docs: Document the [telemetry] trace toggles as 0 or 1

The configuration reference typed the five trace_* switches as bool with
default true. An xrpld config section carries integers, and these keys are
read with an integer cast, so a literal "true" fails to convert rather
than enabling the switch.

Type them as 0 or 1 with default 1, matching the other integer-valued
keys in the same table.

.cspell.config.yaml

@@ -7,7 +7,6 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
-  - src/test/app/wasm_fixtures/*.c
   - nix/check-tools/*.txt # generated, and full of Nix store hashes
 language: en
 allowCompoundWords: true # TODO (#6334)
@@ -69,7 +68,7 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - cdylib
+  - CGNAT
   - canonicalised
   - cctools
   - changespq
@@ -107,7 +106,6 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
-  - desugars
   - desync
   - desynced
   - determ
@@ -131,10 +129,11 @@ words:
   - fsanitize
   - funclets
   - Gamal
+  - gantt
+  - Gantt
   - gcov
   - gcovr
   - ghead
-  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
@@ -144,9 +143,7 @@ words:
   - hwaddress
   - hwrap
   - ifndef
-  - impls
   - inequation
-  - initialiser
   - insuf
   - insuff
   - invasively
@@ -183,11 +180,10 @@ words:
   - mathbunnyru
   - mcmodel
   - MEMORYSTATUSEX
-  - MPTAMM
-  - MPTDEX
   - Merkle
   - misprediction
   - missingok
+  - MPTAMM
   - mptbalance
   - MPTDEX
   - mptflags
@@ -222,6 +218,7 @@ words:
   - nonxrp
   - noreplace
   - noripple
+  - nostd
   - nostdinc
   - notifempty
   - nudb
@@ -230,6 +227,7 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
+  - otelc
   - otool
   - oxalica
   - pargs
@@ -256,7 +254,6 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
-  - qself
   - queuable
   - Raphson
   - rcflags
@@ -314,7 +311,6 @@ words:
   - STATSDCOLLECTOR
   - stissue
   - stnum
-  - stnumber
   - stobj
   - stobject
   - stpath
@@ -333,6 +329,7 @@ words:
   - TMEndpointv2
   - toolchain
   - tparam
+  - traceql
   - trixie
   - tx
   - txid
@@ -340,6 +337,7 @@ words:
   - txjson
   - txn
   - txns
+  - txqueue
   - txs
   - ubsan
   - UBSAN
@@ -355,7 +353,6 @@ words:
   - unflatten
   - unfund
   - unimpair
-  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -376,8 +373,6 @@ words:
   - vfalco
   - vinnie
   - wasmi
-  - wasmparser
-  - Werror
   - wextra
   - wptr
   - writeme
@@ -386,7 +381,6 @@ words:
   - xbridge
   - xchain
   - xcrun
-  - xfloat
   - ximinez
   - XMACRO
   - xored
@@ -396,5 +390,6 @@ words:
   - xrplf
   - xxhash
   - xxhasher
+  - xychart
+  - zpages
   - zstdio
-  - CGNAT

.github/actions/cargo-cache/action.yml

@@ -1,38 +0,0 @@
-name: Use cargo artifacts cache
-description: >
-  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
-  when saving the cache, rust-cache deletes all binaries that were already
-  present there, which on persistent self-hosted runners wipes the tools
-  installed by prepare-runner. Harmless on ephemeral runners, but kept
-  consistent everywhere.
-
-inputs:
-  workspaces:
-    description: "Workspaces to cache, as 'workspace -> target' lines."
-    required: false
-    default: crates
-  key:
-    description: "Additional part of the cache key."
-    required: false
-    default: ""
-  cache-directories:
-    description: "Additional non-workspace directories to cache."
-    required: false
-    default: ""
-  save-if:
-    description: "Condition for saving the cache after the job."
-    required: false
-    default: "true"
-
-runs:
-  using: composite
-
-  steps:
-    - name: Use cargo artifacts cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      with:
-        cache-bin: "false"
-        cache-directories: ${{ inputs.cache-directories }}
-        key: ${{ inputs.key }}
-        save-if: ${{ inputs.save-if }}
-        workspaces: ${{ inputs.workspaces }}

.github/dependabot.yml

@@ -4,7 +4,6 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/cargo-cache/
       - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/

.github/scripts/strategy-matrix/generate.py

@@ -12,6 +12,7 @@ _BASE_CMAKE_ARGS = [
     "-Dwerr=ON",
     "-Dxrpld=ON",
     "-Dwextra=ON",
+    "-Drust=ON",
 ]
 
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.

.github/workflows/build-nix-images.yml

@@ -58,7 +58,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -39,7 +39,7 @@ jobs:
           # AlmaLinux rather than UBI9, which does not ship rpm-sign.
           - name: rhel
             base_image: almalinux:9
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/Dockerfile

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

.github/workflows/publish-docs.yml

@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -163,7 +163,7 @@ jobs:
           compiler: ${{ inputs.compiler }}
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           key: ${{ inputs.config_name }}
@@ -373,10 +373,7 @@ jobs:
       - name: Run Rust tests
         if: ${{ !inputs.build_only }}
         working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn
 
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a

.github/workflows/reusable-clang-tidy.yml

@@ -27,7 +27,7 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
 
   run-clang-tidy:
     name: Run clang tidy
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 
@@ -60,7 +60,7 @@ jobs:
           compiler: ${{ env.COMPILER }}
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
@@ -87,6 +87,7 @@ jobs:
               -Dwerr=ON \
               -Dxrpld=ON \
               -Dverify_headers=ON \
+              -Drust=ON \
               ..
 
       - name: Build clang-tidy prerequisites

.github/workflows/reusable-rust.yml

@@ -33,7 +33,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
@@ -46,7 +48,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
@@ -72,7 +76,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Build documentation
         env:

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
         with:
           enable_ccache: false
 

BUILD.md

@@ -1,6 +1,6 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
@@ -304,6 +304,7 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 | ---------------- | ------------- | ----------------------------------------------------------------------------- |
 | `assert`         | OFF           | Force enabling assertions.                                                    |
 | `coverage`       | OFF           | Prepare the coverage report.                                                  |
+| `rust`           | OFF           | Build the Rust crates and the C++ code that depends on them.                  |
 | `tests`          | OFF           | Build tests.                                                                  |
 | `unity`          | OFF           | Configure a unity build.                                                      |
 | `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
@@ -318,15 +319,23 @@ builds may be faster for incremental builds, and can be helpful for detecting
 
 ### Rust crates
 
-The build compiles the Rust workspace in `crates/` and generates the cxxbridge
-bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
-at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
-[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
-as described in [Rust](./docs/build/environment.md#rust).
+The Rust crates in `crates/` are only part of the build when `rust` is ON. With
+`-Drust=OFF` (the default) the `crates` directory is not added to the build, no
+cxxbridge bindings are generated, and the C++ tests that exercise the Rust
+interop are not compiled — so no Rust toolchain is needed. CI builds always pass
+`-Drust=ON`.
+
+With `-Drust=ON` you need one extra dependency: a Rust toolchain (`cargo`,
+`rustc`) matching the channel pinned in
+[`rust-toolchain.toml`](./rust-toolchain.toml), which compiles the crates and
+generates the cxxbridge bindings. It is provided by the
+[Nix development shell](./docs/build/nix.md), so `-Drust=ON` works there without
+any extra setup; otherwise install it as described in
+[Rust](./docs/build/environment.md#rust).
 
 The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake (CI runs them with
-`cargo nextest`):
+need only the Rust toolchain, independently of CMake and of the `rust` option
+(CI runs them with `cargo nextest`):
 
 ```bash
 cargo test --manifest-path crates/Cargo.toml --workspace

CMakeLists.txt

@@ -160,8 +160,11 @@ endif()
 
 add_custom_target(tidy_prerequisites)
 
-add_subdirectory(crates)
+if(rust)
+    add_subdirectory(crates)
+endif()
 include(XrplCore)
+
 include(XrplProtocolAutogen)
 include(XrplInstall)
 include(XrplValidatorKeys)

CONTRIBUTING.md

@@ -321,7 +321,7 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+Before running clang-tidy, you must generate the files it depends on (protobuf headers, and, when the project is configured with `-Drust=ON`, the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
 
 ```bash
 cmake --build build --target tidy_prerequisites
@@ -362,6 +362,46 @@ run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
 
 `-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
 
+## Telemetry span attribute naming
+
+OpenTelemetry span attribute keys follow these rules so they stay consistent
+across the code, the OTel collector, Tempo, Grafana dashboards, and docs. The
+constants in the `*SpanNames.h` headers are the single source of truth; every
+other layer must match them. A CI check enforces this end to end.
+
+1. Per-span unique attribute: bare field name — allowed when the field is
+   recorded by a single span/workflow, so the span name already supplies the
+   domain (e.g. `command`, `local`, `version` on `rpc.command` / `tx.process`).
+2. Shared attribute (same concept on more than one span): ONE key, reused
+   verbatim on every span that records it — the span name tells the occurrences
+   apart, so no per-emitter prefix is added. Pick the name by the field's
+   meaning: a property of a domain object keeps that object's bare field name
+   (`ledger_hash`, `ledger_seq`, `tx_hash`, `peer_id`, `full_validation`); a
+   field already qualified by a sub-kind keeps that qualifier on every emitter
+   (`proposal_trusted` on both `consensus.proposal.receive` and
+   `peer.proposal.receive`; `validation_trusted` likewise). Define it once in
+   the base `SpanNames.h` `namespace attr` block and re-export (`using`) it from
+   each domain header, so all emitters share the exact string.
+3. Collision qualifier: `<domain>_<field>` — only when a bare name would collide
+   with a DIFFERENT concept in the shared spanmetrics label space, or with the
+   OTel-reserved `status` key (e.g. `rpc_status`, `grpc_status`,
+   `consensus_phase`, `consensus_round`). This disambiguates distinct concepts
+   that share a word; it is NOT used to tag the same concept with the workflow
+   that emitted it — that is rule 2 (one shared name).
+4. Resource attribute: dotted `xrpl.<subsystem>.<field>` — reserved ONLY for
+   process/network identity set once at startup (`xrpl.network.id`,
+   `xrpl.network.type`). Never use the dotted `xrpl.` form for span attributes.
+5. Span names use `<subsystem>[.<component>]` (dotted). Only attribute _keys_
+   follow rules 1–4.
+
+Standard OpenTelemetry semantic-convention keys keep their canonical dotted
+form (e.g. `service.*` resource attributes, `http.*` span attributes); the
+"no dotted form" rule above applies to xrpl-custom keys, not to OTel-standard
+conventions.
+
+Always reference the `*SpanNames.h` constants — never pass string literals as
+attribute keys or values to `setAttribute`/`addEvent`.
+
 ## Contracts and instrumentation
 
