be a valid manifest.
- *
- *       Field                 header + length + body = bytes
- *       sfVersion   (U16)        2          0     2     4
- *       sfSequence  (U32)        1          0     4     5
- *       sfPublicKey (33)         1          1    33    35
- *       sfSigningPubKey (33)     1          1    33    35
- *       sfSignature (72)         1          1    72    74
- *       sfMasterSignature (72)   2          1    72    75
- *       sfDomain    (128)        1          1   128   130
- *                                                    -----
- *                                                      358
- */
-constexpr std::size_t kMaxManifestBytes = 358;
-
-/**
- * Largest a valid manifest can be, in base64 characters.
- *
- *   base64 encodes 3 bytes as 4 characters, so this is the encoded form of
- *   @ref kMaxManifestBytes. Callers that receive a base64 manifest should
- *   reject anything longer than this before decoding, to avoid allocating
- *   memory for an oversized input.
- */
-constexpr std::size_t kMaxManifestBase64 = base64::encodedSize(kMaxManifestBytes);
-
-/**
- * Default number of untrusted manifests to store in cache and allowed
- * in one Manifest message.
- *
- * Bounds unlisted validators two ways. In the cache, a manifest for a
- * brand-new unlisted key is rejected once this many are held, so peer gossip
- * cannot grow the cache without end. In a TMManifests message, this many are
- * sent and processed, so a peer sending its whole cache cannot force unbounded
- * work.
- *
- * Operators can override this with `[overlay] max_untrusted_count`. Both users
- * read the configured value and fall back to this default.
- */
-constexpr std::size_t kMaxUntrustedCount = 300;
-
-/**
- * Default number of trusted manifests allowed in a Manifest message.
- * Not used atm while creating the message, but used to calculate the higher limit on
- * received message size. Introduced to maintain consistency. Future implementation
- * will use this limit.
- *
- * Trusted manifests are never dropped: every one this node holds is sent, and
- * every one received is processed, since dropping one would delay a validator
- * key rotation. This count only sizes the largest message accepted, so it must
- * stay above any realistic validator list. Cap can be increased in the config
- * file if messages get rejected with actual trusted manifest count crossing
- * configured(or else default) value.
- * Operators can override this with `[overlay] max_trusted_count`.
- */
-constexpr std::size_t kMaxTrustedCount = 300;
-
-/**
- * Number of untrusted manifests to store in cache and allowed
- * in one Manifest message..
- *
- * Returns the operator's override when one is configured, otherwise
- * @ref kMaxUntrustedCount. Config stores an override rather than the default
- * itself because the core module cannot depend on this module.
- *
- * @param configured The value from `[overlay] max_untrusted_count`, or
- *     `std::nullopt` when the operator did not set it.
- */
-constexpr std::size_t
-untrustedManifestCount(std::optional<std::size_t> const& configured)
-{
-    return configured.value_or(kMaxUntrustedCount);
-}
-
-/**
- * Number of trusted manifests allowed in a Manifest message.
- *
- * Not a cap on how many are sent or processed; see @ref kMaxTrustedCount.
- * but used to calculate the higher limit on received message size.
- *
- * @param configured The value from `[overlay] max_trusted_count`, or
- *     `std::nullopt` when the operator did not set it.
- */
-constexpr std::size_t
-trustedManifestCount(std::optional<std::size_t> const& configured)
-{
-    return configured.value_or(kMaxTrustedCount);
-}
-
 /**
 * Constructs Manifest from serialized string
 *
@@ -271,7 +172,7 @@ trustedManifestCount(std::optional<std::size_t> const& configured)
 * @return `std::nullopt` if string is invalid
 *
 * @note This does not verify manifest signatures.
- * `Manifest::verify` should be called after constructing manifest.
+ *       `Manifest::verify` should be called after constructing manifest.
 */
 /** @{ */
 std::optional<Manifest>
@@ -324,17 +225,30 @@ loadValidatorToken(
    beast::Journal journal = beast::Journal(beast::Journal::getNullSink()));

 enum class ManifestDisposition {
-    Accepted = 0,  ///< Manifest is valid
+    /**
+     * Manifest is valid
+     */
+    Accepted = 0,

-    Stale,  ///< Sequence is too old
+    /**
+     * Sequence is too old
+     */
+    Stale,

-    BadMasterKey,  ///< The master key is not acceptable to us
+    /**
+     * The master key is not acceptable to us
+     */
+    BadMasterKey,

-    BadEphemeralKey,  ///< The ephemeral key is not acceptable to us
+    /**
+     * The ephemeral key is not acceptable to us
+     */
+    BadEphemeralKey,

-    Invalid,  ///< Timely, but invalid signature
-
-    UntrustedCapacity  ///< Unlisted and limit reached
+    /**
+     * Timely, but invalid signature
+     */
+    Invalid
 };

 inline std::string
@@ -352,25 +266,11 @@ to_string(ManifestDisposition m)
            return "badEphemeralKey";
        case ManifestDisposition::Invalid:
            return "invalid";
-        case ManifestDisposition::UntrustedCapacity:
-            return "untrustedCapacity";
        default:
            return "unknown";
    }
 }

-/**
- * Whether a manifest counts against the 'untrusted' cache cap.
- *
- * Passed to `ManifestCache::applyManifest` with no default, so every caller
- * must choose. `Capped` is the safe, flood-resistant value; only listed or
- * configured keys should use `Uncapped`.
- */
-enum class ManifestRateLimitCapPolicy : std::uint8_t {
-    Capped,   ///< Subject to the untrusted cap (unlisted peer gossip)
-    Uncapped  ///< Bypasses the cap (listed/trusted or config manifests)
-};
-
 class DatabaseCon;

 /**
@@ -394,51 +294,8 @@ private:

    std::atomic<std::uint32_t> seq_{0};

-    /**
-     * Master keys of cached manifests for validators this node does not list.
-     *
-     * One entry per capped key in `map_`; its size enforces the cap below.
-     * A key is added when first cached under `Capped` and removed when it
-     * becomes listed (see `promoteToTrusted`) or an `Uncapped` update arrives,
-     * never re-added on de-listing. Uncapped keys are not tracked here.
-     */
-    hash_set<PublicKey> untrustedKeys_;
-
-    /**
-     * Maximum number of untrusted master keys kept in the cache.
-     *
-     * Once reached, a manifest for a brand-new unlisted key is rejected. Set
-     * from the config, defaulting to @ref kMaxUntrustedCount.
-     */
-    std::size_t const maxUntrustedCount_;
-
-    /**
-     * Running count of manifests rejected because the untrusted cap was full.
-     *
-     * Drives throttled logging (see `kUntrustedRejectCount`). Atomic because
-     * `applyManifest` may run concurrently.
-     */
-    std::atomic<std::uint64_t> untrustedRejectCount_{0};
-
-    /**
-     * Number of cap rejections between summary warnings.
-     *
-     * @see untrustedRejectCount_
-     */
-    static constexpr std::uint64_t kUntrustedRejectCount = 10000;
-
 public:
-    /**
-     * @param j Journal for logging.
-     *
-     * @param maxUntrustedCount Untrusted master keys to keep. Pass the
-     *     configured value; defaults to @ref kMaxUntrustedCount. Taken as a
-     *     parameter because this module cannot depend on the config.
-     */
-    explicit ManifestCache(
-        beast::Journal j = beast::Journal(beast::Journal::getNullSink()),
-        std::size_t maxUntrustedCount = kMaxUntrustedCount)
-        : j_(j), maxUntrustedCount_(maxUntrustedCount)
+    explicit ManifestCache(beast::Journal j = beast::Journal(beast::Journal::getNullSink())) : j_(j)
    {
    }

@@ -521,44 +378,17 @@ public:
    /**
     * Add manifest to cache.
     *
-     * A brand-new unlisted key is rejected once the untrusted cap is full;
-     * updates to a cached key and `Uncapped` manifests bypass the cap. The
-     * caller decides `cap` before calling so the cache lock is not held while
-     * consulting the validator list, which would risk a lock-ordering deadlock.
-     *
     * @param m Manifest to add
     *
-     * @param cap `Uncapped` skips the untrusted cap; use it for keys that are
-     *     listed, configured, or loaded from the DB. Note `Uncapped` does not
-     *     assert the key is currently trusted (a DB entry may predate a
-     *     de-listing). Callers must state this explicitly so a manifest is
-     *     never left uncapped by omission.
-     *
-     * @return `Accepted` if stored, `Stale` if superseded, `Invalid`/
-     *         `BadEphemeralKey` if malformed, or `UntrustedCapacity` if the
-     *         untrusted cap is full.
+     * @return `ManifestDisposition::accepted` if successful, or
+     *         `stale` or `invalid` otherwise
     *
     * @par Thread Safety
     *
     * May be called concurrently
     */
    ManifestDisposition
-    applyManifest(Manifest m, ManifestRateLimitCapPolicy cap);
-
-    /**
-     * Stop counting a master key against the untrusted cap.
-     *
-     * Called when a cached untrusted key becomes listed, freeing its slot.
-     * Idempotent and a no-op for keys that were never counted.
-     *
-     * @param pk Master public key that is now listed/trusted
-     *
-     * @par Thread Safety
-     *
-     * May be called concurrently
-     */
-    void
-    promoteToTrusted(PublicKey const& pk);
+    applyManifest(Manifest m);

    /**
     * Populate manifest cache with manifests in database and config.
@@ -15,6 +15,7 @@
 #include <xrpl/protocol/XRPAmount.h>

 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <optional>
 #include <utility>
@@ -95,6 +96,24 @@ public:
        view_->deliver(amount);
    }

