Merge remote-tracking branch 'origin/develop' into bthomee/rpc-method-name-constants

# Conflicts:
#	src/test/basics/PerfLog_test.cpp
#	src/xrpld/perflog/detail/PerfLogImp.cpp

.codecov.yml

@@ -1,32 +1,10 @@
 codecov:
   require_ci_to_pass: true
-  # The C++ and Rust uploads land minutes apart; without this gate Codecov
-  # publishes a near-zero total from whichever one arrives first.
-  notify:
-    after_n_builds: 2
-    wait_for_ci: true
 
 comment:
   behavior: default
   layout: reach,diff,flags,tree,reach
-  show_carryforward_flags: true
-  after_n_builds: 2
-
-# C++ and Rust coverage upload from independent workflows under the `cpp` and
-# `rust` flags; carryforward keeps one language's total when only the other reran.
-flag_management:
-  default_rules:
-    carryforward: true
-  individual_flags:
-    - name: cpp
-      carryforward: true
-      paths:
-        - include/
-        - src/
-    - name: rust
-      carryforward: true
-      paths:
-        - crates/
+  show_carryforward_flags: false
 
 coverage:
   range: "70..85"

.cspell.config.yaml

@@ -67,7 +67,6 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - cdylib
   - canonicalised
   - changespq
   - checkme
@@ -104,7 +103,6 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
-  - desugars
   - desync
   - desynced
   - determ
@@ -130,7 +128,6 @@ words:
   - gcov
   - gcovr
   - ghead
-  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
@@ -140,9 +137,7 @@ words:
   - hwaddress
   - hwrap
   - ifndef
-  - impls
   - inequation
-  - initialiser
   - insuf
   - insuff
   - invasively
@@ -250,7 +245,6 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
-  - qself
   - queuable
   - Raphson
   - rcflags
@@ -303,7 +297,6 @@ words:
   - STATSDCOLLECTOR
   - stissue
   - stnum
-  - stnumber
   - stobj
   - stobject
   - stpath
@@ -315,7 +308,6 @@ words:
   - summands
   - superpeer
   - superpeers
-  - Swatinem
   - takergets
   - takerpays
   - ters
@@ -344,7 +336,6 @@ words:
   - unflatten
   - unfund
   - unimpair
-  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -365,7 +356,6 @@ words:
   - vfalco
   - vinnie
   - wasmi
-  - Werror
   - wextra
   - wptr
   - writeme
@@ -373,9 +363,9 @@ words:
   - wthread
   - xbridge
   - xchain
-  - xfloat
   - ximinez
   - XMACRO
+  - xored
   - xrpkuwait
   - xrpl
   - xrpld

.envrc

@@ -1,3 +1,7 @@
 watch_file nix/*.nix
 
+# The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
+# change in there has to invalidate direnv's cached environment.
+watch_dir conan
+
 use flake

.github/dependabot.yml

@@ -19,20 +19,3 @@ updates:
       github-actions:
         patterns:
           - "*"
-
-  - package-ecosystem: cargo
-    directory: /crates
-    schedule:
-      interval: weekly
-      day: monday
-      time: "04:00"
-      timezone: Etc/GMT
-    commit-message:
-      prefix: "ci: [DEPENDABOT] "
-    target-branch: develop
-    open-pull-requests-limit: 10
-    # Bundle all Rust dependency bumps into a single PR per run to reduce noise.
-    groups:
-      rust-dependencies:
-        patterns:
-          - "*"

.github/scripts/levelization/results/ordering.txt

@@ -82,7 +82,6 @@ test.app > xrpl.tx
 test.basics > test.jtx
 test.basics > xrpl.basics
 test.basics > xrpl.core
-test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
 test.beast > xrpl.basics
@@ -286,10 +285,10 @@ xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
 xrpld.perflog > xrpld.app
-xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
 xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
+xrpld.perflog > xrpl.server
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
 xrpld.rpc > xrpl.core

.github/workflows/cargo-audit.yml

@@ -1,84 +0,0 @@
-# This workflow audits the Rust dependencies in crates/ for known security
-# advisories using cargo-audit. It runs on a weekly schedule, whenever the
-# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
-# scheduled run, a failure opens a tracking issue (matching the clang-tidy
-# workflow's behavior); on push/PR it simply fails the check.
-name: Cargo audit
-
-on:
-  schedule:
-    # 06:32 UTC every Monday.
-    - cron: "32 6 * * 1"
-  push:
-    branches:
-      - "develop"
-      - "release*"
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  pull_request:
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435
-    permissions:
-      contents: read
-      # Needed to open an issue on scheduled failures.
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Run cargo audit
-        id: audit
-        continue-on-error: true
-        run: |
-          set -o pipefail
-          cargo audit | tee /tmp/cargo-audit.txt
-
-      - name: Prepare issue body
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        run: |
-          {
-              echo "## \`cargo audit\` found advisories"
-              echo
-              echo '```'
-              cat /tmp/cargo-audit.txt
-              echo '```'
-              echo
-              echo "---"
-              echo "*This issue was automatically created by the cargo-audit workflow.*"
-          } >/tmp/cargo-audit-issue.md
-
-      - name: Create issue
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
-        with:
-          title: "cargo audit found vulnerabilities"
-          body_file: /tmp/cargo-audit-issue.md
-          labels: "Bug,Security"
-
-      - name: Fail if advisories were found
-        if: ${{ steps.audit.outcome != 'success' }}
-        run: |
-          echo "cargo audit found advisories!"
-          exit 1

.github/workflows/on-pr.yml

@@ -85,7 +85,6 @@ jobs:
             .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
             .github/workflows/reusable-package.yml
-            .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
             .github/workflows/reusable-upload-recipe.yml
@@ -96,7 +95,6 @@ jobs:
             cfg/**
             cmake/**
             conan/**
-            crates/**
             external/**
             include/**
             src/**
@@ -170,13 +168,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   package:
     needs: [should-run, build-test]
     # Packaging consumes the debian/rhel release binaries, which are only built
@@ -220,7 +211,6 @@ jobs:
       - check-rename
       - clang-tidy
       - build-test
-      - rust
       - package
       - upload-recipe
       - notify-clio

.github/workflows/on-trigger.yml

@@ -23,7 +23,6 @@ on:
       - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
       - ".github/workflows/reusable-package.yml"
-      - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
       - ".github/workflows/reusable-upload-recipe.yml"
@@ -34,7 +33,6 @@ on:
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
-      - "crates/**"
       - "external/**"
       - "include/**"
       - "src/**"
@@ -98,11 +96,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   upload-recipe:
     needs: build-test
     # Only run when pushing to the develop branch.

.github/workflows/reusable-build-test-config.yml

@@ -276,7 +276,7 @@ jobs:
         working-directory: ${{ env.BUILD_DIR }}
         run: |
           ldd ./xrpld
-          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+)' | wc -l)" -eq 0 ]; then
+          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+|libgcc)' | wc -l)" -eq 0 ]; then
               echo 'The binary is statically linked.'
           else
               echo 'The binary is dynamically linked.'
@@ -289,14 +289,6 @@ jobs:
         run: |
           ./xrpld --version | grep libvoidstar
 
-      - name: Run Rust tests
-        if: ${{ !inputs.build_only }}
-        working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
-
       - name: Run the separate tests
         if: ${{ !inputs.build_only }}
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
@@ -402,7 +394,6 @@ jobs:
           disable_telem: true
           fail_ci_if_error: true
           files: ${{ env.BUILD_DIR }}/coverage.xml
-          flags: cpp
           plugins: noop
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true

.github/workflows/reusable-clang-tidy.yml

@@ -88,12 +88,6 @@ jobs:
         run: |
           ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
 
-      # clang-tidy needs cxxbridge headers generated from Rust crates
-      - name: Build xrpl_crates
-        working-directory: ${{ env.BUILD_DIR }}
-        run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl_crates
-
       - name: Run clang tidy
         id: run_clang_tidy
         continue-on-error: true

.github/workflows/reusable-rust.yml

@@ -1,86 +0,0 @@
-# Clippy, coverage and documentation for the Rust crates in crates/. Each runs
-# as an independent job on a GitHub-hosted runner, but inside the same container
-# image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints, coverage instrumentation and the cargo cache) matches
-# what production builds use.
-#
-# Rust unit tests are deliberately NOT run here. They run as part of the C++
-# build (reusable-build-test-config.yml), which already compiles the crates on a
-# self-hosted runner, so there is no need to provision a toolchain again.
-name: Rust
-
-on:
-  workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        description: "The Codecov token to use for uploading coverage reports."
-        required: false
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  clippy:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
-
-      - name: Run clippy
-        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
-
-  coverage:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
-
-      - name: Generate coverage report
-        run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
-
-      - name: Upload coverage report
-        if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          disable_search: true
-          disable_telem: true
-          fail_ci_if_error: true
-          files: crates/lcov.info
-          flags: rust
-          plugins: noop
-          token: ${{ secrets.CODECOV_TOKEN }}
-          verbose: true
-
-  doc:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: crates
-
-      - name: Build documentation
-        env:
-          RUSTDOCFLAGS: "-D warnings"
-        run: cargo doc --workspace --no-deps --all-features --locked

.gitignore

@@ -89,6 +89,3 @@ target/
 
 # clangd cache
 /.cache
-
-# Rust build directory
-crates/target

.pre-commit-config.yaml

@@ -62,15 +62,6 @@ repos:
         types_or: [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
-  - repo: local
-    hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo fmt --manifest-path crates/Cargo.toml --all
-        language: system
-        types: [rust]
-        pass_filenames: false # rustfmt formats the whole workspace
-
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
     hooks:

API-CHANGELOG.md

@@ -54,6 +54,8 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 
 ## XRP Ledger server version 3.1.0
 

BUILD.md

@@ -4,34 +4,14 @@
 
 ## Minimum Requirements
 
-See [System Requirements](https://xrpl.org/system-requirements.html).
+For the hardware needed to run a node, see
+[System Requirements](https://xrpl.org/system-requirements.html).
 
-Building xrpld generally requires Git, Python, Conan, CMake, and a C++
-compiler.
-
-- [Python](https://www.python.org/downloads/)
-- [Conan](https://conan.io/downloads.html)
-- [CMake](https://cmake.org/download/)
-
-You can verify that the required tools are installed and runnable with:
-
-```bash
-./bin/check-tools.sh
-```
-
-`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
-
-| Compiler    | Version         |
-| ----------- | --------------- |
-| GCC         | 15.2            |
-| Clang       | 22              |
-| Apple Clang | 21              |
-| MSVC        | 19.44[^windows] |
+For the software needed to build xrpld, see the
+[environment setup guide](./docs/build/environment.md).
 
 ## Operating Systems
 
-Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
-
 ### Linux
 
 The Ubuntu Linux distribution has received the highest level of quality
@@ -47,9 +27,8 @@ CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOY
 
 ### Windows
 
-Windows is used by some engineers for development only.
-
-[^windows]: Windows is not recommended for production use.
+Windows is used by some engineers for development only, and is not recommended
+for production use.
 
 ## Steps
 
@@ -74,37 +53,25 @@ releases](https://github.com/XRPLF/rippled/releases).
 
 ### Set Up Conan
 
-After you have a [C++ development environment](./docs/build/environment.md) ready with Git, Python,
-Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
-
-These instructions assume a basic familiarity with Conan and CMake. If you are
-unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
-[Getting Started][conan-getting-started] walkthrough.
-
-#### Profiles
-
-We recommend that you install our Conan profiles:
+Once your [development environment](./docs/build/environment.md) is ready, set
+Conan up for this repository:
 
 ```bash
-conan config install conan/profiles/ -tf $(conan config home)/profiles/
+./conan/init.sh
 ```
 
-You can check your Conan profile by running:
+That installs our [`global.conf`](./conan/global.conf), our Conan
+[profiles](./conan/profiles), and the `xrplf` remote that hosts some of our
+dependencies. It honours `CONAN_HOME` and never deletes an existing Conan home,
+so it is safe to re-run — it only overwrites the files it manages.
 
-```bash
-conan profile show
-```
+> [!TIP]
+> In the [Nix development shell](./docs/build/nix.md#conan-configuration) this is
+> already done for you: the script runs on entry.
 
-If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
-More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
-
-#### Add xrplf remote
-
-Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
-
-```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-```
+You can inspect the resulting profile with `conan profile show`. If it is not
+suitable for your environment, create a custom profile and pass it to Conan — see
+[Advanced Conan configuration](./docs/build/advanced_conan.md).
 
 ### Set Up Ccache
 
@@ -269,10 +236,14 @@ which is only enabled when the `coverage` option is set, e.g. with
 Prerequisites for the coverage report:
 
 - [gcovr tool][gcovr] (can be installed e.g. with [pip][python-pip])
-- `gcov` for GCC (installed with the compiler by default) or
-- `llvm-cov` for Clang (installed with the compiler by default)
+- `gcov` for GCC or `llvm-cov` for Clang, usually installed with the compiler
 - `Debug` build type
 
+> [!NOTE]
+> Clang coverage is not available in the [Nix development shell](./docs/build/nix.md#building-xrpld-in-the-nix-shell):
+> its `clang` shells do not ship `llvm-cov`. Use a `gcc` shell instead (`.#gcc`,
+> or `.#gcc-plain` on Linux), which provides a `gcov` matching its compiler.
+
 A coverage report is created when the following steps are completed, in order:
 
 1. `xrpld` binary built with instrumentation data, enabled by the `coverage`
@@ -389,10 +360,14 @@ After any updates or changes to dependencies, you may need to do the following:
 4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
+If you are using the Nix development shell, whether prebuilt Conan binaries apply
+depends on your platform — see
+[Prebuilt packages](./docs/build/nix.md#prebuilt-packages).
+
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please [set Conan up](#set-up-conan) so the `xrplf` remote is configured, or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -412,7 +387,6 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
-[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
 [unity-build]: https://en.wikipedia.org/wiki/Unity_build
 [gcovr]: https://gcovr.com/en/stable/getting-started.html

CMakeLists.txt

@@ -158,7 +158,6 @@ if(coverage)
     include(XrplCov)
 endif()
 
-add_subdirectory(crates)
 include(XrplCore)
 include(XrplProtocolAutogen)
 include(XrplInstall)

cmake/XrplCompiler.cmake

@@ -266,10 +266,50 @@ elseif(use_lld)
     )
     if("${LD_VERSION}" MATCHES "LLD")
         target_link_libraries(common INTERFACE -fuse-ld=lld)
+        # remembered for the linker flag probe below
+        set(fuse_ld_flag "-fuse-ld=lld")
     endif()
     unset(LD_VERSION)
 endif()
 
+# Linker warnings are errors where we control the toolchain and the dependencies: CI and the Nix dev shell.
+# On non-Nix macOS we suppress the deployment target warning: an old Conan profile may not pin os.version.
+# Only the new Apple linker understands the flag, so probe the actual linker (lld may be selected above).
+if(is_macos OR is_linux)
+    if(is_ci OR is_nix_compiler)
+        if(is_macos)
+            set(fatal_warnings_flag "-Wl,-fatal_warnings")
+        else()
+            set(fatal_warnings_flag "-Wl,--fatal-warnings")
+        endif()
+        message(
+            STATUS
+            "Treating all linker warnings as errors (${fatal_warnings_flag})"
+        )
+        target_link_options(common INTERFACE "${fatal_warnings_flag}")
+        unset(fatal_warnings_flag)
+    elseif(is_macos)
+        set(silence_flag "-Wl,-deployment_target_mismatches,suppress")
+        set(probe_flags ${fuse_ld_flag} "${silence_flag}")
+        include(CheckLinkerFlag)
+        check_linker_flag(
+            CXX
+            "${probe_flags}"
+            have_deployment_target_mismatches
+        )
+        if(have_deployment_target_mismatches)
+            message(
+                STATUS
+                "Silencing macOS deployment target mismatch warnings (${silence_flag})"
+            )
+            target_link_options(common INTERFACE "${silence_flag}")
+        endif()
+        unset(probe_flags)
+        unset(silence_flag)
+    endif()
+endif()
+unset(fuse_ld_flag)
+
 if(assert)
     foreach(var_ CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_RELEASE)
         string(REGEX REPLACE "[-/]DNDEBUG" "" ${var_} "${${var_}}")

cmake/XrplCore.cmake

@@ -205,17 +205,7 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-# The wasm engine is a Rust crate reached over cxx: the bridge target supplies the
-# generated `lib.h` and `rust/cxx.h` that `tx/wasm` compiles against, and the Rust
-# static library everything downstream links. PUBLIC because the include path travels
-# with the module's own public headers.
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-# Those headers do not exist at configure time, and the header-verification target
-# compiles this module's headers on their own, so both need the crates built first.
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_module(xrpl consensus)
 target_link_libraries(

cmake/XrplCov.cmake

@@ -44,6 +44,7 @@ setup_target_for_coverage_gcovr(
     EXCLUDE
         "src/test"
         "src/tests"
+        "src/benchmarks"
         "include/xrpl/beast/test"
         "include/xrpl/beast/unit_test"
         "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"

conan/init.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
+# Safe to re-run; never deletes the Conan home.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CONAN_DIR="$(conan config home)"
+
+echo "Installing Conan configuration into ${CONAN_DIR}"
+conan config install "${SCRIPT_DIR}/global.conf"
+conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
+# This script manages these files, so make them read-only - Conan does not
+# preserve the source mode. Only the files: the directories must stay writable
+# for `conan config install` to replace them.
+chmod a-w "${CONAN_DIR}/global.conf"
+find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
+
+echo "Adding the xrplf Conan remote"
+# --index 0: our patched recipes must win over Conan Center.
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/

conan/profiles/default

@@ -1,10 +1,7 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
-{% set compiler_version = version %}
-{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
-{% endif %}
 {% if os == "Macos" %}
 {# Minimum macOS the dependencies target. #}
 {# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}

crates/.cargo/config.toml

@@ -1,5 +0,0 @@
-[target.x86_64-unknown-linux-gnu]
-rustflags = ["-C", "link-args=-static-libgcc"]
-
-[target.x86_64-pc-windows-msvc]
-rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -1,59 +0,0 @@
-set(CORROSION_VERSION 0.6.1)
-
-find_package(Corrosion ${CORROSION_VERSION} QUIET)
-if(NOT Corrosion_FOUND)
-    include(FetchContent)
-    FetchContent_Declare(
-        Corrosion
-        GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-        GIT_TAG v${CORROSION_VERSION}
-    )
-    FetchContent_MakeAvailable(Corrosion)
-endif()
-
-corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
-
-file(
-    WRITE "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
-    "# Auto-generated by crates/CMakeLists.txt. Do not edit.\n"
-    "# Neutralizes clang-tidy for corrosion/cxxbridge-generated C++.\n"
-    "# One check kept enabled to avoid clang-tidy's \"no checks enabled\" error.\n"
-    "Checks: '-*,google-readability-todo'\n"
-    "WarningsAsErrors: ''\n"
-    "HeaderFilterRegex: ''\n"
-    "InheritParentConfig: false\n"
-)
-
-# Umbrella target that aggregates all crate-generated code (cxxbridge headers,
-# etc.). Build this before running clang-tidy so generated headers are present.
-add_custom_target(xrpl_crates)
-
-# add_xrpl_crate(<name> CRATE <crate> FILES <file>...) Creates a cxxbridge
-# target <name>_cxxbridge and registers it with xrpl_crates.
-function(add_xrpl_crate name)
-    cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
-    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
-                            ${ARG_FILES}
-    )
-    # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
-    # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
-    # existence check — build-time ordering is enforced by the custom commands.
-    set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
-    add_dependencies(xrpl_crates ${name}_cxxbridge)
-endfunction()
-
-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-# Test-only, and deliberately not part of xrpl_wasm_vm_ffi: it carries the `wat` assembler,
-# which the engine's `wasmi default-features = false` exists to keep out of the consensus
-# path. Linked from src/tests/libxrpl only, so the shipped node cannot contain it.
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-# The wasm bridge `include!`s a project header, so its generated translation unit needs
-# the project's include root. Deliberately only that: a header reached from here must
-# stay light enough to compile without the Boost paths this target does not get, which
-# is why `HostContext.h` forward-declares `xrpl::HostFunctions` instead of including it.
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)

crates/Cargo.lock

@@ -1,497 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "cc"
-version = "1.2.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "codespan-reporting"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
-dependencies = [
- "serde",
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "cxx"
-version = "1.0.198"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
-dependencies = [
- "cc",
- "cxx-build",
- "cxxbridge-cmd",
- "cxxbridge-flags",
- "cxxbridge-macro",
- "foldhash 0.2.0",
- "link-cplusplus",
-]
-
-[[package]]
-name = "cxx-build"
-version = "1.0.198"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
-dependencies = [
- "cc",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "scratch",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-cmd"
-version = "1.0.198"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
-dependencies = [
- "clap",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-flags"
-version = "1.0.198"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
-
-[[package]]
-name = "cxxbridge-macro"
-version = "1.0.198"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
-dependencies = [
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.0",
-]
-
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "link-cplusplus"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f78c730aaa7d0b9336a299029ea49f9ee53b0ed06e9202e8cb7db9bae7b8c82"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "scratch"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
-
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.239.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.239.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]

crates/Cargo.toml

@@ -1,15 +0,0 @@
-[workspace]
-members = ["xrpl-wasm-vm-ffi", "xrpl-wasm-vm", "xrpl-wasm-testkit", "xrpl-host-functions", "xrpl-host-functions-macros"]
-resolver = "3"
-
-[workspace.dependencies]
-cxx = { version = "1.0.198", features = ["c++20"] }
-
-[workspace.package]
-edition = "2024"
-
-[profile.release]
-opt-level = 3
-overflow-checks = true
-lto = true
-debug = true

crates/xrpl-host-functions-macros/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The expansion names `::xrpl_host_functions::HostFnSpec`, so the doctest needs the
-# facade crate. Cargo allows this cycle because dev-dependencies are outside the
-# library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"

crates/xrpl-host-functions-macros/src/errors.rs

@@ -1,12 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,384 +0,0 @@
-mod errors;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the expansion refers to and holds the one declaration
-/// block. The expansion names those types by absolute path, so a call site needs
-/// `xrpl-host-functions` as a dependency but no imports from it.
-///
-/// ```
-/// use xrpl_host_functions::HostResult;
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // A `HostFunctions` trait, holding the declarations verbatim:
-/// struct Host;
-/// impl HostFunctions for Host {
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize> {
-///         out[..4].copy_from_slice(&7u32.to_le_bytes());
-///         Ok(4)
-///     }
-///     fn trace_num(&self, _msg: &str, _number: i64) -> HostResult<()> { Ok(()) }
-/// }
-///
-/// // A `HostFunctionSpec` enum carrying the ABI metadata as a `const` table:
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.gas(), 60);
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_name(), "trace_num");
-/// assert_eq!(HostFunctionSpec::ALL.len(), 2);
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self` and returning
-/// `HostResult<T>`, with no body and no generics: it maps to exactly one wasm
-/// import signature. Two declarations may not share a `wasm_name`, nor collapse to
-/// the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(generate(&parsed))
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore. C++'s
-        /// `setData` is the reference point: it wrote only on a value that fit.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec::wasm_name`] and
-        /// [`HostFunctionSpec::gas`] read from.
-        ///
-        /// Private, and the only reason it exists is to keep both of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self) -> HostResult < [u8 ; 4] > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , }",
-            "const fn spec (self) -> HostFnSpec",
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The expansion stands alone: every name in it is either generated here or
-    /// written in the declarations, so it cannot depend on the crate it lands in.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // `Self::Variant` is the only path the expansion may build: anything else
-        // would reach out of the generated code. Doc comments spell paths without
-        // spaces (`Self::ALL`), so they do not match.
-        for (index, _) in generated.match_indices(" :: ") {
-            assert!(
-                generated[..index].ends_with("Self"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions-macros/src/parsed_host_function.rs