 We are using [Antithesis](https://antithesis.com/) for continuous fuzzing,

OpenTelemetryPlan/00-tracing-fundamentals.md

@@ -0,0 +1,565 @@
+# Distributed Tracing Fundamentals
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Next**: [Architecture Analysis](./01-architecture-analysis.md)
+
+---
+
+## What is Distributed Tracing?
+
+Distributed tracing is a method for tracking data objects as they flow through distributed systems. In a network like XRP Ledger, a single transaction touches multiple independent nodes—each with no shared memory or logging. Distributed tracing connects these dots.
+
+**Without tracing:** You see isolated logs on each node with no way to correlate them.
+
+**With tracing:** You see the complete journey of a transaction or an event across all nodes it touched.
+
+---
+
+## Actors and Actions at a Glance
+
+### Actors
+
+| Who (Plain English)                            | Technical Term  |
+| ---------------------------------------------- | --------------- |
+| A single unit of work being tracked            | Span            |
+| The complete journey of a request              | Trace           |
+| Data that links spans across services          | Trace Context   |
+| Code that creates spans and propagates context | Instrumentation |
+| Service that receives and processes traces     | Collector       |
+| Storage and visualization system               | Backend (Tempo) |
+| Decision logic for which traces to keep        | Sampler         |
+
+### Actions
+
+| What Happens (Plain English)            | Technical Term          |
+| --------------------------------------- | ----------------------- |
+| Start tracking a new operation          | Create a Span           |
+| Connect a child operation to its parent | Set `parent_span_id`    |
+| Group all related operations together   | Share a `trace_id`      |
+| Pass tracking data between services     | Context Propagation     |
+| Decide whether to record a trace        | Sampling (Head or Tail) |
+| Send completed traces to storage        | Export (OTLP)           |
+
+---
+
+## Core Concepts
+
+### 1. Trace
+
+A **trace** represents the entire journey of a request through the system. It has a unique `trace_id` that stays constant across all nodes.
+
+```
+Trace ID: abc123
+├── Node A: received transaction
+├── Node B: relayed transaction
+├── Node C: included in consensus
+└── Node D: applied to ledger
+```
+
+### 2. Span
+
+A **span** represents a single unit of work within a trace. Each span has:
+
+| Attribute        | Description                      | Example                    |
+| ---------------- | -------------------------------- | -------------------------- |
+| `trace_id`       | Identifies the trace             | `event123`                 |
+| `span_id`        | Unique identifier                | `span456`                  |
+| `parent_span_id` | Parent span (if any)             | `p_span123`                |
+| `name`           | Operation name                   | `rpc.submit`               |
+| `start_time`     | When work began (local time)     | `2024-01-15T10:30:00Z`     |
+| `end_time`       | When work completed (local time) | `2024-01-15T10:30:00.050Z` |
+| `attributes`     | Key-value metadata               | `tx_hash=ABC...`           |
+| `status`         | OK, ERROR MSG                    | `OK`                       |
+
+### 3. Trace Context
+
+**Trace context** is the data that propagates between services to link spans together. It contains:
+
+- `trace_id` - The trace this span belongs to
+- `span_id` - The current span (becomes parent for child spans)
+- `trace_flags` - Sampling decisions
+
+---
+
+## How Spans Form a Trace
+
+Spans have parent-child relationships forming a tree structure:
+
+```mermaid
+flowchart TB
+    subgraph trace["Trace: abc123"]
+        A["tx.submit<br/>span_id: 001<br/>50ms"] --> B["tx.validate<br/>span_id: 002<br/>5ms"]
+        A --> C["tx.relay<br/>span_id: 003<br/>10ms"]
+        A --> D["tx.apply<br/>span_id: 004<br/>30ms"]
+        D --> E["ledger.update<br/>span_id: 005<br/>20ms"]
+    end
+
+    style A fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style B fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style C fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style D fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style E fill:#bf360c,stroke:#8c2809,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **tx.submit (blue, root)**: The top-level span representing the entire transaction submission; all other spans are its descendants.
+- **tx.validate, tx.relay, tx.apply (green)**: Direct children of tx.submit, representing the three main stages -- validation, relay to peers, and application to the ledger.
+- **ledger.update (red)**: A grandchild span nested under tx.apply, representing the actual ledger state mutation triggered by applying the transaction.
+- **Arrows (parent to child)**: Each arrow indicates a parent-child span relationship where the parent's completion depends on the child finishing.
+
+The same trace visualized as a **timeline (Gantt chart)**:
+
+```
+Time →   0ms    10ms    20ms    30ms    40ms    50ms
+         ├───────────────────────────────────────────┤
+tx.submit│▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
+         ├─────┤
+tx.valid │▓▓▓▓▓│
+         │     ├──────────┤
+tx.relay │     │▓▓▓▓▓▓▓▓▓▓│
+         │               ├────────────────────────────┤
+tx.apply │               │▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
+         │                         ├──────────────────┤
+ledger   │                         │▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓│
+```
+
+---
+
+## Span Relationships
+
+Spans don't always form simple parent-child trees. Distributed tracing defines several relationship types to capture different causal patterns:
+
+### 1. Parent-Child (ChildOf)
+
+The default relationship. The parent span **depends on** or **contains** the child span. The child runs within the scope of the parent.
+
+```
+tx.submit (parent)
+├── tx.validate (child)     ← parent waits for this
+├── tx.relay (child)        ← parent waits for this
+└── tx.apply (child)        ← parent waits for this
+```
+
+**When to use:** Synchronous calls, nested operations, any case where the parent's completion depends on the child.
+
+### 2. Follows-From
+
+A causal relationship where the first span **triggers** the second, but does **not wait** for it. The originator fires and moves on.
+
+```
+Time →
+
+tx.receive [=======]
+                     ↓ triggers (follows-from)
+              tx.relay   [===========]   ← runs independently
+```
+
+**When to use:** Asynchronous jobs, queued work, fire-and-forget patterns. For example, a node receives a transaction and queues it for relay — the relay span _follows from_ the receive span but the receiver doesn't wait for relaying to complete.
+
+> **OpenTracing** defined `FollowsFrom` as a first-class reference type alongside `ChildOf`.
+> **OpenTelemetry** represents this using **Span Links** with descriptive attributes instead (see below).
+
+### 3. Span Links (Cross-Trace and Non-Hierarchical)
+
+Links connect spans that are **causally related but not in a parent-child hierarchy**. Unlike parent-child, links can cross trace boundaries.
+
+```
+Trace A                          Trace B
+──────                           ──────
+batch.schedule                   batch.execute
+├─ item.enqueue (span X)    ┌──► process.item
+├─ item.enqueue (span Y) ───┤    (links to X, Y, Z)
+├─ item.enqueue (span Z)    └──►
+```
+
+**Use cases:**
+
+| Pattern              | Description                                                                 |
+| -------------------- | --------------------------------------------------------------------------- |
+| **Batch processing** | A batch span links back to all individual spans that contributed to it      |
+| **Fan-in**           | An aggregation span links to the multiple producer spans it merges          |
+| **Fan-out**          | Multiple downstream spans link back to the single span that triggered them  |
+| **Async handoff**    | A deferred job links back to the request that queued it (follows-from)      |
+| **Cross-trace**      | Correlating spans across independent traces (e.g., retries, related events) |
+
+**Link structure:** Each link carries the target span's context plus optional attributes:
+
+```
+Link {
+    trace_id:   <target trace>
+    span_id:    <target span>
+    attributes: { "link.description": "triggered by batch scheduler" }
+}
+```
+
+### Relationship Summary
+
+```mermaid
+flowchart LR
+    subgraph parent_child["Parent-Child"]
+        direction TB
+        P["Parent"] --> C["Child"]
+    end
+
+    subgraph follows_from["Follows-From"]
+        direction TB
+        A["Span A"] -.->|triggers| B["Span B"]
+    end
+
+    subgraph links["Span Links"]
+        direction TB
+        X["Span X\n(Trace 1)"] -.-|link| Y["Span Y\n(Trace 2)"]
+    end
+
+    parent_child ~~~ follows_from ~~~ links
+
+    style P fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style C fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style A fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style B fill:#bf360c,stroke:#8c2809,color:#ffffff
+    style X fill:#4a148c,stroke:#38006b,color:#ffffff
+    style Y fill:#4a148c,stroke:#38006b,color:#ffffff
+```
+
+| Relationship     | Same Trace? | Dependency?                | OTel Mechanism    |
+| ---------------- | ----------- | -------------------------- | ----------------- |
+| **Parent-Child** | Yes         | Parent depends on child    | `parent_span_id`  |
+| **Follows-From** | Usually     | Causal but no dependency   | Link + attributes |
+| **Span Link**    | Either      | Correlation, no dependency | Link + attributes |
+
+---
+
+## Trace ID Generation
+
+A `trace_id` is a 128-bit (16-byte) identifier that groups all spans belonging to one logical operation. How it's generated determines how easily you can find and correlate traces later.
+
+### General Approaches
+
+#### 1. Random (W3C Default)
+
+Generate a random 128-bit ID when a trace starts. Standard approach for most services.
+
+```
+trace_id = random_128_bits()
+```
+
+| Pros                        | Cons                                          |
+| --------------------------- | --------------------------------------------- |
+| Simple, standard            | No natural correlation to domain events       |
+| Guaranteed unique per trace | If propagation is lost, trace is broken       |
+| Works with all OTel tooling | "Find trace for TX abc" requires index lookup |
+
+#### 2. Deterministic (Derived from Domain Data)
+
+Compute the trace_id from a hash of a natural identifier. Every node independently derives the **same** trace_id for the same event.
+
+```
+trace_id = SHA-256(domain_identifier)[0:16]   // truncate to 128 bits
+```
+
+| Pros                                                | Cons                                                       |
+| --------------------------------------------------- | ---------------------------------------------------------- |
+| Propagation-resilient — same ID computed everywhere | Same event processed twice (retry) shares trace_id         |
+| Natural search — domain ID maps directly to trace   | Non-standard (tooling assumes random)                      |
+| No coordination needed between nodes                | 256→128 bit truncation (collision risk negligible at ~2⁶⁴) |
+
+#### 3. Hybrid (Deterministic Prefix + Random Suffix)
+
+First 8 bytes derived from domain data, last 8 bytes random.
+
+```
+trace_id = SHA-256(domain_identifier)[0:8] || random_64_bits()
+```
+
+| Pros                                        | Cons                                     |
+| ------------------------------------------- | ---------------------------------------- |
+| Prefix search: "find all traces for TX abc" | Must propagate to maintain full trace_id |
+| Unique per processing instance              | More complex generation logic            |
+| Retries get distinct trace_ids              | Partial correlation only (prefix match)  |
+
+### XRPL Workflow Analysis
+
+XRPL has a unique advantage: its core workflows produce **globally unique 256-bit hashes** that are known on every node. This makes deterministic trace_id generation practical in ways most systems can't achieve.
+
+#### Natural Identifiers by Workflow
+
+| Workflow            | Natural Identifier                | Size       | Known at Start?               | Same on All Nodes?               |
+| ------------------- | --------------------------------- | ---------- | ----------------------------- | -------------------------------- |
+| **Transaction**     | Transaction hash (`tid_`)         | 256-bit    | Yes — computed before signing | Yes — hash of canonical tx data  |
+| **Consensus round** | Previous ledger hash + ledger seq | 256+32 bit | Yes — known when round opens  | Yes — all validators agree       |
+| **Validation**      | Ledger hash being validated       | 256-bit    | Yes — from consensus result   | Yes — same closed ledger         |
+| **Ledger catch-up** | Target ledger hash                | 256-bit    | Yes — we know what to fetch   | Yes — identifies ledger globally |
+
+#### Where These Identifiers Live in Code
+
+```
+Transaction:     STTx::getTransactionID()     → uint256 tid_
+                 TMTransaction::rawTransaction → recompute hash from bytes
+
+Consensus:       ConsensusProposal::prevLedger_ → uint256 (previous ledger hash)
+                 ConsensusProposal::position_   → uint256 (TxSet hash)
+                 LedgerHeader::seq              → uint32_t (ledger sequence)
+
+Validation:      STValidation::getLedgerHash()  → uint256
+                 STValidation::getNodeID()      → NodeID (160-bit)
+
+Ledger fetch:    InboundLedger constructor      → uint256 hash, uint32_t seq
+                 TMGetLedger::ledgerHash        → bytes (uint256)
+```
+
+### Recommended Strategy: Workflow-Scoped Deterministic
+
+Each workflow type derives its trace_id from its natural domain identifier:
+
+```
+Transaction trace:   trace_id = SHA-256("tx"    || tx_hash)[0:16]
+Consensus trace:     trace_id = SHA-256("cons"  || prev_ledger_hash || ledger_seq)[0:16]
+Ledger catch-up:     trace_id = SHA-256("fetch" || target_ledger_hash)[0:16]
+```
+
+The string prefix (`"tx"`, `"cons"`, `"fetch"`) prevents collisions between workflows that might share underlying hashes.
+
+**Why this works for XRPL:**
+
+1. **Propagation-resilient** — Even if a P2P message drops trace context, every node independently computes the same trace_id from the same tx_hash or ledger_hash. Spans still correlate.
+
+2. **Zero-cost search** — "Show me the trace for transaction ABC" becomes a direct lookup: compute `SHA-256("tx" || ABC)[0:16]` and query. No secondary index needed.
+
+3. **Cross-workflow linking via Span Links** — A consensus trace links to individual transaction traces. A validation span links to the consensus trace. This connects the full picture without forcing everything into one giant trace.
+
+### Cross-Workflow Correlation
+
+Each workflow gets its own trace. Span Links tie them together:
+
+```mermaid
+flowchart TB
+    subgraph tx_trace["Transaction Trace"]
+        direction LR
+        Tn["trace_id = f(tx_hash)"]:::note --> T1["tx.receive"] --> T2["tx.validate"] --> T3["tx.relay"]
+    end
+
+    subgraph cons_trace["Consensus Trace"]
+        direction LR
+        Cn["trace_id = f(prev_ledger, seq)"]:::note --> C1["cons.open"] --> C2["cons.propose"] --> C3["cons.accept"]
+    end
+
+    subgraph val_trace["Validation"]
+        direction LR
+        Vn["spans within consensus trace"]:::note --> V1["val.create"] --> V2["val.broadcast"]
+    end
+
+    subgraph fetch_trace["Catch-Up Trace"]
+        direction LR
+        Fn["trace_id = f(ledger_hash)"]:::note --> F1["fetch.request"] --> F2["fetch.receive"] --> F3["fetch.apply"]
+    end
+
+    C1 -.-|"span link\n(tx traces)"| T3
+    C3 --> V1
+    F1 -.-|"span link\n(target ledger)"| C3
+
+    classDef note fill:none,stroke:#888,stroke-dasharray:5 5,color:#333,font-style:italic
+    style T1 fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style T2 fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style T3 fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style C1 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style C2 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style C3 fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style V1 fill:#bf360c,stroke:#8c2809,color:#ffffff
+    style V2 fill:#bf360c,stroke:#8c2809,color:#ffffff
+    style F1 fill:#4a148c,stroke:#38006b,color:#ffffff
+    style F2 fill:#4a148c,stroke:#38006b,color:#ffffff
+    style F3 fill:#4a148c,stroke:#38006b,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **Transaction Trace (blue)**: An independent trace whose `trace_id` is deterministically derived from the transaction hash. Contains receive, validate, and relay spans.
+- **Consensus Trace (green)**: An independent trace whose `trace_id` is derived from the previous ledger hash and sequence number. Covers the open, propose, and accept phases.
+- **Validation (red)**: Validation spans live within the consensus trace (not a separate trace). They are created after the accept phase completes.
+- **Catch-Up Trace (purple)**: An independent trace for ledger acquisition, derived from the target ledger hash. Used when a node is behind and fetching missing ledgers.
+- **Dotted arrows (span links)**: Cross-trace correlations. Consensus links to transaction traces it included; catch-up links to the consensus trace that produced the target ledger.
+- **Solid arrow (C3 to V1)**: A parent-child relationship -- validation spans are direct children of the consensus accept span within the same trace.
+
+**How a query flows:**
+
+```
+"Why was TX abc slow?"
+  1. Compute trace_id = SHA-256("tx" || abc)[0:16]
+  2. Find transaction trace → see it was included in consensus round N
+  3. Follow span link → consensus trace for round N
+  4. See which phase was slow (propose? accept?)
+  5. If a node was catching up, follow link → catch-up trace
+```
+
+### Trade-offs to Consider
+
+| Concern                       | Mitigation                                                                                                                    |
+| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| **Retries get same trace_id** | Add `attempt` attribute to root span; spans have unique span_ids and timestamps                                               |
+| **256→128 bit truncation**    | Birthday-bound collision at ~2⁶⁴ operations — negligible for XRPL's throughput                                                |
+| **Non-standard generation**   | OTel spec allows any 16-byte non-zero value; tooling works on the hex string                                                  |
+| **Hash computation cost**     | SHA-256 is ~0.3μs per call; XRPL already computes these hashes for other purposes                                             |
+| **Late-binding identifiers**  | Ledger hash isn't known until after consensus — validation spans use ledger_seq as fallback, then link to the consensus trace |
+
+---
+
+## Distributed Traces Across Nodes
+
+In distributed systems like xrpld, traces span **multiple independent nodes**. The trace context must be propagated in network messages:
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant NodeA as Node A
+    participant NodeB as Node B
+    participant NodeC as Node C
+
+    Client->>NodeA: Submit TX<br/>(no trace context)
+
+    Note over NodeA: Creates new trace<br/>trace_id: abc123<br/>span: tx.receive
+
+    NodeA->>NodeB: Relay TX<br/>(trace_id: abc123, parent: 001)
+
+    Note over NodeB: Creates child span<br/>span: tx.relay<br/>parent_span_id: 001
+
+    NodeA->>NodeC: Relay TX<br/>(trace_id: abc123, parent: 001)
+
+    Note over NodeC: Creates child span<br/>span: tx.relay<br/>parent_span_id: 001
+
+    Note over NodeA,NodeC: All spans share trace_id: abc123<br/>enabling correlation across nodes
+```
+
+**Reading the diagram:**
+
+- **Client**: The external entity that submits a transaction. It does not carry trace context -- the trace originates at the first node.
+- **Node A**: The entry point that creates a new trace (trace_id: abc123) and the root span `tx.receive`. It relays the transaction to peers with trace context attached.
+- **Node B and Node C**: Peer nodes that receive the relayed transaction along with the propagated trace context. Each creates a child span under Node A's span, preserving the same `trace_id`.
+- **Arrows with trace context**: The relay messages carry `trace_id` and `parent_span_id`, allowing each downstream node to link its spans back to the originating span on Node A.
+
+---
+
+## Context Propagation
+
+For traces to work across nodes, **trace context must be propagated** in messages.
+
+### What's in the Context (~26 bytes)
+
+| Field         | Size     | Description                                             |
+| ------------- | -------- | ------------------------------------------------------- |
+| `trace_id`    | 16 bytes | Identifies the entire trace (constant across all nodes) |
+| `span_id`     | 8 bytes  | The sender's current span (becomes parent on receiver)  |
+| `trace_flags` | 1 byte   | Sampling decision (bit 0 = sampled; bits 1-7 reserved)  |
+| `trace_state` | variable | Optional vendor-specific data (typically omitted)       |
+
+### How span_id Changes at Each Hop
+
+Only **one** `span_id` travels in the context - the sender's current span. Each node:
+
+1. Extracts the received `span_id` and uses it as the `parent_span_id`
+2. Creates a **new** `span_id` for its own span
+3. Sends its own `span_id` as the parent when forwarding
+
+```
+Node A                      Node B                      Node C
+──────                      ──────                      ──────
+
+Span AAA                    Span BBB                    Span CCC
+   │                           │                           │
+   ▼                           ▼                           ▼
+Context out:                Context out:                Context out:
+├─ trace_id: abc123         ├─ trace_id: abc123         ├─ trace_id: abc123
+├─ span_id: AAA ──────────► ├─ span_id: BBB ──────────► ├─ span_id: CCC ──────►
+└─ flags: 01                └─ flags: 01                └─ flags: 01
+                               │                           │
+                          parent = AAA               parent = BBB
+```
+
+The `trace_id` stays constant, but `span_id` **changes at every hop** to maintain the parent-child chain.
+
+### Propagation Formats
+
+There are two patterns:
+
+### HTTP/RPC Headers (W3C Trace Context)
+
+```
+traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01
+             │  │                                │                │
+             │  │                                │                └── Flags (sampled)
+             │  │                                └── Parent span ID (16 hex)
+             │  └── Trace ID (32 hex)
+             └── Version
+```
+
+### Protocol Buffers (xrpld P2P messages)
+
+xrpld P2P messages such as `TMTransaction` carry the trace context in two added byte fields alongside the existing payload: `trace_parent` holds the W3C traceparent (`trace_id`, `span_id`, and `trace_flags`), and `trace_state` holds the optional W3C tracestate. Together they propagate the trace across the P2P boundary so a receiving node can attach its spans to the sender's span.
+
+---
+
+## Sampling
+
+Not every trace needs to be recorded. **Sampling** reduces overhead:
+
+### Head Sampling (at trace start)
+
+```
+Request arrives → Random N% chance → Record or skip entire trace
+```
+
+- ✅ Low overhead
+- ❌ May miss interesting traces
+
+> **xrpld note**: xrpld intentionally fixes head sampling at 100% (sample
+> everything) and does not expose a configurable ratio. A per-node ratio
+> would let different nodes make divergent keep/drop decisions for the same
+> distributed trace, producing broken/partial traces. xrpld uses a
+> `ParentBased` sampler so spans with a remote parent honor the upstream
+> decision. Volume reduction is delegated to collector-side tail sampling.
+
+### Tail Sampling (after trace completes)
+
+```
+Trace completes → Collector evaluates:
+                  - Error? → KEEP
+                  - Slow? → KEEP
+                  - Normal? → Sample 10%
+```
+
+- ✅ Never loses important traces
+- ❌ Higher memory usage at collector
+
+---
+
+## Key Benefits for xrpld
+
+| Challenge                          | How Tracing Helps                        |
+| ---------------------------------- | ---------------------------------------- |
+| "Where is my transaction?"         | Follow trace across all nodes it touched |
+| "Why was consensus slow?"          | See timing breakdown of each phase       |
+| "Which node is the bottleneck?"    | Compare span durations across nodes      |
+| "What happened during the outage?" | Correlate errors across the network      |
+
+---
+
+## Glossary
+
+| Term                 | Definition                                                          |
+| -------------------- | ------------------------------------------------------------------- |
+| **Trace**            | Complete journey of a request, identified by `trace_id`             |
+| **Span**             | Single operation within a trace                                     |
+| **Parent-Child**     | Span relationship where the parent depends on the child             |
+| **Follows-From**     | Causal relationship where originator doesn't wait for the result    |
+| **Span Link**        | Non-hierarchical connection between spans, possibly across traces   |
+| **Deterministic ID** | Trace ID derived from domain data (e.g., tx_hash) instead of random |
+| **Context**          | Data propagated between services (`trace_id`, `span_id`, flags)     |
+| **Instrumentation**  | Code that creates spans and propagates context                      |
+| **Collector**        | Service that receives, processes, and exports traces                |
+| **Backend**          | Storage/visualization system (Tempo)                                |
+| **Head Sampling**    | Sampling decision at trace start                                    |
+| **Tail Sampling**    | Sampling decision after trace completes                             |
+
+---
+
+_Next: [Architecture Analysis](./01-architecture-analysis.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/01-architecture-analysis.md