+    /**
+     * Sets the gas used in the metadata
+     */
+    void
+    setGasUsed(std::uint32_t const gasUsed)
+    {
+        gasUsed_ = gasUsed;
+    }
+
+    /**
+     * Sets the gas used in the metadata
+     */
+    void
+    setVMReturnCode(std::int32_t const vmReturnCode)
+    {
+        vmReturnCode_ = vmReturnCode;
+    }
+
    /**
     * Discard changes and start fresh.
     */
@@ -163,6 +182,8 @@ private:

    // The ID of the batch transaction we are executing under, if set.
    std::optional<uint256 const> parentBatchId_;
+    std::optional<std::uint32_t> gasUsed_;
+    std::optional<std::int32_t> vmReturnCode_;
 };

 }  // namespace xrpl
@@ -20,15 +20,21 @@ public:
    {
    }

-    static TxConsequences
-    makeTxConsequences(PreflightContext const& ctx);
-
    static bool
    checkExtraFeatures(PreflightContext const& ctx);

+    static TxConsequences
+    makeTxConsequences(PreflightContext const& ctx);
+
+    static XRPAmount
+    calculateBaseFee(ReadView const& view, STTx const& tx);
+
    static NotTEC
    preflight(PreflightContext const& ctx);

+    static NotTEC
+    preflightSigValidated(PreflightContext const& ctx);
+
    static TER
    preclaim(PreclaimContext const& ctx);

@@ -2,8 +2,6 @@

 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Keylet.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
@@ -18,7 +16,7 @@ namespace xrpl {
 class SponsorshipSet : public Transactor
 {
 public:
-    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Custom;
+    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;

    explicit SponsorshipSet(ApplyContext& ctx) : Transactor(ctx)
    {
@@ -49,15 +47,6 @@ public:
        XRPAmount fee,
        ReadView const& view,
        beast::Journal const& j) override;
-
-private:
-    TER
-    createSponsorship(
-        Keylet const& sponsorshipKeylet,
-        AccountID const& sponsorID,
-        AccountID const& sponseeID,
-        SLE::ref sponsorAccSle,
-        SLE::ref reserveSponsorAccSle);
 };

 }  // namespace xrpl
@@ -32,7 +32,7 @@ struct MPTCreateArgs
    std::optional<std::uint16_t> transferFee = std::nullopt;
    std::optional<Slice> const& metadata{};
    std::optional<uint256> domainId = std::nullopt;
-    std::optional<std::uint32_t> immutableFlags = std::nullopt;
+    std::optional<std::uint32_t> mutableFlags = std::nullopt;
    // Set only by callers that issue an MPT representing a wrapped asset
    // (e.g. VaultCreate's share token). The keylet must point to an
    // existing MPToken or RippleState owned by `account`. Surfaces on
@@ -3,15 +3,12 @@
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/LedgerFormats.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/XRPAmount.h>
 #include <xrpl/tx/ApplyContext.h>
 #include <xrpl/tx/Transactor.h>

-#include <array>
 #include <cstdint>

 namespace xrpl {
@@ -25,37 +22,6 @@ public:
    {
    }

-    // Maps each MPTokenIssuanceSet set flag(e.g., tfMPTSetCanLock), to the issuance's
-    // corresponding immutable flag (e.g., lsifMPTCanLock) and the target ledger flag (e.g.,
-    // lsfMPTCanLock).
-    struct FlagMapping
-    {
-        std::uint32_t setFlag;
-        std::uint32_t immutableFlag;
-        std::uint32_t ledgerFlag;
-    };
-
-    static constexpr std::array<FlagMapping, 7> flagMapping = {
-        {{.setFlag = tfMPTSetCanLock, .immutableFlag = lsifMPTCanLock, .ledgerFlag = lsfMPTCanLock},
-         {.setFlag = tfMPTSetRequireAuth,
-          .immutableFlag = lsifMPTRequireAuth,
-          .ledgerFlag = lsfMPTRequireAuth},
-         {.setFlag = tfMPTSetCanEscrow,
-          .immutableFlag = lsifMPTCanEscrow,
-          .ledgerFlag = lsfMPTCanEscrow},
-         {.setFlag = tfMPTSetCanTrade,
-          .immutableFlag = lsifMPTCanTrade,
-          .ledgerFlag = lsfMPTCanTrade},
-         {.setFlag = tfMPTSetCanTransfer,
-          .immutableFlag = lsifMPTCanTransfer,
-          .ledgerFlag = lsfMPTCanTransfer},
-         {.setFlag = tfMPTSetCanClawback,
-          .immutableFlag = lsifMPTCanClawback,
-          .ledgerFlag = lsfMPTCanClawback},
-         {.setFlag = tfMPTSetCanHoldConfidentialBalance,
-          .immutableFlag = lsifMPTCanHoldConfidentialBalance,
-          .ledgerFlag = lsfMPTCanHoldConfidentialBalance}}};
-
    static bool
    checkExtraFeatures(PreflightContext const& ctx);