@@ -1,871 +0,0 @@
-use proc_macro2::TokenStream;
-use quote::{format_ident, quote};
-use syn::{
-    Attribute, Expr, ExprLit, Ident, Lit, LitStr, PathArguments, ReceiverKind, ReturnType, Safety,
-    Signature, TraitItemFn, Type, TypePath,
-};
-
-use crate::errors;
-
-/// `#[gas = N]`: the base gas charged before the call runs.
-const GAS: &str = "gas";
-/// `#[wasm_name = "..."]`: the name the guest imports the function under.
-const WASM_NAME: &str = "wasm_name";
-/// `///` desugars to `#[doc = "..."]` before macro expansion.
-const DOC: &str = "doc";
-/// The alias every declaration returns its success type through.
-const HOST_RESULT: &str = "HostResult";
-
-/// One entry of a `host_functions!` block: its ABI metadata and its signature.
-pub(crate) struct ParsedHostFunction {
-    pub(crate) gas: u64,
-    /// Kept as the literal the user wrote, so diagnostics and the generated
-    /// string both carry that span.
-    pub(crate) wasm_name: LitStr,
-    /// Doc comments, in source order, to re-emit on the generated items.
-    pub(crate) docs: Vec<Attribute>,
-    /// The enum variant this declaration becomes, spanned at the function name.
-    pub(crate) variant: Ident,
-    pub(crate) signature: Signature,
-}
-
-impl ParsedHostFunction {
-    /// `#[doc …] fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;`
-    pub(crate) fn trait_method(&self) -> TokenStream {
-        let docs = &self.docs;
-        // The declaration is already a trait method: emitted verbatim, so what
-        // the block reads like is what the trait is.
-        let signature = &self.signature;
-
-        quote! {
-            #(#docs)*
-            #signature;
-        }
-    }
-
-    /// `#[doc …] GetLedgerSqn`
-    pub(crate) fn variant_declaration(&self) -> TokenStream {
-        let docs = &self.docs;
-        let variant = &self.variant;
-        quote! {
-            #(#docs)*
-            #variant
-        }
-    }
-
-    /// `Self::GetLedgerSqn => HostFnSpec { name: "ldgr_index", gas: 60u64 }`
-    pub(crate) fn spec_arm(&self) -> TokenStream {
-        let Self {
-            gas,
-            wasm_name,
-            variant,
-            ..
-        } = self;
-        quote! {
-            Self::#variant => HostFnSpec { name: #wasm_name, gas: #gas }
-        }
-    }
-
-    pub(crate) fn parse(function: TraitItemFn) -> syn::Result<Self> {
-        let mut gas = None;
-        let mut wasm_name = None;
-        let mut docs = Vec::new();
-        let mut errors = Vec::new();
-
-        // Tracked separately from `gas`/`wasm_name` so a malformed attribute is
-        // not also reported as a missing one.
-        let mut saw_gas = false;
-        let mut saw_wasm_name = false;
-
-        for attr in function.attrs {
-            if attr.path().is_ident(GAS) {
-                saw_gas = true;
-                if let Err(error) = int_value(&attr).and_then(|v| set_once(&mut gas, v, &attr)) {
-                    errors.push(error);
-                }
-            } else if attr.path().is_ident(WASM_NAME) {
-                saw_wasm_name = true;
-                if let Err(error) =
-                    string_value(&attr).and_then(|v| set_once(&mut wasm_name, v, &attr))
-                {
-                    errors.push(error);
-                }
-            } else if attr.path().is_ident(DOC) {
-                docs.push(attr);
-            } else {
-                errors.push(syn::Error::new_spanned(
-                    &attr,
-                    format!("unexpected attribute `{}`", path_name(&attr)),
-                ));
-            }
-        }
-
-        if !saw_gas {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                format!("missing `#[{GAS} = ...]` attribute"),
-            ));
-        }
-        if !saw_wasm_name {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                format!("missing `#[{WASM_NAME} = \"...\"]` attribute"),
-            ));
-        }
-        if let Some(body) = &function.default {
-            errors.push(syn::Error::new_spanned(
-                body,
-                "a host function is implemented by the host, so it must not have a body",
-            ));
-        }
-        if !function.sig.generics.params.is_empty() || function.sig.generics.where_clause.is_some()
-        {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                "a host function must not be generic: it maps to one wasm import signature",
-            ));
-        }
-        errors.extend(check_receiver(&function.sig).err());
-        errors.extend(check_return_type(&function.sig).err());
-        if let Some(name) = &wasm_name {
-            errors.extend(check_wasm_name(name).err());
-        }
-        reject_modifiers(&function.sig, &mut errors);
-
-        // A name whose PascalCase form is not a legal variant is reported here
-        // rather than emitted, which would either panic or fail downstream.
-        let variant = match variant_ident(&function.sig.ident) {
-            Ok(variant) => Some(variant),
-            Err(error) => {
-                errors.push(error);
-                None
-            }
-        };
-
-        if let Some(error) = errors::combine(errors) {
-            return Err(error);
-        }
-
-        let (Some(gas), Some(wasm_name), Some(variant)) = (gas, wasm_name, variant) else {
-            unreachable!("every absent field is reported above");
-        };
-
-        Ok(Self {
-            gas,
-            wasm_name,
-            docs,
-            variant,
-            signature: function.sig,
-        })
-    }
-}
-
-/// Every declaration carries a receiver, and it is always `&self`.
-///
-/// `&self` is the only receiver that can work: the VM reaches the host through a
-/// shared `&dyn HostFunctions` stored in the wasmi `Store`, and a host that needs
-/// to mutate does so behind interior mutability. The receiver is not part of the
-/// wasm ABI — the guest passes no `self` — so it is uniform across the block.
-fn check_receiver(signature: &Signature) -> syn::Result<()> {
-    let Some(receiver) = signature.receiver() else {
-        return Err(syn::Error::new_spanned(
-            &signature.ident,
-            format!(
-                "a host function must declare its receiver: `fn {}(&self, ...)`",
-                signature.ident
-            ),
-        ));
-    };
-
-    // `&self` and nothing else: not `&mut self`, not `self`/`mut self`, not a
-    // typed `self: Box<Self>`, and not a spelled-out lifetime.
-    if !matches!(receiver.kind, ReceiverKind::Reference(_, None, None)) {
-        return Err(syn::Error::new_spanned(
-            receiver,
-            "a host function's receiver must be exactly `&self`: the VM calls the host \
-             through a shared `&dyn HostFunctions`",
-        ));
-    }
-    Ok(())
-}
-
-/// Every declaration returns `HostResult<T>`, including the ones that yield
-/// nothing (`HostResult<()>`).
-///
-/// One shape for every function is what lets a single dispatch adapter lower them
-/// all: lift the arguments out of guest memory, call the host, then turn `Ok(T)`
-/// into the wire's non-negative `i32` and `Err(e)` into a negative code or a trap.
-/// A function returning a bare `T` would need its own arm.
-fn check_return_type(signature: &Signature) -> syn::Result<()> {
-    const SHAPE: &str = "a host function must return `HostResult<T>` — \
-                         `HostResult<()>` if it yields nothing";
-
-    let ReturnType::Type(_, returned) = &signature.output else {
-        return Err(syn::Error::new_spanned(&signature.ident, SHAPE));
-    };
-
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = &**returned
-    else {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    };
-    // The last segment only, so `HostResult<T>` may be written qualified.
-    let Some(last) = path.segments.last() else {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    };
-    if last.ident != HOST_RESULT {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    }
-
-    // `HostResult` without its success type is `HostResult` the alias, which names
-    // no type; rustc's own message for that is unhelpfully far from the cause.
-    let PathArguments::AngleBracketed(arguments) = &last.arguments else {
-        return Err(syn::Error::new_spanned(
-            returned,
-            format!("`{HOST_RESULT}` needs its success type: `{HOST_RESULT}<T>`"),
-        ));
-    };
-    if arguments.args.len() != 1 {
-        return Err(syn::Error::new_spanned(
-            arguments,
-            format!("`{HOST_RESULT}` takes exactly one type: `{HOST_RESULT}<T>`"),
-        ));
-    }
-    Ok(())
-}
-
-/// `const`, `async`, `unsafe`/`safe` and `extern "…"` have no meaning in the
-/// wasm ABI, and would otherwise pass silently into the generated trait.
-fn reject_modifiers(signature: &Signature, errors: &mut Vec<syn::Error>) {
-    const PLAIN: &str =
-        "a host function must be a plain `fn`: this modifier is not part of the wasm ABI";
-
-    if let Some(constness) = &signature.constness {
-        errors.push(syn::Error::new_spanned(constness, PLAIN));
-    }
-    if let Some(asyncness) = &signature.asyncness {
-        errors.push(syn::Error::new_spanned(asyncness, PLAIN));
-    }
-    match &signature.safety {
-        Safety::Default => {}
-        Safety::Safe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
-        Safety::Unsafe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
-    }
-    if let Some(abi) = &signature.abi {
-        errors.push(syn::Error::new_spanned(abi, PLAIN));
-    }
-}
-
-/// The wasm import name reaches the engine's import table verbatim, so it is
-/// held to what an import name can sanely be rather than to any string.
-fn check_wasm_name(name: &LitStr) -> syn::Result<()> {
-    let value = name.value();
-    if value.is_empty() {
-        return Err(syn::Error::new_spanned(
-            name,
-            "the wasm name must not be empty",
-        ));
-    }
-    if let Some(character) = value
-        .chars()
-        .find(|c| !c.is_ascii_alphanumeric() && *c != '_')
-    {
-        return Err(syn::Error::new_spanned(
-            name,
-            format!(
-                "a wasm name may only contain `A-Za-z0-9_`, but this one contains {character:?}"
-            ),
-        ));
-    }
-    Ok(())
-}
-
-/// The enum variant a declaration becomes: `get_ledger_sqn` -> `GetLedgerSqn`.
-///
-/// The result carries `ident`'s span, so anything the compiler says about the
-/// variant points at the declaration that produced it.
-fn variant_ident(ident: &Ident) -> syn::Result<Ident> {
-    // `to_string` spells raw identifiers `r#type`; the `r#` is not part of the name.
-    let name = ident.to_string();
-    let name = name.strip_prefix("r#").unwrap_or(&name);
-
-    let mut pascal = String::with_capacity(name.len());
-    let mut capitalize = true;
-    for character in name.chars() {
-        if character == '_' {
-            capitalize = true;
-        } else if capitalize {
-            pascal.extend(character.to_uppercase());
-            capitalize = false;
-        } else {
-            pascal.push(character);
-        }
-    }
-
-    // A name of nothing but underscores leaves `pascal` empty; the original is
-    // already a legal identifier, so keep it.
-    if pascal.is_empty() {
-        return Ok(ident.clone());
-    }
-
-    // `Ident::new` panics on a leading digit (`_2fa` -> `2fa`) and silently
-    // accepts keyword spellings (`self_` -> `Self`), which then fails to parse
-    // where the variant is emitted. Parsing rejects both, without panicking.
-    if let Err(error) = syn::parse_str::<Ident>(&pascal) {
-        return Err(syn::Error::new_spanned(
-            ident,
-            format!(
-                "this name becomes the enum variant `{pascal}`, which is not a valid \
-                 variant name ({error}); rename the host function"
-            ),
-        ));
-    }
-    Ok(format_ident!("{pascal}", span = ident.span()))
-}
-
-/// Records `value`, or reports that the attribute appeared more than once.
-fn set_once<T>(slot: &mut Option<T>, value: T, attr: &Attribute) -> syn::Result<()> {
-    if slot.replace(value).is_some() {
-        return Err(syn::Error::new_spanned(
-            attr,
-            format!("duplicate `{}` attribute", path_name(attr)),
-        ));
-    }
-    Ok(())
-}
-
-fn int_value(attr: &Attribute) -> syn::Result<u64> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(int), ..
-        }) => {
-            // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>`
-            // would report a negative value as "invalid digit found in string".
-            if int.base10_digits().starts_with('-') {
-                return Err(syn::Error::new_spanned(
-                    int,
-                    format!("`{}` must not be negative", path_name(attr)),
-                ));
-            }
-            int.base10_parse()
-        }
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects an integer literal", path_name(attr)),
-        )),
-    }
-}
-
-fn string_value(attr: &Attribute) -> syn::Result<LitStr> {
-    match &attr.meta.require_name_value()?.value {
-        Expr::Lit(ExprLit {
-            lit: Lit::Str(string),
-            ..
-        }) => Ok(string.clone()),
-        other => Err(syn::Error::new_spanned(
-            other,
-            format!("`{}` expects a string literal", path_name(attr)),
-        )),
-    }
-}
-
-/// The attribute's path as written, for diagnostics: `gas`, or `foo::bar`.
-fn path_name(attr: &Attribute) -> String {
-    attr.path()
-        .segments
-        .iter()
-        .map(|segment| segment.ident.to_string())
-        .collect::<Vec<_>>()
-        .join("::")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use quote::ToTokens;
-    use syn::parse_quote;
-
-    /// The message of every diagnostic recorded by one failed `parse`.
-    ///
-    /// `expect_err` is unavailable here: it needs `T: Debug`, and syn only
-    /// implements `Debug` for its AST types under the `extra-traits` feature.
-    fn messages(function: TraitItemFn) -> Vec<String> {
-        let Err(error) = ParsedHostFunction::parse(function) else {
-            panic!("expected parsing to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    fn doc_text(attr: &Attribute) -> String {
-        match &attr.meta.require_name_value().unwrap().value {
-            Expr::Lit(ExprLit {
-                lit: Lit::Str(text),
-                ..
-            }) => text.value(),
-            _ => panic!("doc attribute is not a string literal"),
-        }
-    }
-
-    #[test]
-    fn reads_gas_and_wasm_name() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert_eq!(parsed.gas, 60);
-        assert_eq!(parsed.wasm_name.value(), "ldgr_index");
-        assert_eq!(parsed.signature.ident.to_string(), "get_ledger_sqn");
-        assert_eq!(parsed.variant.to_string(), "GetLedgerSqn");
-        assert!(parsed.docs.is_empty());
-    }
-
-    #[test]
-    fn derives_variant_names_from_function_names() {
-        for (function, variant) in [
-            ("get_ledger_sqn", "GetLedgerSqn"),
-            ("sha512_half", "Sha512Half"),
-            ("trace", "Trace"),
-            ("get_current_ledger_obj_field", "GetCurrentLedgerObjField"),
-            ("r#type", "Type"),
-            ("trace2", "Trace2"),
-            // Pathological, but must not panic: no letters to capitalize.
-            ("__", "__"),
-        ] {
-            let ident = format_ident!("{function}");
-            assert_eq!(
-                variant_ident(&ident).map(|v| v.to_string()).ok(),
-                Some(variant.to_owned()),
-                "{function}"
-            );
-        }
-    }
-
-    /// `_2fa` would PascalCase to `2fa`; building that `Ident` panics, and a
-    /// panic in a proc macro is reported with no useful span at all.
-    #[test]
-    fn rejects_a_name_that_becomes_a_leading_digit() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "two_factor"]
-            fn _2fa(&self) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("becomes the enum variant `2fa`"),
-            "{messages:?}"
-        );
-    }
-
-    /// `self_` PascalCases to `Self`, which `Ident::new` accepts and rustc then
-    /// rejects where the variant is emitted. `r#Self` is not a legal escape.
-    #[test]
-    fn rejects_a_name_that_becomes_a_keyword() {
-        for function in ["self_", "_self"] {
-            let ident = format_ident!("{function}");
-            let Err(error) = variant_ident(&ident) else {
-                panic!("expected `{function}` to be rejected");
-            };
-            assert!(
-                error.to_string().contains("variant `Self`"),
-                "{}",
-                error.to_string()
-            );
-        }
-    }
-
-    #[test]
-    fn rejects_negative_gas() {
-        let messages = messages(parse_quote! {
-            #[gas = -5]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert_eq!(messages[0], "`gas` must not be negative");
-    }
-
-    #[test]
-    fn rejects_unusable_wasm_names() {
-        let empty = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = ""]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(empty.len(), 1, "{empty:?}");
-        assert_eq!(empty[0], "the wasm name must not be empty");
-
-        let spaced = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(spaced.len(), 1, "{spaced:?}");
-        assert!(spaced[0].contains("may only contain"), "{spaced:?}");
-    }
-
-    #[test]
-    fn rejects_signature_modifiers() {
-        for declaration in [
-            quote! { unsafe fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { async fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { const fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { extern "C" fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                #declaration
-            })
-            .unwrap();
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "{messages:?}");
-            assert!(messages[0].contains("must be a plain `fn`"), "{messages:?}");
-        }
-    }
-
-    #[test]
-    fn trait_method_keeps_the_declared_receiver_and_ends_in_a_semicolon() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            /// Hashes `data`.
-            #[gas = 2000]
-            #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
-        })
-        .unwrap();
-
-        // `///` reaches the macro as `#[doc = r"..."]`: rustc's lexer spells doc
-        // comments as raw string literals.
-        let method = parsed.trait_method().to_string();
-        assert!(
-            method.starts_with("# [doc = r\" Hashes `data`.\"]"),
-            "{method}"
-        );
-        assert!(
-            method
-                .contains("fn sha512_half (& self , data : & [u8]) -> HostResult < [u8 ; 32] > ;"),
-            "{method}"
-        );
-    }
-
-    #[test]
-    fn spec_arm_carries_the_name_and_the_gas() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert_eq!(
-            parsed.spec_arm().to_string(),
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }"
-        );
-    }
-
-    #[test]
-    fn keeps_doc_comments_in_source_order() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            /// First line.
-            ///
-            /// Third line.
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        let docs: Vec<_> = parsed.docs.iter().map(doc_text).collect();
-        assert_eq!(docs, vec![" First line.", "", " Third line."]);
-    }
-
-    #[test]
-    fn preserves_parameters_and_return_type() {
-        let traced = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 500]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data: &[u8], as_hex: bool) -> HostResult<()>;
-        })
-        .unwrap();
-        // The receiver is `inputs[0]`; the three wasm parameters follow it.
-        assert_eq!(traced.signature.inputs.len(), 4);
-        assert_eq!(
-            traced.signature.output.to_token_stream().to_string(),
-            "-> HostResult < () >"
-        );
-
-        let hashed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 2000]
-            #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; HASH_LEN]>;
-        })
-        .unwrap();
-        assert_eq!(
-            hashed.signature.output.to_token_stream().to_string(),
-            "-> HostResult < [u8 ; HASH_LEN] >"
-        );
-    }
-
-    #[test]
-    fn reports_both_missing_attributes_at_once() {
-        let messages = messages(parse_quote! {
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2);
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn names_the_unexpected_attribute() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wsam_name = "typo"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        // The typo'd attribute, plus the `wasm_name` it failed to be.
-        assert_eq!(messages.len(), 2);
-        assert!(
-            messages.iter().any(|m| m.contains("`wsam_name`")),
-            "{messages:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_wrong_literal_types() {
-        let gas = messages(parse_quote! {
-            #[gas = "60"]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(gas.len(), 1, "{gas:?}");
-        assert!(
-            gas[0].contains("`gas` expects an integer literal"),
-            "{gas:?}"
-        );
-
-        let name = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(name.len(), 1, "{name:?}");
-        assert!(
-            name[0].contains("`wasm_name` expects a string literal"),
-            "{name:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_gas_that_does_not_fit_in_u64() {
-        let messages = messages(parse_quote! {
-            #[gas = 99999999999999999999999]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("number too large"), "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_attribute_shapes_other_than_name_value() {
-        let bare = messages(parse_quote! {
-            #[gas]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(bare.len(), 1, "{bare:?}");
-        assert!(bare[0].contains("gas = ..."), "{bare:?}");
-
-        let list = messages(parse_quote! {
-            #[gas(60)]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(list.len(), 1, "{list:?}");
-    }
-
-    #[test]
-    fn rejects_duplicate_attributes() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[gas = 70]
-            #[wasm_name = "ldgr_index"]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("duplicate `gas`"), "{messages:?}");
-        assert!(
-            messages[1].contains("duplicate `wasm_name`"),
-            "{messages:?}"
-        );
-    }
-
-    /// A malformed attribute must not also be reported as an absent one.
-    #[test]
-    fn does_not_report_a_malformed_attribute_as_missing() {
-        let messages = messages(parse_quote! {
-            #[gas = "60"]
-            #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(
-            !messages.iter().any(|m| m.contains("missing")),
-            "{messages:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_a_body() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> { Ok([0; 4]) }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("must not have a body"), "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_generics() {
-        let parameter = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn<T>(&self) -> HostResult<T>;
-        });
-        assert_eq!(parameter.len(), 1, "{parameter:?}");
-        assert!(
-            parameter[0].contains("must not be generic"),
-            "{parameter:?}"
-        );
-
-        let clause = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> where Self: Sized;
-        });
-        assert_eq!(clause.len(), 1, "{clause:?}");
-    }
-
-    #[test]
-    fn requires_a_receiver() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn() -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("must declare its receiver: `fn get_ledger_sqn(&self, ...)`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Anything but `&self` would need a host the VM cannot hand out: it holds
-    /// one shared `&dyn HostFunctions` for the whole run.
-    #[test]
-    fn rejects_receivers_other_than_shared_self() {
-        for receiver in [
-            quote! { &mut self },
-            quote! { self },
-            quote! { mut self },
-            quote! { self: Box<Self> },
-            quote! { &'a self },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                fn get_ledger_sqn(#receiver) -> HostResult<[u8; 4]>;
-            })
-            .unwrap_or_else(|_| panic!("`{receiver}` should parse"));
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "`{receiver}`: {messages:?}");
-            assert!(
-                messages[0].contains("must be exactly `&self`"),
-                "`{receiver}`: {messages:?}"
-            );
-        }
-    }
-
-    /// A bare `T` return would need its own lowering arm, so the uniform shape is
-    /// required rather than inferred.
-    #[test]
-    fn rejects_returns_that_are_not_host_result() {
-        for output in [
-            quote! {},
-            quote! { -> () },
-            quote! { -> [u8; 4] },
-            quote! { -> i32 },
-            quote! { -> Result<[u8; 4], HostError> },
-            quote! { -> impl Iterator<Item = u8> },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                fn get_ledger_sqn(&self) #output;
-            })
-            .unwrap_or_else(|_| panic!("`{output}` should parse"));
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "`{output}`: {messages:?}");
-            assert!(
-                messages[0].contains("must return `HostResult<T>`"),
-                "`{output}`: {messages:?}"
-            );
-        }
-    }
-
-    /// `HostResult` may be written qualified, since the trait method keeps whatever
-    /// path resolves where the block is written.
-    #[test]
-    fn accepts_a_qualified_host_result() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> xrpl_host_functions::HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert!(
-            parsed
-                .trait_method()
-                .to_string()
-                .contains("xrpl_host_functions :: HostResult < [u8 ; 4] >"),
-            "{}",
-            parsed.trait_method()
-        );
-    }
-
-    /// `HostResult` with no success type names no type at all; rustc's own error
-    /// for that lands on the generated trait, far from the declaration.
-    #[test]
-    fn rejects_host_result_without_a_success_type() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("needs its success type"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions/Cargo.toml