@@ -0,0 +1,467 @@
+# Architecture Analysis
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Design Decisions](./02-design-decisions.md) | [Implementation Strategy](./03-implementation-strategy.md)
+
+---
+
+## 1.1 Current xrpld Architecture Overview
+
+> **WS** = WebSocket | **UNL** = Unique Node List | **TxQ** = Transaction Queue | **StatsD** = Statistics Daemon
+
+The xrpld node software consists of several interconnected components that need instrumentation for distributed tracing:
+
+```mermaid
+flowchart TB
+    subgraph xrpld["xrpld Node"]
+        subgraph services["Core Services"]
+            RPC["RPC Server<br/>(HTTP/WS/gRPC)"]
+            Overlay["Overlay<br/>(P2P Network)"]
+            Consensus["Consensus<br/>(RCLConsensus)"]
+            ValidatorList["ValidatorList<br/>(UNL Mgmt)"]
+        end
+
+        JobQueue["JobQueue<br/>(Thread Pool)"]
+
+        subgraph processing["Processing Layer"]
+            NetworkOPs["NetworkOPs<br/>(Tx Processing)"]
+            LedgerMaster["LedgerMaster<br/>(Ledger Mgmt)"]
+            NodeStore["NodeStore<br/>(Database)"]
+            InboundLedgers["InboundLedgers<br/>(Ledger Sync)"]
+        end
+
+        subgraph appservices["Application Services"]
+            PathFind["PathFinding<br/>(Payment Paths)"]
+            TxQ["TxQ<br/>(Fee Escalation)"]
+            LoadMgr["LoadManager<br/>(Fee/Load)"]
+        end
+
+        subgraph observability["Existing Observability"]
+            PerfLog["PerfLog<br/>(JSON)"]
+            Insight["Insight<br/>(StatsD)"]
+            Logging["Logging<br/>(Journal)"]
+        end
+
+        services --> JobQueue
+        JobQueue --> processing
+        JobQueue --> appservices
+    end
+
+    style xrpld fill:#424242,stroke:#212121,color:#ffffff
+    style services fill:#1565c0,stroke:#0d47a1,color:#ffffff
+    style processing fill:#2e7d32,stroke:#1b5e20,color:#ffffff
+    style appservices fill:#6a1b9a,stroke:#4a148c,color:#ffffff
+    style observability fill:#e65100,stroke:#bf360c,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **Core Services (blue)**: The entry points into xrpld -- RPC Server handles client requests, Overlay manages peer-to-peer networking, Consensus drives agreement, and ValidatorList manages trusted validators.
+- **JobQueue (center)**: The asynchronous thread pool that decouples Core Services from the Processing and Application layers. All work flows through it.
+- **Processing Layer (green)**: Core business logic -- NetworkOPs processes transactions, LedgerMaster manages ledger state, NodeStore handles persistence, and InboundLedgers synchronizes missing data.
+- **Application Services (purple)**: Higher-level features -- PathFinding computes payment routes, TxQ manages fee-based queuing, and LoadManager tracks server load.
+- **Existing Observability (orange)**: The current monitoring stack (PerfLog, Insight, Journal logging) that OpenTelemetry will complement, not replace.
+- **Arrows (Services to JobQueue to layers)**: Work originates at Core Services, is enqueued onto the JobQueue, and dispatched to Processing or Application layers for execution.
+
+---
+
+## 1.1.1 Actors and Actions
+
+### Actors
+
+| Who (Plain English)                       | Technical Term             |
+| ----------------------------------------- | -------------------------- |
+| Network node running XRPL software        | xrpld node                 |
+| External client submitting requests       | RPC Client                 |
+| Network neighbor sharing data             | Peer (PeerImp)             |
+| Request handler for client queries        | RPC Server (ServerHandler) |
+| Command executor for specific RPC methods | RPCHandler                 |
+| Agreement process between nodes           | Consensus (RCLConsensus)   |
+| Transaction processing coordinator        | NetworkOPs                 |
+| Background task scheduler                 | JobQueue                   |
+| Ledger state manager                      | LedgerMaster               |
+| Payment route calculator                  | PathFinding (Pathfinder)   |
+| Transaction waiting room                  | TxQ (Transaction Queue)    |
+| Fee adjustment system                     | LoadManager                |
+| Trusted validator list manager            | ValidatorList              |
+| Protocol upgrade tracker                  | AmendmentTable             |
+| Ledger state hash tree                    | SHAMap                     |
+| Persistent key-value storage              | NodeStore                  |
+
+### Actions
+
+| What Happens (Plain English)                   | Technical Term         |
+| ---------------------------------------------- | ---------------------- |
+| Client sends a request to a node               | `rpc.request`          |
+| Node executes a specific RPC command           | `rpc.command.*`        |
+| Node receives a transaction from a peer        | `tx.receive`           |
+| Node checks if a transaction is valid          | `tx.validate`          |
+| Node forwards a transaction to neighbors       | `tx.relay`             |
+| Nodes agree on which transactions to include   | `consensus.round`      |
+| Consensus progresses through phases            | `consensus.phase.*`    |
+| Node builds a new confirmed ledger             | `ledger.build`         |
+| Node fetches missing ledger data from peers    | `ledger.acquire`       |
+| Node computes payment routes                   | `pathfind.compute`     |
+| Node queues a transaction for later processing | `txq.enqueue`          |
+| Node increases fees due to high load           | `fee.escalate`         |
+| Node fetches the latest trusted validator list | `validator.list.fetch` |
+| Node votes on a protocol amendment             | `amendment.vote`       |
+| Node synchronizes state tree data              | `shamap.sync`          |
+
+---
+
+## 1.2 Key Components for Instrumentation
+
+> **TxQ** = Transaction Queue | **UNL** = Unique Node List
+
+| Component          | Location                                   | Purpose                  | Trace Value                      |
+| ------------------ | ------------------------------------------ | ------------------------ | -------------------------------- |
+| **Overlay**        | `src/xrpld/overlay/`                       | P2P communication        | Message propagation timing       |
+| **PeerImp**        | `src/xrpld/overlay/detail/PeerImp.cpp`     | Individual peer handling | Per-peer latency                 |
+| **RCLConsensus**   | `src/xrpld/app/consensus/RCLConsensus.cpp` | Consensus algorithm      | Round timing, phase analysis     |
+| **NetworkOPs**     | `src/xrpld/app/misc/NetworkOPs.cpp`        | Transaction processing   | Tx lifecycle tracking            |
+| **ServerHandler**  | `src/xrpld/rpc/detail/ServerHandler.cpp`   | RPC entry point          | Request latency                  |
+| **RPCHandler**     | `src/xrpld/rpc/detail/RPCHandler.cpp`      | Command execution        | Per-command timing               |
+| **JobQueue**       | `src/xrpl/core/JobQueue.h`                 | Async task execution     | Queue wait times                 |
+| **PathFinding**    | `src/xrpld/app/paths/`                     | Payment path computation | Path latency, cache hits         |
+| **TxQ**            | `src/xrpld/app/misc/TxQ.cpp`               | Transaction queue/fees   | Queue depth, eviction rates      |
+| **LoadManager**    | `src/xrpld/app/main/LoadManager.cpp`       | Fee escalation/load      | Fee levels, load factors         |
+| **InboundLedgers** | `src/xrpld/app/ledger/InboundLedgers.cpp`  | Ledger acquisition       | Sync time, peer reliability      |
+| **ValidatorList**  | `src/xrpld/app/misc/ValidatorList.cpp`     | UNL management           | List freshness, fetch failures   |
+| **AmendmentTable** | `src/xrpld/app/misc/AmendmentTable.cpp`    | Protocol amendments      | Voting status, activation events |
+| **SHAMap**         | `src/xrpld/shamap/`                        | State hash tree          | Sync speed, missing nodes        |
+
+---
+
+## 1.3 Transaction Flow Diagram
+
+Transaction flow spans multiple nodes in the network. Each node creates linked spans to form a distributed trace:
+
+```mermaid
+sequenceDiagram
+    participant Client
+    participant PeerA as Peer A (Receive)
+    participant PeerB as Peer B (Relay)
+    participant PeerC as Peer C (Validate)
+
+    Client->>PeerA: 1. Submit TX
+
+    rect rgb(230, 245, 255)
+        Note over PeerA: tx.receive SPAN START
+        PeerA->>PeerA: HashRouter Deduplication
+        PeerA->>PeerA: tx.validate (child span)
+    end
+
+    PeerA->>PeerB: 2. Relay TX (with trace ctx)
+
+    rect rgb(230, 245, 255)
+        Note over PeerB: tx.receive (linked span)
+    end
+
+    PeerB->>PeerC: 3. Relay TX
+
+    rect rgb(230, 245, 255)
+        Note over PeerC: tx.receive (linked span)
+        PeerC->>PeerC: tx.process
+    end
+
+    Note over Client,PeerC: DISTRIBUTED TRACE (same trace_id: abc123)
+```
+
+**Reading the diagram:**
+
+- **Client**: The external entity that submits a transaction to Peer A. It has no trace context -- the trace starts at the first node.
+- **Peer A (Receive)**: The entry node that creates the root span `tx.receive`, runs HashRouter deduplication to avoid processing duplicates, and creates a child `tx.validate` span.
+- **Peer A to Peer B arrow**: The relay message carries trace context (trace_id + parent span_id), enabling Peer B to create a linked span under the same trace.
+- **Peer B (Relay)**: Receives the transaction and trace context, creates a `tx.receive` span linked to Peer A's trace, then relays onward.
+- **Peer C (Validate)**: Final hop in this example. Creates a linked `tx.receive` span and runs `tx.process` to fully process the transaction.
+- **Blue rectangles**: Highlight the span boundaries on each node, showing where instrumentation creates and closes spans.
+
+### Trace Structure
+
+```
+trace_id: abc123
+├── span: tx.receive (Peer A)
+│   ├── span: tx.validate
+│   └── span: tx.relay
+├── span: tx.receive (Peer B) [parent: Peer A]
+│   └── span: tx.relay
+└── span: tx.receive (Peer C) [parent: Peer B]
+    └── span: tx.process
+```
+
+---
+
+## 1.4 Consensus Round Flow
+
+Consensus rounds are multi-phase operations that benefit significantly from tracing:
+
+```mermaid
+flowchart TB
+    subgraph round["consensus.round (root span)"]
+        attrs["Attributes:<br/>ledger_seq = 12345678<br/>consensus_mode = proposing<br/>proposers = 35"]
+
+        subgraph open["consensus.phase.open"]
+            open_desc["Duration: ~3s<br/>Waiting for transactions"]
+        end
+
+        subgraph establish["consensus.phase.establish"]
+            est_attrs["proposals_received = 28<br/>disputes_resolved = 3"]
+            est_children["├── consensus.proposal.receive (×28)<br/>├── consensus.proposal.send (×1)<br/>└── consensus.dispute.resolve (×3)"]
+        end
+
+        subgraph accept["consensus.phase.accept"]
+            acc_attrs["transactions_applied = 150<br/>ledger_hash = DEF456..."]
+            acc_children["├── ledger.build<br/>└── ledger.validate"]
+        end
+
+        attrs --> open
+        open --> establish
+        establish --> accept
+    end
+
+    style round fill:#f57f17,stroke:#e65100,color:#ffffff
+    style open fill:#1565c0,stroke:#0d47a1,color:#ffffff
+    style establish fill:#2e7d32,stroke:#1b5e20,color:#ffffff
+    style accept fill:#c2185b,stroke:#880e4f,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **consensus.round (orange, root span)**: The top-level span encompassing the entire consensus round, with attributes like ledger sequence, mode, and proposer count.
+- **consensus.phase.open (blue)**: The first phase where the node waits (~3s) to collect incoming transactions before proposing.
+- **consensus.phase.establish (green)**: The negotiation phase where validators exchange proposals, resolve disputes, and converge on a transaction set. Child spans track each proposal received/sent and each dispute resolved.
+- **consensus.phase.accept (pink)**: The final phase where the agreed transaction set is applied, a new ledger is built, and the ledger is validated. Child spans cover `ledger.build` and `ledger.validate`.
+- **Arrows (open to establish to accept)**: The sequential flow through the three consensus phases. Each phase must complete before the next begins.
+
+---
+
+## 1.5 RPC Request Flow
+
+> **WS** = WebSocket
+
+RPC requests support W3C Trace Context headers for distributed tracing across services:
+
+```mermaid
+flowchart TB
+    subgraph request["rpc.request (root span)"]
+        http["HTTP Request — POST /<br/>traceparent:<br/>00-abc123...-def456...-01"]
+
+        attrs["Attributes:<br/>http.method = POST<br/>net.peer.ip = 192.168.1.100<br/>command = submit"]
+
+        subgraph enqueue["jobqueue.enqueue"]
+            job_attr["job_type = jtCLIENT_RPC"]
+        end
+
+        subgraph command["rpc.command.submit"]
+            cmd_attrs["version = 2<br/>rpc_role = user"]
+            cmd_children["├── tx.deserialize<br/>├── tx.validate_local<br/>└── tx.submit_to_network"]
+        end
+
+        response["Response: 200 OK<br/>Duration: 45ms"]
+
+        http --> attrs
+        attrs --> enqueue
+        enqueue --> command
+        command --> response
+    end
+
+    style request fill:#2e7d32,stroke:#1b5e20,color:#ffffff
+    style enqueue fill:#1565c0,stroke:#0d47a1,color:#ffffff
+    style command fill:#e65100,stroke:#bf360c,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **rpc.request (green, root span)**: The outermost span representing the full RPC request lifecycle, from HTTP receipt to response. Carries the W3C `traceparent` header for distributed tracing.
+- **HTTP Request node**: Shows the incoming POST request with its `traceparent` header and extracted attributes (method, peer IP, command name).
+- **jobqueue.enqueue (blue)**: The span covering the asynchronous handoff from the RPC thread to the JobQueue worker thread. The trace context is preserved across this async boundary.
+- **rpc.command.submit (orange)**: The span for the actual command execution, with child spans for deserialization, local validation, and network submission.
+- **Response node**: The final output with HTTP status and total duration, marking the end of the root span.
+- **Arrows (top to bottom)**: The sequential processing pipeline -- receive request, extract attributes, enqueue job, execute command, return response.
+
+---
+
+## 1.6 Key Trace Points
+
+> **TxQ** = Transaction Queue
+
+The following table identifies priority instrumentation points across the codebase:
+
+| Category        | Span Name              | File                   | Method                  | Priority |
+| --------------- | ---------------------- | ---------------------- | ----------------------- | -------- |
+| **Transaction** | `tx.receive`           | `PeerImp.cpp`          | `handleTransaction()`   | High     |
+| **Transaction** | `tx.validate`          | `NetworkOPs.cpp`       | `processTransaction()`  | High     |
+| **Transaction** | `tx.process`           | `NetworkOPs.cpp`       | `doTransactionSync()`   | High     |
+| **Transaction** | `tx.relay`             | `OverlayImpl.cpp`      | `relay()`               | Medium   |
+| **Consensus**   | `consensus.round`      | `RCLConsensus.cpp`     | `startRound()`          | High     |
+| **Consensus**   | `consensus.phase.*`    | `Consensus.h`          | `timerEntry()`          | High     |
+| **Consensus**   | `consensus.proposal.*` | `RCLConsensus.cpp`     | `peerProposal()`        | Medium   |
+| **RPC**         | `rpc.request`          | `ServerHandler.cpp`    | `onRequest()`           | High     |
+| **RPC**         | `rpc.command.*`        | `RPCHandler.cpp`       | `doCommand()`           | High     |
+| **Peer**        | `peer.connect`         | `OverlayImpl.cpp`      | `onHandoff()`           | Low      |
+| **Peer**        | `peer.message.*`       | `PeerImp.cpp`          | `onMessage()`           | Low      |
+| **Ledger**      | `ledger.acquire`       | `InboundLedgers.cpp`   | `acquire()`             | Medium   |
+| **Ledger**      | `ledger.build`         | `RCLConsensus.cpp`     | `buildLCL()`            | High     |
+| **PathFinding** | `pathfind.request`     | `PathRequest.cpp`      | `doUpdate()`            | High     |
+| **PathFinding** | `pathfind.compute`     | `Pathfinder.cpp`       | `findPaths()`           | High     |
+| **TxQ**         | `txq.enqueue`          | `TxQ.cpp`              | `apply()`               | High     |
+| **TxQ**         | `txq.apply`            | `TxQ.cpp`              | `processClosedLedger()` | High     |
+| **Fee**         | `fee.escalate`         | `LoadManager.cpp`      | `raiseLocalFee()`       | Medium   |
+| **Ledger**      | `ledger.replay`        | `LedgerReplayer.h`     | `replay()`              | Medium   |
+| **Ledger**      | `ledger.delta`         | `LedgerDeltaAcquire.h` | `processData()`         | Medium   |
+| **Validator**   | `validator.list.fetch` | `ValidatorList.cpp`    | `verify()`              | Medium   |
+| **Validator**   | `validator.manifest`   | `Manifest.cpp`         | `applyManifest()`       | Low      |
+| **Amendment**   | `amendment.vote`       | `AmendmentTable.cpp`   | `doVoting()`            | Low      |
+| **SHAMap**      | `shamap.sync`          | `SHAMap.cpp`           | `fetchRoot()`           | Medium   |
+
+---
+
+## 1.7 Instrumentation Priority
+
+> **TxQ** = Transaction Queue
+
+```mermaid
+quadrantChart
+    title Instrumentation Priority Matrix
+    x-axis Low Complexity --> High Complexity
+    y-axis Low Value --> High Value
+    quadrant-1 Implement First
+    quadrant-2 Plan Carefully
+    quadrant-3 Quick Wins
+    quadrant-4 Consider Later
+
+    RPC Tracing: [0.2, 0.92]
+    Transaction Tracing: [0.55, 0.88]
+    Consensus Tracing: [0.78, 0.82]
+    PathFinding: [0.38, 0.75]
+    TxQ and Fees: [0.25, 0.65]
+    Ledger Sync: [0.62, 0.58]
+    Peer Message Tracing: [0.35, 0.25]
+    JobQueue Tracing: [0.2, 0.48]
+    Validator Mgmt: [0.48, 0.42]
+    Amendment Tracking: [0.15, 0.32]
+    SHAMap Operations: [0.72, 0.45]
+```
+
+---
+
+## 1.8 Observable Outcomes
+
+> **TxQ** = Transaction Queue | **UNL** = Unique Node List
+
+After implementing OpenTelemetry, operators and developers will gain visibility into the following:
+
+### 1.8.1 What You Will See: Traces
+
+| Trace Type                 | Description                                                                                 | Example Query in Grafana/Tempo                  |
+| -------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------- |
+| **Transaction Lifecycle**  | Full journey from RPC submission through validation, relay, consensus, and ledger inclusion | `{service.name="xrpld" && tx_hash="ABC123..."}` |
+| **Cross-Node Propagation** | Transaction path across multiple xrpld nodes with timing                                    | `{relay_count > 0}`                             |
+| **Consensus Rounds**       | Complete round with all phases (open, establish, accept)                                    | `{span.name=~"consensus.round.*"}`              |
+| **RPC Request Processing** | Individual command execution with timing breakdown                                          | `{command="account_info"}`                      |
+| **Ledger Acquisition**     | Peer-to-peer ledger data requests and responses                                             | `{span.name="ledger.acquire"}`                  |
+| **PathFinding Latency**    | Path computation time and cache effectiveness for payment RPCs                              | `{span.name="pathfind.compute"}`                |
+| **TxQ Behavior**           | Queue depth, eviction patterns, fee escalation during congestion                            | `{span.name=~"txq.*"}`                          |
+| **Ledger Sync**            | Full acquisition timeline including delta and transaction fetches                           | `{span.name=~"ledger.acquire.*"}`               |
+| **Validator Health**       | UNL fetch success, manifest updates, stale list detection                                   | `{span.name=~"validator.*"}`                    |
+
+### 1.8.2 What You Will See: Metrics (Derived from Traces)
+
+| Metric                        | Description                             | Dashboard Panel             |
+| ----------------------------- | --------------------------------------- | --------------------------- |
+| **RPC Latency (p50/p95/p99)** | Response time distribution per command  | Heatmap by command          |
+| **Transaction Throughput**    | Transactions processed per second       | Time series graph           |
+| **Consensus Round Duration**  | Time to complete consensus phases       | Histogram                   |
+| **Cross-Node Latency**        | Time for transaction to reach N nodes   | Line chart with percentiles |
+| **Error Rate**                | Failed transactions/RPC calls by type   | Stacked bar chart           |
+| **PathFinding Latency**       | Path computation time per currency pair | Heatmap by currency         |
+| **TxQ Depth**                 | Queued transactions over time           | Time series with thresholds |
+| **Fee Escalation Level**      | Current fee multiplier                  | Gauge with alert thresholds |
+| **Ledger Sync Duration**      | Time to acquire missing ledgers         | Histogram                   |
+
+### 1.8.3 Concrete Dashboard Examples
+
+**Transaction Trace View (Tempo):**
+
+```
+┌────────────────────────────────────────────────────────────────────────────────┐
+│ Trace: abc123... (Transaction Submission)                    Duration: 847ms   │
+├────────────────────────────────────────────────────────────────────────────────┤
+│ ├── rpc.request [ServerHandler]                              ████░░░░░░  45ms  │
+│ │   └── rpc.command.submit [RPCHandler]                      ████░░░░░░  42ms  │
+│ │       └── tx.receive [NetworkOPs]                          ███░░░░░░░  35ms  │
+│ │           ├── tx.validate [TxQ]                            █░░░░░░░░░   8ms  │
+│ │           └── tx.relay [Overlay]                           ██░░░░░░░░  15ms  │
+│ │               ├── tx.receive [Node-B]                      █████░░░░░  52ms  │
+│ │               │   └── tx.relay [Node-B]                    ██░░░░░░░░  18ms  │
+│ │               └── tx.receive [Node-C]                      ██████░░░░  65ms  │
+│ └── consensus.round [RCLConsensus]                           ████████░░ 720ms  │
+│     ├── consensus.phase.open                                 ██░░░░░░░░ 180ms  │
+│     ├── consensus.phase.establish                            █████░░░░░ 480ms  │
+│     └── consensus.phase.accept                               █░░░░░░░░░  60ms  │
+└────────────────────────────────────────────────────────────────────────────────┘
+```
+
+**RPC Performance Dashboard Panel:**
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│ RPC Command Latency (Last 1 Hour)                           │
+├─────────────────────────────────────────────────────────────┤
+│ Command          │ p50    │ p95    │ p99    │ Errors │ Rate │
+│──────────────────┼────────┼────────┼────────┼────────┼──────│
+│ account_info     │  12ms  │  45ms  │  89ms  │  0.1%  │ 150/s│
+│ submit           │  35ms  │ 120ms  │ 250ms  │  2.3%  │  45/s│
+│ ledger           │   8ms  │  25ms  │  55ms  │  0.0%  │  80/s│
+│ tx               │  15ms  │  50ms  │ 100ms  │  0.5%  │  60/s│
+│ server_info      │   5ms  │  12ms  │  20ms  │  0.0%  │ 200/s│
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Consensus Health Dashboard Panel:**
+
+```mermaid
+---
+config:
+    xyChart:
+        width: 1200
+        height: 400
+        plotReservedSpacePercent: 50
+        chartOrientation: vertical
+    themeVariables:
+        xyChart:
+            plotColorPalette: "#3498db"
+---
+xychart-beta
+    title "Consensus Round Duration (Last 24 Hours)"
+    x-axis "Time of Day (Hours)" [0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24]
+    y-axis "Duration (seconds)" 1 --> 5
+    line [2.1, 2.4, 2.8, 3.2, 3.8, 4.3, 4.5, 5.0, 4.7, 4.0, 3.2, 2.6, 2.0]
+```
+
+### 1.8.4 Operator Actionable Insights
+
+| Scenario                  | What You'll See                                                              | Action                                           |
+| ------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------ |
+| **Slow RPC**              | Span showing which phase is slow (parsing, execution, serialization)         | Optimize specific code path                      |
+| **Transaction Stuck**     | Trace stops at validation; error attribute shows reason                      | Fix transaction parameters                       |
+| **Consensus Delay**       | Phase.establish taking too long; proposer attribute shows missing validators | Investigate network connectivity                 |
+| **Memory Spike**          | Large batch of spans correlating with memory increase                        | Tune batch_size or sampling                      |
+| **Network Partition**     | Traces missing cross-node links for specific peer                            | Check peer connectivity                          |
+| **Path Computation Slow** | pathfind.compute span shows high latency; cache miss rate in attributes      | Warm the RippleLineCache, check order book depth |
+| **TxQ Full**              | txq.enqueue spans show evictions; fee.escalate spans increasing              | Monitor fee levels, alert operators              |
+| **Ledger Sync Stalled**   | ledger.acquire spans timing out; peer reliability attributes show issues     | Check peer connectivity, add trusted peers       |
+| **UNL Stale**             | validator.list.fetch spans failing; last_update attribute aging              | Verify validator site URLs, check DNS            |
+
+### 1.8.5 Developer Debugging Workflow
+
+1. **Find Transaction**: Query by `tx_hash` to get full trace
+2. **Identify Bottleneck**: Look at span durations to find slowest component
+3. **Check Attributes**: Review `validity`, `rpc_status` for errors
+4. **Correlate Logs**: Use `trace_id` to find related PerfLog entries
+5. **Compare Nodes**: Filter by `service.instance.id` to compare behavior across nodes
+
+---
+
+_Next: [Design Decisions](./02-design-decisions.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/02-design-decisions.md