@@ -0,0 +1,530 @@
+#pragma once
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/insight/Event.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/tx/wasm/WasmCommon.h>
+
+#include <cstdint>
+#include <expected>
+#include <functional>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+namespace xrpl {
+
+namespace wasm_float {
+
+std::string
+floatToString(Slice const& data);
+
+std::expected<Bytes, HostFunctionError>
+floatFromIntImpl(int64_t x, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatFromUintImpl(uint64_t x, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatFromSTAmountImpl(STAmount const& x, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatFromSTNumberImpl(STNumber const& x, int32_t mode);
+
+std::expected<int64_t, HostFunctionError>
+floatToIntImpl(Slice const& x, int32_t mode);
+
+std::expected<FloatPair, HostFunctionError>
+floatToMantExpImpl(Slice const& x);
+
+std::expected<Bytes, HostFunctionError>
+floatFromMantExpImpl(int64_t mantissa, int32_t exponent, int32_t mode);
+
+std::expected<int32_t, HostFunctionError>
+floatCompareImpl(Slice const& x, Slice const& y);
+
+std::expected<Bytes, HostFunctionError>
+floatAddImpl(Slice const& x, Slice const& y, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatSubtractImpl(Slice const& x, Slice const& y, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatMultiplyImpl(Slice const& x, Slice const& y, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatDivideImpl(Slice const& x, Slice const& y, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatRootImpl(Slice const& x, int32_t n, int32_t mode);
+
+std::expected<Bytes, HostFunctionError>
+floatPowerImpl(Slice const& x, int32_t n, int32_t mode);
+
+}  // namespace wasm_float
+
+// Intended to work only through wasm runtime. Don't call them directly, except with unit tests
+class HostFunctions
+{
+protected:
+    RTOptRef rt_;
+    beast::Journal j_;
+
+public:
+    HostFunctions(beast::Journal j = beast::Journal{beast::Journal::getNullSink()}) : j_(j)
+    {
+    }
+
+    void
+    setRT(WasmRuntimeWrapper& rt)
+    {
+        rt_ = rt;
+    }
+
+    void
+    resetRT()
+    {
+        rt_ = std::nullopt;
+    }
+
+    [[nodiscard]] WasmRuntimeWrapper&
+    getRT() const
+    {
+        if (!rt_)
+            Throw<std::logic_error>("Wasm runtime not set");
+        return rt_->get();
+    }
+
+    [[nodiscard]] beast::Journal
+    getJournal() const
+    {
+        return j_;
+    }
+
+    [[nodiscard]] virtual beast::insight::Event
+    executionTimeEvent(std::string_view name) const
+    {
+        return {};
+    }
+
+    // LCOV_EXCL_START
+
+    [[nodiscard]] virtual bool
+    checkSelf() const
+    {
+        return true;
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
+    getLedgerSqn() const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
+    getParentLedgerTime() const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Hash, HostFunctionError>
+    getParentLedgerHash() const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<uint32_t, HostFunctionError>
+    getBaseFee() const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    isAmendmentEnabled(uint256 const& amendmentId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    isAmendmentEnabled(std::string_view const& amendmentName) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    virtual std::expected<int32_t, HostFunctionError>
+    cacheLedgerObj(uint256 const& objId, int32_t cacheIdx)
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getTxField(SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getCurrentLedgerObjField(SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getLedgerObjField(int32_t cacheIdx, SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getTxNestedField(FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getCurrentLedgerObjNestedField(FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getTxArrayLen(SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getCurrentLedgerObjArrayLen(SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getTxNestedArrayLen(FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    virtual std::expected<int32_t, HostFunctionError>
+    updateData(Slice const& data)
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    checkSignature(Slice const& message, Slice const& signature, Slice const& pubkey) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Hash, HostFunctionError>
+    computeSha512HalfHash(Slice const& data) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    accountKeylet(AccountID const& account) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    ammKeylet(Asset const& issue1, Asset const& issue2) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    checkKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    credentialKeylet(AccountID const& subject, AccountID const& issuer, Slice const& credentialType)
+        const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    didKeylet(AccountID const& account) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    delegateKeylet(AccountID const& account, AccountID const& authorize) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    depositPreauthKeylet(AccountID const& account, AccountID const& authorize) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    escrowKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    trustLineKeylet(AccountID const& account1, AccountID const& account2, Currency const& currency)
+        const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    mptokenIssuanceKeylet(AccountID const& issuer, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    mptokenKeylet(MPTID const& mptid, AccountID const& holder) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    nftokenOfferKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    offerKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    oracleKeylet(AccountID const& account, std::uint32_t docId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    paychannelKeylet(AccountID const& account, AccountID const& destination, std::uint32_t seq)
+        const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    permissionedDomainKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    signerListKeylet(AccountID const& account) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    ticketKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    vaultKeylet(AccountID const& account, std::uint32_t seq) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getNFT(AccountID const& account, uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    getNFTIssuer(uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
+    getNFTTaxon(uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getNFTFlags(uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    getNFTTransferFee(uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
+    getNFTSequence(uint256 const& nftId) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    trace(std::string_view const& msg, Slice const& data, bool asHex) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    traceNum(std::string_view const& msg, int64_t data) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    traceAccount(std::string_view const& msg, AccountID const& account) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    traceFloat(std::string_view const& msg, Slice const& data) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    traceAmount(std::string_view const& msg, STAmount const& amount) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatFromInt(int64_t x, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatFromUint(uint64_t x, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatFromSTAmount(STAmount const& x, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatFromSTNumber(STNumber const& x, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int64_t, HostFunctionError>
+    floatToInt(Slice const& x, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<FloatPair, HostFunctionError>
+    floatToMantExp(Slice const& x) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
+    floatCompare(Slice const& x, Slice const& y) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatAdd(Slice const& x, Slice const& y, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatSubtract(Slice const& x, Slice const& y, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatMultiply(Slice const& x, Slice const& y, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatDivide(Slice const& x, Slice const& y, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatRoot(Slice const& x, int32_t n, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
+    floatPower(Slice const& x, int32_t n, int32_t mode) const
+    {
+        return std::unexpected(HostFunctionError::Unimplemented);
+    }
+
+    virtual ~HostFunctions() = default;
+    // LCOV_EXCL_STOP
+};
+
+using HFRef = std::reference_wrapper<HostFunctions>;
+
+}  // namespace xrpl
@@ -0,0 +1,313 @@
+#pragma once
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/insight/Event.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/core/CollectorManager.h>
+#include <xrpl/core/ServiceRegistry.h>
+#include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/Keylet.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/UintTypes.h>
+#include <xrpl/tx/ApplyContext.h>
+#include <xrpl/tx/wasm/HostFunc.h>
+#include <xrpl/tx/wasm/WasmCommon.h>
+
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <expected>
+#include <memory>
+#include <optional>
+#include <string_view>
+
+namespace xrpl {
+
+// Intended to work only through wasm runtime. Don't call them directly, except with unit tests
+class WasmHostFunctionsImpl : public HostFunctions
+{
+    ApplyContext& ctx_;
+
+    Keylet leKey_;
+    mutable std::optional<std::shared_ptr<SLE const>> currentLedgerObj_;
+
+    static int constexpr maxCache = 256;
+    std::array<std::shared_ptr<SLE const>, maxCache> cache_;
+
+    std::optional<Bytes> data_;
+
+public:
+    std::expected<std::shared_ptr<SLE const>, HostFunctionError>
+    getCurrentLedgerObj() const
+    {
+        if (!currentLedgerObj_)
+            currentLedgerObj_ = ctx_.view().read(leKey_);
+        if (*currentLedgerObj_)
+            return *currentLedgerObj_;
+        return std::unexpected(HostFunctionError::LedgerObjNotFound);
+    }
+
+    std::expected<int32_t, HostFunctionError>
+    normalizeCacheIndex(int32_t cacheIdx) const
+    {
+        --cacheIdx;
+        if (cacheIdx < 0 || cacheIdx >= maxCache)
+            return std::unexpected(HostFunctionError::SlotOutRange);
+        if (!cache_[cacheIdx])
+            return std::unexpected(HostFunctionError::EmptySlot);
+        return cacheIdx;
+    }
+
+    template <typename F>
+    void
+    log(std::string_view const& msg, F&& dataFn) const
+    {
+#ifdef DEBUG_OUTPUT
+        auto& j = std::cerr;
+#else
+        if (!getJournal().active(beast::Severity::Trace))
+            return;
+        auto j = getJournal().trace();
+#endif
+        j << "WasmTrace[" << toShortString(leKey_.key) << "]: " << msg << " " << dataFn();
+
+#ifdef DEBUG_OUTPUT
+        j << std::endl;
+#endif
+    }
+
+public:
+    WasmHostFunctionsImpl(ApplyContext& ct, Keylet const& leKey)
+        : HostFunctions(ct.journal), ctx_(ct), leKey_(leKey)
+    {
+    }
+
+    beast::insight::Event
+    executionTimeEvent(std::string_view name) const override
+    {
+        return ctx_.registry.get()
+            .getCollectorManager()
+            .group(std::string{name.data(), name.size()})
+            ->makeEvent("finish_time");
+    }
+
+    bool
+    checkSelf() const override
+    {
+        return !currentLedgerObj_ && !data_ &&
+            std::ranges::none_of(cache_, [](auto const& p) { return !!p; });
+    }
+
+    std::optional<Bytes> const&
+    getData() const
+    {
+        return data_;
+    }
+
+    std::expected<std::uint32_t, HostFunctionError>
+    getLedgerSqn() const override;
+
+    std::expected<std::uint32_t, HostFunctionError>
+    getParentLedgerTime() const override;
+
+    std::expected<Hash, HostFunctionError>
+    getParentLedgerHash() const override;
+
+    std::expected<std::uint32_t, HostFunctionError>
+    getBaseFee() const override;
+
+    std::expected<int32_t, HostFunctionError>
+    isAmendmentEnabled(uint256 const& amendmentId) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    isAmendmentEnabled(std::string_view const& amendmentName) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    cacheLedgerObj(uint256 const& objId, int32_t cacheIdx) override;
+
+    std::expected<Bytes, HostFunctionError>
+    getTxField(SField const& fname) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getCurrentLedgerObjField(SField const& fname) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getLedgerObjField(int32_t cacheIdx, SField const& fname) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getTxNestedField(FieldLocator const& locator) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getCurrentLedgerObjNestedField(FieldLocator const& locator) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getTxArrayLen(SField const& fname) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getCurrentLedgerObjArrayLen(SField const& fname) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getTxNestedArrayLen(FieldLocator const& locator) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    updateData(Slice const& data) override;
+
+    std::expected<int32_t, HostFunctionError>
+    checkSignature(Slice const& message, Slice const& signature, Slice const& pubkey)
+        const override;
+
+    std::expected<Hash, HostFunctionError>
+    computeSha512HalfHash(Slice const& data) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    accountKeylet(AccountID const& account) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    ammKeylet(Asset const& issue1, Asset const& issue2) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    checkKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    credentialKeylet(AccountID const& subject, AccountID const& issuer, Slice const& credentialType)
+        const override;
+
+    std::expected<Bytes, HostFunctionError>