@@ -1,7 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"

crates/xrpl-host-functions/src/lib.rs

@@ -1,539 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`HostResult`], [`HASH_LEN`] — and everything
-//! derived from the declarations is generated. The expansion names nothing this file
-//! does not, so the two sides meet only in the block below.
-//!
-//! So this file is lists — error codes, trace data types, functions. The `macro_rules!`
-//! that expand the first two into enums live in `macros.rs`.
-
-#![no_std]
-
-#[macro_use]
-mod macros;
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::host_functions;
-
-host_errors! {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-trace_data_types! {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its
-    /// name; the answer is `1` if enabled and `0` if not. Unlike the getters, this
-    /// reads an input region and returns the flag directly rather than writing bytes.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Returns the slot used, or a negative error.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a
-    /// non-zero multiple of 4). Reads the locator region and writes the field bytes.
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly, or a negative error (`NoArray` if
-    /// the field is not an array). Reads and writes no memory.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`. Reads the locator region and answers the count directly.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Reads the three regions and
-    /// answers `1` if the signature is valid, `0` if not, or a negative error.
-    ///
-    /// GAS DISCREPANCY: this 300 is the value the C-ABI fork registered
-    /// (`rippled-wasm-host-functions`, WasmVM.cpp), which this port follows. The
-    /// prior C++ integration in this tree charged 35000 for the same call — 100x
-    /// more, and closer to the real cost of signature verification. The value is
-    /// consensus-critical, so confirm which is intended before this ships.
-    #[gas = 300]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a
-    /// byte slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued
-    /// currency + issuer). Reads both asset regions and writes the keylet.
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string. Reads all three regions
-    /// and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account
-    /// and the account it authorizes. Reads both account regions and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit. Reads both account regions and writes the
-    /// keylet.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    /// Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency. Reads all three regions and writes the
-    /// keylet.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number. `seq` is the guest's `u32` carried as its
-    /// `i32` bit pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account. Reads both regions and writes the keylet.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id. `doc_id` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number. `seq` is the
-    /// guest's `u32` carried as its `i32` bit pattern. Reads both account regions and
-    /// writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
-    /// bit pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    /// Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and its
-    /// ticket sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern. Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    /// Reads the account region and writes the keylet.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    ///
-    /// It is also the one declaration that is **not** the wasm parameter order.
-    /// `data_type` is the third wasm parameter, between the two regions, because that
-    /// is where xrpld's `trace_proto` and the guest stdlib put it; `register.rs` takes
-    /// the arguments in wasm order and calls this in declaration order.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data: &[u8], data_type: TraceDataType) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored. Reads the data region; `DataFieldTooLarge`
-    /// if it exceeds the host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`. Reads both regions and writes the URI bytes.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    /// Reads the id region and writes the issuer bytes.
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
-    /// and writes the taxon as its four little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
-    /// and returns the flags as the call's scalar result.
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id
-    /// region and returns the fee as the call's scalar result.
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes). Reads the
-    /// id region and writes the sequence as its four little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`. Writes the
-    /// float bytes; no input region.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`. Reads the integer region and writes the float bytes.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    /// Reads the amount region and writes the float bytes.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    /// Reads the number region and writes the float bytes.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`. Reads the float
-    /// region and writes the integer as its eight little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa and exponent. Reads the float region and
-    /// writes the mantissa (eight little-endian bytes) and the exponent (four little-
-    /// endian bytes) to two separate output regions.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`. Writes the
-    /// float bytes; no input region.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        mode: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, returning a negative, zero, or positive scalar as
-    /// `x` is less than, equal to, or greater than `y`. Reads both float regions.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32>;
-
-    /// The float sum `x + y` under rounding `mode`. Reads both float regions and writes
-    /// the result bytes.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`. Reads both float regions and
-    /// writes the result bytes.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The `n`-th root of the float `x` under rounding `mode`. Reads the float region
-    /// and writes the result bytes.
-    #[gas = 5500]
-    #[wasm_name = "float_root"]
-    fn float_root(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`. Reads the float
-    /// region and writes the result bytes.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-}

crates/xrpl-host-functions/src/macros.rs

@@ -1,102 +0,0 @@
-//! The `macro_rules!` behind the two hand-listed enums, [`crate::HostError`] and
-//! [`crate::TraceDataType`].
-//!
-//! Each takes one list of `Variant = code,` and expands the enum together with the
-//! `ALL`/`code`/`from_code` set that must not fall behind it. The lists themselves stay
-//! in `lib.rs`, beside the `host_functions!` block.
-
-/// Declares [`crate::HostError`] from one list: the variants, `HostError::ALL` and
-/// `HostError::from_code`'s table all expand from the codes given.
-///
-/// One list is what makes `ALL` complete. Rust cannot enumerate an enum's
-/// variants — an exhaustive `match` forces an arm per variant but gives nothing to
-/// iterate — so a hand-written `ALL` beside a hand-written enum could only be kept
-/// in step by review, and `ALL`'s whole purpose is to be the set a test can trust.
-/// A code added to the list gains its `ALL` entry and its `from_code` arm by
-/// construction. `HostFunctionSpec::ALL` is complete the same way, from the
-/// `host_functions!` block.
-macro_rules! host_errors {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// Error codes a host function may return.
-        ///
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum HostError {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl HostError {
-            /// Every error a host function may return, in code order.
-            ///
-            /// The complete set, and complete by construction: a wasm engine's
-            /// split between the codes it hands the guest and the conditions it
-            /// traps on is a decision per variant, so the test that checks the
-            /// split iterates this and a code added to the ABI cannot slip past it.
-            pub const ALL: &'static [HostError] = &[$(HostError::$variant,)+];
-
-            /// The negative wire value a failed call returns. Every code but
-            /// `InternalFatal` is one a guest reads off that value.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// Reconstruct a `HostError` from its wire code.
-            ///
-            /// A code this ABI does not define is `InternalFatal`: an answer the
-            /// caller cannot act on is the call not having been served, and that is
-            /// the variant which says so. Positive values are not errors at all and go
-            /// the same way, since this is reached only once a negative return has
-            /// been read as a failure.
-            pub const fn from_code(code: i32) -> HostError {
-                match code {
-                    $($code => HostError::$variant,)+
-                    _ => HostError::InternalFatal,
-                }
-            }
-        }
-    };
-}
-
-/// Declares [`crate::TraceDataType`] from one list, so `TraceDataType::ALL`,
-/// `TraceDataType::code` and `TraceDataType::from_code` cannot fall behind the
-/// variants — the reason `host_errors!` above is written this way.
-macro_rules! trace_data_types {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// How [`HostFunctions::trace`] is to read its data buffer.
-        ///
-        /// The discriminants are wire values shared with the guest stdlib: append only,
-        /// never renumber. They start at 1, so a zeroed argument names no type rather
-        /// than the first one.
-        ///
-        /// This is the declaration a guest and a host both compile against. The host
-        /// side needs a second one — `cxx` cannot be a dependency here, since this
-        /// crate also links into the guest — so `xrpl-wasm-vm-ffi` declares a shared
-        /// enum for C++ and converts, exhaustively, from this.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum TraceDataType {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl TraceDataType {
-            /// Every data type a guest may name, in code order.
-            pub const ALL: &'static [TraceDataType] = &[$(TraceDataType::$variant,)+];
-
-            /// The wire value a guest passes to name this type.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The type `code` names, or `None`: the engine drops a call it cannot
-            /// read rather than guessing at a rendering the guest did not ask for.
-            pub const fn from_code(code: i32) -> Option<TraceDataType> {
-                match code {
-                    $($code => Some(TraceDataType::$variant),)+
-                    _ => None,
-                }
-            }
-        }
-    };
-}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -1,34 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are the ones the declarations themselves spell.
-
-use xrpl_host_functions::HostResult;
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -1,102 +0,0 @@
-//! Exercises what `host_errors!` generates: the wire codes, the set
-//! [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), error, "{error:?}");
-    }
-}
-
-/// A code from outside the set is `InternalFatal`: a host answering something this ABI
-/// does not define has not served the call, whatever it meant by it, and success is not
-/// an error at all.
-///
-/// `-21` is the code xrpld would append next, so it is the one that decides whether a
-/// list this crate has not caught up with reaches a guest or stops the run. `i32::MIN +
-/// 1` is next to the sentinel and unassigned, which is what makes the sentinel a value
-/// rather than a range.
-#[test]
-fn a_code_outside_the_set_is_internal_fatal() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(
-            HostError::from_code(code),
-            HostError::InternalFatal,
-            "{code}"
-        );
-    }
-}

crates/xrpl-wasm-testkit/Cargo.toml

@@ -1,11 +0,0 @@
-[package]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-wat = "1"

crates/xrpl-wasm-testkit/src/lib.rs

@@ -1,49 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag (review finding A5). Putting `compile_wat` on the production bridge
-//! would link `wat` into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::compile_wat;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }

crates/xrpl-wasm-vm/Cargo.toml

@@ -1,11 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "1.1.0", default-features = false, features = ["std"] }
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-
-[dev-dependencies]
-wat = "1"

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,824 +0,0 @@
-use crate::region::Region;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// [`Region::read`] of the guest's memory, for a call that reads and writes nothing
-/// back (`trace`).
-pub(crate) fn read_borrowed<'a>(
-    caller: &'a Caller<'_, VmState<'_>>,
-    input: Region,
-) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(input.read(mem.data(caller))?)
-}
-
-/// Decode a guest `u32` argument — a keylet's sequence number or document id — from
-/// its four little-endian bytes, carried on to the host as its `i32` bit pattern.
-///
-/// The ABI transports these as a 4-byte region rather than a wasm scalar (the guest
-/// SDK passes `seq.to_le_bytes()`), so the region must be exactly four bytes;
-/// `InvalidParams` otherwise, matching the C-ABI wrapper's `getDataUInt32`.
-pub(crate) fn read_u32_arg(bytes: &[u8]) -> HostResult<i32> {
-    let arr: [u8; 4] = bytes.try_into().map_err(|_| HostError::InvalidParams)?;
-    Ok(i32::from_le_bytes(arr))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region nor the
-/// cap, and both checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: Region,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    // Bounds-checked over the guest's whole declared region, so a buffer running
-    // past memory is a wrong pointer rather than a truncated prefix being served…
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    // …of which only the field cap is writable, so no call can exceed it whatever
-    // the guest declared.
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can borrow any number of input
-/// regions with [`Region::read`] — which a `&mut` view of that memory would forbid.
-/// That is why the answer goes through a buffer instead of straight into the guest
-/// as [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: Region,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: Region,
-    exponent_out: Region,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    // Copy the mantissa, then the exponent, each only if its whole value fits its
-    // region — a region too small is `BufferTooSmall`, with nothing written.
-    let mant_range = mantissa_out.range()?;
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if mant_dst.len() < MANTISSA_BYTES {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-
-    let exp_range = exponent_out.range()?;
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if exp_dst.len() < EXPONENT_BYTES {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::TraceDataType;
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data: &[u8], _data_type: TraceDataType) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_root(&self, _x: &[u8], _n: i32, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/lib.rs

@@ -1,28 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-
-mod abi;
-mod preflight;
-mod region;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check};
-pub use vm::{
-    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, RunError, RunFailure, RunOutcome,
-    TRANSFER_LIMIT_BYTES, run,
-};

crates/xrpl-wasm-vm/src/preflight.rs

@@ -1,351 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the three stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two things it deliberately does not screen. A module exporting **no** linear
-//! memory passes: a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section
-//! passes: it is guest code, and executing it is the one thing a check must not do
-//! — a trap in one is charged to the contract like any other trap.
-//!
-//! One thing it screens that a run can only discover: an exported memory larger
-//! than the engine grants. See [`check_memory`] for what stays invisible.
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::HostFunctionSpec;
-
-use crate::register::HOST_MODULE;
-use crate::vm::{MAX_MEMORY_PAGES, compile};
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory than it may have.
-///
-/// The stages are ordered by how much of the module each explains. An import fault
-/// is reported before a missing entry point because the imports are what the rest of
-/// the module is built on; memory comes last, being a resource request rather than a
-/// mistake about the ABI.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let module = compile(wasm).map_err(CheckError::Compile)?;
-    check_imports(&module)?;
-    check_entry_point(&module, function_name)?;
-    check_memory(&module)
-}
-
-/// Every import must be one the linker defines. The first that is not ends the
-/// check, so a module with several faults reports the earliest.
-fn check_imports(module: &Module) -> Result<(), CheckError> {
-    for import in module.imports() {
-        check_import(import.module(), import.name(), import.ty()).map_err(CheckError::Import)?;
-    }
-    Ok(())
-}
-
-/// Whether the engine defines this one import.
-///
-/// The set of names is [`HostFunctionSpec::ALL`], which is also what
-/// [`crate::register::register_host_functions`] iterates — so a check and a run
-/// cannot disagree about which names exist, and adding a host function extends
-/// both at once. The one thing this does not compare is `ty`'s *signature*, which
-/// still parts a module from the engine at instantiation; the kind is compared
-/// because the engine defines these names as functions and as nothing else.
-///
-/// The rules are ordered, not merely alternatives: a guest importing `env::malloc`
-/// is told about the namespace rather than that `malloc` is not a host function,
-/// because the namespace is the one that explains every other import it has too.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    if !HostFunctionSpec::ALL
-        .iter()
-        .any(|op| op.wasm_name() == name)
-    {
-        return Err(format!("no host function '{name}'"));
-    }
-    if !matches!(ty, ExternType::Func(_)) {
-        return Err(format!("'{HOST_MODULE}::{name}' is not a function"));
-    }
-    Ok(())
-}
-
-fn check_entry_point(module: &Module, name: &str) -> Result<(), CheckError> {
-    match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => Ok(()),
-        found => Err(CheckError::EntryPoint(entry_point_fault(found, name))),
-    }
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may not declare more linear memory than the engine grants.
-///
-/// Only what it *exports* is visible here. A memory a module keeps to itself is not
-/// in its exports, and the store's limiter is what refuses that one — at
-/// instantiation, where the run is charged nothing and the caller cannot tell it
-/// from any other resource failure. Screening the exported case covers every
-/// contract built against the guest SDK, since a contract needs an exported memory
-/// to make a host call at all.
-fn check_memory(module: &Module) -> Result<(), CheckError> {
-    for export in module.exports() {
-        if let ExternType::Memory(ty) = export.ty() {
-            check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
-        }
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`]; what is here is
-/// what a module cannot state precisely — which rule fires, in which order, and in
-/// what words the caller logs it.
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// A host function as a guest declares it. Any function type will do: the
-    /// signature is not what [`check_import`] compares.
-    fn a_function() -> ExternType {
-        ExternType::Func(FuncType::new([ValType::I32], [ValType::I32]))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served. Derived from `ALL` rather than
-    /// listed, so a host function added to the ABI is covered the day it lands.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for op in HostFunctionSpec::ALL {
-            assert_eq!(
-                check_import(HOST_MODULE, op.wasm_name(), &a_function()),
-                Ok(()),
-                "{}",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = check_import(namespace, a_host_function_name(), &a_function())
-                .expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal =
-            check_import(HOST_MODULE, "no_such_function", &a_function()).expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = check_import(HOST_MODULE, name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = check_import("env", "no_such_function", &a_function())
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(Some(a_function()), "finish"),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/region.rs

@@ -1,50 +0,0 @@
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{HostError, HostResult};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// Every byte parameter in this ABI is such a pair, so pairing them once at the wire
-/// boundary is what keeps the helpers in `abi.rs` from each taking two loose integers
-/// they could be handed in either order.
-///
-/// It lives in a module of its own so that the fields are out of reach and
-/// [`range`](Region::range) is the *only* way to indices — the check cannot be
-/// skipped, only deferred. Construction is infallible for that reason: a call whose
-/// output region is malformed is then refused in the order its own helper chooses,
-/// rather than at the moment the pair happened to be formed.
-#[derive(Copy, Clone)]
-pub(crate) struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    pub(crate) fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check — it fails on
-    /// exactly the negative values — and the addition guards a 32-bit `usize`, where
-    /// two `i32`s can sum past the end.
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. No copy: the slice aliases
-    /// `data`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}