@@ -0,0 +1,568 @@
+# Design Decisions
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Architecture Analysis](./01-architecture-analysis.md)
+
+---
+
+## 2.1 OpenTelemetry Components
+
+> **OTLP** = OpenTelemetry Protocol
+
+### 2.1.1 SDK Selection
+
+**Primary Choice**: OpenTelemetry C++ SDK (`opentelemetry-cpp`)
+
+| Component                               | Purpose                | Required                  |
+| --------------------------------------- | ---------------------- | ------------------------- |
+| `opentelemetry-cpp::api`                | Tracing API headers    | Yes                       |
+| `opentelemetry-cpp::sdk`                | SDK implementation     | Yes                       |
+| `opentelemetry-cpp::ext`                | Extensions (exporters) | Yes                       |
+| `opentelemetry-cpp::otlp_http_exporter` | OTLP/HTTP export       | Yes (shipped in Phase 1b) |
+| `opentelemetry-cpp::otlp_grpc_exporter` | OTLP/gRPC export       | Future (not yet wired up) |
+
+### 2.1.2 Instrumentation Strategy
+
+**Manual Instrumentation** (recommended):
+
+| Approach   | Pros                                                            | Cons                                                    |
+| ---------- | --------------------------------------------------------------- | ------------------------------------------------------- |
+| **Manual** | Precise control, optimized placement, xrpld-specific attributes | More development effort                                 |
+| **Auto**   | Less code, automatic coverage                                   | Less control, potential overhead, limited customization |
+
+---
+
+## 2.2 Exporter Configuration
+
+> **OTLP** = OpenTelemetry Protocol
+
+```mermaid
+flowchart TB
+    subgraph nodes["xrpld Nodes"]
+        node1["xrpld<br/>Node 1"]
+        node2["xrpld<br/>Node 2"]
+        node3["xrpld<br/>Node 3"]
+    end
+
+    collector["OpenTelemetry<br/>Collector<br/>(sidecar or standalone)"]
+
+    subgraph backends["Observability Backends"]
+        tempo["Tempo"]
+        elastic["Elastic<br/>APM"]
+    end
+
+    node1 -->|"OTLP/HTTP<br/>:4318"| collector
+    node2 -->|"OTLP/HTTP<br/>:4318"| collector
+    node3 -->|"OTLP/HTTP<br/>:4318"| collector
+
+    collector --> tempo
+    collector --> elastic
+
+    style nodes fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style backends fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style collector fill:#bf360c,stroke:#8c2809,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **xrpld Nodes (blue)**: The source of telemetry data. Each xrpld node exports spans via OTLP/HTTP on port 4318 (the only exporter shipped in Phase 1b).
+- **OpenTelemetry Collector (red)**: The central aggregation point that receives spans from all nodes. Can run as a sidecar (per-node) or standalone (shared). Handles batching, filtering, and routing.
+- **Observability Backends (green)**: The storage and visualization destinations. Tempo is the recommended backend for both development and production, and Elastic APM is an alternative. The Collector routes to one or more backends.
+- **Arrows (nodes to collector to backends)**: The data pipeline -- spans flow from nodes to the Collector over HTTP, then the Collector fans out to the configured backends.
+
+### 2.2.1 OTLP/HTTP (Shipped in Phase 1b)
+
+OTLP/HTTP is the only exporter wired up in Phase 1b. It is configured via
+`OtlpHttpExporterOptions` with the collector traces endpoint
+(`http://localhost:4318/v1/traces` by default) and a JSON content type
+(binary protobuf is also available).
+
+### 2.2.2 OTLP/gRPC (Future Work — Planned Upgrade)
+
+OTLP/gRPC is planned as a future upgrade from the HTTP exporter. The gRPC
+transport offers lower per-span overhead and tighter back-pressure semantics
+than HTTP/JSON, making it attractive for production deployments once the HTTP
+path is validated in earlier phases.
+
+Required to land this upgrade:
+
+1. Add `opentelemetry-cpp::otlp_grpc_exporter` to the Conan recipe (the
+   dependency already exists but is not linked in Phase 1b builds).
+2. Extend `TelemetryConfig.cpp` to parse an `exporter` key (`otlp_http`
+   default, `otlp_grpc` opt-in) and a gRPC endpoint override.
+3. In `Telemetry::start()` branch on the parsed exporter type and construct
+   either `OtlpHttpExporterFactory::Create(httpOpts)` or
+   `OtlpGrpcExporterFactory::Create(grpcOpts)` accordingly.
+4. Update the runbook and dashboards to document the alternate port and TLS
+   settings.
+
+When wired up, the gRPC path will use `OtlpGrpcExporterOptions` configured with
+the collector endpoint (host on port 4317), TLS credentials enabled, and a CA
+certificate path.
+
+Until that work lands, `OtlpGrpcExporterOptions` is **not** used by any code
+path in Phase 1b through Phase 5.
+
+---
+
+## 2.3 Span Naming Conventions
+
+> **TxQ** = Transaction Queue | **UNL** = Unique Node List | **WS** = WebSocket
+
+### 2.3.1 Naming Schema
+
+```
+<component>.<operation>[.<sub-operation>]
+```
+
+**Examples**:
+
+- `tx.receive` - Transaction received from peer
+- `consensus.phase.establish` - Consensus establish phase
+- `rpc.command.server_info` - server_info RPC command
+
+### 2.3.2 Complete Span Catalog
+
+| Span name                      | Description                             |
+| ------------------------------ | --------------------------------------- |
+| `tx.receive`                   | Transaction received from network       |
+| `tx.validate`                  | Transaction signature/format validation |
+| `tx.process`                   | Full transaction processing             |
+| `tx.relay`                     | Transaction relay to peers              |
+| `tx.apply`                     | Apply transaction to ledger             |
+| `consensus.round`              | Complete consensus round                |
+| `consensus.phase.open`         | Open phase - collecting transactions    |
+| `consensus.phase.establish`    | Establish phase - reaching agreement    |
+| `consensus.phase.accept`       | Accept phase - applying consensus       |
+| `consensus.proposal.receive`   | Receive peer proposal                   |
+| `consensus.proposal.send`      | Send our proposal                       |
+| `consensus.validation.receive` | Receive peer validation                 |
+| `consensus.validation.send`    | Send our validation                     |
+| `rpc.request`                  | HTTP/WebSocket request handling         |
+| `rpc.command.*`                | Specific RPC command (dynamic)          |
+| `peer.connect`                 | Peer connection establishment           |
+| `peer.disconnect`              | Peer disconnection                      |
+| `peer.message.send`            | Send protocol message                   |
+| `peer.message.receive`         | Receive protocol message                |
+| `ledger.acquire`               | Ledger acquisition from network         |
+| `ledger.build`                 | Build new ledger                        |
+| `ledger.validate`              | Ledger validation                       |
+| `ledger.close`                 | Close ledger                            |
+| `ledger.replay`                | Ledger replay executed                  |
+| `ledger.delta`                 | Delta-based ledger acquired             |
+| `pathfind.request`             | Path request initiated                  |
+| `pathfind.compute`             | Path computation executed               |
+| `txq.enqueue`                  | Transaction queued                      |
+| `txq.apply`                    | Queued transaction applied              |
+| `fee.escalate`                 | Fee escalation triggered                |
+| `validator.list.fetch`         | UNL list fetched                        |
+| `validator.manifest`           | Manifest update processed               |
+| `amendment.vote`               | Amendment voting executed               |
+| `shamap.sync`                  | State tree synchronization              |
+| `job.enqueue`                  | Job added to queue                      |
+| `job.execute`                  | Job execution                           |
+
+### 2.3.3 Attribute Naming Conventions
+
+Span **names** follow §2.3.1 (dotted `<component>.<operation>`). Span
+**attribute keys** follow the rules below. The constants in the `*SpanNames.h`
+headers are the single source of truth; the collector, Tempo, the Grafana
+dashboards, and the runbook all consume these exact keys, so every layer must
+agree with the code. A CI check enforces this end to end.
+
+1. **Per-span unique attribute** → bare field name, allowed when the field is
+   recorded by a single span/workflow so the span name already supplies the
+   domain (e.g. `command`, `version`, `local` on `rpc.command`).
+2. **Shared attribute (same concept on more than one span)** → ONE key, reused
+   verbatim on every span that records it; the span name tells the occurrences
+   apart, so no per-emitter prefix is added. Name it by the field's meaning: a
+   property of a domain object keeps that object's bare field name (`ledger_hash`,
+   `ledger_seq`, `tx_hash`, `peer_id`, `full_validation`); a field already
+   qualified by a sub-kind keeps that qualifier on every emitter (`proposal_trusted`
+   on both `consensus.proposal.receive` and `peer.proposal.receive`;
+   `validation_trusted` likewise). Defined once in the base `SpanNames.h`
+   `namespace attr` block and re-exported (`using`) by each domain header.
+3. **Collision qualifier** → `<domain>_<field>`, only when a bare name would
+   collide with a DIFFERENT concept in the shared spanmetrics label space or with
+   the OTel-reserved `status` key (e.g. `rpc_status`, `grpc_status`,
+   `consensus_phase`, `consensus_round`, `consensus_mode`). This disambiguates
+   distinct concepts that share a word; it is NOT used to tag the same concept
+   with its emitting workflow — that is rule 2 (one shared name).
+4. **Resource attribute** → dotted `xrpl.<subsystem>.<field>`, reserved ONLY
+   for process/network identity set once at startup (`xrpl.network.id`,
+   `xrpl.network.type`). Span attributes are never dotted in the `xrpl.` form —
+   it blurs the resource/span scope boundary and parses awkwardly in TraceQL.
+5. **Span names** use `<subsystem>[.<component>]` (dotted, per §2.3.1). Only
+   attribute _keys_ follow rules 1–4.
+
+Standard OpenTelemetry semantic-convention keys keep their canonical dotted
+form (e.g. `service.*` resource attributes, `http.*` span attributes); the
+"no dotted form" rule applies to xrpl-custom keys only.
+
+The same rules are recorded in `CONTRIBUTING.md` (the permanent home, since
+`OpenTelemetryPlan/` is removed once the rollout completes). The attribute
+examples in §2.4 below follow these rules.
+
+---
+
+## 2.4 Attribute Schema
+
+> **TxQ** = Transaction Queue | **UNL** = Unique Node List | **OTLP** = OpenTelemetry Protocol
+
+### 2.4.1 Resource Attributes (Set Once at Startup)
+
+Resource attributes identify the process and are set once at startup. They use
+the standard OpenTelemetry semantic conventions plus custom dotted `xrpl.*`
+keys (the dotted form is reserved for resource scope per §2.3.3).
+
+| Key                   | Type / value                                            | Description                    |
+| --------------------- | ------------------------------------------------------- | ------------------------------ |
+| `service.name`        | `"xrpld"`                                               | Standard `SERVICE_NAME`        |
+| `service.version`     | `build_info::getVersionString()`                        | Standard `SERVICE_VERSION`     |
+| `service.instance.id` | node public key (base58)                                | Standard `SERVICE_INSTANCE_ID` |
+| `xrpl.network.id`     | network id (e.g. 0 for mainnet)                         | Network identifier             |
+| `xrpl.network.type`   | `"mainnet"` \| `"testnet"` \| `"devnet"` \| `"unknown"` | Network kind                   |
+| `xrpl.node.type`      | `"validator"` \| `"stock"` \| `"reporting"`             | Node role                      |
+| `xrpl.node.cluster`   | cluster name                                            | Cluster name, if clustered     |
+
+### 2.4.2 Span Attributes by Category
+
+> Span attribute keys use the underscore form from §2.3.3 (shared/qualified
+> keys are `<domain>_<field>`; per-span unique keys are bare). The dotted form
+> is reserved for the resource attributes in §2.4.1 above. This catalog lists
+> the planned attribute set by category; the exact emitted key for each
+> implemented span is defined by the `*SpanNames.h` constants, which are the
+> single source of truth where the two differ.
+
+#### Transaction Attributes
+
+| Key            | Type   | Description                           |
+| -------------- | ------ | ------------------------------------- |
+| `tx_hash`      | string | Transaction hash (hex)                |
+| `tx_type`      | string | `"Payment"`, `"OfferCreate"`, etc.    |
+| `tx_account`   | string | Source account (redacted in prod)     |
+| `tx_sequence`  | int64  | Account sequence number               |
+| `tx_fee`       | int64  | Fee in drops                          |
+| `tx_result`    | string | `"tesSUCCESS"`, `"tecPATH_DRY"`, etc. |
+| `ledger_index` | int64  | Ledger containing transaction         |
+| `relay_count`  | int64  | Peers the transaction was relayed to  |
+| `suppressed`   | bool   | `true` when HashRouter dropped a dup  |
+
+#### Consensus Attributes
+
+| Key                  | Type    | Description                         |
+| -------------------- | ------- | ----------------------------------- |
+| `consensus_round`    | int64   | Round number                        |
+| `consensus_phase`    | string  | `"open"`, `"establish"`, `"accept"` |
+| `consensus_mode`     | string  | `"proposing"`, `"observing"`, etc.  |
+| `proposers`          | int64   | Number of proposers                 |
+| `prev_ledger_prefix` | string  | Previous ledger hash prefix         |
+| `ledger_seq`         | int64   | Ledger sequence                     |
+| `tx_count`           | int64   | Transactions in consensus set       |
+| `round_time_ms`      | float64 | Round duration                      |
+
+#### RPC Attributes
+
+| Key           | Type    | Description                                                                   |
+| ------------- | ------- | ----------------------------------------------------------------------------- |
+| `command`     | string  | Command name (per-span unique on `rpc.command`)                               |
+| `version`     | int64   | API version                                                                   |
+| `rpc_role`    | string  | `"admin"` or `"user"` (qualified — `role` is generic)                         |
+| `params`      | string  | Sanitized parameters (optional)                                               |
+| `rpc_status`  | string  | Response status: `success` \| `error` (qualified — `status` is OTel-reserved) |
+| `duration_ms` | float64 | Request duration in milliseconds                                              |
+
+#### Peer & Message Attributes
+
+| Key                  | Type    | Description                |
+| -------------------- | ------- | -------------------------- |
+| `peer_id`            | string  | Peer public key (base58)   |
+| `peer_address`       | string  | IP:port                    |
+| `peer_latency_ms`    | float64 | Measured latency           |
+| `peer_cluster`       | string  | Cluster name if clustered  |
+| `message_type`       | string  | Protocol message type name |
+| `message_size_bytes` | int64   | Message size               |
+| `message_compressed` | bool    | Whether compressed         |