+    didKeylet(AccountID const& account) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    delegateKeylet(AccountID const& account, AccountID const& authorize) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    depositPreauthKeylet(AccountID const& account, AccountID const& authorize) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    escrowKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    trustLineKeylet(AccountID const& account1, AccountID const& account2, Currency const& currency)
+        const override;
+
+    std::expected<Bytes, HostFunctionError>
+    mptokenIssuanceKeylet(AccountID const& issuer, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    mptokenKeylet(MPTID const& mptid, AccountID const& holder) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    nftokenOfferKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    offerKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    oracleKeylet(AccountID const& account, std::uint32_t docId) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    paychannelKeylet(AccountID const& account, AccountID const& destination, std::uint32_t seq)
+        const override;
+
+    std::expected<Bytes, HostFunctionError>
+    permissionedDomainKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    signerListKeylet(AccountID const& account) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    ticketKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    vaultKeylet(AccountID const& account, std::uint32_t seq) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getNFT(AccountID const& account, uint256 const& nftId) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    getNFTIssuer(uint256 const& nftId) const override;
+
+    std::expected<std::uint32_t, HostFunctionError>
+    getNFTTaxon(uint256 const& nftId) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getNFTFlags(uint256 const& nftId) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    getNFTTransferFee(uint256 const& nftId) const override;
+
+    std::expected<std::uint32_t, HostFunctionError>
+    getNFTSequence(uint256 const& nftId) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    trace(std::string_view const& msg, Slice const& data, bool asHex) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    traceNum(std::string_view const& msg, int64_t data) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    traceAccount(std::string_view const& msg, AccountID const& account) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    traceFloat(std::string_view const& msg, Slice const& data) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    traceAmount(std::string_view const& msg, STAmount const& amount) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatFromInt(int64_t x, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatFromUint(uint64_t x, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatFromSTAmount(STAmount const& x, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatFromSTNumber(STNumber const& x, int32_t mode) const override;
+
+    std::expected<int64_t, HostFunctionError>
+    floatToInt(Slice const& x, int32_t mode) const override;
+
+    std::expected<FloatPair, HostFunctionError>
+    floatToMantExp(Slice const& x) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const override;
+
+    std::expected<int32_t, HostFunctionError>
+    floatCompare(Slice const& x, Slice const& y) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatAdd(Slice const& x, Slice const& y, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatSubtract(Slice const& x, Slice const& y, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatMultiply(Slice const& x, Slice const& y, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatDivide(Slice const& x, Slice const& y, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatRoot(Slice const& x, int32_t n, int32_t mode) const override;
+
+    std::expected<Bytes, HostFunctionError>
+    floatPower(Slice const& x, int32_t n, int32_t mode) const override;
+};
+
+}  // namespace xrpl
@@ -0,0 +1,254 @@
+#pragma once
+
+#include <xrpl/tx/wasm/HostFunc.h>
+
+#include <wasm.h>
+
+#include <cstdint>
+
+namespace xrpl {
+
+#define WASM_CB_PARAMS_LIST void *env, wasm_val_vec_t const *params, wasm_val_vec_t *results
+#define WASM_SECONDARY_CB_PARAMS_LIST \
+    HostFunctions &hf, wasm_val_vec_t const *params, wasm_val_vec_t *results
+
+wasm_trap_t* HostFuncMain_wrap(WASM_CB_PARAMS_LIST);
+
+using getLedgerSqn_proto = int32_t(uint8_t*, int32_t);
+wasm_trap_t* getLedgerSqn_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getParentLedgerTime_proto = int32_t(uint8_t*, int32_t);
+wasm_trap_t* getParentLedgerTime_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getParentLedgerHash_proto = int32_t(uint8_t*, int32_t);
+wasm_trap_t* getParentLedgerHash_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getBaseFee_proto = int32_t(uint8_t*, int32_t);
+wasm_trap_t* getBaseFee_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using isAmendmentEnabled_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* isAmendmentEnabled_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using cacheLedgerObj_proto = int32_t(uint8_t const*, int32_t, int32_t);
+wasm_trap_t* cacheLedgerObj_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getTxField_proto = int32_t(int32_t, uint8_t*, int32_t);
+wasm_trap_t* getTxField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getCurrentLedgerObjField_proto = int32_t(int32_t, uint8_t*, int32_t);
+wasm_trap_t* getCurrentLedgerObjField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getLedgerObjField_proto = int32_t(int32_t, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getLedgerObjField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getTxNestedField_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getTxNestedField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getCurrentLedgerObjNestedField_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getCurrentLedgerObjNestedField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getLedgerObjNestedField_proto = int32_t(int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getLedgerObjNestedField_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getTxArrayLen_proto = int32_t(int32_t);
+wasm_trap_t* getTxArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getCurrentLedgerObjArrayLen_proto = int32_t(int32_t);
+wasm_trap_t* getCurrentLedgerObjArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getLedgerObjArrayLen_proto = int32_t(int32_t, int32_t);
+wasm_trap_t* getLedgerObjArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getTxNestedArrayLen_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* getTxNestedArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getCurrentLedgerObjNestedArrayLen_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* getCurrentLedgerObjNestedArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getLedgerObjNestedArrayLen_proto = int32_t(int32_t, uint8_t const*, int32_t);
+wasm_trap_t* getLedgerObjNestedArrayLen_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using updateData_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* updateData_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using checkSignature_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t const*, int32_t);
+wasm_trap_t* checkSignature_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using computeSha512HalfHash_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* computeSha512HalfHash_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using accountKeylet_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* accountKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using ammKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* ammKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using checkKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* checkKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using credentialKeylet_proto = int32_t(
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t*,
+    int32_t);
+wasm_trap_t* credentialKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using delegateKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* delegateKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using depositPreauthKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* depositPreauthKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using didKeylet_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* didKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using escrowKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* escrowKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using trustLineKeylet_proto = int32_t(
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t*,
+    int32_t);
+wasm_trap_t* trustLineKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using mptokenIssuanceKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* mptokenIssuanceKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using mptokenKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* mptokenKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using nftokenOfferKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* nftokenOfferKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using offerKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* offerKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using oracleKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* oracleKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using paychannelKeylet_proto = int32_t(
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t const*,
+    int32_t,
+    uint8_t*,
+    int32_t);
+wasm_trap_t* paychannelKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using permissionedDomainKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* permissionedDomainKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using signerListKeylet_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* signerListKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using ticketKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* ticketKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using vaultKeylet_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* vaultKeylet_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFT_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getNFT_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFTIssuer_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getNFTIssuer_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFTTaxon_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getNFTTaxon_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFTFlags_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* getNFTFlags_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFTTransferFee_proto = int32_t(uint8_t const*, int32_t);
+wasm_trap_t* getNFTTransferFee_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using getNFTSequence_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* getNFTSequence_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using trace_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, int32_t);
+wasm_trap_t* trace_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using traceNum_proto = int32_t(uint8_t const*, int32_t, int64_t);
+wasm_trap_t* traceNum_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using traceAccount_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t);
+wasm_trap_t* traceAccount_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using traceFloat_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t);
+wasm_trap_t* traceFloat_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using traceAmount_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t);
+wasm_trap_t* traceAmount_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatFromInt_proto = int32_t(int64_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatFromInt_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatFromUint_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatFromUint_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatFromSTAmount_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatFromSTAmount_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatFromSTNumber_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatFromSTNumber_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatToInt_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatToInt_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatToMantExp_proto = int32_t(uint8_t const*, int32_t, uint8_t*, int32_t, uint8_t*, int32_t);
+wasm_trap_t* floatToMantExp_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatFromMantExp_proto = int32_t(int64_t, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatFromMantExp_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatCompare_proto = int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t);
+wasm_trap_t* floatCompare_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatAdd_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatAdd_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatSubtract_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatSubtract_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatMultiply_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatMultiply_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatDivide_proto =
+    int32_t(uint8_t const*, int32_t, uint8_t const*, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatDivide_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatRoot_proto = int32_t(uint8_t const*, int32_t, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatRoot_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+using floatPower_proto = int32_t(uint8_t const*, int32_t, int32_t, uint8_t*, int32_t, int32_t);
+wasm_trap_t* floatPower_wrap(WASM_SECONDARY_CB_PARAMS_LIST);
+
+}  // namespace xrpl
@@ -0,0 +1,189 @@
+# WASM Module for Programmable Escrows
+
+This module provides WebAssembly (WASM) execution capabilities for programmable
+escrows on the XRP Ledger. When an escrow is finished, the WASM code runs to
+determine whether the escrow conditions are met, enabling custom programmable
+logic for escrow release conditions.
+
+For the full specification, see
+[XLS-0102: WASM VM](https://xls.xrpl.org/xls/XLS-0102-wasm-vm.html).
+
+## Architecture
+
+The module follows a layered architecture:
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                 WasmEngine (WasmVM.h)                       │
+│         runEscrowWasm(), preflightEscrowWasm()              │
+│              Host function registration                     │
+├─────────────────────────────────────────────────────────────┤