crates/xrpl-wasm-vm/src/vm.rs

@@ -1,353 +0,0 @@
-use std::cell::Cell;
-use std::fmt;
-use std::sync::LazyLock;
-use wasmi::{
-    Config, Engine, Export, Linker, Memory, Module, Store, StoreLimits, StoreLimitsBuilder,
-    TrapCode,
-};
-use xrpl_host_functions::HostFunctions;
-
-use crate::abi::{FatalHostError, Fault};
-use crate::preflight::entry_point_fault;
-use crate::register::register_host_functions;
-
-/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
-const WASM_PAGE_BYTES: u32 = 64 * 1024;
-
-/// Linear-memory page cap.
-pub const MAX_MEMORY_PAGES: u32 = 128;
-
-/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
-pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
-
-/// Total bytes that may cross the host/guest boundary in one [`run`], separate
-/// from gas.
-pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
-
-/// Size cap on any single value crossing the boundary, in either direction; over
-/// it is `DataFieldTooLarge`.
-///
-/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
-pub const MAX_FIELD_BYTES: usize = 1024;
-
-/// State threaded through every host call, stored in the wasmi [`Store`].
-pub(crate) struct VmState<'h> {
-    pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`MAX_MEMORY_BYTES`] via `Store::limiter`, which needs a `&mut`
-    /// into it from `&mut VmState` — hence a field rather than a local.
-    pub(crate) mem_limits: StoreLimits,
-    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
-    ///
-    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
-    /// invocation touches the store, so the lack of `Sync` costs nothing.
-    ///
-    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
-    /// until this ABI gains a `FieldLocator` host function.
-    pub(crate) transfer_budget: Cell<u64>,
-    /// The guest's linear memory, resolved once by [`run`] after instantiation so
-    /// no host call pays for an export lookup.
-    ///
-    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
-    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
-    /// re-derive the slice per call.
-    ///
-    /// The handle is scoped to one store, so this assumes **one module, one
-    /// instance, one store per `run`**. Module linking or nested execution would
-    /// have to resolve per instance: a cached handle would serve a call against the
-    /// wrong instance's memory, which is a wrong answer rather than an error.
-    pub(crate) memory: Option<Memory>,
-    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
-    /// to the guest. One buffer per run, so no call zero-fills one of its own.
-    ///
-    /// Inline rather than boxed: the store's data is built once and then only
-    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
-    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
-    /// stack buffer is zero-filled — per call, which is the cost this removes.
-    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
-}
-
-/// Outcome of running an escrow contract to completion.
-#[derive(Debug)]
-pub struct RunOutcome {
-    /// The value returned by the exported entry point (`finish`): `> 0` means
-    /// allow the escrow to finish.
-    pub result: i32,
-    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
-    /// the per-call host charges.
-    pub fuel_used: u64,
-}
-
-/// Why a run produced no result. Each variant is one outcome for the caller to
-/// map to a TER.
-#[derive(Debug)]
-pub enum RunError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// The module compiled but the engine would not accept it: an import the
-    /// linker does not define, or an initial memory past the page cap. Not guest
-    /// code failing — a start section that traps is [`RunError::Trap`].
-    Instantiate(String),
-    /// No export named `function_name` with signature `() -> i32`: absent, not a
-    /// function, or a function of another type — which the detail tells apart.
-    EntryPoint(String),
-    /// Gas exhausted — by the guest's own instructions or by a host call's
-    /// charge. [`RunFailure::fuel_used`] is the whole limit.
-    OutOfGas,
-    /// The host could not serve a call.
-    Internal,
-    /// A host call had no linear memory to work in: the module exports none, or
-    /// the call came from a start section, which runs before there is an instance
-    /// to resolve the memory from.
-    NoMemory,
-    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
-    /// access, or `memory.grow` past the page cap. Wherever the guest was
-    /// executing, including a start section during instantiation.
-    Trap(String),
-}
-
-impl fmt::Display for RunError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            RunError::Compile(detail) => write!(f, "compile: {detail}"),
-            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            RunError::EntryPoint(detail) => write!(f, "{detail}"),
-            RunError::OutOfGas => write!(f, "out of gas"),
-            RunError::Internal => write!(f, "internal error"),
-            RunError::NoMemory => write!(f, "no exported memory"),
-            RunError::Trap(detail) => write!(f, "trap: {detail}"),
-        }
-    }
-}
-
-/// A failed run, with the gas it still owes: a contract that traps or exhausts
-/// its gas is charged for what it burned.
-#[derive(Debug)]
-pub struct RunFailure {
-    pub error: RunError,
-    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
-    /// when the module never ran.
-    pub fuel_used: u64,
-}
-
-impl fmt::Display for RunFailure {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
-    }
-}
-
-impl RunFailure {
-    /// A failure with no fuel accounted: it stopped the run at or before the guest's
-    /// first instruction, or under a store with no meter to read.
-    fn owing_nothing(error: RunError) -> RunFailure {
-        RunFailure {
-            error,
-            fuel_used: 0,
-        }
-    }
-}
-
-/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
-/// trap and refusal all report it the same way.
-///
-/// `Store::get_fuel` fails only on a store without fuel metering, which
-/// [`build_wasm_engine`] rules out and `run`'s `set_fuel` would already have
-/// caught — so a failure here is a defect in this crate. It must not become a
-/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
-/// everything. [`RunError::Internal`] instead.
-fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
-    store
-        .get_fuel()
-        .map(|remaining| gas.saturating_sub(remaining))
-        .map_err(|_| RunError::Internal)
-}
-
-/// Report `error` with the run's cost attached. A cost that cannot be read replaces
-/// the outcome rather than being invented — see [`fuel_used`].
-fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
-    match fuel_used(store, gas) {
-        Ok(fuel_used) => RunFailure { error, fuel_used },
-        Err(unmetered) => RunFailure::owing_nothing(unmetered),
-    }
-}
-
-/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
-/// the stage that raised it.
-///
-/// Two ways a run halts mid-flight: a host call that could not be served, which
-/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
-/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
-///
-/// Both can happen anywhere the guest executes — including a start section, which
-/// is guest code running during instantiation — so every stage from there on asks
-/// this before naming a failure after itself.
-fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
-    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
-        return Some(fatal.0.into());
-    }
-    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
-}
-
-/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
-/// that can arise anywhere.
-///
-/// A start section is guest code, so it can trap on its own — `unreachable`, a
-/// division by zero, an out-of-bounds access — and a trap is the guest's fault
-/// wherever it happens. Naming that after the *stage* would file it beside the
-/// module faults a caller treats as its own defect, and charge nothing for
-/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
-/// module the linker or the store would not accept at all.
-fn instantiation_failure(error: &wasmi::Error) -> RunError {
-    match error.as_trap_code() {
-        Some(_) => RunError::Trap(error.to_string()),
-        None => RunError::Instantiate(error.to_string()),
-    }
-}
-
-/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
-///
-/// Total and one arm each, because a `Fault` is only ever a condition that stops the
-/// run — the guest-visible codes cannot reach here, which is what
-/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
-/// compile.
-impl From<Fault> for RunError {
-    fn from(fault: Fault) -> RunError {
-        match fault {
-            Fault::OutOfGas => RunError::OutOfGas,
-            Fault::Internal => RunError::Internal,
-            Fault::NoMemory => RunError::NoMemory,
-        }
-    }
-}
-
-/// The process-wide wasmi engine, built once on first use.
-///
-/// The configuration is consensus-fixed and identical for every invocation, and an
-/// [`Engine`] is an internally `Arc`ed `Send + Sync` handle, so one shared engine
-/// serves concurrent [`run`] calls.
-pub(crate) fn wasm_engine() -> &'static Engine {
-    static ENGINE: LazyLock<Engine> = LazyLock::new(build_wasm_engine);
-    &ENGINE
-}
-
-/// Build the wasmi engine the escrow VM requires: deterministic, minimal
-/// features, fuel metering on.
-fn build_wasm_engine() -> Engine {
-    let mut config = Config::default();
-    config.consume_fuel(true);
-    config.ignore_custom_sections(true);
-    config.wasm_mutable_global(false);
-    config.wasm_multi_value(false);
-    config.wasm_sign_extension(false);
-    config.wasm_saturating_float_to_int(false);
-    config.wasm_bulk_memory(false);
-    config.wasm_reference_types(false);
-    config.wasm_tail_call(false);
-    config.wasm_extended_const(false);
-    config.floats(false);
-    config.wasm_multi_memory(false);
-    config.wasm_custom_page_sizes(false);
-    config.wasm_memory64(false);
-    config.wasm_wide_arithmetic(false);
-    // TODO: enable option to reject wasm code containing start section after wasmi 2.0 release
-    Engine::new(&config)
-}
-
-/// Compile `wasm` for this engine.
-///
-/// The one path to a [`Module`]: the configuration is what decides whether a
-/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
-/// compile against different ones.
-pub(crate) fn compile(wasm: &[u8]) -> Result<Module, String> {
-    Module::new(wasm_engine(), wasm).map_err(|e| e.to_string())
-}
-
-/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
-/// calls through `host`, and call the exported `function_name`.
-pub fn run<'h>(
-    wasm: &[u8],
-    gas: u64,
-    host: &'h dyn HostFunctions,
-    function_name: &str,
-) -> Result<RunOutcome, RunFailure> {
-    let engine = wasm_engine();
-    let module =
-        compile(wasm).map_err(|detail| RunFailure::owing_nothing(RunError::Compile(detail)))?;
-
-    let mem_limits = StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .trap_on_grow_failure(true)
-        .build();
-    let mut store = Store::new(
-        engine,
-        VmState {
-            host,
-            mem_limits,
-            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        },
-    );
-
-    store
-        .set_fuel(gas)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-    store.limiter(|state| &mut state.mem_limits);
-
-    let mut linker = Linker::<VmState<'h>>::new(engine);
-    register_host_functions(&mut linker)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-
-    let instance = match linker.instantiate_and_start(&mut store, &module) {
-        Ok(instance) => instance,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
-            return Err(failed(&store, gas, error));
-        }
-    };
-    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
-
-    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
-        Ok(function) => function,
-        Err(e) => {
-            let found = instance
-                .get_export(&store, function_name)
-                .map(|export| export.ty(&store));
-            let error =
-                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let result = match function.call(&mut store, ()) {
-        Ok(result) => result,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
-    Ok(RunOutcome { result, fuel_used })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_engine_is_one_engine() {
-        assert!(Engine::same(wasm_engine(), wasm_engine()));
-    }
-
-    /// The only place these numbers appear as literals; every other test derives
-    /// them from the constants.
-    #[test]
-    fn the_limits_are_the_protocol_limits() {
-        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
-        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
-        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
-        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
-    }
-}

crates/xrpl-wasm-vm/tests/budgets.rs

@@ -1,750 +0,0 @@
-//! The two budgets a run spends: gas (fuel), and the transfer limit on bytes
-//! crossing the boundary. Both are consensus input, so several of these tests
-//! assert exact numbers.
-
-mod support;
-
-use support::{
-    Answer, EMPTY_REGION, FakeHost, ONE_PAGE, PLENTY_OF_GAS, code, import, module, run,
-    run_with_gas, trace_call,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, HostFunctionSpec, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError, TRANSFER_LIMIT_BYTES};
-
-// ---------------------------------------------------------------------------
-// Gas
-// ---------------------------------------------------------------------------
-
-/// The fuel a module of `body` burns, given gas to spare.
-fn fuel_for(body: &str, parts: &[&str], host: &FakeHost) -> u64 {
-    let wat = module(parts, body);
-    run(&wat, host).expect("the module should run").fuel_used
-}
-
-/// The fuel a module burns doing nothing but returning a constant; every figure
-/// below builds on it. wasmi's number, pinned deliberately because wasmi's fuel
-/// table is consensus input.
-const EMPTY_MODULE_FUEL: u64 = 30;
-
-/// wasmi's own fuel for a host call whose operands are all constants under 64: 14
-/// per `*.const`, plus 1 for the call. Our gas sits on top.
-///
-/// The formula holds only under 64, because wasmi widens a constant's encoding
-/// above that, each tier costing 7 more. Every call in [`call_for`] keeps its
-/// operands small for that reason; one with a larger constant fails here by a
-/// multiple of 7.
-fn wasmi_call_fuel(small_const_operands: u64) -> u64 {
-    14 * small_const_operands + 1
-}
-
-/// What wasmi charges on top of that for a call to a function with no result —
-/// `trace`'s shape, and nothing else in the ABI. Per call, not per module. Measured
-/// and pinned like the figures above.
-const WASMI_NO_RESULT_FUEL: u64 = 14;
-
-/// wasmi's fuel for one `(drop …)`, which is how a module makes more than one call
-/// and keeps only the last result. Pinned like the two above.
-const WASMI_DROP_FUEL: u64 = 21;
-
-/// The wasm a test needs in order to call one host function: the `(import …)`
-/// declaration, a call with small-constant operands, and how many it pushes.
-struct Call {
-    import: &'static str,
-    call: &'static str,
-    operands: u64,
-    /// Whether the call leaves an `i32` behind. `trace` does not, which is why
-    /// [`Call::body`] ends every module with a constant instead of the call.
-    yields: bool,
-}
-
-impl Call {
-    /// `n` calls in a row, leaving one `i32` for the module to return: the last
-    /// answer where there is one, and a constant where the call has none.
-    fn body(&self, n: usize) -> String {
-        if self.yields {
-            format!(
-                "{}{}",
-                format!("(drop {}) ", self.call).repeat(n - 1),
-                self.call
-            )
-        } else {
-            format!("{}(i32.const 0)", format!("{} ", self.call).repeat(n))
-        }
-    }
-
-    /// What [`Call::body`] burns beside the calls' own gas and the module's floor:
-    /// one `drop` between consecutive answers, or wasmi's own surcharge on a call
-    /// that has none.
-    fn overhead(&self, n: u64) -> u64 {
-        if self.yields {
-            (n - 1) * WASMI_DROP_FUEL
-        } else {
-            n * WASMI_NO_RESULT_FUEL
-        }
-    }
-}
-
-/// The test wasm for each host function. The `match` is exhaustive, so a function
-/// added to the ABI fails to compile until it has wasm here, and iterating
-/// [`HostFunctionSpec::ALL`] then covers the whole ABI.
-fn call_for(op: HostFunctionSpec) -> Call {
-    let (import, call, operands) = match op {
-        HostFunctionSpec::GetLedgerSqn => (
-            import::LDGR_INDEX,
-            "(call $ldgr_index (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetParentLedgerTime => (
-            import::PARENT_LDGR_TIME,
-            "(call $parent_ldgr_time (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetParentLedgerHash => (
-            import::PARENT_LDGR_HASH,
-            "(call $parent_ldgr_hash (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetBaseFee => (
-            import::BASE_FEE,
-            "(call $base_fee (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::IsAmendmentEnabled => (
-            import::AMENDMENT_ENABLED,
-            "(call $amendment_enabled (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::CacheLedgerObj => (
-            import::CACHE_LE,
-            "(call $cache_le (i32.const 0) (i32.const 32) (i32.const 0))",
-            3,
-        ),
-        HostFunctionSpec::GetTxField => (
-            import::TX_FIELD,
-            "(call $tx_field (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjField => (
-            import::HOME_LE_FIELD,
-            "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::GetLedgerObjField => (
-            import::LE_FIELD,
-            "(call $le_field (i32.const 1) (i32.const 1) (i32.const 0) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetTxNestedField => (
-            import::TX_INNER,
-            "(call $tx_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjNestedField => (
-            import::HOME_LE_INNER,
-            "(call $home_le_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetLedgerObjNestedField => (
-            import::LE_INNER,
-            "(call $le_inner (i32.const 1) (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            5,
-        ),
-        HostFunctionSpec::GetTxArrayLen => {
-            (import::TX_ARR_LEN, "(call $tx_arr_len (i32.const 1))", 1)
-        }
-        HostFunctionSpec::GetCurrentLedgerObjArrayLen => (
-            import::HOME_LE_ARR_LEN,
-            "(call $home_le_arr_len (i32.const 1))",
-            1,
-        ),
-        HostFunctionSpec::GetLedgerObjArrayLen => (
-            import::LE_ARR_LEN,
-            "(call $le_arr_len (i32.const 1) (i32.const 1))",
-            2,
-        ),
-        HostFunctionSpec::GetTxNestedArrayLen => (
-            import::TX_INNER_ARR_LEN,
-            "(call $tx_inner_arr_len (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjNestedArrayLen => (
-            import::HOME_LE_INNER_ARR_LEN,
-            "(call $home_le_inner_arr_len (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetLedgerObjNestedArrayLen => (
-            import::LE_INNER_ARR_LEN,
-            "(call $le_inner_arr_len (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::CheckSignature => (
-            import::CHECK_SIG,
-            "(call $check_sig (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0))",
-            6,
-        ),
-        HostFunctionSpec::AccountKeylet => (
-            import::ACCOUNTROOT_ID,
-            "(call $accountroot_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::AmmKeylet => (
-            import::AMM_ID,
-            "(call $amm_id (i32.const 0) (i32.const 20) (i32.const 24) (i32.const 40) (i32.const 0) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::CheckKeylet => (
-            import::CHECK_ID,
-            "(call $check_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::CredentialKeylet => (
-            import::CREDENTIAL_ID,
-            "(call $credential_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 4) (i32.const 44) (i32.const 20))",
-            8,
-        ),
-        HostFunctionSpec::DelegateKeylet => (
-            import::DELEGATE_ID,
-            "(call $delegate_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::DepositPreauthKeylet => (
-            import::DEPOSIT_PREAUTH_ID,
-            "(call $deposit_preauth_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::DidKeylet => (
-            import::DID_ID,
-            "(call $did_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::EscrowKeylet => (
-            import::ESCROW_ID,
-            "(call $escrow_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::TrustLineKeylet => (
-            import::TRUSTLINE_ID,
-            "(call $trustline_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 20) (i32.const 60) (i32.const 32))",
-            8,
-        ),
-        HostFunctionSpec::MptokenIssuanceKeylet => (
-            import::MPT_ISSUANCE_ID,
-            "(call $mpt_issuance_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::MptokenKeylet => (
-            import::MPTOKEN_ID,
-            "(call $mptoken_id (i32.const 0) (i32.const 24) (i32.const 24) (i32.const 20) (i32.const 44) (i32.const 20))",
-            6,
-        ),
-        HostFunctionSpec::NftokenOfferKeylet => (
-            import::NFT_OFFER_ID,
-            "(call $nft_offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::OfferKeylet => (
-            import::OFFER_ID,
-            "(call $offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::OracleKeylet => (
-            import::ORACLE_ID,
-            "(call $oracle_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::PaychannelKeylet => (
-            import::PAYCHAN_ID,
-            "(call $paychan_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 40) (i32.const 20))",
-            8,
-        ),
-        HostFunctionSpec::PermissionedDomainKeylet => (
-            import::PERMISSIONED_DOMAIN_ID,
-            "(call $permissioned_domain_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::SignerListKeylet => (
-            import::SIGNERS_ID,
-            "(call $signers_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::TicketKeylet => (
-            import::TICKET_ID,
-            "(call $ticket_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::VaultKeylet => (
-            import::VAULT_ID,
-            "(call $vault_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::Sha512Half => (
-            import::SHA512_HALF,
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::Trace => (
-            import::TRACE,
-            "(call $trace (i32.const 0) (i32.const 0) (i32.const 1) (i32.const 0) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::UpdateData => (
-            import::SET_DATA,
-            "(call $set_data (i32.const 0) (i32.const 8))",
-            2,
-        ),
-        HostFunctionSpec::GetNft => (
-            import::NFT_URI,
-            "(call $nft_uri (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 32) (i32.const 52) (i32.const 12))",
-            6,
-        ),
-        HostFunctionSpec::GetNftIssuer => (
-            import::NFT_ISSUER,
-            "(call $nft_issuer (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 20))",
-            4,
-        ),
-        HostFunctionSpec::GetNftTaxon => (
-            import::NFT_TAXON,
-            "(call $nft_taxon (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetNftFlags => (
-            import::NFT_FLAGS,
-            "(call $nft_flags (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetNftTransferFee => (
-            import::NFT_XFER_FEE,
-            "(call $nft_xfer_fee (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetNftSequence => (
-            import::NFT_SERIAL,
-            "(call $nft_serial (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::FloatFromInt => (
-            import::FLOAT_FROM_INT,
-            "(call $float_from_int (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 0))",
-            4,
-        ),
-        HostFunctionSpec::FloatFromUint => (
-            import::FLOAT_FROM_UINT,
-            "(call $float_from_uint (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatFromStamount => (
-            import::FLOAT_FROM_STAMOUNT,
-            "(call $float_from_stamount (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatFromStnumber => (
-            import::FLOAT_FROM_STNUMBER,
-            "(call $float_from_stnumber (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatToInt => (
-            import::FLOAT_TO_INT,
-            "(call $float_to_int (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatToMantExp => (
-            import::FLOAT_TO_MANT_EXP,
-            "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 4))",
-            6,
-        ),
-        HostFunctionSpec::FloatFromMantExp => (
-            import::FLOAT_FROM_MANT_EXP,
-            "(call $float_from_mant_exp (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatCompare => (
-            import::FLOAT_CMP,
-            "(call $float_cmp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8))",
-            4,
-        ),
-        HostFunctionSpec::FloatAdd => (
-            import::FLOAT_ADD,
-            "(call $float_add (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatSubtract => (
-            import::FLOAT_SUB,
-            "(call $float_sub (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatMultiply => (
-            import::FLOAT_MULT,
-            "(call $float_mult (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatDivide => (
-            import::FLOAT_DIV,
-            "(call $float_div (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatRoot => (
-            import::FLOAT_ROOT,
-            "(call $float_root (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
-            6,
-        ),
-        HostFunctionSpec::FloatPower => (
-            import::FLOAT_POW,
-            "(call $float_pow (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
-            6,
-        ),
-    };
-    Call {
-        import,
-        call,
-        operands,
-        yields: !matches!(op, HostFunctionSpec::Trace),
-    }
-}
-
-#[test]
-fn an_empty_module_burns_a_fixed_amount_of_fuel() {
-    let fuel = fuel_for("(i32.const 0)", &[ONE_PAGE], &FakeHost::new());
-    assert_eq!(fuel, EMPTY_MODULE_FUEL);
-}
-
-/// Calling a host function `n` times costs `n` times its gas, to the unit. Every
-/// other term is known — the module's floor, wasmi's fuel per call, one `drop` per
-/// answered call — so the total is a closed form, with the gas read from the spec
-/// table rather than restated. `n = 1` pins the charge, `n > 1` pins that it lands
-/// on every call rather than once per run.
-#[test]
-fn a_host_call_costs_its_gas_every_time_it_is_called() {
-    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
-
-    for &op in HostFunctionSpec::ALL {
-        let call = call_for(op);
-        let per_call = wasmi_call_fuel(call.operands) + op.gas();
-
-        for n in 1..=3 {
-            let body = call.body(n);
-            let n = n as u64;
-
-            assert_eq!(
-                fuel_for(&body, &[call.import, ONE_PAGE], &host),
-                EMPTY_MODULE_FUEL + n * per_call + call.overhead(n),
-                "{n} x {}",
-                call.call
-            );
-        }
-    }
-}
-
-/// The gas charge precedes the call's body, so a failing call costs exactly what a
-/// successful one costs. Field 1 is answered and field 7 is not; the two modules
-/// are otherwise identical, so their totals are comparable.
-#[test]
-fn a_failing_host_call_costs_exactly_what_a_successful_one_costs() {
-    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
-    let call = |field: i32| {
-        module(
-            &[import::HOME_LE_FIELD, ONE_PAGE],
-            &format!("(call $home_le_field (i32.const {field}) (i32.const 0) (i32.const 4))"),
-        )
-    };
-
-    let answered = run(&call(1), &host).expect("the module should run");
-    let refused = run(&call(7), &host).expect("the module should run");
-
-    assert_eq!(answered.result, 1);
-    assert_eq!(refused.result, code(HostError::FieldNotFound));
-    assert_eq!(refused.fuel_used, answered.fuel_used);
-}
-
-/// `fuel_used` is `gas - remaining`: what the run spent, not what was left or what
-/// it was handed. The gas figures are derived from the run's cost, so the boundary
-/// — exactly enough, and one short — is among the cases.
-#[test]
-fn fuel_used_is_what_was_spent_not_what_was_supplied() {
-    let host = FakeHost::new();
-    let op = HostFunctionSpec::GetLedgerSqn;
-    let call = call_for(op);
-    let wat = module(&[call.import, ONE_PAGE], call.call);
-    let cost = EMPTY_MODULE_FUEL + wasmi_call_fuel(call.operands) + op.gas();
-
-    // Exactly its cost is enough, and no amount above it changes the figure. The
-    // result is checked too, so the figure belongs to a run that did the work
-    // rather than to one that was cut short.
-    for gas in [cost, cost + 1, cost * 100, PLENTY_OF_GAS] {
-        let outcome = run_with_gas(&wat, gas, &host).expect("should run");
-        assert_eq!(
-            outcome.result, 4,
-            "gas {gas}: the call should have succeeded"
-        );
-        assert_eq!(outcome.fuel_used, cost, "gas {gas}");
-    }
-
-    // One fuel short: the run ends at the call it cannot pay for and still owes the
-    // whole limit, because `charge` spends what is left.
-    let short = run_with_gas(&wat, cost - 1, &host).expect_err("one fuel short must not complete");
-    assert!(
-        matches!(short.error, RunError::OutOfGas),
-        "expected the run to end out of gas, got: {short}"
-    );
-    assert_eq!(short.fuel_used, cost - 1);
-}
-
-/// Fuel is metered, so the same module burns the same fuel every time — a
-/// property consensus depends on.
-#[test]
-fn the_same_run_burns_the_same_fuel() {
-    let call = call_for(HostFunctionSpec::Trace);
-    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
-
-    let first = run(&wat, &FakeHost::new()).expect("should run").fuel_used;
-    for _ in 0..4 {
-        assert_eq!(
-            run(&wat, &FakeHost::new()).expect("should run").fuel_used,
-            first
-        );
-    }
-    assert!(first > HostFunctionSpec::Trace.gas());
-}
-
-/// Too little gas to finish stops the run: the meter refuses the guest's own
-/// instructions before it ever reaches the host call.
-#[test]
-fn a_run_that_cannot_afford_itself_fails() {
-    let host = FakeHost::new();
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-
-    for gas in [0, 1, 10] {
-        let Err(failure) = run_with_gas(&wat, gas, &host) else {
-            panic!("gas {gas} should not have completed");
-        };
-        assert!(
-            matches!(failure.error, RunError::OutOfGas),
-            "gas {gas}: expected the run to end out of gas, got: {failure}"
-        );
-    }
-}
-
-/// A guest looping forever is stopped by gas rather than running away, and owes
-/// the gas it burned doing it.
-#[test]
-fn an_endless_loop_is_stopped_by_gas() {
-    const GAS: u64 = 100_000;
-
-    let host = FakeHost::new();
-    let wat = module(&[ONE_PAGE], "(loop $l (br $l)) (i32.const 0)");
-
-    let failure = run_with_gas(&wat, GAS, &host).expect_err("an endless loop must not complete");
-    assert!(
-        matches!(failure.error, RunError::OutOfGas),
-        "expected the meter to stop it, got: {failure}"
-    );
-    assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway guest burns the whole limit"
-    );
-}
-
-/// A host call refused its gas stops the run: the guest never gets a chance to
-/// ignore the refusal and carry on, and it is charged the whole limit.
-///
-/// The gas range is every amount that reaches the call and cannot pay for it, so
-/// the case is the whole boundary rather than one number. `trace` is the call under
-/// it because it is the one that could not report a refusal even if it wanted to:
-/// stopping the run is the whole of what the guest sees.
-#[test]
-fn a_host_call_refused_its_gas_stops_the_run() {
-    let host = FakeHost::new();
-    let op = HostFunctionSpec::Trace;
-    let call = call_for(op);
-    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
-    // Measured rather than derived: the whole run's cost, less the call's own gas,
-    // is the least a guest can be given and still reach the call. Below that the
-    // meter stops the guest's own instructions instead, which is
-    // `a_run_that_cannot_afford_itself_fails`'s case, not this one.
-    let cost = run(&wat, &FakeHost::new())
-        .expect("the module should run")
-        .fuel_used;
-
-    for gas in cost - op.gas()..cost {
-        let Err(failure) = run_with_gas(&wat, gas, &host) else {
-            panic!("gas {gas}: the run completed, so the guest was handed the refusal");
-        };
-        assert!(
-            matches!(failure.error, RunError::OutOfGas),
-            "gas {gas}: expected the run to end out of gas, got: {failure}"
-        );
-        assert_eq!(
-            failure.fuel_used, gas,
-            "gas {gas}: a call it cannot afford burns the whole limit"
-        );
-    }
-    assert!(host.traces().is_empty(), "the host body must not have run");
-}
-
-// ---------------------------------------------------------------------------
-// The transfer limit
-// ---------------------------------------------------------------------------
-
-/// A module that repeats `call` while `keep_going` holds, then returns the last
-/// status, so a budget can be run to exhaustion inside one invocation.
-fn until_refused(imports: &str, call: &str, keep_going: &str) -> String {
-    module(
-        &[imports, ONE_PAGE],
-        &format!(
-            "(local $r i32)
-             (loop $l
-               (local.set $r {call})
-               (br_if $l {keep_going}))
-             (local.get $r)"
-        ),
-    )
-}
-
-/// For a call whose success is a positive byte count.
-const WHILE_POSITIVE: &str = "(i32.gt_s (local.get $r) (i32.const 0))";
-
-/// Bytes written into guest memory are charged against the run's budget, and the
-/// budget is a per-run total: 1 MiB of 1 KiB values exhausts it.
-#[test]
-fn writes_spend_the_transfer_budget() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let wat = until_refused(
-        import::HOME_LE_FIELD,
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-        WHILE_POSITIVE,
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
-    assert_eq!(
-        host.fields_asked.borrow().len() as u64,
-        TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1,
-        "one call per 1 KiB of budget, plus the one that was refused"
-    );
-}
-
-/// The budget is per run, not per call: a fresh run starts with a full budget.
-#[test]
-fn each_run_gets_its_own_budget() {
-    let wat = until_refused(
-        import::HOME_LE_FIELD,
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-        WHILE_POSITIVE,
-    );
-
-    for _ in 0..2 {
-        let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-        let outcome = run(&wat, &host).expect("the module should run");
-        assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
-        assert_eq!(
-            host.fields_asked.borrow().len() as u64,
-            TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1
-        );
-    }
-}
-
-/// A run well inside the budget never sees it.
-#[test]
-fn a_modest_run_never_meets_the_budget() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, MAX_FIELD_BYTES as i32);
-}
-
-/// Reads leave the budget alone: `read_borrowed` hands the host a slice *aliasing*
-/// guest memory, so there are no copied bytes to charge. What bounds how many reads
-/// a run can make is gas, which every host call pays before its body runs.
-///
-/// The observation is the write at the end, not the reads: the module reads four
-/// times the whole budget first, so a rule that charged reads would have nothing
-/// left, and the write would answer `OutOfTransferLimit` instead of a byte count.
-#[test]
-fn reads_do_not_spend_the_transfer_budget() {
-    /// 1 KiB reads, four times over the budget.
-    const READS: u64 = 4 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
-
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let read = trace_call(
-        TraceDataType::AsHex,
-        EMPTY_REGION,
-        &format!("(i32.const 0) (i32.const {MAX_FIELD_BYTES})"),
-    );
-    let wat = module(
-        &[import::TRACE, import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (loop $l
-               {read}
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {READS}))))
-             (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"
-        ),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(
-        host.traces().len() as u64,
-        READS,
-        "every read should have been served"
-    );
-    assert_eq!(
-        outcome.result, MAX_FIELD_BYTES as i32,
-        "the write after {READS} reads of {MAX_FIELD_BYTES} bytes should still have its budget"
-    );
-}
-
-/// Only the output half of a read-write call spends the budget. `sha512_half`'s
-/// input is a borrowed read like any other, aliasing guest memory rather than
-/// crossing the boundary, so a run may hash far more bytes than the budget holds as
-/// long as the digests it writes fit inside it.
-///
-/// The two totals are asserted, so the arithmetic that makes the case is in the
-/// test rather than in a comment: the inputs alone would overrun the budget, the
-/// digests alone are a small fraction of it.
-#[test]
-fn only_the_output_half_of_a_read_write_spends_the_budget() {
-    /// Enough 1 KiB inputs to overrun the budget twice over.
-    const CALLS: u64 = 2 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
-
-    assert!(
-        CALLS * MAX_FIELD_BYTES as u64 > TRANSFER_LIMIT_BYTES,
-        "the inputs alone must overrun the budget"
-    );
-    assert!(
-        CALLS * HASH_LEN as u64 <= TRANSFER_LIMIT_BYTES / 2,
-        "the digests alone must stay well inside it"
-    );
-
-    let host = FakeHost::new().answering_digest(Answer::filler(HASH_LEN));
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $r i32)
-             (loop $l
-               (local.set $r (call $sha512_half (i32.const 0) (i32.const {MAX_FIELD_BYTES})
-                                                (i32.const 0) (i32.const {HASH_LEN})))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {CALLS}))))
-             (local.get $r)"
-        ),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(
-        host.digested.borrow().len() as u64,
-        CALLS,
-        "every call should have been served"
-    );
-    assert_eq!(
-        outcome.result, HASH_LEN as i32,
-        "only the digests are charged, and they fit"
-    );
-}