+
+#### Ledger & Job Attributes
+
+| Key               | Type    | Description           |
+| ----------------- | ------- | --------------------- |
+| `ledger_hash`     | string  | Ledger hash           |
+| `ledger_index`    | int64   | Ledger sequence/index |
+| `close_time`      | int64   | Close time (epoch)    |
+| `ledger_tx_count` | int64   | Transaction count     |
+| `job_type`        | string  | Job type name         |
+| `job_queue_ms`    | float64 | Time spent in queue   |
+| `job_worker`      | int64   | Worker thread ID      |
+
+#### PathFinding Attributes
+
+| Key                        | Type   | Description               |
+| -------------------------- | ------ | ------------------------- |
+| `pathfind_source_currency` | string | Source currency code      |
+| `pathfind_dest_currency`   | string | Destination currency code |
+| `pathfind_path_count`      | int64  | Number of paths found     |
+| `pathfind_cache_hit`       | bool   | RippleLineCache hit       |
+
+#### TxQ Attributes
+
+| Key                   | Type   | Description                 |
+| --------------------- | ------ | --------------------------- |
+| `txq_queue_depth`     | int64  | Current queue depth         |
+| `txq_fee_level`       | int64  | Fee level of transaction    |
+| `txq_eviction_reason` | string | Why transaction was evicted |
+
+#### Fee Attributes
+
+| Key                    | Type  | Description               |
+| ---------------------- | ----- | ------------------------- |
+| `fee_load_factor`      | int64 | Current load factor       |
+| `fee_escalation_level` | int64 | Fee escalation multiplier |
+
+#### Validator Attributes
+
+| Key                      | Type  | Description               |
+| ------------------------ | ----- | ------------------------- |
+| `validator_list_size`    | int64 | UNL size                  |
+| `validator_list_age_sec` | int64 | Seconds since last update |
+
+#### Amendment Attributes
+
+| Key                | Type   | Description                            |
+| ------------------ | ------ | -------------------------------------- |
+| `amendment_name`   | string | Amendment name                         |
+| `amendment_status` | string | `"enabled"`, `"vetoed"`, `"supported"` |
+
+#### SHAMap Attributes
+
+| Key                    | Type    | Description                                   |
+| ---------------------- | ------- | --------------------------------------------- |
+| `shamap_type`          | string  | `"transaction"`, `"state"`, `"account_state"` |
+| `shamap_missing_nodes` | int64   | Number of missing nodes during sync           |
+| `shamap_duration_ms`   | float64 | Sync duration                                 |
+
+### 2.4.3 Data Collection Summary
+
+The following table summarizes what data is collected by category:
+
+| Category        | Attributes Collected                                                                              | Purpose                      |
+| --------------- | ------------------------------------------------------------------------------------------------- | ---------------------------- |
+| **Transaction** | `tx_hash`, `tx_type`, `tx_result`, `tx_fee`, `ledger_index`                                       | Trace transaction lifecycle  |
+| **Consensus**   | `consensus_round`, `consensus_phase`, `consensus_mode`, `proposers`, `round_time_ms`              | Analyze consensus timing     |
+| **RPC**         | `command`, `version`, `rpc_status`, `duration_ms`                                                 | Monitor RPC performance      |
+| **Peer**        | `peer_id` (public key), `peer_latency_ms`, `message_type`, `message_size_bytes`                   | Network topology analysis    |
+| **Ledger**      | `ledger_hash`, `ledger_index`, `close_time`, `ledger_tx_count`                                    | Ledger progression tracking  |
+| **Job**         | `job_type`, `job_queue_ms`, `job_worker`                                                          | JobQueue performance         |
+| **PathFinding** | `pathfind_source_currency`, `pathfind_dest_currency`, `pathfind_path_count`, `pathfind_cache_hit` | Payment path analysis        |
+| **TxQ**         | `txq_queue_depth`, `txq_fee_level`, `txq_eviction_reason`                                         | Queue depth and fee tracking |
+| **Fee**         | `fee_load_factor`, `fee_escalation_level`                                                         | Fee escalation monitoring    |
+| **Validator**   | `validator_list_size`, `validator_list_age_sec`                                                   | UNL health monitoring        |
+| **Amendment**   | `amendment_name`, `amendment_status`                                                              | Protocol upgrade tracking    |
+| **SHAMap**      | `shamap_type`, `shamap_missing_nodes`, `shamap_duration_ms`                                       | State tree sync performance  |
+
+### 2.4.4 Privacy & Sensitive Data Policy
+
+> **PII** = Personally Identifiable Information
+
+OpenTelemetry instrumentation is designed to collect **operational metadata only**, never sensitive content.
+
+#### Data NOT Collected
+
+The following data is explicitly **excluded** from telemetry collection:
+
+| Excluded Data           | Reason                                    |
+| ----------------------- | ----------------------------------------- |
+| **Private Keys**        | Never exposed; not relevant to tracing    |
+| **Account Balances**    | Financial data; privacy sensitive         |
+| **Transaction Amounts** | Financial data; privacy sensitive         |
+| **Raw TX Payloads**     | May contain sensitive memo/data fields    |
+| **Personal Data**       | No PII collected                          |
+| **IP Addresses**        | Configurable; excluded by default in prod |
+
+#### Privacy Protection Mechanisms
+
+| Mechanism                     | Description                                                                                                                             |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| **Account Hashing**           | `tx_account` is hashed at collector level before storage                                                                                |
+| **Configurable Redaction**    | Sensitive fields can be excluded via `[telemetry]` config section                                                                       |
+| **Collector Tail Sampling**   | xrpld head sampling is fixed at 1.0 (every span emitted); the collector retains ~10% of non-error traces, reducing stored data exposure |
+| **Local Control**             | Node operators have full control over what gets exported                                                                                |
+| **No Raw Payloads**           | Transaction content is never recorded, only metadata (hash, type, result)                                                               |
+| **Collector-Level Filtering** | Additional redaction/hashing can be configured at OTel Collector                                                                        |
+
+#### Collector-Level Data Protection
+
+The OpenTelemetry Collector can be configured (via an `attributes` processor)
+to hash or redact sensitive attributes before export — for example, hashing
+`tx_account`, deleting `peer_address` to drop IP addresses, and deleting
+`params` to redact request parameters.
+
+#### Configuration Options for Privacy
+
+In `xrpld.cfg`, operators control data collection granularity through the
+`[telemetry]` section. Besides `enabled`, per-component toggles
+(`trace_transactions`, `trace_consensus`, `trace_rpc`, `trace_peer` — the last
+often disabled due to high volume) select which spans are emitted, and
+redaction flags (`redact_account` to hash account addresses, `redact_peer_address`
+to remove peer IP addresses) control SDK-level redaction before export.
+
+> **Note**: The `redact_account` configuration in `xrpld.cfg` controls SDK-level redaction before export, while collector-level filtering (see [Collector-Level Data Protection](#collector-level-data-protection) above) provides an additional defense-in-depth layer. Both can operate independently.
+
+> **Key Principle**: Telemetry collects **operational metadata** (timing, counts, hashes) — never **sensitive content** (keys, balances, amounts, raw payloads).
+
+---
+
+## 2.5 Context Propagation Design
+
+> **WS** = WebSocket
+
+### 2.5.1 Propagation Boundaries
+
+```mermaid
+flowchart TB
+    subgraph http["HTTP/WebSocket (RPC)"]
+        w3c["W3C Trace Context Headers:<br/>traceparent:<br/>00-trace_id-span_id-flags<br/>tracestate: xrpld=..."]
+    end
+
+    subgraph protobuf["Protocol Buffers (P2P)"]
+        proto["message TraceContext {<br/>  bytes trace_id = 1;  // 16 bytes<br/>  bytes span_id = 2;   // 8 bytes<br/>  uint32 trace_flags = 3;<br/>  string trace_state = 4;<br/>}"]
+    end
+
+    subgraph jobqueue["JobQueue (Internal Async)"]
+        job["Context captured at job creation,<br/>restored at execution<br/><br/>class Job {<br/>  otel::context::Context<br/>    traceContext_;<br/>};"]
+    end
+
+    style http fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style protobuf fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style jobqueue fill:#bf360c,stroke:#8c2809,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **HTTP/WebSocket - RPC (blue)**: For client-facing RPC requests, trace context is propagated using the W3C `traceparent` header. This is the standard approach and works with any OTel-compatible client.
+- **Protocol Buffers - P2P (green)**: For peer-to-peer messages between xrpld nodes, trace context is embedded as a protobuf `TraceContext` message carrying trace_id, span_id, flags, and optional trace_state.
+- **JobQueue - Internal Async (red)**: For asynchronous work within a single node, the OTel context is captured when a job is created and restored when the job executes on a worker thread. This bridges the async gap so spans remain linked.
+
+---
+
+## 2.6 Integration with Existing Observability
+
+> **OTLP** = OpenTelemetry Protocol | **WS** = WebSocket
+
+### 2.6.1 Existing Frameworks Comparison
+
+xrpld already has two observability mechanisms. OpenTelemetry complements (not replaces) them:
+
+| Aspect                | PerfLog                       | Beast Insight (StatsD)       | OpenTelemetry             |
+| --------------------- | ----------------------------- | ---------------------------- | ------------------------- |
+| **Type**              | Logging                       | Metrics                      | Distributed Tracing       |
+| **Data**              | JSON log entries              | Counters, gauges, histograms | Spans with context        |
+| **Scope**             | Single node                   | Single node                  | **Cross-node**            |
+| **Output**            | `perf.log` file               | StatsD server                | OTLP Collector            |
+| **Question answered** | "What happened on this node?" | "How many? How fast?"        | "What was the journey?"   |
+| **Correlation**       | By timestamp                  | By metric name               | By `trace_id`             |
+| **Overhead**          | Low (file I/O)                | Low (UDP packets)            | Low-Medium (configurable) |
+
+### 2.6.2 What Each Framework Does Best
+
+#### PerfLog
+
+- **Purpose**: Detailed local event logging for RPC and job execution
+- **Strengths**:
+  - Rich JSON output with timing data
+  - Already integrated in RPC handlers
+  - File-based, no external dependencies
+- **Limitations**:
+  - Single-node only (no cross-node correlation)
+  - No parent-child relationships between events
+  - Manual log parsing required
+
+A PerfLog entry is a JSON object with fields such as `time`, `method`,
+`duration_us`, and `result`.
+
+#### Beast Insight (StatsD)
+
+- **Purpose**: Real-time metrics for monitoring dashboards
+- **Strengths**:
+  - Aggregated metrics (counters, gauges, histograms)
+  - Low overhead (UDP, fire-and-forget)
+  - Good for alerting thresholds
+- **Limitations**:
+  - No request-level detail
+  - No causal relationships
+  - Single-node perspective
+
+In xrpld, Beast Insight is used through `increment` (counters), `gauge`
+(point-in-time values), and `timing` (durations) calls.
+
+#### OpenTelemetry (NEW)
+
+- **Purpose**: Distributed request tracing across nodes
+- **Strengths**:
+  - **Cross-node correlation** via `trace_id`
+  - Parent-child span relationships
+  - Rich attributes per span
+  - Industry standard (CNCF)
+- **Limitations**:
+  - Requires collector infrastructure
+  - Higher complexity than logging
+
+A span is created via `startSpan` (e.g. `"tx.relay"`), annotated with
+attributes such as `tx_hash` and `peer_id`, and is automatically linked to its
+parent through the active context.
+
+### 2.6.3 When to Use Each
+
+| Scenario                                | PerfLog    | StatsD | OpenTelemetry |
+| --------------------------------------- | ---------- | ------ | ------------- |
+| "How many TXs per second?"              | ❌         | ✅     | ✅            |
+| "What's the p99 RPC latency?"           | ❌         | ✅     | ✅            |
+| "Why was this specific TX slow?"        | ⚠️ partial | ❌     | ✅            |
+| "Which node delayed consensus?"         | ❌         | ❌     | ✅            |
+| "What happened on node X at time T?"    | ✅         | ❌     | ✅            |
+| "Show me the TX journey across 5 nodes" | ❌         | ❌     | ✅            |
+
+### 2.6.4 Coexistence Strategy
+
+```mermaid
+flowchart TB
+    subgraph xrpld["xrpld Process"]
+        perflog["PerfLog<br/>(JSON to file)"]
+        insight["Beast Insight<br/>(StatsD)"]
+        otel["OpenTelemetry<br/>(Tracing)"]
+    end
+
+    perflog --> perffile["perf.log"]
+    insight --> statsd["StatsD Server"]
+    otel --> collector["OTLP Collector"]
+
+    perffile --> grafana["Grafana<br/>(Unified UI)"]
+    statsd --> grafana
+    collector --> grafana
+
+    style xrpld fill:#212121,stroke:#0a0a0a,color:#ffffff
+    style grafana fill:#bf360c,stroke:#8c2809,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **xrpld Process (dark gray)**: The single xrpld node running all three observability frameworks side by side. Each framework operates independently with no interference.
+- **PerfLog to perf.log**: PerfLog writes JSON-formatted event logs to a local file. Grafana can ingest these via Loki or a file-based datasource.
+- **Beast Insight to StatsD Server**: Insight sends aggregated metrics (counters, gauges) over UDP to a StatsD server. Grafana reads from StatsD-compatible backends like Graphite or Prometheus (via StatsD exporter).
+- **OpenTelemetry to OTLP Collector**: OTel exports spans over OTLP/HTTP to a Collector, which then forwards to a trace backend (Tempo). (OTLP/gRPC is future work — §2.2.2.)
+- **Grafana (red, unified UI)**: All three data streams converge in Grafana, enabling operators to correlate logs, metrics, and traces in a single dashboard.
+
+### 2.6.5 Correlation with PerfLog
+
+Trace IDs can be correlated with existing PerfLog entries for comprehensive
+debugging. The design is for `RPCHandler.cpp` to start an `rpc.command.<method>`
+span alongside the existing PerfLog `rpcStart`/`rpcFinish`/`rpcError` calls,
+extract the span's `trace_id` (when valid), and eventually stamp it onto the
+PerfLog entry (a planned `setTraceId` hook) so logs and traces share a key. The
+span status is set to OK on success or to error (recording the exception) on
+failure.
+
+---
+
+_Previous: [Architecture Analysis](./01-architecture-analysis.md)_ | _Next: [Implementation Strategy](./03-implementation-strategy.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/03-implementation-strategy.md