+│                 WasmiEngine (WasmiVM.h)                     │
+│            Low-level wasmi interpreter integration          │
+├─────────────────────────────────────────────────────────────┤
+│    HostFuncWrapper          │       HostFuncImpl            │
+│   C-style WASM bridges      │   C++ implementations         │
+├─────────────────────────────────────────────────────────────┤
+│                   HostFunc (Interface)                      │
+│            Abstract base class for host functions           │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Key Components
+
+- **`WasmVM.h` / `detail/WasmVM.cpp`** - High-level facade providing:
+  - `WasmEngine` singleton that wraps the underlying WASM interpreter
+  - `runEscrowWasm()` - Execute WASM code for escrow finish
+  - `preflightEscrowWasm()` - Validate WASM code during preflight
+  - `createWasmImport()` - Register all host functions
+
+- **`WasmiVM.h` / `detail/WasmiVM.cpp`** - Low-level integration with the
+  [wasmi](https://github.com/wasmi-labs/wasmi) WebAssembly interpreter:
+  - `WasmiEngine` - Manages WASM modules, instances, and execution
+  - Memory management and gas metering
+  - Function invocation and result handling
+
+- **`HostFunc.h`** - Abstract `HostFunctions` base class defining the interface
+  for all callable host functions. Each method returns
+  `std::expected<T, HostFunctionError>`.
+
+- **`HostFuncImpl.h` / `detail/HostFuncImpl*.cpp`** - Concrete
+  `WasmHostFunctionsImpl` class that implements host functions with access to
+  `ApplyContext` for ledger state queries. Implementation split across files:
+  - `HostFuncImpl.cpp` - Core utilities (updateData, checkSignature, etc.)
+  - `HostFuncImplFloat.cpp` - Float/number arithmetic operations
+  - `HostFuncImplGetter.cpp` - Field access (transaction, ledger objects)
+  - `HostFuncImplKeylet.cpp` - Keylet construction functions
+  - `HostFuncImplLedgerHeader.cpp` - Ledger header info access
+  - `HostFuncImplNFT.cpp` - NFT-related queries
+  - `HostFuncImplTrace.cpp` - Debugging/tracing functions
+
+- **`HostFuncWrapper.h` / `detail/HostFuncWrapper.cpp`** - C-style wrapper
+  functions that bridge WASM calls to C++ `HostFunctions` methods. Each host
+  function has:
+  - A `_proto` type alias defining the function signature
+  - A `_wrap` function that extracts parameters and calls the implementation
+
+- **`ParamsHelper.h`** - Utilities for WASM parameter handling:
+  - `WASM_IMPORT_FUNC` / `WASM_IMPORT_FUNC2` macros for registration
+  - `wasmParams()` helper for building parameter vectors
+  - Type conversion between WASM and C++ types
+
+## Host Functions
+
+Host functions allow WASM code to interact with the XRP Ledger. They are
+organized into categories:
+
+- **Ledger Information** - Access ledger sequence, timestamps, hashes, fees
+- **Transaction & Ledger Object Access** - Read fields from the transaction
+  and ledger objects (including the current escrow object)
+- **Keylet Construction** - Build keylets to look up various ledger object types
+- **Cryptography** - Signature verification and hashing
+- **Float Arithmetic** - Mathematical operations for amount calculations
+- **NFT Operations** - Query NFT properties
+- **Tracing/Debugging** - Log messages for debugging
+
+For the complete list of available host functions, their WASM names, and gas
+costs, see the [XLS-0102 specification](https://xls.xrpl.org/xls/XLS-0102-wasm-vm.html)
+or `detail/WasmVM.cpp` where they are registered via `WASM_IMPORT_FUNC2` macros.
+For method signatures, see `HostFunc.h`.
+
+## Gas Model
+
+Each host function has an associated gas cost. The gas cost is specified when
+registering the function in `detail/WasmVM.cpp`:
+
+```cpp
+WASM_IMPORT_FUNC2(i, getLedgerSqn, "get_ledger_sqn", hfs, 60);
+//                                                        ^^ gas cost
+```
+
+WASM execution is metered, and if the gas limit is exceeded, execution fails.
+
+## Entry Point
+
+The WASM module must export a function with the name defined by
+`escrowFunctionName` (currently `"escrow_finish"`). This function:
+
+- Takes no parameters (or parameters passed via host function calls)
+- Returns an `int32_t`:
+  - `1` (or positive): Escrow conditions are met, allow finish
+  - `0` (or negative): Escrow conditions are not met, reject finish
+
+## Adding a New Host Function
+
+To add a new host function, follow these steps:
+
+### 1. Add to HostFunc.h (Base Class)
+
+Add a virtual method declaration with a default implementation that returns an
+error:
+
+```cpp
+virtual std::expected<ReturnType, HostFunctionError>
+myNewFunction(ParamType1 param1, ParamType2 param2)
+{
+    return std::unexpected(HostFunctionError::INTERNAL);
+}
+```
+
+### 2. Add to HostFuncImpl.h (Declaration)
+
+Add the method override declaration in `WasmHostFunctionsImpl`:
+
+```cpp
+std::expected<ReturnType, HostFunctionError>
+myNewFunction(ParamType1 param1, ParamType2 param2) override;
+```
+
+### 3. Implement in detail/HostFuncImpl\*.cpp
+
+Add the implementation in the appropriate file:
+
+```cpp
+std::expected<ReturnType, HostFunctionError>
+WasmHostFunctionsImpl::myNewFunction(ParamType1 param1, ParamType2 param2)
+{
+    // Implementation using ctx (ApplyContext) for ledger access
+    return result;
+}
+```
+
+### 4. Add Wrapper to HostFuncWrapper.h
+
+Add the prototype and wrapper declaration:
+
+```cpp
+using myNewFunction_proto = int32_t(uint8_t const*, int32_t, ...);
+wasm_trap_t*
+myNewFunction_wrap(void* env, wasm_val_vec_t const* params, wasm_val_vec_t* results);
+```
+
+### 5. Implement Wrapper in detail/HostFuncWrapper.cpp
+
+Implement the C-style wrapper that bridges WASM to C++:
+
+```cpp
+wasm_trap_t*
+myNewFunction_wrap(void* env, wasm_val_vec_t const* params, wasm_val_vec_t* results)
+{
+    // Extract parameters from params
+    // Call hfs->myNewFunction(...)
+    // Set results and return
+}
+```
+
+### 6. Register in WasmVM.cpp
+
+Add the function registration in `setCommonHostFunctions()` or
+`createWasmImport()`:
+
+```cpp
+WASM_IMPORT_FUNC2(i, myNewFunction, "my_new_function", hfs, 100);
+//                                   ^^ WASM name       ^^ gas cost
+```
+
+> [!IMPORTANT]
+> New host functions MUST be amendment-gated in `WasmVM.cpp`.
+> Wrap the registration in an amendment check to ensure the function is only
+> available after the corresponding amendment is enabled on the network.
@@ -0,0 +1,241 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/contract.h>
+#include <xrpl/protocol/TER.h>
+
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <optional>
+#include <stdexcept>
+#include <string_view>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+namespace xrpl {
+
+using Bytes = std::vector<std::uint8_t>;
+using Hash = xrpl::uint256;
+using FloatPair = std::pair<int64_t, int32_t>;
+
+// Error signals that cross the wasm boundary as trap messages (the C API has no
+// trap code). WasmiEngine::call maps them to TER: hfErrInternal -> tecINTERNAL,
+// hfErrOutOfGas / wasmi's OutOfFuel -> tecOUT_OF_GAS, anything else ->
+// tecFAILED_PROCESSING.
+//
+// Matched as substrings, not by equality: the C API returns the Rust Debug form
+// of the error, e.g. `Error { kind: Message("HfInternal") }` or
+// `Error { kind: TrapCode(OutOfFuel) }`.
+std::string_view inline constexpr hfErrInternal = "HfInternal";
+std::string_view inline constexpr hfErrOutOfGas = "HfOutOfGas";
+std::string_view inline constexpr wasmiTrapOutOfFuel = "OutOfFuel";
+
+enum class HostFunctionError : int32_t {
+    Unimplemented = -1,
+    FieldNotFound = -2,
+    BufferTooSmall = -3,
+    NoArray = -4,
+    NotLeafField = -5,
+    LocatorMalformed = -6,
+    SlotOutRange = -7,
+    SlotsFull = -8,
+    EmptySlot = -9,
+    LedgerObjNotFound = -10,
+    OutOfTransferLimit = -11,
+    DataFieldTooLarge = -12,
+    PointerOutOfBounds = -13,
+    NoMemExported = -14,
+    InvalidParams = -15,
+    InvalidAccount = -16,
+    InvalidField = -17,
+    IndexOutOfBounds = -18,
+    FloatInputMalformed = -19,
+    FloatComputationError = -20,
+};
+
+enum class WasmTypes { WtI32, WtI64 };
+
+struct Wmem
+{
+    std::uint8_t* p = nullptr;
+    std::size_t s = 0;
+
+    Wmem() = default;
+    Wmem(void* ptr, std::size_t size) : p(reinterpret_cast<std::uint8_t*>(ptr)), s(size)
+    {
+    }
+};
+
+template <typename T>
+struct WasmResult
+{
+    T result;
+    int64_t cost;
+};
+using EscrowResult = WasmResult<int32_t>;
+
+// Engine error when wasm does not run to completion. `cost` is the gas consumed
+// when meaningful (tecOUT_OF_GAS / tecFAILED_PROCESSING; caller writes it to tx
+// metadata); std::nullopt for tecINTERNAL and malformed input (no gas reported).
+struct WasmTER
+{
+    TER ter;
+    std::optional<int64_t> cost;
+};
+
+class FieldLocator
+{
+    int32_t const* ptr_ = nullptr;
+    uint32_t size_ = 0;
+    std::vector<int32_t> buf_;
+
+public:
+    FieldLocator(std::vector<int32_t>&& buf)
+        : ptr_(&buf[0]), size_(buf.size()), buf_(std::move(buf))
+    {
+    }
+
+    FieldLocator(int32_t const* ptr, uint32_t const size) : ptr_(ptr), size_(size)
+    {
+    }
+
+    FieldLocator(FieldLocator const&) = delete;
+    FieldLocator&
+    operator=(FieldLocator const&) = delete;
+    FieldLocator(FieldLocator&&) = default;
+    FieldLocator&
+    operator=(FieldLocator&&) = default;
+
+    int32_t
+    operator[](unsigned i) const
+    {
+        if (i >= size_)
+            Throw<std::runtime_error>("index out of bounds");
+        return ptr_[i];
+    }
+
+    [[nodiscard]] uint32_t
+    size() const
+    {
+        return size_;
+    }
+
+    [[nodiscard]] int32_t const*
+    data() const
+    {
+        return ptr_;
+    }
+
+    [[nodiscard]] bool
+    empty() const
+    {
+        return size_ == 0;
+    }
+};
+
+class WasmRuntimeWrapper
+{
+public:
+    virtual ~WasmRuntimeWrapper() = default;
+
+    virtual Wmem
+    getMem() = 0;
+
+    virtual std::int64_t
+    getGas() = 0;
+
+    virtual std::int64_t
+    setGas(std::int64_t gas) = 0;
+
+    virtual std::int64_t
+    getTransferLimit() = 0;
+
+    virtual std::int64_t
+    setTransferLimit(std::int64_t transferLimit) = 0;
+};
+using RTOptRef = std::optional<std::reference_wrapper<WasmRuntimeWrapper>>;
+
+struct WasmParam
+{
+    // We are not supporting float/double
+
+    WasmTypes type = WasmTypes::WtI32;
+    union
+    {
+        std::int32_t i32;
+        std::int64_t i64 = 0;
+    } of;
+};
+
+template <class... Types>
+inline void
+wasmParamsHlp(std::vector<WasmParam>& v, std::int32_t p, Types&&... args)
+{
+    v.push_back({.type = WasmTypes::WtI32, .of = {.i32 = p}});
+    wasmParamsHlp(v, std::forward<Types>(args)...);
+}
+
+template <class... Types>
+inline void
+wasmParamsHlp(std::vector<WasmParam>& v, std::int64_t p, Types&&... args)
+{
+    v.push_back({.type = WasmTypes::WtI64, .of = {.i64 = p}});
+    wasmParamsHlp(v, std::forward<Types>(args)...);
+}
+
+inline void
+wasmParamsHlp(std::vector<WasmParam>& v)
+{
+}
+
+template <class... Types>
+inline std::vector<WasmParam>
+wasmParams(Types&&... args)
+{
+    std::vector<WasmParam> v;
+    v.reserve(sizeof...(args));
+    wasmParamsHlp(v, std::forward<Types>(args)...);
+    return v;
+}
+
+template <typename T, size_t Size = sizeof(T)>
+constexpr T
+adjustWasmEndianessHlp(T x)
+{
+    static_assert(std::is_integral_v<T>, "Only integral types");
+    if constexpr (Size > 1)
+    {
+        using U = std::make_unsigned_t<T>;
+        U u = static_cast<U>(x);
+        U const low = (u & 0xFF) << ((Size - 1) << 3);
+        u = adjustWasmEndianessHlp<U, Size - 1>(u >> 8);
+        return static_cast<T>(low | u);
+    }
+
+    return x;
+}
+
+template <typename T, size_t Size = sizeof(T)>
+constexpr T
+adjustWasmEndianess(T x)
+{
+    // LCOV_EXCL_START
+    static_assert(std::is_integral_v<T>, "Only integral types");
+    if constexpr (std::endian::native == std::endian::big)
+    {
+        return adjustWasmEndianessHlp(x);
+    }
+    return x;
+    // LCOV_EXCL_STOP
+}
+
+constexpr int32_t
+hfErrorToInt(HostFunctionError e)
+{
+    return static_cast<int32_t>(e);
+}
+
+}  // namespace xrpl
@@ -0,0 +1,126 @@
+#pragma once
+
+#include <xrpl/tx/wasm/HostFunc.h>
+#include <xrpl/tx/wasm/WasmCommon.h>
+
+#include <boost/function_types/function_arity.hpp>
+#include <boost/function_types/parameter_types.hpp>
+#include <boost/function_types/result_type.hpp>
+#include <boost/mpl/vector.hpp>
+
+#include <wasm.h>
+
+#include <cstdint>
+#include <optional>
+#include <string_view>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+namespace bft = boost::function_types;
+
+namespace xrpl {
+
+using wasmSecondaryCbFuncType =
+    wasm_trap_t*(HostFunctions&, wasm_val_vec_t const*, wasm_val_vec_t*);
+
+struct WasmImportFunc
+{
+    std::string_view name;
+    std::optional<WasmTypes> result;
+    std::vector<WasmTypes> params;
+
+    wasmSecondaryCbFuncType* wrap = nullptr;
+    uint32_t gas = 0;
+};
+
+using WasmUserData = std::pair<HFRef, WasmImportFunc>;
+// string - import function name
+using ImportVec = std::unordered_map<std::string_view, WasmUserData>;
+
+template <int N, int C, typename Mpl>
+void
+WasmImpArgs(WasmImportFunc& e)
+{
+    if constexpr (N < C)
+    {
+        using at = boost::mpl::at_c<Mpl, N>::type;
+        if constexpr (std::is_pointer_v<at> || std::is_same_v<at, std::int32_t>)
+        {
+            e.params.push_back(WasmTypes::WtI32);
+        }
+        else if constexpr (std::is_same_v<at, std::int64_t>)
+        {
+            e.params.push_back(WasmTypes::WtI64);
+        }
+        else
+        {
+            static_assert(std::is_pointer_v<at>, "Unsupported argument type");
+        }
+
+        return WasmImpArgs<N + 1, C, Mpl>(e);
+    }
+}
+
+template <typename>
+inline constexpr bool wasmDependentFalse = false;
+
+template <typename Rt>
+void
+WasmImpRet(WasmImportFunc& e)
+{
+    if constexpr (std::is_pointer_v<Rt> || std::is_same_v<Rt, std::int32_t>)
+    {
+        e.result = WasmTypes::WtI32;
+    }
+    else if constexpr (std::is_same_v<Rt, std::int64_t>)
+    {
+        e.result = WasmTypes::WtI64;
+    }
+    else if constexpr (std::is_void_v<Rt>)
+    {
+        e.result.reset();
+    }
+    else
+    {
+        static_assert(wasmDependentFalse<Rt>, "Unsupported return type");
+    }
+}
+
+template <typename F>
+void
+WasmImpFuncHelper(WasmImportFunc& e)
+{
+    using rt = bft::result_type<F>::type;
+    using pt = bft::parameter_types<F>::type;
+    // typename boost::mpl::at_c<mpl, N>::type