crates/xrpl-wasm-vm/tests/memory_policy.rs

@@ -1,621 +0,0 @@
-//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
-//! crossing the boundary. This is the policy the guest observes, so each rule is
-//! pinned to the code it answers with.
-
-mod support;
-
-use support::{
-    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
-    traced,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
-
-/// One page, so anything at or past 65536 is out of bounds.
-const PAGE: i64 = 64 * 1024;
-
-/// The per-field size cap, as a wasm operand.
-const CAP: i64 = MAX_FIELD_BYTES as i64;
-/// One byte over the cap: the smallest value the engine must refuse.
-const OVER_CAP: i64 = CAP + 1;
-
-// ---------------------------------------------------------------------------
-// Output regions (`write_into`)
-// ---------------------------------------------------------------------------
-
-/// The whole output region must be in bounds, not merely its start — the engine
-/// checks `[dst, dst + cap)` before the host is allowed to write.
-#[test]
-fn an_output_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// A region ending exactly at the last byte of memory is in bounds.
-#[test]
-fn an_output_region_ending_at_the_last_byte_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
-    );
-    assert_eq!(status(&wat, &host), 4);
-}
-
-/// The wire carries `i32`, so a guest can present a negative pointer or length.
-#[test]
-fn a_negative_output_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// The host reports a value's true length whether or not it fitted; a value that
-/// did not fit is the guest's error, not the host's.
-#[test]
-fn a_value_larger_than_the_buffer_is_refused() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(64));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
-}
-
-/// A zero-length output region is in bounds and simply cannot hold anything.
-#[test]
-fn a_zero_length_output_region_is_in_bounds_but_too_small() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 0))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-}
-
-/// A host that reports more than the per-field cap is refused even when the
-/// guest offered room for it: the cap is the engine's rule, not the buffer's.
-#[test]
-fn a_value_past_the_field_cap_is_refused() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::claiming(OVER_CAP as usize))
-        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
-}
-
-/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
-/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
-/// declared, so a value past the cap does not fit the region it is offered and no
-/// prefix of it can reach guest memory either.
-///
-/// The host answers with a real over-cap value: [`Answer::claiming`] writes
-/// nothing whatever the engine does, so it could not tell the two apart. The
-/// second module folds the *whole* declared buffer rather than one byte, so the
-/// claim is about the region and not about its first byte.
-#[test]
-fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
-    /// The buffer the guest declares: well over the cap, so the clamp bites.
-    const BUFFER: usize = 4096;
-
-    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
-    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
-    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
-
-    // The status the guest sees, from a module that returns it directly.
-    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
-    assert_eq!(
-        status(&refusing, &host),
-        code(HostError::DataFieldTooLarge),
-        "the value is refused"
-    );
-
-    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
-    // so any byte the host wrote shows up here.
-    let reading = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $seen i32)
-             (drop {call})
-             (loop $l
-               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $seen)"
-        ),
-    );
-    assert_eq!(
-        status(&reading, &host),
-        0,
-        "and not one of its bytes is in the guest's buffer"
-    );
-}
-
-/// The field cap is checked before the buffer-fit rule, so a value that breaks both
-/// is reported as over-cap. The guest branches on the code, and the two rules
-/// answer different questions, so the order is worth pinning.
-#[test]
-fn the_field_cap_precedes_the_buffer_fit_check() {
-    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
-
-    // A 63-byte buffer: the value is both over the cap and far too big to fit.
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-}
-
-// ---------------------------------------------------------------------------
-// Input regions (`Region::read`, via `sha512_half`)
-//
-// `sha512_half`'s first pair is an input region like any other, and it is the
-// input the guest gets a status back from: `trace`, the other reader, answers
-// nothing at all. So the codes are pinned here and the silence below.
-// ---------------------------------------------------------------------------
-
-/// An input region is bounds-checked the same way an output region is. Every case
-/// here stays within the field cap, which on an input is checked first.
-#[test]
-fn an_input_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "ptr {ptr} len {len}"
-        );
-        assert!(host.digested.borrow().is_empty(), "the host is not called");
-    }
-}
-
-#[test]
-fn a_negative_input_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "ptr {ptr} len {len}"
-        );
-    }
-}
-
-/// The field cap bounds what the guest may hand *in*, too.
-#[test]
-fn an_input_past_the_field_cap_is_refused() {
-    let host = FakeHost::new();
-    let digest = |len: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const 0) (i32.const {len})
-                                    (i32.const 2048) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    assert_eq!(
-        status(&digest(OVER_CAP), &host),
-        code(HostError::DataFieldTooLarge)
-    );
-    assert!(host.digested.borrow().is_empty());
-
-    assert_eq!(
-        status(&digest(CAP), &host),
-        HASH_LEN as i32,
-        "the cap itself is allowed"
-    );
-}
-
-/// The two directions check in opposite orders: an input's length is known before
-/// the read, so the cap comes first, while an output's region has to be resolved
-/// before the host can produce a value, so bounds come first there.
-#[test]
-fn the_field_cap_precedes_the_bounds_check_on_an_input() {
-    let host = FakeHost::new();
-
-    let reading = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {})
-                                (i32.const 0) (i32.const {HASH_LEN}))",
-            PAGE + 1
-        ),
-    );
-    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
-
-    let writing = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
-    );
-    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
-}
-
-// ---------------------------------------------------------------------------
-// The reader with no result (`read_borrowed`, via `trace`)
-// ---------------------------------------------------------------------------
-
-/// `trace` reads two regions and either one being bad refuses the call. The same
-/// rule as above, and the guest is told nothing: the refusal is the host not being
-/// called, and the run carries on to the constant that follows.
-#[test]
-fn both_of_traces_regions_are_checked_silently() {
-    let host = FakeHost::new();
-    let regions = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-            EMPTY_REGION.to_owned(),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const 0) (i32.const {OVER_CAP})"),
-        ),
-        (
-            "(i32.const -1) (i32.const 1)".to_owned(),
-            EMPTY_REGION.to_owned(),
-        ),
-    ];
-
-    for (msg, data) in regions {
-        let wat = module(
-            &[import::TRACE, ONE_PAGE],
-            &traced(TraceDataType::AsHex, &msg, &data),
-        );
-        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
-        assert!(
-            host.traces().is_empty(),
-            "msg {msg} data {data}: the host must not be called"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Both at once (`write_buffered`, via `sha512_half`)
-// ---------------------------------------------------------------------------
-
-/// A call with an input and an output region decides everything about the input
-/// before anything about the output, so a bad input is reported however the output
-/// region is wrong — out of bounds, or a pointer that is not one at all.
-///
-/// The whole output region, params included, is judged after the host has answered.
-/// Hoisting any part of that above the call would put the output's verdict first for
-/// these cases, and there is no half of it that can be hoisted on a principle the
-/// other half shares.
-#[test]
-fn a_read_write_checks_its_input_before_its_output() {
-    let host = FakeHost::new();
-    let digest = |src: i64, src_len: i64, dst: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
-                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    let over_cap = digest(0, OVER_CAP, 0);
-    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
-
-    let out_of_bounds = digest(PAGE, 4, 0);
-    assert_eq!(
-        status(&out_of_bounds, &host),
-        code(HostError::PointerOutOfBounds)
-    );
-
-    // A bad input against each way the output can be wrong: the input's verdict is
-    // the one reported, and the host is never asked for a value nobody can take.
-    for dst in [PAGE, -1] {
-        let both_bad = digest(0, OVER_CAP, dst);
-        assert_eq!(
-            status(&both_bad, &host),
-            code(HostError::DataFieldTooLarge),
-            "dst {dst}"
-        );
-    }
-    assert!(host.digested.borrow().is_empty(), "the host is not reached");
-}
-
-/// The output half of a read-write call obeys the same rules as a plain write.
-#[test]
-fn a_read_write_output_obeys_the_write_rules() {
-    let host = FakeHost::new().answering_digest(Answer::filler(32));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// A refused value reaches guest memory in no part, however much of it the host
-/// wrote. The host answers with 32 bytes it did write and a length it did not, so
-/// the refusal happens with the value sitting in the run's output buffer — and the
-/// guest's buffer has to come back untouched.
-///
-/// Stronger than the contract asks for: a guest must not read its buffer on a
-/// negative status. It holds because the buffer is copied to the guest only after
-/// the length, the bounds, the fit and the budget have all passed, so there is no
-/// window in which a refused value is in guest memory.
-#[test]
-fn a_refused_value_leaves_nothing_in_guest_memory() {
-    const MARKER: u8 = 77;
-
-    // The two refusals a value can meet after the host has produced it: longer
-    // than the field cap, and longer than the buffer the guest offered.
-    let refusals = [
-        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
-        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
-    ];
-
-    for (claimed, cap, expected) in refusals {
-        let host =
-            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
-        let call = format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
-        );
-
-        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
-        assert_eq!(
-            status(&refused, &host),
-            code(expected),
-            "claiming {claimed}"
-        );
-
-        // The same call, reporting what is at the output region afterwards.
-        let inspect = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
-        );
-        assert_eq!(
-            status(&inspect, &host),
-            0,
-            "claiming {claimed}: the refused value must not have been written"
-        );
-    }
-}
-
-/// An input region may overlap the output region: the host is served the input as
-/// it stands and its answer lands afterwards, so the two cannot interfere. The
-/// marker is any byte distinct from the input's first (`a`), so `finish` returning
-/// it proves the write landed.
-#[test]
-fn an_input_may_overlap_the_output() {
-    const MARKER: u8 = 99;
-
-    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
-
-    let wat = module(
-        &[
-            import::SHA512_HALF,
-            ONE_PAGE,
-            r#"(data (i32.const 0) "abcd")"#,
-        ],
-        &format!(
-            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
-                                      (i32.const 0) (i32.const {HASH_LEN})))
-             (i32.load8_u (i32.const 0))"
-        ),
-    );
-    assert_eq!(
-        status(&wat, &host),
-        i32::from(MARKER),
-        "the output overwrote the input"
-    );
-    assert_eq!(
-        *host.digested.borrow(),
-        vec![b"abcd".to_vec()],
-        "the host saw the input as it was"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The memory export itself
-// ---------------------------------------------------------------------------
-
-/// A host call with no memory to work in ends the run instead of answering the
-/// guest: there is no buffer for a status to describe, and nothing the guest could
-/// do about the answer — which is what puts this beside out-of-gas on the fatal
-/// channel. What the guest burned getting there is still charged.
-fn assert_no_memory(wat: &str, host: &FakeHost) {
-    let failure = failure(wat, host);
-    assert!(
-        matches!(failure.error, RunError::NoMemory),
-        "expected the run to end for want of a memory export, got: {failure}"
-    );
-    assert!(failure.fuel_used > 0, "{failure}");
-}
-
-/// Every region is relative to the guest's exported memory, so a module without
-/// one cannot make a host call at all.
-#[test]
-fn a_module_that_exports_no_memory_cannot_call_the_host() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, "(memory 1)"],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// Having no memory is answered before anything about a call's arguments, so a
-/// module without one ends the run even when its arguments would have earned a
-/// guest-visible code of their own (here an input over the field cap).
-///
-/// The order is deliberate: no memory is a fact about the instance, not about this
-/// call, and a region cannot be validated against a memory that is not there. It
-/// costs the guest nothing — every call such a module makes ends the run anyway.
-#[test]
-fn no_memory_is_answered_before_a_calls_arguments_are() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::SHA512_HALF, "(memory 1)"],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
-                                (i32.const 0) (i32.const {HASH_LEN}))"
-        ),
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// The memory's export *name* is not part of the contract: the engine takes the
-/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
-/// to `"memory"` — it is a toolchain convention, so the kind decides.
-#[test]
-fn a_memory_exported_under_any_name_is_the_guests_memory() {
-    let host = FakeHost::new();
-
-    for name in ["mem", "linear", "the memory"] {
-        let wat = module(
-            &[
-                import::LDGR_INDEX,
-                &format!(r#"(memory (export "{name}") 1)"#),
-            ],
-            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-             (i32.load (i32.const 64))",
-        );
-        assert_eq!(
-            status(&wat, &host),
-            7,
-            "the host wrote into the memory exported as '{name}'"
-        );
-    }
-}
-
-/// One memory exported under several names is one memory. The engine resolves the
-/// first export of kind memory, and with at most one memory per module every such
-/// export is that memory, so the order the exports are walked in cannot change the
-/// answer.
-#[test]
-fn one_memory_exported_under_several_names_is_still_that_memory() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
-        ],
-        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-         (i32.load (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 7);
-}
-
-/// The export has to *be* a memory: a global named `memory` is not one, and it
-/// neither serves as the guest's memory nor hides the memory the module really
-/// exports. The kind decides, so the conventional name carries no weight on
-/// either side.
-#[test]
-fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
-    let host = FakeHost::new();
-
-    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
-
-    let wrong_kind = module(
-        &[
-            import::LDGR_INDEX,
-            "(memory 1)",
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_no_memory(&wrong_kind, &host);
-
-    let shadowed = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "mem") 1)"#,
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_eq!(
-        status(&shadowed, &host),
-        4,
-        "the real memory is found past the global that took its name"
-    );
-}
-
-/// Bounds follow the memory the module actually declared, not a fixed page.
-#[test]
-fn bounds_follow_the_declared_memory_size() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
-        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
-    );
-    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
-}