@@ -0,0 +1,415 @@
+# Implementation Strategy
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Configuration Reference](./05-configuration-reference.md)
+
+---
+
+## 3.1 Directory Structure
+
+The telemetry implementation follows xrpld's existing code organization pattern:
+
+```
+include/xrpl/
+├── telemetry/
+│   ├── Telemetry.h              # Main telemetry interface
+│   ├── TelemetryConfig.h        # Configuration structures
+│   ├── TraceContext.h           # Context propagation utilities
+│   ├── SpanGuard.h              # RAII span management
+│   └── SpanAttributes.h         # Attribute helper functions
+
+src/libxrpl/
+├── telemetry/
+│   ├── Telemetry.cpp            # Implementation
+│   ├── TelemetryConfig.cpp      # Config parsing
+│   ├── TraceContext.cpp         # Context serialization
+│   └── NullTelemetry.cpp        # No-op implementation
+
+src/xrpld/
+├── telemetry/
+│   ├── TracingInstrumentation.h # Instrumentation macros
+│   └── TracingInstrumentation.cpp
+```
+
+---
+
+## 3.2 Implementation Approach
+
+<div align="center">
+
+```mermaid
+%%{init: {'flowchart': {'nodeSpacing': 20, 'rankSpacing': 30}}}%%
+flowchart TB
+    subgraph phase1["Phase 1: Core"]
+        direction LR
+        sdk["SDK Integration"] ~~~ interface["Telemetry Interface"] ~~~ config["Configuration"]
+    end
+
+    subgraph phase2["Phase 2: RPC"]
+        direction LR
+        http["HTTP Context"] ~~~ rpc["RPC Handlers"]
+    end
+
+    subgraph phase3["Phase 3: P2P"]
+        direction LR
+        proto["Protobuf Context"] ~~~ tx["Transaction Relay"]
+    end
+
+    subgraph phase4["Phase 4: Consensus"]
+        direction LR
+        consensus["Consensus Rounds"] ~~~ proposals["Proposals"]
+    end
+
+    phase1 --> phase2 --> phase3 --> phase4
+
+    style phase1 fill:#1565c0,stroke:#0d47a1,color:#ffffff
+    style phase2 fill:#2e7d32,stroke:#1b5e20,color:#ffffff
+    style phase3 fill:#e65100,stroke:#bf360c,color:#ffffff
+    style phase4 fill:#c2185b,stroke:#880e4f,color:#ffffff
+```
+
+</div>
+
+### Key Principles
+
+1. **Minimal Intrusion**: Instrumentation should not alter existing control flow
+2. **Zero-Cost When Disabled**: Use compile-time flags and no-op implementations
+3. **Backward Compatibility**: Protocol Buffer extensions use high field numbers
+4. **Graceful Degradation**: Tracing failures must not affect node operation
+
+---
+
+## 3.3 Performance Overhead Summary
+
+> **OTLP** = OpenTelemetry Protocol
+
+| Metric        | Overhead   | Notes                                            |
+| ------------- | ---------- | ------------------------------------------------ |
+| CPU           | 1-3%       | Of per-transaction CPU cost (~200μs baseline)    |
+| Memory        | ~10 MB     | SDK statics + batch buffer + worker thread stack |
+| Network       | 10-50 KB/s | Compressed OTLP export to collector              |
+| Latency (p99) | <2%        | With proper sampling configuration               |
+
+---
+
+## 3.4 Detailed CPU Overhead Analysis
+
+### 3.4.1 Per-Operation Costs
+
+> **Note on hardware assumptions**: The costs below are based on the official OTel C++ SDK CI benchmarks
+> (969 runs on GitHub Actions 2-core shared runners). On production server hardware (3+ GHz Xeon),
+> expect costs at the **lower end** of each range (~30-50% improvement over CI hardware).
+
+| Operation             | Time (ns) | Frequency              | Impact     |
+| --------------------- | --------- | ---------------------- | ---------- |
+| Span creation         | 500-1000  | Every traced operation | Low        |
+| Span end              | 100-200   | Every traced operation | Low        |
+| SetAttribute (string) | 80-120    | 3-5 per span           | Low        |
+| SetAttribute (int)    | 40-60     | 2-3 per span           | Negligible |
+| AddEvent              | 100-200   | 0-2 per span           | Low        |
+| Context injection     | 150-250   | Per outgoing message   | Low        |
+| Context extraction    | 100-180   | Per incoming message   | Low        |
+| GetCurrent context    | 10-20     | Thread-local access    | Negligible |
+
+**Source**: Span creation based on OTel C++ SDK `BM_SpanCreation` benchmark (AlwaysOnSampler +
+SimpleSpanProcessor + InMemoryExporter), median ~1,000 ns on CI hardware. AddEvent includes
+timestamp read + string copy + vector push + mutex acquisition. Context injection/extraction
+confirmed by `BM_SpanCreationWithScope` benchmark delta (~160 ns).
+
+### 3.4.2 Transaction Processing Overhead
+
+<div align="center">
+
+```mermaid
+%%{init: {'pie': {'textPosition': 0.75}}}%%
+pie showData
+    "tx.receive (1400ns)" : 1400
+    "tx.validate (1200ns)" : 1200
+    "tx.relay (1200ns)" : 1200
+    "Context inject (200ns)" : 200
+```
+
+**Transaction Tracing Overhead (~4.0μs total)**
+
+</div>
+
+**Overhead percentage**: 4.0 μs / 200 μs (avg tx processing) = **~2.0%**
+
+> **Breakdown**: Each span (tx.receive, tx.validate, tx.relay) costs ~1,000 ns for creation plus
+> ~200-400 ns for 3-5 attribute sets. Context injection is ~200 ns (confirmed by benchmarks).
+> On production hardware, expect ~2.6 μs total (~1.3% overhead) due to faster span creation (~500-600 ns).
+
+### 3.4.3 Consensus Round Overhead
+
+| Operation              | Count | Cost (ns) | Total      |
+| ---------------------- | ----- | --------- | ---------- |
+| consensus.round span   | 1     | ~1200     | ~1.2 μs    |
+| consensus.phase spans  | 3     | ~1100     | ~3.3 μs    |
+| proposal.receive spans | ~20   | ~1100     | ~22 μs     |
+| proposal.send spans    | ~3    | ~1100     | ~3.3 μs    |
+| Context operations     | ~30   | ~200      | ~6 μs      |
+| **TOTAL**              |       |           | **~36 μs** |
+
+> **Why higher**: Each span costs ~1,000 ns creation + ~100-200 ns for 1-2 attributes, totaling ~1,100-1,200 ns.
+> Context operations remain ~200 ns (confirmed by benchmarks). On production hardware, expect ~24 μs total.
+
+**Overhead percentage**: 36 μs / 3s (typical round) = **~0.001%** (negligible)
+
+### 3.4.4 RPC Request Overhead
+
+| Operation        | Cost (ns)    |
+| ---------------- | ------------ |
+| rpc.request span | ~1200        |
+| rpc.command span | ~1100        |
+| Context extract  | ~250         |
+| Context inject   | ~200         |
+| **TOTAL**        | **~2.75 μs** |
+
+> **Why higher**: Each span costs ~1,000 ns creation + ~100-200 ns for attributes (command name,
+> version, role). Context extract/inject costs are confirmed by OTel C++ benchmarks.
+
+- Fast RPC (1ms): 2.75 μs / 1ms = **~0.275%**
+- Slow RPC (100ms): 2.75 μs / 100ms = **~0.003%**
+
+---
+
+## 3.5 Memory Overhead Analysis
+
+> **OTLP** = OpenTelemetry Protocol
+
+### 3.5.1 Static Memory
+
+| Component                            | Size        | Allocated  |
+| ------------------------------------ | ----------- | ---------- |
+| TracerProvider singleton             | ~64 KB      | At startup |
+| BatchSpanProcessor (circular buffer) | ~16 KB      | At startup |
+| BatchSpanProcessor (worker thread)   | ~8 MB       | At startup |
+| OTLP/HTTP exporter (client init)     | ~64 KB      | At startup |
+| Propagator registry                  | ~8 KB       | At startup |
+| **Total static**                     | **~8.1 MB** |            |
+
+> **Why higher than earlier estimate**: The BatchSpanProcessor's circular buffer itself is only ~16 KB
+> (2049 x 8-byte `AtomicUniquePtr` entries), but it spawns a dedicated worker thread whose default
+> stack size on Linux is ~8 MB. The OTLP/HTTP exporter allocates a small client and TLS
+> initialization buffer. The worker thread stack dominates the static footprint.
+
+### 3.5.2 Dynamic Memory
+
+| Component            | Size per unit  | Max units  | Peak            |
+| -------------------- | -------------- | ---------- | --------------- |
+| Active span          | ~500-800 bytes | 1000       | ~500-800 KB     |
+| Queued span (export) | ~500 bytes     | 2048       | ~1 MB           |
+| Attribute storage    | ~80 bytes      | 5 per span | Included        |
+| Context storage      | ~64 bytes      | Per thread | ~6.4 KB         |
+| **Total dynamic**    |                |            | **~1.5-1.8 MB** |
+
+> **Why active spans are larger**: An active `Span` object includes the wrapper (~88 bytes: shared_ptr,
+> mutex, unique_ptr to Recordable) plus `SpanData` (~250 bytes: SpanContext, timestamps, name, status,
+> empty containers) plus attribute storage (~200-500 bytes for 3-5 string attributes in a `std::map`).
+> Source: `sdk/src/trace/span.h` and `sdk/include/opentelemetry/sdk/trace/span_data.h`.
+> Queued spans release the wrapper, keeping only `SpanData` + attributes (~500 bytes).
+
+### 3.5.3 Memory Growth Characteristics
+
+```mermaid
+---
+config:
+    xyChart:
+        width: 700
+        height: 400
+---
+xychart-beta
+    title "Memory Usage vs Span Rate (bounded by queue limit)"
+    x-axis "Spans/second" [0, 200, 400, 600, 800, 1000]
+    y-axis "Memory (MB)" 0 --> 12
+    line [8.5, 9.2, 9.6, 9.9, 10.0, 10.0]
+```
+
+**Notes**:
+
+- Memory increases with span rate but **plateaus at queue capacity** (default 2048 spans)
+- Batch export prevents unbounded growth
+- At queue limit, oldest spans are dropped (not blocked)
+- Maximum memory is bounded: ~8.3 MB static (dominated by worker thread stack) + 2048 queued spans x ~500 bytes (~1 MB) + active spans (~0.8 MB) ≈ **~10 MB ceiling**
+- The worker thread stack (~8 MB) is virtual memory; actual RSS depends on stack usage (typically much less)
+
+> **Measured outcome**: A perf-iac comparison (telemetry compiled-in + enabled vs compiled-out,
+> 9 nodes — validators and client-handlers — under sustained payment load) recorded **no measurable
+> RSS increase over the telemetry-off baseline** (~15 GiB mean / ~18–19 GiB peak on both sides),
+> with no OOM, no swap, and no leak across the run. The ~10 MB ceiling above is therefore a
+> provisioning safety margin (dominated by virtual thread-stack address space), not an expected
+> resident-memory increase. Steady-state cost shows up as throughput (~3–4% at head sampling 1.0),
+> not memory.
+
+### 3.5.4 Performance Data Sources
+
+The overhead estimates in Sections 3.3-3.5 are derived from the following sources:
+
+| Source                                           | What it covers                                        | URL                                                                                                                                        |
+| ------------------------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| OTel C++ SDK CI benchmarks (969 runs)            | Span creation, context activation, sampler overhead   | [Benchmark Dashboard](https://open-telemetry.github.io/opentelemetry-cpp/benchmarks/)                                                      |
+| `api/test/trace/span_benchmark.cc`               | API-level span creation (~22 ns no-op)                | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/api/test/trace/span_benchmark.cc)                                   |
+| `sdk/test/trace/sampler_benchmark.cc`            | SDK span creation with samplers (~1,000 ns AlwaysOn)  | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/test/trace/sampler_benchmark.cc)                                |
+| `sdk/include/.../span_data.h`                    | SpanData memory layout (~250 bytes base)              | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/trace/span_data.h)                    |
+| `sdk/src/trace/span.h`                           | Span wrapper memory layout (~88 bytes)                | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/src/trace/span.h)                                               |
+| `sdk/include/.../batch_span_processor_options.h` | Default queue size (2048), batch size (512)           | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/trace/batch_span_processor_options.h) |
+| `sdk/include/.../circular_buffer.h`              | CircularBuffer implementation (AtomicUniquePtr array) | [Source](https://github.com/open-telemetry/opentelemetry-cpp/blob/main/sdk/include/opentelemetry/sdk/common/circular_buffer.h)             |
+| OTLP proto definition                            | Serialized span size estimation                       | [Proto](https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/trace/v1/trace.proto)                          |
+
+---
+
+## 3.6 Network Overhead Analysis
+
+### 3.6.1 Export Bandwidth
+
+> **Bytes per span**: Estimates use ~500 bytes/span (conservative upper bound). OTLP protobuf analysis
+> shows a typical span with 3-5 string attributes serializes to ~200-300 bytes raw; with gzip
+> compression (~60-70% of raw) and batching (amortized headers), ~350 bytes/span is more realistic.
+> The table uses the conservative estimate for capacity planning.
+
+| Sampling Rate | Spans/sec | Bandwidth | Notes            |
+| ------------- | --------- | --------- | ---------------- |
+| 100%          | ~500      | ~250 KB/s | Development only |
+| 10%           | ~50       | ~25 KB/s  | Staging          |
+| 1%            | ~5        | ~2.5 KB/s | Production       |
+| Error-only    | ~1        | ~0.5 KB/s | Minimal overhead |
+
+### 3.6.2 Trace Context Propagation
+
+| Message Type           | Context Size | Messages/sec | Overhead    |
+| ---------------------- | ------------ | ------------ | ----------- |
+| TMTransaction          | 25 bytes     | ~100         | ~2.5 KB/s   |
+| TMProposeSet           | 25 bytes     | ~10          | ~250 B/s    |
+| TMValidation           | 25 bytes     | ~50          | ~1.25 KB/s  |
+| **Total P2P overhead** |              |              | **~4 KB/s** |
+
+---
+
+## 3.7 Optimization Strategies
+
+### 3.7.1 Sampling Strategies
+
+#### Tail Sampling
+
+```mermaid
+flowchart TD
+    trace["New Trace"]
+
+    trace --> errors{"Is Error?"}
+    errors -->|Yes| sample["SAMPLE"]
+    errors -->|No| consensus{"Is Consensus?"}
+
+    consensus -->|Yes| sample
+    consensus -->|No| slow{"Is Slow?"}
+
+    slow -->|Yes| sample
+    slow -->|No| prob{"Random < 10%?"}
+
+    prob -->|Yes| sample
+    prob -->|No| drop["DROP"]
+
+    style sample fill:#4caf50,stroke:#388e3c,color:#fff
+    style drop fill:#f44336,stroke:#c62828,color:#fff
+```
+
+### 3.7.2 Batch Tuning Recommendations
+
+| Environment        | Batch Size | Batch Delay | Max Queue |
+| ------------------ | ---------- | ----------- | --------- |
+| Low-latency        | 128        | 1000ms      | 512       |
+| High-throughput    | 1024       | 10000ms     | 8192      |
+| Memory-constrained | 256        | 2000ms      | 512       |
+
+### 3.7.3 Conditional Instrumentation
+
+Instrumentation is gated on two levels. A compile-time feature flag (`XRPL_ENABLE_TELEMETRY`) reduces the trace macros to no-ops when telemetry is built out, so disabled builds carry zero cost. At runtime, per-component guards (e.g. `shouldTracePeer()`) skip span creation for components whose tracing is turned off, incurring no overhead beyond a single boolean check.
+
+---
+
+## 3.8 Links to Detailed Documentation
+
+- **[Configuration Reference](./05-configuration-reference.md)**: Configuration options and collector setup
+- **[Implementation Phases](./06-implementation-phases.md)**: Detailed timeline and milestones
+
+---
+
+## 3.9 Code Intrusiveness Assessment
+
+> **TxQ** = Transaction Queue
+
+This section provides a detailed assessment of how intrusive the OpenTelemetry integration is to the existing xrpld codebase.
+
+### 3.9.3 Risk Assessment by Component
+
+<div align="center">
+
+**Do First** ↖ ↗ **Plan Carefully**
+
+```mermaid
+quadrantChart
+    title Code Intrusiveness Risk Matrix
+    x-axis Low Risk --> High Risk
+    y-axis Low Value --> High Value
+
+    RPC Tracing: [0.2, 0.55]
+    Transaction Relay: [0.55, 0.85]
+    Consensus Tracing: [0.75, 0.92]
+    Peer Message Tracing: [0.85, 0.35]
+    JobQueue Context: [0.3, 0.42]
+    Ledger Acquisition: [0.48, 0.65]
+    PathFinding: [0.38, 0.72]
+    TxQ and Fees: [0.25, 0.62]
+    Validator Mgmt: [0.15, 0.35]
+```
+
+**Optional** ↙ ↘ **Avoid**
+
+</div>
+
+#### Risk Level Definitions
+
+| Risk Level | Definition                                                       | Mitigation                         |
+| ---------- | ---------------------------------------------------------------- | ---------------------------------- |
+| **Low**    | Additive changes only; no modification to existing logic         | Standard code review               |
+| **Medium** | Minor modifications to existing functions; clear boundaries      | Comprehensive unit tests           |
+| **High**   | Changes to core logic or data structures; potential side effects | Integration tests + staged rollout |
+
+### 3.9.4 Architectural Impact Assessment
+
+| Aspect               | Impact  | Justification                                                                    |
+| -------------------- | ------- | -------------------------------------------------------------------------------- |
+| **Data Flow**        | Minimal | Read-only instrumentation; no modification to consensus or transaction data flow |
+| **Threading Model**  | Minimal | Context propagation uses thread-local storage (standard OTel pattern)            |
+| **Memory Model**     | Low     | Bounded queues prevent unbounded growth; RAII ensures cleanup                    |
+| **Network Protocol** | Low     | Optional fields in protobuf (high field numbers); backward compatible            |
+| **Configuration**    | None    | New config section; existing configs unaffected                                  |
+| **Build System**     | Low     | Optional CMake flag; builds work without OpenTelemetry                           |
+| **Dependencies**     | Low     | OpenTelemetry SDK is optional; null implementation when disabled                 |
+
+### 3.9.5 Backward Compatibility
+
+| Compatibility   | Status  | Notes                                                 |
+| --------------- | ------- | ----------------------------------------------------- |
+| **Config File** | ✅ Full | New `[telemetry]` section is optional                 |
+| **Protocol**    | ✅ Full | Optional protobuf fields with high field numbers      |
+| **Build**       | ✅ Full | `XRPL_ENABLE_TELEMETRY=OFF` produces identical binary |
+| **Runtime**     | ✅ Full | `enabled=0` produces zero overhead                    |
+| **API**         | ✅ Full | No changes to public RPC or P2P APIs                  |
+
+### 3.9.6 Rollback Strategy
+
+If issues are discovered after deployment:
+
+1. **Immediate**: Set `enabled=0` in config and restart (zero code change)
+2. **Quick**: Rebuild with `XRPL_ENABLE_TELEMETRY=OFF`
+3. **Complete**: Revert telemetry commits (clean separation makes this easy)
+
+### 3.9.7 Code Change Examples
+
+**Minimal RPC Instrumentation (Low Intrusiveness):** Instrumenting an RPC handler adds roughly 3-4 lines: one macro to start the span and one or two `setAttribute` calls (command name, status). The span ends automatically via RAII, so the existing control flow — process the request, send the result — is untouched.
+
+**Consensus Instrumentation (Medium Intrusiveness):** Consensus is slightly more intrusive because child spans in later phase transitions need the round's context. Beyond the span-start and attribute macros, this requires storing the active context in a new member variable (`currentRoundContext_`) at round start. The existing round logic itself remains unchanged.
+
+---
+
+_Previous: [Design Decisions](./02-design-decisions.md)_ | _Next: [Configuration Reference](./05-configuration-reference.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/05-configuration-reference.md