+
+    WasmImpRet<rt>(e);
+    WasmImpArgs<0, bft::function_arity<F>::value, pt>(e);
+    // WasmImpWrap(e, std::forward<F>(f));
+}
+
+// imp_name - string literal, must have static lifetime
+template <typename F>
+void
+WasmImpFunc(
+    ImportVec& v,
+    std::string_view impName,
+    wasmSecondaryCbFuncType* fWrap,
+    HostFunctions& hf,
+    uint32_t gas = 0)
+{
+    WasmImportFunc e;
+    e.name = impName;
+    e.wrap = fWrap;
+    e.gas = gas;
+    WasmImpFuncHelper<F>(e);
+    v.emplace(impName, std::make_pair(HFRef(hf), std::move(e)));
+}
+
+#define WASM_IMPORT_FUNC(v, f, ...) WasmImpFunc<f##_proto>(v, #f, &f##_wrap, ##__VA_ARGS__)
+
+// n - string literal name, must have static lifetime
+#define WASM_IMPORT_FUNC2(v, f, n, ...) WasmImpFunc<f##_proto>(v, n, &f##_wrap, ##__VA_ARGS__)
+
+}  // namespace xrpl
@@ -0,0 +1,97 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/tx/wasm/HostFunc.h>
+#include <xrpl/tx/wasm/WasmCommon.h>
+#include <xrpl/tx/wasm/WasmImportsHelper.h>
+
+#include <cstdint>
+#include <expected>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace xrpl {
+
+std::string_view inline constexpr wEnv = "env";
+std::string_view inline constexpr wHostLib = "host_lib";
+std::string_view inline constexpr wMem = "memory";
+std::string_view inline constexpr wStore = "store";
+std::string_view inline constexpr wLoad = "load";
+std::string_view inline constexpr wSize = "size";
+std::string_view inline constexpr wAlloc = "allocate";
+std::string_view inline constexpr wDealloc = "deallocate";
+std::string_view inline constexpr wProcExit = "proc_exit";
+
+std::string_view inline constexpr escrowFunctionName = "escrow_finish";
+
+uint32_t inline constexpr maxPages = 128;  // 8MB = 64KB*128
+
+class WasmiEngine;
+
+class WasmEngine
+{
+    std::unique_ptr<WasmiEngine> const impl_;
+
+    WasmEngine();
+
+public:
+    WasmEngine(WasmEngine const&) = delete;
+    WasmEngine(WasmEngine&&) = delete;
+    WasmEngine&
+    operator=(WasmEngine const&) = delete;
+    WasmEngine&
+    operator=(WasmEngine&&) = delete;
+
+    static WasmEngine&
+    instance();
+
+    std::expected<WasmResult<int32_t>, WasmTER>
+    run(Bytes const& wasmCode,
+        HostFunctions& hfs,
+        int64_t gasLimit,
+        std::string_view funcName = {},
+        std::vector<WasmParam> const& params = {},
+        ImportVec const& imports = {},
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()});
+
+    NotTEC
+    check(
+        Bytes const& wasmCode,
+        HostFunctions& hfs,
+        std::string_view funcName,
+        std::vector<WasmParam> const& params = {},
+        ImportVec const& imports = {},
+        beast::Journal j = beast::Journal{beast::Journal::getNullSink()});
+
+    // Host functions helper functionality
+    void*
+    newTrap(std::string const& txt = std::string());
+
+    [[nodiscard]] beast::Journal
+    getJournal() const;
+};
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+ImportVec
+createWasmImport(HostFunctions& hfs);
+
+std::expected<EscrowResult, WasmTER>
+runEscrowWasm(
+    Bytes const& wasmCode,
+    HostFunctions& hfs,
+    int64_t gasLimit,
+    std::string_view funcName = escrowFunctionName,
+    std::vector<WasmParam> const& params = {});
+
+NotTEC
+preflightEscrowWasm(
+    Bytes const& wasmCode,
+    HostFunctions& hfs,
+    std::string_view funcName = escrowFunctionName,
+    std::vector<WasmParam> const& params = {});
+
+}  // namespace xrpl
@@ -0,0 +1,462 @@
+#pragma once
+
+#include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/tx/wasm/HostFunc.h>
+#include <xrpl/tx/wasm/WasmCommon.h>
+#include <xrpl/tx/wasm/WasmImportsHelper.h>
+#include <xrpl/tx/wasm/WasmVM.h>
+
+#include <wasm.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <expected>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+namespace xrpl {
+
+template <class T, void (*Create)(T*, size_t), void (*Destroy)(T*)>
+class WasmVec
+{
+    using TD = std::remove_pointer_t<decltype(T::data)>;
+    T vec_;
+
+public:
+    WasmVec(size_t s = 0) : vec_ WASM_EMPTY_VEC
+    {
+        if (s > 0)
+            Create(&vec_, s);  // zeroes memory
+    }
+
+    ~WasmVec()
+    {
+        clear();
+    }
+
+    WasmVec(WasmVec const&) = delete;
+    WasmVec&
+    operator=(WasmVec const&) = delete;
+
+    WasmVec(WasmVec&& other) noexcept : vec_ WASM_EMPTY_VEC
+    {
+        *this = std::move(other);
+    }
+
+    WasmVec&
+    operator=(WasmVec&& other) noexcept
+    {
+        if (this != &other)
+        {
+            clear();
+            vec_ = other.vec_;
+            other.vec_ = WASM_EMPTY_VEC;
+        }
+        return *this;
+    }
+
+    void
+    clear()
+    {
+        Destroy(&vec_);  // call destructor for every elements too
+        vec_ = WASM_EMPTY_VEC;
+    }
+
+    T
+    release()
+    {
+        T result = vec_;
+        vec_ = WASM_EMPTY_VEC;
+        return result;
+    }
+
+    T*
+    get()
+    {
+        return &vec_;
+    }
+
+    [[nodiscard]] T const*
+    get() const
+    {
+        return &vec_;
+    }
+
+    TD&
+    operator[](size_t i)
+    {
+        if (i >= vec_.size)
+            Throw<std::runtime_error>("Out of bound");
+        return vec_.data[i];
+    }
+
+    TD const&
+    operator[](size_t i) const
+    {
+        if (i >= vec_.size)
+            Throw<std::runtime_error>("Out of bound");
+        return vec_.data[i];
+    }
+
+    [[nodiscard]] size_t
+    size() const
+    {
+        return vec_.size;
+    }
+
+    [[nodiscard]] bool
+    empty() const
+    {
+        return vec_.size == 0u;
+    }
+};
+
+using WasmValtypeVec =
+    WasmVec<wasm_valtype_vec_t, &wasm_valtype_vec_new_uninitialized, &wasm_valtype_vec_delete>;
+using WasmValVec = WasmVec<wasm_val_vec_t, &wasm_val_vec_new_uninitialized, &wasm_val_vec_delete>;
+using WasmExternVec =
+    WasmVec<wasm_extern_vec_t, &wasm_extern_vec_new_uninitialized, &wasm_extern_vec_delete>;
+using WasmExporttypeVec = WasmVec<
+    wasm_exporttype_vec_t,
+    &wasm_exporttype_vec_new_uninitialized,
+    &wasm_exporttype_vec_delete>;
+using WasmImporttypeVec = WasmVec<
+    wasm_importtype_vec_t,
+    &wasm_importtype_vec_new_uninitialized,
+    &wasm_importtype_vec_delete>;
+
+struct WasmiResult
+{
+    WasmValVec r;
+    // Set iff the call trapped. Holds the TER the trap was classified into
+    // (tecINTERNAL / tecOUT_OF_GAS / tecFAILED_PROCESSING); see
+    // WasmiEngine::call. std::nullopt means the call returned normally.
+    std::optional<TER> ter;
+
+    WasmiResult(unsigned n = 0) : r(n)
+    {
+    }
+
+    WasmiResult() = delete;
+    ~WasmiResult() = default;
+    WasmiResult(WasmiResult&& o) = default;
+    WasmiResult&
+    operator=(WasmiResult&& o) = default;
+};
+
+using ModulePtr = std::unique_ptr<wasm_module_t, decltype(&wasm_module_delete)>;
+using InstancePtr = std::unique_ptr<wasm_instance_t, decltype(&wasm_instance_delete)>;
+using EnginePtr = std::unique_ptr<wasm_engine_t, decltype(&wasm_engine_delete)>;
+using StorePtr = std::unique_ptr<wasm_store_t, decltype(&wasm_store_delete)>;
+
+using FuncInfo = std::pair<wasm_func_t const*, wasm_functype_t const*>;
+
+class InstanceWrapper
+{
+    wasm_store_t* store_ = nullptr;
+    WasmExternVec exports_;
+    mutable int memIdx_ = -1;
+    InstancePtr instance_;
+    beast::Journal j_ = beast::Journal(beast::Journal::getNullSink());
+    std::int64_t transferLimit_ = kWasmTransferLimit;
+
+private:
+    static InstancePtr
+    init(
+        StorePtr& s,
+        ModulePtr& m,
+        WasmExternVec& expt,
+        WasmExternVec const& imports,
+        beast::Journal j);
+
+public:
+    InstanceWrapper() : instance_(nullptr, &wasm_instance_delete) {};
+
+    InstanceWrapper(InstanceWrapper const&) = delete;
+
+    InstanceWrapper(InstanceWrapper&& o) : instance_(nullptr, &wasm_instance_delete)
+    {
+        *this = std::move(o);  // LCOV_EXCL_LINE
+    }
+
+    InstanceWrapper(StorePtr& s, ModulePtr& m, WasmExternVec const& imports, beast::Journal j)
+        : store_(s.get()), instance_(init(s, m, exports_, imports, j)), j_(j)
+    {
+    }
+
+    InstanceWrapper&
+    operator=(InstanceWrapper&& o);
+
+    InstanceWrapper&
+    operator=(InstanceWrapper const&) = delete;
+
+    operator bool() const
+    {
+        return static_cast<bool>(instance_);
+    }
+
+    FuncInfo
+    getFunc(std::string_view funcName, WasmExporttypeVec const& exportTypes) const;
+
+    Wmem
+    getMem() const;
+
+    std::int64_t
+    getGas() const;
+
+    std::int64_t
+    setGas(std::int64_t) const;
+
+    std::int64_t
+    getTransferLimit() const;
+
+    std::int64_t
+    setTransferLimit(std::int64_t);
+};
+
+class ModuleWrapper
+{
+    ModulePtr module_;
+    InstanceWrapper instanceWrap_;
+    WasmExporttypeVec exportTypes_;
+    beast::Journal j_ = beast::Journal(beast::Journal::getNullSink());
+
+public:
+    // LCOV_EXCL_START
+    ModuleWrapper() : module_(nullptr, &wasm_module_delete)
+    {
+    }
+
+    ModuleWrapper(ModuleWrapper&& o) : module_(nullptr, &wasm_module_delete)
+    {
+        *this = std::move(o);
+    }
+    // LCOV_EXCL_STOP
+
+    ModuleWrapper&
+    operator=(ModuleWrapper&& o);
+    ModuleWrapper(
+        StorePtr& s,
+        Bytes const& wasmBin,
+        bool instantiate,
+        ImportVec const& imports,
+        beast::Journal j);
+    ~ModuleWrapper() = default;
+
+    operator bool() const
+    {
+        return instanceWrap_;
+    }
+
+    FuncInfo
+    getFunc(std::string_view funcName) const
+    {
+        return instanceWrap_.getFunc(funcName, exportTypes_);
+    }
+
+    wasm_functype_t const*
+    getFuncType(std::string_view funcName) const;
+
+    Wmem
+    getMem() const
+    {
+        return instanceWrap_.getMem();
+    }
+
+    InstanceWrapper&
+    getInstance(int i = 0)
+    {
+        return instanceWrap_;
+    }
+
+    InstanceWrapper const&
+    getInstance(int i = 0) const
+    {
+        return instanceWrap_;
+    }
+
+    int
+    addInstance(StorePtr& s, WasmExternVec const& imports)
+    {
+        instanceWrap_ = {s, module_, imports, j_};
+        return 0;
+    }
+
+    std::int64_t
+    getGas() const
+    {
+        return instanceWrap_ ? instanceWrap_.getGas() : -1;
+    }
+
+private:
+    static ModulePtr
+    init(StorePtr& s, Bytes const& wasmBin, beast::Journal j);
+
+    WasmExternVec
+    buildImports(StorePtr& s, ImportVec const& imports) const;
+};
+
+class WasmiEngine
+{
+    EnginePtr engine_;
+    StorePtr store_;
+    std::unique_ptr<ModuleWrapper> moduleWrap_;
+    beast::Journal j_ = beast::Journal(beast::Journal::getNullSink());
+
+    std::mutex m_;  // 1 instance mutex
+
+public:
+    WasmiEngine() : engine_(init()), store_(nullptr, &wasm_store_delete)
+    {
+    }
+
+    ~WasmiEngine() = default;
+
+    static EnginePtr
+    init();
+
+    std::expected<WasmResult<int32_t>, WasmTER>
+    run(Bytes const& wasmCode,
+        HostFunctions& hfs,
+        int64_t gas,
+        std::string_view funcName,
+        std::vector<WasmParam> const& params,
+        ImportVec const& imports,
+        beast::Journal j);
+
+    NotTEC
+    check(
+        Bytes const& wasmCode,
+        HostFunctions& hfs,
+        std::string_view funcName,
+        std::vector<WasmParam> const& params,
+        ImportVec const& imports,
+        beast::Journal j);
+
+    [[nodiscard]] std::int64_t
+    getGas() const
+    {
+        return moduleWrap_ ? moduleWrap_->getGas() : -1;  // LCOV_EXCL_LINE
+    }
+
+    // Host functions helper functionality
+    wasm_trap_t*
+    newTrap(std::string const& msg);
+
+    // LCOV_EXCL_START
+    [[nodiscard]] beast::Journal
+    getJournal() const
+    {
+        return j_;
+    }
+    // LCOV_EXCL_STOP
+
+private:
+    [[nodiscard]] InstanceWrapper&
+    getRT(int m = 0, int i = 0) const
+    {
+        if (!moduleWrap_)
+            Throw<std::runtime_error>("no module");
+        return moduleWrap_->getInstance(i);
+    }
+
+    [[nodiscard]] Wmem
+    getMem() const
+    {
+        return moduleWrap_ ? moduleWrap_->getMem() : Wmem();
+    }
+
+    std::expected<WasmResult<int32_t>, WasmTER>
+    runHlp(
+        Bytes const& wasmCode,
+        HostFunctions& hfs,
+        int64_t gas,
+        std::string_view funcName,
+        std::vector<WasmParam> const& params,
+        ImportVec const& imports,
+        beast::Journal j);
+
+    NotTEC
+    checkHlp(
+        Bytes const& wasmCode,
+        HostFunctions& hfs,
+        std::string_view funcName,
+        std::vector<WasmParam> const& params,
+        ImportVec const& imports,
+        beast::Journal j);
+
+    int
+    addModule(Bytes const& wasmCode, bool instantiate, ImportVec const& imports, int64_t gas);
+    void
+    clearModules();
+
+    // int  addInstance();
+
+    int32_t
+    runFunc(std::string_view const funcName, int32_t p);
+
+    int32_t
+    makeModule(Bytes const& wasmCode, WasmExternVec const& imports = {});
+
+    [[nodiscard]] FuncInfo
+    getFunc(std::string_view funcName) const
+    {
+        return moduleWrap_->getFunc(funcName);
+    }
+
+    static std::vector<wasm_val_t>
+    convertParams(std::vector<WasmParam> const& params);
+
+    static int
+    compareParamTypes(wasm_valtype_vec_t const* ftp, std::vector<wasm_val_t> const& p);
+
+    static void
+    addParam(std::vector<wasm_val_t>& in, int32_t p);
+    static void
+    addParam(std::vector<wasm_val_t>& in, int64_t p);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(std::string_view func, Types&&... args);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(FuncInfo const& f, Types&&... args);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(FuncInfo const& f, std::vector<wasm_val_t>& in);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(FuncInfo const& f, std::vector<wasm_val_t>& in, std::int32_t p, Types&&... args);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(FuncInfo const& f, std::vector<wasm_val_t>& in, std::int64_t p, Types&&... args);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(
+        FuncInfo const& f,
+        std::vector<wasm_val_t>& in,
+        uint8_t const* d,
+        int32_t sz,
+        Types&&... args);
+
+    template <int NR, class... Types>
+    inline WasmiResult
+    call(FuncInfo const& f, std::vector<wasm_val_t>& in, Bytes const& p, Types&&... args);
+};
+
+}  // namespace xrpl
@@ -7,8 +7,10 @@ let
  inherit (import ./packages.nix { inherit pkgs; })
    commonPackages
    gccPackage
+    gccVersion
    llvmPackages
    llvmVersion
+    mkVersionedToolLinks
    ;