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -1,516 +0,0 @@
-//! What screening refuses, and that it refuses nothing a run would have served.
-//!
-//! `check` reaches its verdict from the compiled module alone, so these tests take
-//! no host — except the ones that put the same module through `run` to compare the
-//! two.
-
-mod support;
-
-use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
-use xrpl_host_functions::HostFunctionSpec;
-use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, RunError};
-
-/// Assert which stage screening refused a module at, because the caller maps the
-/// stages separately. The error comes back out for the tests that also read its
-/// message.
-macro_rules! assert_stage {
-    ($refusal:expr, $stage:pat) => {{
-        let refusal = $refusal;
-        assert!(
-            matches!(refusal, $stage),
-            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
-            refusal
-        );
-        refusal
-    }};
-}
-
-/// Screens `wat`, which must assemble.
-fn check(wat: &str) -> Result<(), CheckError> {
-    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
-}
-
-fn refusal(wat: &str) -> CheckError {
-    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
-}
-
-fn passes(wat: &str) {
-    if let Err(refusal) = check(wat) {
-        panic!("expected this module to pass, but: {refusal}\n{wat}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Compiling
-// ---------------------------------------------------------------------------
-
-/// A contract that imports a host function, exports its memory and exports the
-/// entry point is what screening is looking for.
-#[test]
-fn a_runnable_contract_passes() {
-    passes(&module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    ));
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_pass() {
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// Screening takes wasm binaries, and text is not one — the same rule the VM
-/// applies, from the same `wasmi` built without its `wat` feature. Turning that
-/// feature on would make this transaction blob valid at both ends.
-#[test]
-fn a_text_format_module_does_not_pass() {
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let refusal =
-        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
-    assert_stage!(refusal, CheckError::Compile(_));
-
-    // The same module, assembled first, passes: the text is sound and only the
-    // format was refused.
-    passes(&text);
-}
-
-/// A feature the engine disables is refused here too, because both stages compile
-/// against the one engine. `vm_limits.rs` walks every disabled feature; this pins
-/// that screening sees the same configuration.
-#[test]
-fn a_disabled_feature_does_not_pass() {
-    let refusal = refusal(&module(
-        &[ONE_PAGE],
-        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// Every host function the ABI declares, spelled as a guest imports it. The count
-/// is asserted against the ABI so a function added to it cannot be left out here.
-const ALL_IMPORTS: [&str; 61] = [
-    import::LDGR_INDEX,
-    import::PARENT_LDGR_TIME,
-    import::PARENT_LDGR_HASH,
-    import::BASE_FEE,
-    import::AMENDMENT_ENABLED,
-    import::CACHE_LE,
-    import::TX_FIELD,
-    import::HOME_LE_FIELD,
-    import::LE_FIELD,
-    import::TX_INNER,
-    import::HOME_LE_INNER,
-    import::LE_INNER,
-    import::TX_ARR_LEN,
-    import::HOME_LE_ARR_LEN,
-    import::LE_ARR_LEN,
-    import::TX_INNER_ARR_LEN,
-    import::HOME_LE_INNER_ARR_LEN,
-    import::LE_INNER_ARR_LEN,
-    import::CHECK_SIG,
-    import::ACCOUNTROOT_ID,
-    import::AMM_ID,
-    import::CHECK_ID,
-    import::CREDENTIAL_ID,
-    import::DELEGATE_ID,
-    import::DEPOSIT_PREAUTH_ID,
-    import::DID_ID,
-    import::ESCROW_ID,
-    import::TRUSTLINE_ID,
-    import::MPT_ISSUANCE_ID,
-    import::MPTOKEN_ID,
-    import::NFT_OFFER_ID,
-    import::OFFER_ID,
-    import::ORACLE_ID,
-    import::PAYCHAN_ID,
-    import::PERMISSIONED_DOMAIN_ID,
-    import::SIGNERS_ID,
-    import::TICKET_ID,
-    import::VAULT_ID,
-    import::SHA512_HALF,
-    import::TRACE,
-    import::SET_DATA,
-    import::NFT_URI,
-    import::NFT_ISSUER,
-    import::NFT_TAXON,
-    import::NFT_FLAGS,
-    import::NFT_XFER_FEE,
-    import::NFT_SERIAL,
-    import::FLOAT_FROM_INT,
-    import::FLOAT_FROM_UINT,
-    import::FLOAT_FROM_STAMOUNT,
-    import::FLOAT_FROM_STNUMBER,
-    import::FLOAT_TO_INT,
-    import::FLOAT_TO_MANT_EXP,
-    import::FLOAT_FROM_MANT_EXP,
-    import::FLOAT_CMP,
-    import::FLOAT_ADD,
-    import::FLOAT_SUB,
-    import::FLOAT_MULT,
-    import::FLOAT_DIV,
-    import::FLOAT_ROOT,
-    import::FLOAT_POW,
-];
-
-#[test]
-fn every_declared_host_function_may_be_imported() {
-    assert_eq!(
-        ALL_IMPORTS.len(),
-        HostFunctionSpec::ALL.len(),
-        "the ABI gained a host function with no import declaration in this test"
-    );
-
-    let mut parts = ALL_IMPORTS.to_vec();
-    parts.push(ONE_PAGE);
-    passes(&module(&parts, "(i32.const 0)"));
-}
-
-/// A module may import fewer host functions than are registered, but not more.
-#[test]
-fn an_unknown_host_function_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("no host function 'no_such_function'"),
-        "{refusal}"
-    );
-}
-
-/// Host functions live under one module name — `host_lib` — and an import naming
-/// another is refused even when the function name is real. `env` is in the list
-/// because that is what plain clang emits.
-#[test]
-fn an_import_from_another_module_does_not_pass() {
-    for module_name in ["host", "env", ""] {
-        let refusal = refusal(&module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        ));
-        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-    }
-}
-
-/// A host function's name imported as something other than a function. The engine
-/// defines it as a function and nothing else, so this does not link either.
-#[test]
-fn a_host_function_imported_as_a_global_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
-            ONE_PAGE,
-        ],
-        "(global.get $g)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("'host_lib::ldgr_index' is not a function"),
-        "{refusal}"
-    );
-}
-
-/// A module faulty at two stages is refused by the earlier one — it imports what no
-/// engine serves *and* exports no entry point. The imports are what the rest of the
-/// module depends on, so that is the message worth having.
-#[test]
-fn the_earlier_stage_is_the_one_reported() {
-    let refusal = refusal(
-        r#"(module
-             (import "host_lib" "no_such_function" (func $f (result i32)))
-             (memory (export "memory") 1)
-             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
-    );
-
-    assert_stage!(refusal, CheckError::Import(_));
-}
-
-/// The signature is the one part of an import screening does not compare, so a
-/// module that will not link can still pass. Recorded here because it is the gap
-/// this stage leaves, not because it is wanted.
-#[test]
-fn an_import_with_the_wrong_signature_still_passes() {
-    let wat = module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(i32.const 0)",
-    );
-    passes(&wat);
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a mistyped import must not link");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1)
-                              (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "no entry point 'finish'");
-}
-
-/// The entry point is looked up by the name the caller asks for, as a run looks it
-/// up: screening a contract for one entry point says nothing about another.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let wasm = assemble(
-        r#"(module (memory (export "memory") 1)
-             (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-
-    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
-    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
-}
-
-/// Both halves of the entry point's type are screened: a module returning the
-/// wrong thing, or taking anything at all, would fail the run's typed lookup.
-#[test]
-fn an_entry_point_of_the_wrong_type_does_not_pass() {
-    for (signature, body) in [
-        ("(result i64)", "(i64.const 0)"),
-        ("(param i32) (result i32)", "(i32.const 0)"),
-        ("", "(nop)"),
-    ] {
-        let refusal = refusal(&format!(
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") {signature} {body}))"#
-        ));
-        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-        assert_eq!(
-            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
-            "{signature}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "export 'finish' is not a function");
-}
-
-// ---------------------------------------------------------------------------
-// Agreement with a run
-// ---------------------------------------------------------------------------
-
-/// A module with no linear memory to export passes. A contract that makes no host
-/// call needs none, and one that does is refused at the call and charged — a
-/// runtime fault, not a malformed module.
-#[test]
-fn a_module_exporting_no_memory_passes() {
-    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
-    passes(wat);
-
-    let host = FakeHost::new();
-    assert_eq!(
-        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
-            .expect("a module that calls no host function needs no memory")
-            .result,
-        0
-    );
-}
-
-/// Modules spanning what screening decides, each also put through a run.
-fn modules() -> Vec<(&'static str, String)> {
-    vec![
-        (
-            "a runnable contract",
-            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
-        ),
-        (
-            "a contract that traps",
-            module(&[ONE_PAGE], "(unreachable)"),
-        ),
-        (
-            "a disabled feature",
-            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
-        ),
-        (
-            "an unknown host function",
-            module(
-                &[
-                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(call $f)",
-            ),
-        ),
-        (
-            "an import from another module",
-            module(
-                &[
-                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "a host function imported as a global",
-            module(
-                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
-                "(global.get $g)",
-            ),
-        ),
-        (
-            "no entry point",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "other") (result i32) (i32.const 0)))"#
-                .to_string(),
-        ),
-        (
-            "an entry point of the wrong type",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") (result i64) (i64.const 0)))"#
-                .to_string(),
-        ),
-    ]
-}
-
-/// Screening refuses a module exactly when a run would refuse it at one of the
-/// three stages screening covers — nothing it rejects would have run, and nothing
-/// it passes stops before the entry point is called. The exceptions are the ones
-/// [`what_static_screening_cannot_see`] lists.
-#[test]
-fn screening_and_a_run_agree() {
-    let host = FakeHost::new();
-
-    for (label, wat) in modules() {
-        let wasm = assemble(&wat);
-        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => matches!(
-                failure.error,
-                RunError::Compile(_) | RunError::Instantiate(_) | RunError::EntryPoint(_)
-            ),
-            Ok(_) => false,
-        };
-
-        assert_eq!(
-            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
-            refused_early,
-            "{label}"
-        );
-    }
-}
-
-/// A module asking for more memory than the engine grants is refused, so the
-/// contract that could never run does not reach the ledger. The cap itself passes.
-#[test]
-fn an_exported_memory_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
-    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    ));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, so screening
-/// must not turn it away: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(memory (export "memory") 1 {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// The gap, listed rather than described, and now one entry long. A memory a module
-/// keeps to itself is not in its exports, so this is the one module that passes
-/// screening and then fails to *instantiate* — which is why a run's refusal at that
-/// stage cannot be read as the node's fault.
-///
-/// A contract needs an exported memory to make any host call, so a module of this
-/// shape can do nothing but compute; the SDK does not produce one.
-#[test]
-fn what_static_screening_cannot_see() {
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module (memory {})
-             (func (export "finish") (result i32) (i32.const 0)))"#,
-        MAX_MEMORY_PAGES + 1
-    );
-
-    passes(&wat);
-
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("the store's limiter must refuse the memory");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-/// A start section is guest code, so screening cannot see whether it traps — but it
-/// no longer has to. A trap is the guest's fault wherever it happens, so the run
-/// charges the contract for what it burned instead of reporting a module the node
-/// should have screened.
-#[test]
-fn a_start_section_screening_cannot_see_is_charged_as_a_trap() {
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    passes(&wat);
-
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a start section that traps must not complete the run");
-    assert!(matches!(failure.error, RunError::Trap(_)), "{failure}");
-    assert!(
-        failure.fuel_used > 0,
-        "charged for what it burned: {failure}"
-    );
-}

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -1,580 +0,0 @@
-//! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the linear-memory cap.
-//!
-//! These are the sandbox's outer wall. Everything here fails the run rather than
-//! returning a code to the guest, so each test reads the failure's message.
-
-mod support;
-
-use support::{
-    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
-};
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, RunError};
-
-/// Assert which stage a run failed at, because the caller maps the stages to
-/// different outcomes. A stage is one `RunError` variant, so the expectation is a
-/// pattern; the failure comes back out for the tests that also read its message.
-macro_rules! assert_stage {
-    ($failure:expr, $stage:pat) => {{
-        let failure = $failure;
-        assert!(
-            matches!(failure.error, $stage),
-            concat!("expected a ", stringify!($stage), " failure, got: {}"),
-            failure
-        );
-        failure
-    }};
-}
-
-// ---------------------------------------------------------------------------
-// Linear memory
-// ---------------------------------------------------------------------------
-
-/// A module declaring more than the cap fails to instantiate — the limit applies
-/// to the initial memory, not only to growth.
-#[test]
-fn an_initial_memory_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_memory_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
-/// `memory.grow` otherwise would, because the engine's limiter sets
-/// `trap_on_grow_failure(true)`.
-#[test]
-fn growth_stops_at_the_cap() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
-    );
-    assert_eq!(
-        run(&wat, &host).expect("should run").result,
-        1,
-        "growing to exactly the cap answers the previous size"
-    );
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// A module may declare a maximum above the cap: the cap is enforced on the initial
-/// memory and on growth, not on the memory type's declared bound.
-#[test]
-fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
-
-    let wat = module(&[&memory], "(i32.const 0)");
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    let wat = module(
-        &[&memory],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-// ---------------------------------------------------------------------------
-// Engine configuration
-// ---------------------------------------------------------------------------
-
-/// One row per feature `build_wasm_engine` turns off: the smallest module that uses
-/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
-/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
-/// instead.
-fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
-    vec![
-        (
-            "wasm_multi_value",
-            vec![
-                ONE_PAGE,
-                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
-            ],
-            "(call $two) (drop) (drop) (i32.const 0)",
-            "multi-value",
-        ),
-        (
-            "wasm_sign_extension",
-            vec![ONE_PAGE],
-            "(i32.extend8_s (i32.const 1))",
-            "sign extension",
-        ),
-        (
-            "wasm_bulk_memory",
-            vec![ONE_PAGE],
-            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
-            "bulk memory",
-        ),
-        (
-            "wasm_reference_types",
-            vec![ONE_PAGE, "(table 1 externref)"],
-            "(i32.const 0)",
-            "reference types",
-        ),
-        // The proposal covers mutable globals crossing the module boundary; an
-        // internal one is core wasm and stays allowed — see the test below.
-        (
-            "wasm_mutable_global",
-            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
-            "(i32.const 0)",
-            "mutable global",
-        ),
-        (
-            "wasm_tail_call",
-            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
-            "(return_call $f)",
-            "tail call",
-        ),
-        // Arithmetic in a constant initialiser. wasmi names the operator rather
-        // than the proposal here.
-        (
-            "wasm_extended_const",
-            vec![
-                ONE_PAGE,
-                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
-            ],
-            "(global.get $g)",
-            "non-constant operator",
-        ),
-        (
-            "wasm_multi_memory",
-            vec![ONE_PAGE, "(memory 1)"],
-            "(i32.const 0)",
-            "multiple memories",
-        ),
-        (
-            "wasm_memory64",
-            vec![r#"(memory (export "memory") i64 1)"#],
-            "(i32.const 0)",
-            "memory64",
-        ),
-        (
-            "wasm_custom_page_sizes",
-            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
-            "(i32.const 0)",
-            "custom page sizes",
-        ),
-        (
-            "wasm_wide_arithmetic",
-            vec![ONE_PAGE],
-            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
-             (i32.const 0)",
-            "wide arithmetic",
-        ),
-        // Determinism across nodes is the reason floats are off.
-        (
-            "floats",
-            vec![ONE_PAGE],
-            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-            "floating-point",
-        ),
-    ]
-}
-
-/// Every feature the engine disables is refused, and refused for that reason.
-///
-/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
-/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against our own config.
-#[test]
-fn every_disabled_feature_is_refused_by_name() {
-    let host = FakeHost::new();
-
-    for (knob, parts, body, expected) in disabled_features() {
-        let wat = module(&parts, body);
-        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-
-        assert!(
-            failure.contains(expected),
-            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
-        );
-    }
-}
-
-/// The three knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// engine is a process-wide `LazyLock`, so a test observes the one configuration we
-/// build: a knob masked by another, or with no caller-visible effect, has no
-/// distinguishing module.
-#[test]
-fn the_knobs_without_a_module_of_their_own() {
-    let host = FakeHost::new();
-
-    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
-    // float operand, so `floats(false)` refuses it first, as the message shows.
-    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
-    let refusal = failure(&wat, &host).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-    assert!(!refusal.contains("saturating"), "{refusal}");
-
-    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
-    // sections, not accept/reject, so this pins only that one is harmless.
-    let wat = module(
-        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
-    // before instantiating, so every test in the suite fails.
-    let wat = module(&[ONE_PAGE], "(i32.const 0)");
-    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
-}
-
-/// A mutable global the module keeps to itself is core wasm, so the disabled
-/// proposal does not reach it: a guest can still have mutable state.
-#[test]
-fn an_internal_mutable_global_is_still_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
-        "(global.set $g (i32.const 7)) (global.get $g)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 7);
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_compile() {
-    let host = FakeHost::new();
-
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
-            .expect_err("garbage must not compile");
-        assert_stage!(failure, RunError::Compile(_));
-    }
-}
-
-/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
-/// default and would have `Module::new` assemble text too, so the crate builds
-/// wasmi without it; turning it back on would make this transaction blob valid.
-#[test]
-fn the_vm_refuses_a_text_format_module() {
-    let host = FakeHost::new();
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
-        .expect_err("text must not compile as a module");
-    assert_stage!(failure, RunError::Compile(_));
-
-    // The same module, assembled first, runs: the text is sound and only the
-    // format was refused.
-    assert_eq!(run(&text, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// A module may import fewer host functions than are registered, but not more:
-/// an import the linker does not define fails instantiation.
-#[test]
-fn an_unknown_import_fails_instantiation() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// Host functions are registered under one module name — `host_lib`, the name the
-/// guest SDK and this repo's fixtures import from — and a guest naming a different
-/// one does not link. `env` is in the list because that is what plain clang emits.
-#[test]
-fn the_import_module_name_must_match() {
-    let host = FakeHost::new();
-
-    for module_name in ["host", "env", ""] {
-        let wat = module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// An import spelled with the wrong signature does not link even under the right
-/// name, which is what makes the registered signatures load-bearing.
-#[test]
-fn an_import_with_the_wrong_signature_fails_instantiation() {
-    let host = FakeHost::new();
-
-    for signature in [
-        "(param i32) (result i32)",         // too few parameters
-        "(param i32 i32 i32) (result i32)", // too many
-        "(param i64 i64) (result i32)",     // wrong parameter types
-        "(param i32 i32) (result i64)",     // wrong result type
-        "(param i32 i32)",                  // no result
-    ] {
-        let wat = module(
-            &[
-                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// A module that imports a host function it never calls still has to link.
-#[test]
-fn an_unused_import_is_still_linked() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// The start section
-// ---------------------------------------------------------------------------
-
-/// A start section runs guest code during instantiation, before the entry point
-/// is even looked up, and `set_fuel` and the memory limiter are both installed by
-/// then — so it is metered like any other guest code, and a run it stops is
-/// charged for what it burned.
-///
-/// Reported as a **trap**, not as a module that would not instantiate: a trap is the
-/// guest's fault wherever it happens, and the stage a run stopped at is not what the
-/// caller maps. Filing it under the stage would put a contract's own defect among the
-/// faults a caller treats as the node's, and charge nothing for the instructions the
-/// contract burned reaching it.
-#[test]
-fn a_trapping_start_section_is_a_guest_trap_and_is_charged() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a start section that traps must not complete the run"),
-        RunError::Trap(_)
-    );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section's instructions are metered: {failure}"
-    );
-}
-
-/// What `RunError::Instantiate` is left to mean: a module the linker or the store
-/// would not accept, rather than one whose guest code failed. Its two shapes, so the
-/// variant is not left standing for nothing.
-#[test]
-fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
-    let host = FakeHost::new();
-
-    // The linker defines no such import.
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-
-    // The store's limiter will not grant the memory, and does not trap to say so.
-    let wat = module(
-        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A start section that runs out of gas is reported as out of gas, not as a module
-/// that would not instantiate. The stage a run stopped at is not what the caller
-/// maps — the reason is — and gas exhaustion is one outcome wherever the guest
-/// reaches it.
-#[test]
-fn a_start_section_that_exhausts_gas_is_out_of_gas_not_an_instantiation_failure() {
-    const GAS: u64 = 10_000;
-
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (loop $l (br $l)))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, GAS, &host).expect_err("an endless start section must not instantiate"),
-        RunError::OutOfGas
-    );
-    assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway start section burns the whole limit"
-    );
-}
-
-/// A start section cannot make a host call that needs guest memory, even in a
-/// module that exports one: the memory is resolved from the *instance's* exports,
-/// and instantiation is what produces the instance, so a call made while it is
-/// still running has no memory to work in and ends the run.
-///
-/// Not a choice: `Module::instantiate` is `pub(crate)` in wasmi, so instantiation
-/// cannot be split from the start section to resolve the memory in between.
-#[test]
-fn a_start_section_cannot_make_a_host_call() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ldgr_index} {ONE_PAGE}
-             (func $init (drop (call $ldgr_index (i32.const 0) (i32.const 4))))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#,
-        ldgr_index = import::LDGR_INDEX
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a host call from a start section must not be served"),
-        RunError::NoMemory
-    );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section is metered up to the refused call: {failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_fails() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module without the entry point must not run"),
-        RunError::EntryPoint(_)
-    );
-    assert!(
-        failure.to_string().contains("no entry point 'finish'"),
-        "{failure}"
-    );
-}
-
-/// The entry point is looked up by the name the caller asks for.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
-    let outcome = run_entry(wat, &host, "other").expect("should run");
-    assert_eq!(outcome.result, 9);
-}
-
-/// The entry point must take nothing and return an `i32`. A module that exports the
-/// name with another signature is told so, rather than being told the export is
-/// missing: wasmi answers both cases with one error, and "no entry point" would send
-/// a contract author looking for a function they already have.
-#[test]
-fn an_entry_point_of_the_wrong_type_fails() {
-    let host = FakeHost::new();
-
-    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
-        let body = if signature.contains("result i64") {
-            "(i64.const 0)"
-        } else if signature.is_empty() {
-            "(nop)"
-        } else {
-            "(i32.const 0)"
-        };
-        let wat = format!(
-            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
-        );
-        let failure = assert_stage!(
-            run_with_gas(&wat, PLENTY_OF_GAS, &host)
-                .expect_err("a wrongly-typed entry point must not run"),
-            RunError::EntryPoint(_)
-        )
-        .to_string();
-        assert!(
-            failure.contains("entry point 'finish' has the wrong signature"),
-            "{signature}: {failure}"
-        );
-        assert!(
-            !failure.contains("no entry point"),
-            "a present export must not be reported as absent — {signature}: {failure}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_fails() {
-    let host = FakeHost::new();
-
-    let wat =
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
-        RunError::EntryPoint(_)
-    )
-    .to_string();
-    assert!(
-        failure.contains("export 'finish' is not a function"),
-        "{failure}"
-    );
-}
-
-/// A guest that traps fails the run rather than returning a value.
-#[test]
-fn a_trapping_guest_fails_the_run() {
-    let host = FakeHost::new();
-
-    let wat = module(&[ONE_PAGE], "(unreachable)");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-
-    // An out-of-bounds guest access is a trap too, caught by the engine rather
-    // than anything the host is asked about.
-    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}

docs/build/environment.md

@@ -6,22 +6,52 @@ This document explains how to set one up.
 
 ## Tested compiler versions
 
-`xrpld` is built in the **C++23** dialect by default.
-Make sure your toolchain is recent enough — the compiler versions currently tested in CI are:
+`xrpld` is built in the **C++23** dialect by default, so your toolchain has to
+support it — see [compiler support for C++23][cpp23-support].
+The versions currently tested in CI are:
 
-| Compiler    | Version |
-| ----------- | ------- |
-| GCC         | 15.2    |
-| Clang       | 22      |
-| Apple Clang | 17      |
-| MSVC        | 19.44   |
+| Compiler    | Version            |
+| ----------- | ------------------ |
+| GCC         | 15.2               |
+| Clang       | 22                 |
+| Apple Clang | 21                 |
+| MSVC        | Visual Studio 2026 |
 
 LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
 
+### Older compilers
+
 Older compilers may fail to build the latest `develop` code: the codebase now
 relies on C++23 features and has been adjusted for `clang-tidy`.
 If the latest code doesn't build for you, update your build toolchain first.
 