@@ -0,0 +1,265 @@
+# Configuration Reference
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Implementation Phases](./06-implementation-phases.md)
+
+---
+
+## 5.1 xrpld Configuration
+
+> **OTLP** = OpenTelemetry Protocol | **TxQ** = Transaction Queue
+
+### 5.1.1 Configuration File Section
+
+The authoritative `[telemetry]` example lives in `cfg/xrpld-example.cfg`. Telemetry is disabled by default (`enabled=0`); enabling it turns on distributed tracing for transaction flow, consensus, and RPC calls, with traces exported to an OpenTelemetry Collector over OTLP. Head sampling is intentionally fixed at 1.0 (sample everything) and is not configurable — per-node head-sampling would produce broken/partial distributed traces, so volume reduction is delegated to the collector's tail sampling (see Section 7.4.2). The full option reference follows.
+
+### 5.1.2 Configuration Options Summary
+
+| Option                | Type   | Default                           | Description                                          |
+| --------------------- | ------ | --------------------------------- | ---------------------------------------------------- |
+| `enabled`             | bool   | `false`                           | Enable/disable telemetry                             |
+| `endpoint`            | string | `http://localhost:4318/v1/traces` | OTLP/HTTP collector endpoint                         |
+| `use_tls`             | bool   | `false`                           | Enable TLS for exporter connection                   |
+| `tls_ca_cert`         | string | `""`                              | Path to CA certificate file                          |
+| `batch_size`          | uint   | `512`                             | Spans per export batch                               |
+| `batch_delay_ms`      | uint   | `5000`                            | Max delay before sending batch (ms)                  |
+| `max_queue_size`      | uint   | `2048`                            | Maximum queued spans                                 |
+| `trace_transactions`  | 0 or 1 | `1`                               | Enable transaction tracing                           |
+| `trace_consensus`     | 0 or 1 | `1`                               | Enable consensus tracing                             |
+| `trace_rpc`           | 0 or 1 | `1`                               | Enable RPC tracing                                   |
+| `trace_peer`          | 0 or 1 | `1`                               | Enable peer message tracing (high volume)            |
+| `trace_ledger`        | 0 or 1 | `1`                               | Enable ledger tracing                                |
+| `service_name`        | string | `"xrpld"`                         | Service name (`service.name`) for traces and metrics |
+| `service_instance_id` | string | `<node_pubkey>`                   | Instance identifier                                  |
+
+**Planned (not yet implemented)**: the following options appear in the design
+documents but are not parsed by `TelemetryConfig.cpp` in Phase 1b and later
+phases. They will be added as the corresponding subsystems are instrumented:
+
+| Option                     | Planned Phase | Purpose                                                                 |
+| -------------------------- | ------------- | ----------------------------------------------------------------------- |
+| `exporter`                 | Future        | Select between OTLP/HTTP and OTLP/gRPC                                  |
+| `trace_pathfind`           | Phase 2       | Path computation tracing toggle                                         |
+| `trace_txq`                | Phase 3       | Transaction queue tracing toggle                                        |
+| `trace_validator`          | Future        | Validator list / manifest update tracing                                |
+| `trace_amendment`          | Future        | Amendment voting tracing                                                |
+| `consensus_trace_strategy` | Phase 4       | Trace ID strategy for consensus rounds (`deterministic` \| `attribute`) |
+
+---
+
+## 5.2 Configuration Parser
+
+> **TxQ** = Transaction Queue
+
+The parser `setup_Telemetry()` in `src/libxrpl/telemetry/TelemetryConfig.cpp` reads the `[telemetry]` `Section` and populates a `Telemetry::Setup` struct, applying the defaults listed in Section 5.1.2 via `section.value_or(...)`. It derives `serviceInstanceId` from the node public key when not overridden, selects the exporter endpoint default by exporter type, and leaves the sampling ratio at its fixed 1.0 default (not read from config — see Section 7.4.2).
+
+---
+
+## 5.3 Application Integration
+
+### 5.3.1 ApplicationImp Changes
+
+> **Deferred identity**: The node public key (`nodeIdentity_`) is not
+> available during `ApplicationImp`'s member initializer list — it is
+> resolved later in `setup()`. The `Telemetry` object is therefore
+> constructed with an empty `serviceInstanceId` and patched via
+> `setServiceInstanceId()` once `setup()` has called `getNodeIdentity()`.
+
+`ApplicationImp` (in `src/xrpld/app/main/Application.cpp`) owns a `std::unique_ptr<telemetry::Telemetry> telemetry_`. It is built in the member initializer list via `make_Telemetry(setup_Telemetry(...))` with an empty `serviceInstanceId`, then patched in `setup()` by calling `setServiceInstanceId()` with the Base58 node public key (unless the user supplied a custom `service_instance_id`). `start()` and `run()` forward to `telemetry_->start()` / `telemetry_->stop()`, and `getTelemetry()` returns the owned instance.
+
+### 5.3.2 ServiceRegistry Interface Addition
+
+`include/xrpl/core/ServiceRegistry.h` gains a pure-virtual `telemetry::Telemetry& getTelemetry()` (with a forward declaration of `telemetry::Telemetry`), giving every component a uniform accessor for the tracing subsystem.
+
+> **Note:** `Application` extends `ServiceRegistry`, so `getTelemetry()` is
+> available on both. Components that hold a `ServiceRegistry&` (e.g.
+> `NetworkOPsImp`) call `registry_.get().getTelemetry()`. Components that
+> still hold an `Application&` (e.g. `ServerHandler`, `PeerImp`,
+> `RCLConsensusAdaptor`) call `app_.getTelemetry()` directly.
+
+---
+
+## 5.4 CMake Integration
+
+> **OTLP** = OpenTelemetry Protocol
+
+### 5.4.1 Find OpenTelemetry Module
+
+A `cmake/FindOpenTelemetry.cmake` module locates the OpenTelemetry C++ SDK. It first tries `find_package(opentelemetry-cpp CONFIG)`, aliasing the imported targets `OpenTelemetry::api`, `OpenTelemetry::sdk`, and `OpenTelemetry::otlp_grpc_exporter`, and falls back to `pkg-config` when no CMake config package is present.
+
+### 5.4.2 CMakeLists.txt Changes
+
+The top-level `CMakeLists.txt` adds an `XRPL_ENABLE_TELEMETRY` option (default `OFF`). When enabled, it runs `find_package(OpenTelemetry REQUIRED)`, defines the `XRPL_ENABLE_TELEMETRY` compile flag, and builds the `xrpl_telemetry` library from the real telemetry sources linked against the OpenTelemetry targets; when disabled, it builds the same target from a no-op `NullTelemetry.cpp` so call sites compile unchanged.
+
+---
+
+## 5.5 OpenTelemetry Collector Configuration
+
+> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring
+
+The authoritative collector config lives in the repo at `docker/telemetry/otel-collector-config.yaml` (with Tempo backend config in `docker/telemetry/tempo.yaml`). The sections below summarize the development and production shapes of that pipeline.
+
+### 5.5.1 Development Configuration
+
+The development collector enables an OTLP receiver on both gRPC (`0.0.0.0:4317`) and HTTP (`0.0.0.0:4318`), a single `batch` processor (1s timeout, batch size 100), and two exporters: a `logging` exporter for console debugging and `otlp/tempo` (insecure) for trace visualization. The single `traces` pipeline wires receiver → batch → both exporters.
+
+### 5.5.2 Production Configuration
+
+The production collector adds TLS on the OTLP gRPC receiver and a richer processor chain: a `memory_limiter` (OOM guard), `batch` (5s timeout, size 512), `tail_sampling`, and an `attributes` processor that hashes sensitive fields (e.g. `tx_account`) and stamps `deployment.environment`. Tail sampling keeps all `ERROR` traces, slow consensus rounds (>5s) and slow RPC requests (>1s), and probabilistically samples the remainder at 10%. Exporters target Grafana Tempo (TLS) and Elastic APM; `health_check` and `zpages` extensions are enabled for operability.
+
+---
+
+## 5.6 Docker Compose Development Environment
+
+> **OTLP** = OpenTelemetry Protocol
+
+The authoritative development stack lives in the repo at `docker/telemetry/docker-compose.yml`. It brings up four services on a shared `xrpld-telemetry` network: an `otel-collector` (otel/opentelemetry-collector-contrib) exposing OTLP gRPC `4317`, OTLP HTTP `4318`, and health check `13133`; `tempo` for trace storage/visualization; `grafana` with provisioned datasources and dashboards (anonymous admin enabled); and an optional `prometheus` for metric correlation.
+
+---
+
+## 5.7 Configuration Architecture
+
+> **OTLP** = OpenTelemetry Protocol
+
+```mermaid
+flowchart TB
+    subgraph config["Configuration Sources"]
+        cfgFile["xrpld.cfg<br/>[telemetry] section"]
+        cmake["CMake<br/>XRPL_ENABLE_TELEMETRY"]
+    end
+
+    subgraph init["Initialization"]
+        parse["setup_Telemetry()"]
+        factory["make_Telemetry()"]
+    end
+
+    subgraph runtime["Runtime Components"]
+        tracer["TracerProvider"]
+        exporter["OTLP Exporter"]
+        processor["BatchProcessor"]
+    end
+
+    subgraph collector["Collector Pipeline"]
+        recv["Receivers"]
+        proc["Processors"]
+        exp["Exporters"]
+    end
+
+    cfgFile --> parse
+    cmake -->|"compile flag"| parse
+    parse --> factory
+    factory --> tracer
+    tracer --> processor
+    processor --> exporter
+    exporter -->|"OTLP"| recv
+    recv --> proc
+    proc --> exp
+
+    style config fill:#e3f2fd,stroke:#1976d2
+    style runtime fill:#e8f5e9,stroke:#388e3c
+    style collector fill:#fff3e0,stroke:#ff9800
+```
+
+**Reading the diagram:**
+
+- **Configuration Sources**: `xrpld.cfg` provides runtime settings (endpoint, per-component trace toggles) while the CMake flag controls whether telemetry is compiled in at all. Head sampling is fixed at 1.0 and is not a config option; volume reduction happens via tail sampling in the collector.
+- **Initialization**: `setup_Telemetry()` parses config values, then `make_Telemetry()` constructs the provider, processor, and exporter objects.
+- **Runtime Components**: The `TracerProvider` creates spans, the `BatchProcessor` buffers them, and the `OTLP Exporter` serializes and sends them over the wire.
+- **OTLP arrow to Collector**: Trace data leaves the xrpld process via OTLP/HTTP and enters the external Collector pipeline. (OTLP/gRPC is future work — see design decisions §2.2.2.)
+- **Collector Pipeline**: `Receivers` ingest OTLP data, `Processors` apply sampling/filtering/enrichment, and `Exporters` forward traces to storage backends (Tempo, etc.).
+
+---
+
+## 5.8 Grafana Integration
+
+> **APM** = Application Performance Monitoring
+
+Step-by-step instructions for integrating xrpld traces with Grafana.
+
+### 5.8.1 Data Source Configuration
+
+#### Tempo (Recommended)
+
+A Tempo datasource (`grafana/provisioning/datasources/tempo.yaml`, provisioned from `docker/telemetry/grafana/`) points at `http://tempo:3200` and enables `tracesToLogs` (linking to Loki on `service.name`/`tx_hash` and mapping `trace_id` → `traceID`), `serviceMap` against Prometheus, the node graph, and Loki search.
+
+#### Elastic APM
+
+Alternatively, an Elasticsearch datasource (`grafana/provisioning/datasources/elastic-apm.yaml`) of type `elasticsearch` points at `http://elasticsearch:9200` against the `apm-*` index, using `@timestamp` as the time field and mapping the log message/level fields.
+
+### 5.8.2 Dashboard Provisioning
+
+A dashboard provider (`grafana/provisioning/dashboards/dashboards.yaml`) loads the `xrpld` dashboard folder from disk (`/var/lib/grafana/dashboards/rippled`), polling for changes every 30s with deletion disabled.
+
+### 5.8.3 Example Dashboard: RPC Performance
+
+An example `xrpld RPC Performance` dashboard (uid `xrpld-rpc-performance`) sourced from Tempo via TraceQL provides four panels: RPC latency by command (heatmap), RPC error rate by command (timeseries), the top 10 slowest RPC commands by average duration (table), and a recent-traces table.
+
+### 5.8.4 Example Dashboard: Transaction Tracing
+
+An example `xrpld Transaction Tracing` dashboard (uid `xrpld-tx-tracing`) over Tempo provides three panels: transaction throughput (`tx.receive` rate, stat), cross-node relay count (average `span.relay_count` on `tx.relay`, timeseries), and a table of transaction validation errors (`tx.validate` with `status.code=error`).
+
+### 5.8.5 TraceQL Query Examples
+
+Common queries for xrpld traces:
+
+```
+# Find all traces for a specific transaction hash
+{resource.service.name="xrpld" && span.tx_hash="ABC123..."}
+
+# Find slow RPC commands (>100ms)
+{resource.service.name="xrpld" && name=~"rpc.command.*"} | duration > 100ms
+
+# Find consensus rounds taking >5 seconds
+{resource.service.name="xrpld" && name="consensus.round"} | duration > 5s
+
+# Find failed transactions with error details
+{resource.service.name="xrpld" && name="tx.validate" && status.code=error}
+
+# Find transactions relayed to many peers
+{resource.service.name="xrpld" && name="tx.relay"} | span.relay_count > 10
+
+# Compare latency across nodes
+{resource.service.name="xrpld" && name="rpc.command.account_info"} | avg(duration) by (resource.service.instance.id)
+```
+
+### 5.8.6 Correlation with PerfLog
+
+To correlate OpenTelemetry traces with existing PerfLog data:
+
+**Step 1: Configure Loki to ingest PerfLog**
+
+Configure a Promtail scrape job (`promtail-config.yaml`) that tails `/var/log/rippled/perf*.log`, parses each JSON line, and promotes `trace_id`, `ledger_seq`, and `tx_hash` to Loki labels.
+
+**Step 2: Add trace_id to PerfLog entries**
+
+Modify PerfLog so its JSON output includes a `trace_id` field whenever a valid span is active: fetch the current span from the OpenTelemetry runtime context, and if its context is valid, render the trace ID as a 32-character lowercase hex string into the log entry.
+
+**Step 3: Configure Grafana trace-to-logs link**
+
+In the Tempo datasource, set the `tracesToLogs` derived field to link to Loki on the `trace_id` and `tx_hash` tags, with `filterByTraceID: true`.
+
+### 5.8.7 Correlation with Insight/StatsD Metrics
+
+To correlate traces with existing Beast Insight metrics:
+
+**Step 1: Export Insight metrics to Prometheus**
+
+Add a Prometheus scrape job (`prometheus.yaml`) named `xrpld-statsd` targeting the StatsD exporter at `statsd-exporter:9102`.
+
+**Step 2: Add exemplars to metrics**
+
+The OpenTelemetry SDK automatically adds exemplars (trace IDs) to metrics when using the Prometheus exporter, linking metric spikes to specific traces.
+
+**Step 3: Configure Grafana metric-to-trace link**
+
+In the Prometheus datasource, set `exemplarTraceIdDestinations` to map the `trace_id` exemplar to the Tempo datasource.
+
+**Step 4: Dashboard panel with exemplars**
+
+Add a timeseries panel over Prometheus (e.g. `histogram_quantile(0.99, rate(xrpld_rpc_duration_seconds_bucket[5m]))`) with `exemplar: true` enabled.
+
+This allows clicking on metric data points to jump directly to the related trace.
+
+---
+
+_Previous: [Implementation Strategy](./03-implementation-strategy.md)_ | _Next: [Implementation Phases](./06-implementation-phases.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/06-implementation-phases.md