  # Underlying compiler toolchains to wrap (versions pinned in packages.nix).
@@ -127,6 +129,25 @@ in
      customGcov
      customClangForCiEnv
      customBinutils
+      (mkVersionedToolLinks {
+        name = "gcc";
+        package = customGcc;
+        version = gccVersion;
+        tools = [
+          "gcc"
+          "g++"
+          "cpp"
+        ];
+      })
+      (mkVersionedToolLinks {
+        name = "clang";
+        package = customClang;
+        version = llvmVersion;
+        tools = [
+          "clang"
+          "clang++"
+        ];
+      })
      # CA certificate bundle so HTTPS clients (git, curl, conan) can verify
      # TLS connections without ca-certificates being installed in the system.
      pkgs.cacert
@@ -3,7 +3,9 @@ let
  inherit (import ./packages.nix { inherit pkgs; })
    commonPackages
    gccVersion
+    llvmVersion
    llvmPackages
+    mkVersionedToolLinks
    ;

  # Plain nixpkgs stdenvs — no custom glibc, unlike ci-env.nix.
@@ -15,6 +17,8 @@ let
    {
      stdenv,
      compilerName,
+      version ? null,
+      versionedTools ? [ ],
    }:
    let
      compilerVersion =
@@ -25,9 +29,15 @@ let
            echo "Compiler: "
            ${compilerName} --version
          '';
+      versionedLinks = pkgs.lib.optional (version != null) (mkVersionedToolLinks {
+        name = compilerName;
+        package = stdenv.cc;
+        inherit version;
+        tools = versionedTools;
+      });
    in
    (pkgs.mkShell.override { inherit stdenv; }) {
-      packages = commonPackages;
+      packages = commonPackages ++ versionedLinks;
      shellHook = ''
        echo "Welcome to xrpld development shell";
        ${compilerVersion}
@@ -41,11 +51,22 @@ rec {
  gcc = makeShell {
    stdenv = gccStdenv;
    compilerName = "gcc";
+    version = gccVersion;
+    versionedTools = [
+      "gcc"
+      "g++"
+      "cpp"
+    ];
  };