+If updating isn't an option for you, we do accept pull requests that fix builds
+on older compilers, as long as the change is small and doesn't make the code
+harder to read. What we can't promise is that older compilers will keep working:
+only the versions in the table above are tested in CI, and we won't hold back
+the use of C++23 features or add invasive workarounds to keep an untested
+compiler building. Treat support for anything outside the table as best-effort.
+
+## Required tools
+
+Besides a compiler, building `xrpld` requires:
+
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |
+
+On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
+(see below). On Windows they have to be installed manually.
+
+Once they are in place, verify that everything is installed and runnable with:
+
+```bash
+./bin/check-tools.sh
+```
+
 ## Linux and macOS
 
 The **recommended way** to get a development environment on Linux and macOS is
@@ -39,20 +69,15 @@ Clang. If you instead opt to use your system-wide Apple Clang (via
 below).
 
 See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler.
-
-> [!NOTE]
-> Using Nix is not mandatory. Any custom environment (Homebrew packages or
-> anything else) will continue to work, but then it is up to you to keep it in
-> sync with the environment used in CI. Nix unifies the development environment
-> for everyone and synchronizes updates, which is why we recommend it.
+details, including how to select a different compiler and why we recommend Nix
+over a hand-maintained environment.
 
 ### macOS: managing the Apple Clang version
 
 If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
 the compiler version is whatever your installed Xcode (or Command Line Tools)
 provides. The following command should return a version greater than or equal to
-the [minimum required](#tested-compiler-versions):
+the [tested one](#tested-compiler-versions):
 
 ```bash
 clang --version
@@ -89,23 +114,23 @@ building xrpld. You may want to install and pin a specific version of Xcode:
 Nix is not available on Windows, so the required tools have to be installed
 manually:
 
-- [Visual Studio 2022](https://visualstudio.microsoft.com/) with the
+- [Visual Studio 2026](https://visualstudio.microsoft.com/) with the
   **"Desktop development with C++"** workload — this provides MSVC and the
-  "x64 Native Tools Command Prompt".
+  "x64 Native Tools Command Prompt". CI configures CMake with the
+  `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- [Python 3.11](https://www.python.org/downloads/), or higher
-- [Conan 2.17](https://conan.io/downloads.html), or higher
-- [CMake 3.22](https://cmake.org/download/), or higher
-
-> [!NOTE]
-> Windows is used for development only and is not recommended for production.
+- Python, Conan, and CMake, at the versions listed in
+  [Required tools](#required-tools).
 
 ## Clang-tidy
 
 `clang-tidy` is required to run static analysis checks locally (see
 [CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. This project currently uses `clang-tidy` version 22.
+project. The version this project uses is listed in
+[Tested compiler versions](#tested-compiler-versions).
 
-On Linux and macOS, the [Nix development shell](./nix.md) provides `clang-tidy`
-22 out of the box — run it via `run-clang-tidy`. No separate installation is
-needed.
+On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
+version out of the box — run it via `run-clang-tidy`. No separate installation
+is needed.
+
+[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23

docs/build/nix.md

@@ -120,7 +120,7 @@ nix develop -c "$SHELL"
 >
 > If it doesn't, either adjust your shell configuration so it doesn't override `$PATH`, or use [direnv](#automatic-activation-with-direnv) (below), which loads the environment _after_ your shell config and so takes precedence regardless of the shell you use.
 
-## Building xrpld with Nix
+## Building xrpld in the Nix shell
 
 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).
 
@@ -128,6 +128,28 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
+## Conan configuration
+
+The shell runs [`conan/init.sh`](../../conan/init.sh) on entry, so
+[Set Up Conan](../../BUILD.md#set-up-conan) is already done for you. It installs
+into the shell's own Conan home: `CONAN_HOME=~/.conan2-nix`.
+
+### Prebuilt packages
+
+On **Linux**, the binaries on the `xrplf` remote are built in this same Nix
+environment — CI runs in Docker images that bundle the dev shell's toolchain (see
+[`nix/docker`](../../nix/docker)) — so `.#gcc` and `.#clang` can reuse them. The
+`-plain` shells do not match that toolchain's glibc, so binaries from the remote
+are not a reliable match there.
+
+On **macOS**, CI builds with Apple Clang, so the remote holds nothing for the Nix
+`clang` toolchain and dependencies are compiled locally. We do not publish
+Nix-built macOS binaries because a Conan package ID records the compiler version
+but not the nixpkgs revision.
+
+To compile everything from source, add `--build '*'` to the `conan install`
+command.
+
 ## Automatic Activation with direnv
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
@@ -142,14 +164,6 @@ The repository already ships an `.envrc` at its root that activates the Nix flak
 > [!NOTE]
 > direnv only caches the `.direnv` directory (already listed in `.gitignore`); no other repository files are affected.
 
-## Conan and Prebuilt Packages
-
-Please note that there is no guarantee that binaries from conan cache will work when using nix. If you encounter any errors, please use `--build '*'` to force conan to compile everything from source:
-
-```bash
-conan install .. --output-folder . --build '*' --settings build_type=Release
-```
-
 ## Updating `flake.lock` file
 
 To update `flake.lock` to the latest revision use `nix flake update` command.

docs/sample_chart.doc

@@ -1,24 +0,0 @@
-/*!
-    \page somestatechart Example state diagram
-
-    \startuml SomeState "my state diagram"
-    scale 600 width
-
-    [*] -> State1
-    State1 --> State2 : Succeeded
-    State1 --> [*] : Aborted
-    State2 --> State3 : Succeeded
-    State2 --> [*] : Aborted
-    state State3 {
-      state "Accumulate Enough Data\nLong State Name" as long1
-      long1 : Just a test
-      [*] --> long1
-      long1 --> long1 : New Data
-      long1 --> ProcessData : Enough Data
-    }
-    State3 --> State3 : Failed
-    State3 --> [*] : Succeeded / Save Result
-    State3 --> [*] : Aborted
-
-    \enduml
-*/

include/xrpl/basics/Archive.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
+#include <filesystem>
 
 namespace xrpl {
 
@@ -13,6 +13,6 @@ namespace xrpl {
  * @throws runtime_error
  */
 void
-extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
+extractTarLz4(std::filesystem::path const& src, std::filesystem::path const& dst);
 
 }  // namespace xrpl

include/xrpl/basics/Buffer.h

@@ -3,6 +3,7 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <cstring>
 #include <memory>
@@ -156,6 +157,19 @@ public:
     }
     /** @} */
 
+    /**
+     * Set every byte in the buffer to the given value.
+     *
+     * The size is unchanged, and this is a no-op on an empty buffer.
+     *
+     * @param value the byte to write to every position.
+     */
+    void
+    fill(std::uint8_t value) noexcept
+    {
+        std::fill_n(p_.get(), size_, value);
+    }
+
     /**
      * Reset the buffer.
      * All memory is deallocated. The resulting size is 0.
@@ -226,10 +240,4 @@ operator==(Buffer const& lhs, Buffer const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
-inline bool
-operator!=(Buffer const& lhs, Buffer const& rhs) noexcept
-{
-    return !(lhs == rhs);
-}
-
 }  // namespace xrpl

include/xrpl/basics/FileUtilities.h

@@ -1,24 +1,79 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
-#include <boost/system/error_code.hpp>
-
 #include <cstddef>
+#include <filesystem>
 #include <optional>
 #include <string>
+#include <system_error>
 
 namespace xrpl {
 
 std::string
 getFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& sourcePath,
+    std::error_code& ec,
+    std::filesystem::path const& sourcePath,
     std::optional<std::size_t> maxSize = std::nullopt);
 
 void
 writeFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& destPath,
+    std::error_code& ec,
+    std::filesystem::path const& destPath,
     std::string const& contents);
 
+/**
+ * Generate a unique, non-existing path under @p base whose filename starts with
+ * @p prefix and ends with a random hex suffix.
+ *
+ * Attempts up to @p maxAttempts paths. Throws `std::runtime_error` if a unique
+ * path cannot be found or if the filesystem returns an error while checking for
+ * existence.
+ */
+std::filesystem::path
+uniqueRandomPath(
+    std::filesystem::path const& base,
+    std::string const& prefix = "",
+    std::size_t maxAttempts = 100);
+
+/**
+ * RAII temporary directory.
+ *
+ * The directory and all its contents are deleted when
+ * the instance of `TempDir` is destroyed.
+ */
+class TempDir
+{
+    std::filesystem::path path_;
+
+public:
+#if !GENERATING_DOCS
+    TempDir(TempDir const&) = delete;
+    TempDir&
+    operator=(TempDir const&) = delete;
+#endif
+
+    /**
+     * Construct a temporary directory.
+     */
+    TempDir();
+
+    /**
+     * Destroy a temporary directory.
+     */
+    ~TempDir();
+
+    /**
+     * Get the native path for the temporary directory.
+     */
+    [[nodiscard]] std::string
+    path() const;
+
+    /**
+     * Get the native path for a file.
+     *
+     * The file does not need to exist.
+     */
+    [[nodiscard]] std::string
+    file(std::string const& name) const;
+};
+
 }  // namespace xrpl

include/xrpl/basics/IntrusivePointer.h

@@ -96,9 +96,6 @@ public:
     SharedIntrusive&
     operator=(SharedIntrusive const& rhs);
 
-    bool
-    operator!=(std::nullptr_t) const;
-
     bool
     operator==(std::nullptr_t) const;
 

include/xrpl/basics/IntrusivePointer.ipp

@@ -111,13 +111,6 @@ SharedIntrusive<T>::operator=(SharedIntrusive<TT>&& rhs)
     return *this;
 }
 
-template <class T>
-bool
-SharedIntrusive<T>::operator!=(std::nullptr_t) const
-{
-    return this->get() != nullptr;
-}
-
 template <class T>
 bool
 SharedIntrusive<T>::operator==(std::nullptr_t) const

include/xrpl/basics/Log.h

@@ -3,8 +3,8 @@
 #include <xrpl/beast/utility/Journal.h>
 
 #include <boost/beast/core/string.hpp>
-#include <boost/filesystem.hpp>
 
+#include <filesystem>
 #include <fstream>
 #include <map>
 #include <memory>
@@ -84,7 +84,7 @@ private:
          * @return `true` if the file was opened.
          */
         bool
-        open(boost::filesystem::path const& path);
+        open(std::filesystem::path const& path);
 
         /**
          * Close and re-open the system file associated with the log
@@ -133,7 +133,7 @@ private:
 
     private:
         std::unique_ptr<std::ofstream> stream_;
-        boost::filesystem::path path_;
+        std::filesystem::path path_;
     };
 
     std::mutex mutable mutex_;
@@ -152,7 +152,7 @@ public:
     virtual ~Logs() = default;
 
     bool
-    open(boost::filesystem::path const& pathToLogFile);
+    open(std::filesystem::path const& pathToLogFile);
 
     beast::Journal::Sink&
     get(std::string const& name);

include/xrpl/basics/Number.h

@@ -304,7 +304,7 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *      on-ledger are non-negative. This is due to implementation details of
  *      several operations which use unsigned arithmetic internally. This is
  *      sufficient to represent all valid XRP values (where the absolute value
- *      can not exceed INITIAL_XRP: 10^17), and MPT values (where the absolute
+ *      can not exceed kInitialXRP: 10^17), and MPT values (where the absolute
  *      value can not exceed maxMPTokenAmount: 2^63-1).
  *
  * ---- Mantissa Range Switching ----
@@ -449,12 +449,6 @@ public:
             x.exponent_ == y.exponent_;
     }
 
-    friend constexpr bool
-    operator!=(Number const& x, Number const& y) noexcept
-    {
-        return !(x == y);
-    }
-
     friend constexpr bool
     operator<(Number const& l, Number const& r) noexcept
     {
@@ -549,21 +543,8 @@ public:
     setround(RoundingMode inMode);
 
     /**
-     * Convert an integer to a RoundingMode, validating that it is in range.
+     * Returns which mantissa scale is currently in use for normalization.
      *
-     * Returns std::nullopt if the value does not correspond to a valid
-     * RoundingMode.
-     */
-    static std::optional<RoundingMode>
-    checkedRoundingMode(int mode) noexcept
-    {
-        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
-            mode > static_cast<int>(RoundingMode::Upward))
-            return std::nullopt;
-        return static_cast<RoundingMode>(mode);
-    }
-
-    /**
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale

include/xrpl/basics/SHAMapHash.h

@@ -85,12 +85,6 @@ public:
     }
 };
 
-inline bool
-operator!=(SHAMapHash const& x, SHAMapHash const& y)
-{
-    return !(x == y);
-}
-
 template <>
 inline std::size_t
 extract(SHAMapHash const& key)

include/xrpl/basics/Slice.h

@@ -208,12 +208,6 @@ operator==(Slice const& lhs, Slice const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
-inline bool
-operator!=(Slice const& lhs, Slice const& rhs) noexcept
-{
-    return !(lhs == rhs);
-}
-
 inline bool
 operator<(Slice const& lhs, Slice const& rhs) noexcept
 {

include/xrpl/basics/StringUtilities.h

@@ -125,9 +125,31 @@ struct ParsedUrl
 bool
 parseUrl(ParsedUrl& pUrl, std::string const& strUrl);
 
+/**
+ * Remove leading and trailing ASCII whitespace.
+ *
+ * Whitespace is the fixed set " \t\n\v\f\r"; the current locale is not
+ * consulted, so the result depends only on the input.
+ *
+ * @param str The string to trim.
+ * @return @p str without leading or trailing whitespace.
+ */
 std::string
 trimWhitespace(std::string str);
 
+/**
+ * Fold ASCII upper case letters to lower case.
+ *
+ * Only 'A' through 'Z' are remapped; every other byte is left alone and the
+ * current locale is not consulted, so the result depends only on the input.
+ *
+ * @param str The string to fold.
+ * @return @p str with each ASCII upper case letter replaced by its lower case
+ *         equivalent.
+ */
+std::string
+toLower(std::string str);
+
 std::optional<std::uint64_t>
 toUInt64(std::string const& s);
 
@@ -141,4 +163,31 @@ toUInt64(std::string const& s);
 bool
 isProperlyFormedTomlDomain(std::string_view domain);
 
+/**
+ * Whether a view can be passed on as a C string.
+ *
+ * A view is only usable that way if it covers a whole null-terminated string
+ * rather than a slice of one, since a reader given just the pointer stops at
+ * the first null. This asks exactly that question: rebuild the view from its
+ * data() as a C string, as such a reader would, and see if it comes back
+ * unchanged. A slice comes back longer, having run past its own end.
+ *
+ * The byte after a view is not part of it, so this is only well defined when
+ * @p str points into storage that is known to hold a null somewhere at or
+ * after its end -- a string literal, or the buffer of a std::string. For a
+ * view built from a bare pointer and length it reads out of bounds, and in a
+ * constant expression that is a compile error rather than undefined behaviour.
+ *
+ * @param str The view to test.
+ * @return Whether @p str is null-terminated.
+ */
+constexpr bool
+isNullTerminated(std::string_view str)
+{
+    // Reading past the view is the point, so the usual warning about data() not
+    // being null-terminated does not apply.
+    // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+    return std::string_view{str.data()} == str;
+}
+
 }  // namespace xrpl

include/xrpl/basics/partitioned_unordered_map.h

@@ -116,12 +116,6 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
-
-        friend bool
-        operator!=(Iterator const& lhs, Iterator const& rhs)
-        {
-            return !(lhs == rhs);
-        }
     };
 
     struct ConstIterator
@@ -189,12 +183,6 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
-
-        friend bool
-        operator!=(ConstIterator const& lhs, ConstIterator const& rhs)
-        {
-            return !(lhs == rhs);
-        }
     };
 
 private:

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -1038,25 +1038,6 @@ public:
                Compare,
                OtherAllocator> const& other) const;
 
-    template <
-        bool OtherIsMulti,
-        bool OtherIsMap,
-        class OtherT,
-        class OtherDuration,
-        class OtherAllocator>
-    bool
-    operator!=(AgedOrderedContainer<
-               OtherIsMulti,
-               OtherIsMap,
-               Key,
-               OtherT,
-               OtherDuration,
-               Compare,
-               OtherAllocator> const& other) const
-    {
-        return !(this->operator==(other));
-    }
-
     template <
         bool OtherIsMulti,
         bool OtherIsMap,

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -1340,28 +1340,6 @@ public:
                OtherAllocator> const& other) const
         requires MaybeMulti;
 
-    template <
-        bool OtherIsMulti,
-        bool OtherIsMap,
-        class OtherKey,
-        class OtherT,
-        class OtherDuration,
-        class OtherHash,
-        class OtherAllocator>
-    bool
-    operator!=(AgedUnorderedContainer<
-               OtherIsMulti,
-               OtherIsMap,
-               OtherKey,
-               OtherT,
-               OtherDuration,
-               OtherHash,
-               KeyEqual,
-               OtherAllocator> const& other) const
-    {
-        return !(this->operator==(other));
-    }
-
 private:
     bool
     wouldExceed(size_type additional) const

include/xrpl/beast/core/List.h

@@ -82,13 +82,6 @@ public:
         return node_ == other.node_;
     }
 
-    template <typename M>
-    bool
-    operator!=(ListIterator<M> const& other) const noexcept
-    {
-        return !((*this) == other);
-    }
-
     reference
     operator*() const noexcept
     {

include/xrpl/beast/net/IPEndpoint.h

@@ -110,12 +110,6 @@ public:
     operator==(Endpoint const& lhs, Endpoint const& rhs);
     friend bool
     operator<(Endpoint const& lhs, Endpoint const& rhs);
-
-    friend bool
-    operator!=(Endpoint const& lhs, Endpoint const& rhs)
-    {
-        return !(lhs == rhs);
-    }
     friend bool
     operator>(Endpoint const& lhs, Endpoint const& rhs)
     {

include/xrpl/beast/rfc2616.h

@@ -229,12 +229,6 @@ public:
         return other.it_ == it_ && other.end_ == end_ && other.value_.size() == value_.size();
     }
 
-    bool
-    operator!=(ListIterator const& other) const
-    {
-        return !(*this == other);
-    }
-
     reference
     operator*() const
     {

include/xrpl/beast/unit_test/reporter.h

@@ -8,7 +8,6 @@
 #include <xrpl/beast/unit_test/runner.h>
 #include <xrpl/beast/unit_test/suite_info.h>
 
-#include <boost/lexical_cast.hpp>
 #include <boost/optional.hpp>
 
 #include <algorithm>
@@ -188,7 +187,7 @@ Reporter<Unused>::fmtdur(clock_type::duration const& d)
     using namespace std::chrono;
     auto const ms = duration_cast<milliseconds>(d);
     if (ms < seconds{1})
-        return boost::lexical_cast<std::string>(ms.count()) + "ms";
+        return std::to_string(ms.count()) + "ms";
     std::stringstream ss;
     ss << std::fixed << std::setprecision(1) << (ms.count() / 1000.) << "s";
     return ss.str();

include/xrpl/beast/unit_test/suite.h

@@ -6,11 +6,10 @@
 
 #include <xrpl/beast/unit_test/runner.h>
 
-#include <boost/filesystem.hpp>
-#include <boost/lexical_cast.hpp>
 #include <boost/throw_exception.hpp>
 
 #include <exception>
+#include <filesystem>
 #include <memory>
 #include <ostream>
 #include <sstream>
@@ -27,10 +26,10 @@ makeReason(String const& reason, char const* file, int line)
     std::string s(reason);
     if (!s.empty())
         s.append(": ");
-    namespace fs = boost::filesystem;
+    namespace fs = std::filesystem;
     s.append(fs::path{file}.filename().string());
     s.append("(");
-    s.append(boost::lexical_cast<std::string>(line));
+    s.append(std::to_string(line));
     s.append(")");
     return s;
 }

include/xrpl/beast/utility/temp_dir.h

@@ -1,71 +0,0 @@
-#pragma once
-
-#include <boost/filesystem.hpp>
-
-#include <string>
-
-namespace beast {
-
-/**
- * RAII temporary directory.
- *
- * The directory and all its contents are deleted when
- * the instance of `temp_dir` is destroyed.
- */
-class TempDir
-{
-    boost::filesystem::path path_;
-
-public:
-#if !GENERATING_DOCS
-    TempDir(TempDir const&) = delete;
-    TempDir&
-    operator=(TempDir const&) = delete;
-#endif
-
-    /**
-     * Construct a temporary directory.
-     */
-    TempDir()
-    {
-        auto const dir = boost::filesystem::temp_directory_path();
-        do
-        {
-            path_ = dir / boost::filesystem::unique_path();
-        } while (boost::filesystem::exists(path_));
-        boost::filesystem::create_directory(path_);
-    }
-
-    /**
-     * Destroy a temporary directory.
-     */
-    ~TempDir()
-    {
-        // use non-throwing calls in the destructor
-        boost::system::error_code ec;
-        boost::filesystem::remove_all(path_, ec);
-        // TODO: warn/notify if ec set ?
-    }
-
-    /**
-     * Get the native path for the temporary directory
-     */
-    [[nodiscard]] std::string
-    path() const
-    {
-        return path_.string();
-    }
-
-    /**
-     * Get the native path for the a file.
-     *
-     * The file does not need to exist.
-     */
-    [[nodiscard]] std::string
-    file(std::string const& name) const
-    {
-        return (path_ / name).string();
-    }
-};
-
-}  // namespace beast

include/xrpl/conditions/Condition.h

@@ -92,10 +92,4 @@ operator==(Condition const& lhs, Condition const& rhs)
         lhs.fingerprint == rhs.fingerprint;
 }
 
-inline bool
-operator!=(Condition const& lhs, Condition const& rhs)
-{
-    return !(lhs == rhs);
-}
-
 }  // namespace xrpl::cryptoconditions