  clang = makeShell {
    stdenv = clangStdenv;
    compilerName = "clang";
+    version = llvmVersion;
+    versionedTools = [
+      "clang"
+      "clang++"
+    ];
  };

  # Nix provides no compiler; use the one from your system (e.g. Apple Clang).
@@ -12,6 +12,7 @@ COPY nix/packages.nix /tmp/build/nix/packages.nix
 COPY nix/utils.nix /tmp/build/nix/utils.nix
 COPY flake.nix /tmp/build/
 COPY flake.lock /tmp/build/
+COPY rust-toolchain.toml /tmp/build/
 WORKDIR /tmp/build

 FROM builder-source AS builder
@@ -47,7 +47,9 @@ work without `ca-certificates` being installed in the base image.
     [`test_files/cpp/sources/`](./test_files/cpp/sources) with both `g++` and
     `clang++`, and sanitizers, and
   - compiles the Rust test programs in
-     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`.
+     [`test_files/rust/sources/`](./test_files/rust/sources) with `rustc`, and
+     builds the [`test_files/rust/proc_macro/`](./test_files/rust/proc_macro)
+     workspace with `cargo` to exercise proc-macro dylib loading.
 3. **`tester`** — Start again from a clean `BASE_IMAGE` (no Nix toolchain),
   install only the sanitizer runtime libraries
   ([`install-sanitizer-libs.sh`](./install-sanitizer-libs.sh)), and run the
@@ -76,20 +78,23 @@ toolchain being present at runtime. Two pieces make that work:
  [`loader-path.sh`](./loader-path.sh) reports the expected loader path for the
  current architecture, so we can patch the binaries to use the correct loader.

-The build then verifies all of this end to end: the C++ test programs in
-`test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan variants) and
-the Rust test programs in `test_files/rust/sources/` (a hello binary plus panic
-and overflow-check variants) are compiled in `final`, their `PT_INTERP` is
-patched to the target loader, and they are run in the clean `tester` stage to
-confirm each emits the expected diagnostic on a stock base image.
+The build then verifies all of this end to end, and the C++ and Rust programs
+go through the same pipeline: each is compiled in `final`, has its `PT_INTERP`
+patched to the target loader, and is then run in the clean `tester` stage to
+confirm it emits the expected diagnostic on a stock base image. The C++ programs
+are in `test_files/cpp/sources/` (a regular binary plus ASan/TSan/UBSan
+variants); the Rust programs are in `test_files/rust/sources/` (a hello binary
+plus panic and overflow-check variants), plus the `test_files/rust/proc_macro/`
+workspace — a crate whose compilation additionally loads a proc-macro dylib, and
+whose resulting binary is patched and run like the others.

 ## Files

-| File                                                                    | Purpose                                                                       |
-| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
-| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                            |
-| [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.     |
-| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                      |
-| [`./test_files/rust/`](./test_files/rust)                               | Rust rustc smoke test: sources + compile/run scripts.                         |
-| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                         |
-| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images. |
+| File                                                                    | Purpose                                                                              |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| [`./Dockerfile`](./Dockerfile)                                          | Multi-stage build described above.                                                   |
+| [`./loader-path.sh`](./loader-path.sh)                                  | Print the dynamic-linker (`PT_INTERP`) path for the current architecture.            |
+| [`./test_files/cpp/`](./test_files/cpp)                                 | C++ sanitizer smoke test: sources + compile/run scripts.                             |
+| [`./test_files/rust/`](./test_files/rust)                               | Rust smoke test: rustc sources + a cargo proc-macro workspace + compile/run scripts. |
+| [`/bin/check-tools.sh`](../../bin/check-tools.sh)                       | Verify every expected tools are present and runnable.                                |
+| [`/bin/install-sanitizer-libs.sh`](../../bin/install-sanitizer-libs.sh) | Install `libasan`/`libtsan`/`libubsan` runtimes on the supported base images.        |
@@ -40,6 +40,29 @@ compile hello
 compile panic
 compile overflow "-C overflow-checks=on"

+function compile_proc_macro() {
+    local proj="${src_dir}/../proc_macro"
+
+    echo "=== Building proc-macro workspace (cargo) ==="
+    cargo build --manifest-path "${proj}/Cargo.toml" --offline
+
+    local built="${proj}/target/debug/test_macro"
+    if [ ! -f "${built}" ]; then
+        echo "ERROR: built test_macro binary not found at ${built}" >&2
+        exit 1
+    fi
+
+    local binary="${dst_dir}/proc_macro"
+    cp "${built}" "${binary}"
+
+    echo "=== Patching ${binary} to use ${loader} as PT_INTERP ==="
+    patchelf --set-interpreter "${loader}" --remove-rpath "${binary}"
+
+    rm -rf "${proj}/target"
+}
+
+compile_proc_macro
+
 echo "=== All binaries compiled ==="

 ls -la "${dst_dir}"
@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "echo_macro"
+version = "0.0.0"
+
+[[package]]
+name = "test_macro"
+version = "0.0.0"
+dependencies = [
+ "echo_macro",
+]
@@ -0,0 +1,3 @@
+[workspace]
+resolver = "2"
+members = ["echo_macro", "test_macro"]
@@ -0,0 +1,8 @@
+[package]
+name = "echo_macro"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[lib]
+proc-macro = true
@@ -0,0 +1,6 @@
+use proc_macro::TokenStream;
+
+#[proc_macro]
+pub fn define_echo(item: TokenStream) -> TokenStream {
+    format!("fn echo() -> u32 {{ {item} }}").parse().unwrap()
+}
@@ -0,0 +1,8 @@
+[package]
+name = "test_macro"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+echo_macro = { path = "../echo_macro" }
@@ -0,0 +1,9 @@
+use echo_macro::define_echo;
+
+define_echo!(42);
+
+fn main() {
+    let a = echo();
+    println!("proc-macro answer = {a}");
+    assert_eq!(a, 42, "proc-macro expansion produced the wrong value");
+}
@@ -1,7 +1,7 @@
 #!/bin/bash
 # Run pre-compiled Rust binaries and confirm each emits its expected diagnostic.
 # Binaries must already exist in <bins_dir> as <name> for name in
-# {hello,panic,overflow}.
+# {hello,panic,overflow,proc_macro}.

 set -eo pipefail

@@ -54,12 +54,13 @@ declare -A expect=(
    [hello]="Hello from main thread"
    [panic]="explicit panic from test"
    [overflow]="attempt to add with overflow"
+    [proc_macro]="proc-macro answer = 42"
 )

-for name in hello panic overflow; do
+for name in hello panic overflow proc_macro; do
    binary="${bins_dir}/${name}"

-    if [ "${name}" = "hello" ]; then
+    if [ "${name}" = "hello" ] || [ "${name}" = "proc_macro" ]; then
        expected_rc=0
    else
        expected_rc=nonzero