include/xrpl/conditions/Fulfillment.h

@@ -93,12 +93,6 @@ operator==(Fulfillment const& lhs, Fulfillment const& rhs)
         lhs.fingerprint() == rhs.fingerprint();
 }
 
-inline bool
-operator!=(Fulfillment const& lhs, Fulfillment const& rhs)
-{
-    return !(lhs == rhs);
-}
-
 /**
  * Determine whether the given fulfillment and condition match
  */

include/xrpl/core/PerfLog.h

@@ -4,13 +4,13 @@
 #include <xrpl/core/Job.h>
 #include <xrpl/json/json_value.h>
 
-#include <boost/filesystem.hpp>
-
 #include <chrono>
 #include <cstdint>
+#include <filesystem>
 #include <functional>
 #include <memory>
-#include <string>
+#include <span>
+#include <string_view>
 
 namespace beast {
 class Journal;
@@ -44,7 +44,7 @@ public:
      */
     struct Setup
     {
-        boost::filesystem::path perfLog;
+        std::filesystem::path perfLog;
         // log_interval is in milliseconds to support faster testing.
         milliseconds logInterval{seconds(1)};
     };
@@ -68,7 +68,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcStart(std::string const& method, std::uint64_t requestId) = 0;
+    rpcStart(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log successful finish of RPC call
@@ -77,7 +77,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcFinish(std::string const& method, std::uint64_t requestId) = 0;
+    rpcFinish(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log errored RPC call
@@ -86,7 +86,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcError(std::string const& method, std::uint64_t requestId) = 0;
+    rpcError(std::string_view method, std::uint64_t requestId) = 0;
 
     /**
      * Log queued job
@@ -149,12 +149,22 @@ public:
 };
 
 PerfLog::Setup
-setupPerfLog(Section const& section, boost::filesystem::path const& configDir);
+setupPerfLog(Section const& section, std::filesystem::path const& configDir);
 
+/**
+ * @param methodNames The RPC methods to count, one counter per name. Each name
+ *        must be a view of a whole, null-terminated string literal rather than
+ *        a slice of one, because the counters are reported as JSON keys that
+ *        borrow the name and read it as a C string. The names must outlive the
+ *        returned object, which holds views of them. Callers pass
+ *        rpc::getHandlerNames(); it is an argument so that this layer needs to
+ *        know nothing about the RPC dispatch table.
+ */
 std::unique_ptr<PerfLog>
 makePerfLog(
     PerfLog::Setup const& setup,
     Application& app,
+    std::span<std::string_view const> methodNames,
     beast::Journal journal,
     std::function<void()>&& signalStop);
 
@@ -162,7 +172,7 @@ template <typename Func, class Rep, class Period>
 auto
 measureDurationAndLog(
     Func&& func,
-    std::string const& actionDescription,
+    std::string_view actionDescription,
     std::chrono::duration<Rep, Period> maxDelay,
     beast::Journal const& journal)
 {

include/xrpl/json/json_value.h

@@ -4,6 +4,7 @@
 #include <xrpl/json/json_forwards.h>
 
 #include <cstring>
+#include <iterator>
 #include <limits>
 #include <map>
 #include <string>
@@ -72,36 +73,18 @@ operator==(StaticString x, StaticString y)
     return strcmp(x.cStr(), y.cStr()) == 0;
 }
 
-inline bool
-operator!=(StaticString x, StaticString y)
-{
-    return !(x == y);
-}
-
 inline bool
 operator==(std::string const& x, StaticString y)
 {
     return strcmp(x.c_str(), y.cStr()) == 0;
 }
 
-inline bool
-operator!=(std::string const& x, StaticString y)
-{
-    return !(x == y);
-}
-
 inline bool
 operator==(StaticString x, std::string const& y)
 {
     return y == x;
 }
 
-inline bool
-operator!=(StaticString x, std::string const& y)
-{
-    return !(y == x);
-}
-
 /**
  * @brief Represents a <a HREF="http://www.json.org">JSON</a> value.
  *
@@ -489,12 +472,6 @@ toJson(xrpl::Number const& number)
 bool
 operator==(Value const&, Value const&);
 
-inline bool
-operator!=(Value const& x, Value const& y)
-{
-    return !(x == y);
-}
-
 bool
 operator<(Value const&, Value const&);
 
@@ -548,6 +525,7 @@ public:
 class ValueIteratorBase
 {
 public:
+    using iterator_category = std::bidirectional_iterator_tag;
     using size_t = unsigned int;
     using difference_type = int;
     using SelfType = ValueIteratorBase;
@@ -562,12 +540,6 @@ public:
         return isEqual(other);
     }
 
-    bool
-    operator!=(SelfType const& other) const
-    {
-        return !isEqual(other);
-    }
-
     /**
      * Return either the index or the member name of the referenced value as a
      * Value.

include/xrpl/ledger/BookDirs.h

@@ -49,12 +49,6 @@ public:
     bool
     operator==(const_iterator const& other) const;
 
-    bool
-    operator!=(const_iterator const& other) const
-    {
-        return !(*this == other);
-    }
-
     reference
     operator*() const;
 

include/xrpl/ledger/CanonicalTXSet.h

@@ -59,12 +59,6 @@ private:
             return lhs.txId_ == rhs.txId_;
         }
 
-        friend bool
-        operator!=(Key const& lhs, Key const& rhs)
-        {
-            return !(lhs == rhs);
-        }
-
         [[nodiscard]] uint256 const&
         getAccount() const
         {

include/xrpl/ledger/Dir.h

@@ -59,12 +59,6 @@ public:
     bool
     operator==(ConstIterator const& other) const;
 
-    bool
-    operator!=(ConstIterator const& other) const
-    {
-        return !(*this == other);
-    }
-
     reference
     operator*() const;
 

include/xrpl/ledger/View.h

@@ -35,6 +35,11 @@ enum class SkipEntry : bool { No = false, Yes };
 //
 //------------------------------------------------------------------------------
 
+/**
+ * Whether an expiration check should be inclusive or exclusive.
+ */
+enum class ExpiryComparison { Inclusive, Exclusive };
+
 /**
  * Determines whether the given expiration time has passed.
  *
@@ -54,11 +59,16 @@ enum class SkipEntry : bool { No = false, Yes };
  *
  * @param view The ledger whose parent time is used as the clock.
  * @param exp The optional expiration time we want to check.
+ * @param comparison Whether the boundary is inclusive (`now >= exp`, the
+ *                   default) or exclusive (`now > exp`).
  *
  * @return `true` if `exp` is in the past; `false` otherwise.
  */
 [[nodiscard]] bool
-hasExpired(ReadView const& view, std::optional<std::uint32_t> const& exp);
+hasExpired(
+    ReadView const& view,
+    std::optional<std::uint32_t> const& exp,
+    ExpiryComparison comparison = ExpiryComparison::Inclusive);
 
 // Note, depth parameter is used to limit the recursion depth
 [[nodiscard]] bool

include/xrpl/ledger/detail/ReadViewFwdRange.h

@@ -85,9 +85,6 @@ public:
         bool
         operator==(Iterator const& other) const;
 
-        bool
-        operator!=(Iterator const& other) const;
-
         // Can throw
         reference
         operator*() const;

include/xrpl/ledger/detail/ReadViewFwdRange.ipp

@@ -64,13 +64,6 @@ ReadViewFwdRange<ValueType>::Iterator::operator==(Iterator const& other) const
     return impl_ == other.impl_;
 }
 
-template <class ValueType>
-bool
-ReadViewFwdRange<ValueType>::Iterator::operator!=(Iterator const& other) const
-{
-    return !(*this == other);
-}
-
 template <class ValueType>
 auto
 ReadViewFwdRange<ValueType>::Iterator::operator*() const -> reference

include/xrpl/ledger/helpers/AMMHelpers.h

@@ -226,7 +226,7 @@ getAMMOfferStartWithTakerGets(
 
     auto getAmounts = [&pool, &tfee](Number const& nTakerGetsProposed) {
         // Round downward to minimize the offer and to maximize the quality.
-        // This has the most impact when takerGets is XRP.
+        // This has the most impact when takerGets is integral.
         auto const takerGets =
             toAmount<TOut>(getAsset(pool.out), nTakerGetsProposed, Number::RoundingMode::Downward);
         return TAmounts<TIn, TOut>{swapAssetOut(pool, takerGets, tfee), takerGets};
@@ -294,7 +294,7 @@ getAMMOfferStartWithTakerPays(
 
     auto getAmounts = [&pool, &tfee](Number const& nTakerPaysProposed) {
         // Round downward to minimize the offer and to maximize the quality.
-        // This has the most impact when takerPays is XRP.
+        // This has the most impact when takerPays is integral.
         auto const takerPays =
             toAmount<TIn>(getAsset(pool.in), nTakerPaysProposed, Number::RoundingMode::Downward);
         return TAmounts<TIn, TOut>{takerPays, swapAssetIn(pool, takerPays, tfee)};
@@ -313,11 +313,11 @@ getAMMOfferStartWithTakerPays(
  * is equal to LOB quality (in this case AMM offer quality is
  * better than LOB quality) or AMM offer is equal to LOB quality
  * (in this case SPQ is better than LOB quality).
- * Pre-amendment code calculates takerPays first. If takerGets is XRP,
- * it is rounded down, which results in worse offer quality than
- * LOB quality, and the offer might fail to generate.
- * Post-amendment code calculates the XRP offer side first. The result
- * is rounded down, which makes the offer quality better.
+ * Pre-amendment code calculates takerPays first. If takerGets is the
+ * economically coarser integral side, it is rounded down, which results in
+ * worse offer quality than LOB quality, and the offer might fail to generate.
+ * Post-amendment code calculates the economically coarser integral offer side
+ * first. The result is rounded down, which makes the offer quality better.
  *   It might not be possible to match either SPQ or AMM offer to LOB
  * quality. This generally happens at higher fees.
  * @param pool AMM pool balances
@@ -396,10 +396,18 @@ changeSpotPriceQuality(
         return std::nullopt;
     }
 
-    // Generate the offer starting with XRP side. Return seated offer amounts
-    // if the offer can be generated, otherwise nullopt.
     auto amounts = [&]() {
-        if (isXRP(getAsset(pool.out)))
+        bool const inIntegral = getAsset(pool.in).integral();
+        bool const outIntegral = getAsset(pool.out).integral();
+
+        // Preserve historical behavior for fractional pairs and XRP/IOU-style
+        // one-integral-side pairs. For two integral assets, pick the side whose
+        // minimum unit is economically coarser at this quality.
+        //
+        // Quality::rate() is input units per output unit, so one output unit is
+        // coarser when it costs at least one input unit. Ties use takerGets,
+        // matching the historical XRP-output behavior.
+        if (outIntegral && (!inIntegral || Number(quality.rate()) >= 1))
             return getAMMOfferStartWithTakerGets(pool, quality, tfee);
         return getAMMOfferStartWithTakerPays(pool, quality, tfee);
     }();

include/xrpl/ledger/helpers/CredentialHelpers.h

@@ -7,6 +7,7 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/STArray.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
@@ -34,7 +35,7 @@ deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j);
 
 // Amendment and parameters checks for sfCredentialIDs field
 NotTEC
-checkFields(STTx const& tx, beast::Journal j);
+checkFields(STTx const& tx, Rules const& rules, beast::Journal j);
 
 // Accessing the ledger to check if provided credentials are valid. Do not use
 // in doApply (only in preclaim) since it does not remove expired credentials.

include/xrpl/ledger/helpers/MPTokenHelpers.h

@@ -261,6 +261,14 @@ checkCreateMPT(
     xrpl::MPTIssue const& mptIssue,
     xrpl::AccountID const& holder,
     SLE::ref sponsorSle,
+    std::uint32_t flags,
+    beast::Journal j);
+
+TER
+checkCreateMPT(
+    xrpl::ApplyView& view,
+    xrpl::MPTIssue const& mptIssue,
+    xrpl::AccountID const& holder,
     beast::Journal j);
 
 //------------------------------------------------------------------------------

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -6,10 +6,13 @@
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 
+#include <cstdint>
 #include <optional>
 
 namespace xrpl {
 
+class STTx;
+
 /**
  * From the perspective of a vault, return the number of shares to give
  * depositor when they offer a fixed amount of assets. Note, since shares are
@@ -123,4 +126,82 @@ isSoleShareholder(ReadView const& view, AccountID const& account, SLE::const_ref
 [[nodiscard]] VaultVersion
 getVaultVersion(SLE::const_ref vault);
 
+/**
+ * Resolves the VaultKind of a vault SLE. Returns VaultKind::ClosedEnded when
+ * sfVaultKind is present and equal to that value; anything else (including an
+ * absent field or an unrecognised value) is treated as VaultKind::OpenEnded.
+ *
+ * @param vault The vault SLE.
+ */
+[[nodiscard]] VaultKind
+getVaultKind(SLE::const_ref vault);
+
+/**
+ * Reads sfVaultKind from a transaction. An absent field resolves to
+ * VaultKind::OpenEnded (matching the on-ledger default); any unrecognised
+ * value is also treated as VaultKind::OpenEnded, mirroring the SLE overload.
+ * Callers that need to reject out-of-range values (e.g. preflight) should
+ * gate on isValidVaultKind() first.
+ *
+ * @param tx The transaction.
+ */
+[[nodiscard]] VaultKind
+getVaultKind(STTx const& tx);
+
+/**
+ * Returns true iff sfVaultKind is either absent from @p tx or is present and
+ * equal to a recognised VaultKind enumerator. Intended for use in preflight
+ * to reject malformed transactions before decoding with getVaultKind().
+ *
+ * @param tx The transaction.
+ */
+[[nodiscard]] bool
+isValidVaultKind(STTx const& tx);
+
+/**
+ * Returns true iff the (SubscriptionDate, RedemptionDate) gap of a
+ * closed-ended vault satisfies
+ * kMinInvestmentPeriod <= (red - sub) < kMaxInvestmentPeriod. The arithmetic
+ * is performed in std::int64_t so that @p sub near UINT32_MAX does not
+ * overflow. Shared by VaultCreate::preflight and the ValidVault invariant.
+ *
+ * @param sub The value of sfSubscriptionDate.
+ * @param red The value of sfRedemptionDate.
+ */
+[[nodiscard]] bool
+isValidClosedEndedGap(std::uint32_t sub, std::uint32_t red);
+
+/**
+ * Returns the current lifecycle phase of a vault. Open-ended
+ * vaults are always NoPhase. For closed-ended vaults the phase is derived
+ * from the parent ledger close time and the vault's immutable
+ * SubscriptionDate and RedemptionDate.
+ *
+ * @param view The ledger view whose parent close time is used as the clock.
+ * @param vault The vault SLE.
+ */
+[[nodiscard]] VaultPhase
+getVaultPhase(ReadView const& view, SLE::const_ref vault);
+
+/**
+ * Raw-fields overload of getVaultPhase. Derives the phase from an already
+ * decomposed vault snapshot: an absent or non-ClosedEnded @p vaultKind
+ * resolves to VaultPhase::NoPhase; otherwise the phase is computed from
+ * @p subscriptionDate and @p redemptionDate against the view's parent
+ * close time using the same boundary semantics as the SLE overload
+ * (Subscription is inclusive of now == SubscriptionDate; Investment starts
+ * strictly after).
+ *
+ * @param view The ledger view whose parent close time is used as the clock.
+ * @param vaultKind The value of sfVaultKind, or nullopt if absent.
+ * @param subscriptionDate The value of sfSubscriptionDate, or nullopt if absent.
+ * @param redemptionDate The value of sfRedemptionDate, or nullopt if absent.
+ */
+[[nodiscard]] VaultPhase
+getVaultPhase(
+    ReadView const& view,
+    std::optional<std::uint8_t> vaultKind,
+    std::optional<std::uint32_t> subscriptionDate,
+    std::optional<std::uint32_t> redemptionDate);
+
 }  // namespace xrpl

include/xrpl/protocol/AMMCore.h

@@ -47,7 +47,7 @@ ammLPTIssue(Asset const& asset1, Asset const& asset2, AccountID const& ammAccoun
 
 /**
  * Validate the amount.
- * If validZero is false and amount is beast::zero then invalid amount.
+ * If validZero is false and amount is beast::kZero then invalid amount.
  * Return error code if invalid amount.
  * If pair then validate amount's issue matches one of the pair's issue.
  */

include/xrpl/protocol/AmountConversions.h

@@ -154,7 +154,7 @@ T
 toAmount(Asset const& asset, Number const& n, Number::RoundingMode mode = Number::getround())
 {
     SaveNumberRoundMode const rm(Number::getround());
-    if (isXRP(asset))
+    if (asset.integral())
         Number::setround(mode);
 
     if constexpr (std::is_same_v<IOUAmount, T>)

include/xrpl/protocol/Protocol.h

@@ -9,6 +9,7 @@
 #include <mpt_protocol.h>
 #include <secp256k1_mpt.h>
 
+#include <chrono>
 #include <cstddef>
 #include <cstdint>
 
@@ -327,22 +328,42 @@ enum class VaultVersion : uint8_t {
     CashBasis,
 };
 
+/**
+ * Vault kind. Distinguishes closed-ended vaults from the default open-ended
+ * kind. Persisted as sfVaultKind (UINT8); absent means OpenEnded.
+ */
+enum class VaultKind : std::uint8_t {
+    OpenEnded = 0,
+    ClosedEnded = 1,
+};
+
+/**
+ * Lifecycle phase of a vault. Open-ended vaults are always NoPhase; the other
+ * three values are the phases of a closed-ended vault.
+ */
+enum class VaultPhase : std::uint8_t {
+    NoPhase = 0,
+    Subscription,
+    Investment,
+    Redemption,
+};
+
+/**
+ * Bounds on the length of a closed-ended vault's Investment phase
+ * (RedemptionDate - SubscriptionDate). At vault creation the gap must satisfy
+ * kMinInvestmentPeriod <= gap < kMaxInvestmentPeriod.
+ */
+constexpr std::uint32_t kMinInvestmentPeriod =
+    std::chrono::seconds{std::chrono::minutes{1}}.count();
+// This is 946708560 seconds which 30 x 365.2425 days (the average length of a Gregorian year).
+constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono::years{30}}.count();
+
 /**
  * Maximum recursion depth for vault shares being put as an asset inside
  * another vault; counted from 0
  */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;
 
-/**
- * Maximum length of a Data field in Escrow object that can be updated by WASM code.
- */
-constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB
-
-/**
- * Maximum amount of data transfer across hostfunction<->wasm border.
- */
-constexpr std::size_t kWasmTransferLimit = 1 << 20;  // 1MB
-
 /**
  * A ledger index.
  */

include/xrpl/protocol/Quality.h

@@ -75,13 +75,6 @@ operator==(TAmounts<In, Out> const& lhs, TAmounts<In, Out> const& rhs) noexcept
     return lhs.in == rhs.in && lhs.out == rhs.out;
 }
 
-template <class In, class Out>
-bool
-operator!=(TAmounts<In, Out> const& lhs, TAmounts<In, Out> const& rhs) noexcept
-{
-    return !(lhs == rhs);
-}
-
 //------------------------------------------------------------------------------
 
 // XRPL specific constant used for parsing qualities and other things
@@ -271,12 +264,6 @@ public:
         return lhs.value_ == rhs.value_;
     }
 
-    friend bool
-    operator!=(Quality const& lhs, Quality const& rhs) noexcept
-    {
-        return !(lhs == rhs);
-    }
-
     friend std::ostream&
     operator<<(std::ostream& os, Quality const& quality)
     {

include/xrpl/protocol/QualityFunction.h

@@ -60,6 +60,15 @@ public:
     std::optional<Number>
     outFromAvgQ(Quality const& quality);
 
+    /**
+     * Return whether `out` produces at least the requested
+     * average quality.
+     * @param quality requested average quality (quality limit)
+     * @param out output amount to test
+     */
+    [[nodiscard]] bool
+    satisfiesAvgQ(Quality const& quality, Number const& out) const;
+
     /**
      * Return true if the quality function is constant
      */

include/xrpl/protocol/Rules.h

@@ -98,9 +98,6 @@ public:
      */
     bool
     operator==(Rules const&) const;
-
-    bool
-    operator!=(Rules const& other) const;
 };
 
 std::optional<Rules> const&

include/xrpl/protocol/STAmount.h

@@ -642,12 +642,6 @@ operator==(STAmount const& lhs, STAmount const& rhs);
 bool
 operator<(STAmount const& lhs, STAmount const& rhs);
 
-inline bool
-operator!=(STAmount const& lhs, STAmount const& rhs)
-{
-    return !(lhs == rhs);
-}
-
 inline bool
 operator>(STAmount const& lhs, STAmount const& rhs)
 {

include/xrpl/protocol/STArray.h

@@ -133,9 +133,6 @@ public:
     bool
     operator==(STArray const& s) const;
 
-    bool
-    operator!=(STArray const& s) const;
-
     iterator
     erase(iterator pos);
 
@@ -283,12 +280,6 @@ STArray::operator==(STArray const& s) const
     return v_ == s.v_;
 }
 
-inline bool
-STArray::operator!=(STArray const& s) const
-{
-    return v_ != s.v_;
-}
-
 inline STArray::iterator
 STArray::erase(iterator pos)
 {

include/xrpl/protocol/STBase.h

@@ -140,8 +140,6 @@ public:
 
     bool
     operator==(STBase const& t) const;
-    bool
-    operator!=(STBase const& t) const;
 
     template <class D>
     D&

include/xrpl/protocol/STCurrency.h

@@ -93,12 +93,6 @@ operator==(STCurrency const& lhs, STCurrency const& rhs)
     return lhs.currency() == rhs.currency();
 }
 
-inline bool
-operator!=(STCurrency const& lhs, STCurrency const& rhs)
-{
-    return !operator==(lhs, rhs);
-}
-
 inline bool
 operator<(STCurrency const& lhs, STCurrency const& rhs)
 {

include/xrpl/protocol/STObject.h

@@ -432,8 +432,6 @@ public:
 
     bool
     operator==(STObject const& o) const;
-    bool
-    operator!=(STObject const& o) const;
 
     class FieldErr;
 
@@ -667,36 +665,6 @@ public:
         return !lhs.engaged() || *lhs == *rhs;
     }
 
-    friend bool
-    operator!=(OptionalProxy const& lhs, std::nullopt_t) noexcept
-    {
-        return !(lhs == std::nullopt);
-    }
-
-    friend bool
-    operator!=(std::nullopt_t, OptionalProxy const& rhs) noexcept
-    {
-        return !(rhs == std::nullopt);
-    }
-
-    friend bool
-    operator!=(OptionalProxy const& lhs, optional_type const& rhs) noexcept
-    {
-        return !(lhs == rhs);
-    }
-
-    friend bool
-    operator!=(optional_type const& lhs, OptionalProxy const& rhs) noexcept
-    {
-        return !(lhs == rhs);
-    }
-
-    friend bool
-    operator!=(OptionalProxy const& lhs, OptionalProxy const& rhs) noexcept
-    {
-        return !(lhs == rhs);
-    }
-
     // Emulate std::optional::value_or
     [[nodiscard]] value_type
     valueOr(value_type val) const;
@@ -1202,12 +1170,6 @@ STObject::setFieldH160(SField const& field, BaseUInt<160, Tag> const& v)
     }
 }
 
-inline bool
-STObject::operator!=(STObject const& o) const
-{
-    return !(*this == o);
-}
-
 template <typename T, typename V>
 V
 STObject::getFieldByValue(SField const& field) const