@@ -0,0 +1,575 @@
+# Implementation Phases
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Configuration Reference](./05-configuration-reference.md) | [Observability Backends](./07-observability-backends.md)
+
+---
+
+## 6.1 Phase Overview
+
+> **TxQ** = Transaction Queue
+
+```mermaid
+gantt
+    title OpenTelemetry Implementation Timeline
+    dateFormat  YYYY-MM-DD
+    axisFormat  Week %W
+
+    section Phase 1
+    Core Infrastructure        :p1, 2024-01-01, 2w
+    SDK Integration           :p1a, 2024-01-01, 4d
+    Telemetry Interface       :p1b, after p1a, 3d
+    Configuration & CMake     :p1c, after p1b, 3d
+    Unit Tests                :p1d, after p1c, 2d
+    Buffer & Integration      :p1e, after p1d, 2d
+
+    section Phase 2
+    RPC Tracing               :p2, after p1, 2w
+    HTTP Context Extraction   :p2a, after p1, 2d
+    RPC Handler Instrumentation :p2b, after p2a, 4d
+    PathFinding Instrumentation :p2f, after p2b, 2d
+    TxQ Instrumentation       :p2g, after p2f, 2d
+    WebSocket Support         :p2c, after p2g, 2d
+    Integration Tests         :p2d, after p2c, 2d
+    Buffer & Review           :p2e, after p2d, 4d
+
+    section Phase 3
+    Transaction Tracing       :p3, after p2, 2w
+    Protocol Buffer Extension :p3a, after p2, 2d
+    PeerImp Instrumentation   :p3b, after p3a, 3d
+    Fee Escalation Instrumentation :p3f, after p3b, 2d
+    Relay Context Propagation :p3c, after p3f, 3d
+    Multi-node Tests          :p3d, after p3c, 2d
+    Buffer & Review           :p3e, after p3d, 4d
+
+    section Phase 4
+    Consensus Tracing         :p4, after p3, 2w
+    Consensus Round Spans     :p4a, after p3, 3d
+    Proposal Handling         :p4b, after p4a, 3d
+    Validator List & Manifest Tracing :p4f, after p4b, 2d
+    Amendment Voting Tracing  :p4g, after p4f, 2d
+    SHAMap Sync Tracing       :p4h, after p4g, 2d
+    Validation Tests          :p4c, after p4h, 4d
+    Buffer & Review           :p4e, after p4c, 4d
+
+    section Phase 5
+    Documentation & Deploy    :p5, after p4, 1w
+```
+
+---
+
+## 6.2 Phase 1: Core Infrastructure (Weeks 1-2)
+
+**Objective**: Establish foundational telemetry infrastructure
+
+### Tasks
+
+| Task | Description                                           |
+| ---- | ----------------------------------------------------- |
+| 1.1  | Add OpenTelemetry C++ SDK to Conan/CMake              |
+| 1.2  | Implement `Telemetry` interface and factory           |
+| 1.3  | Implement `SpanGuard` RAII wrapper                    |
+| 1.4  | Implement configuration parser                        |
+| 1.5  | Integrate into `ApplicationImp`                       |
+| 1.6  | Add conditional compilation (`XRPL_ENABLE_TELEMETRY`) |
+| 1.7  | Create `NullTelemetry` no-op implementation           |
+| 1.8  | Unit tests for core infrastructure                    |
+
+### Exit Criteria
+
+- [ ] OpenTelemetry SDK compiles and links
+- [ ] Telemetry can be enabled/disabled via config
+- [ ] Basic span creation works
+- [ ] No performance regression when disabled
+- [ ] Unit tests passing
+
+---
+
+## 6.3 Phase 2: RPC Tracing (Weeks 3-4)
+
+> **TxQ** = Transaction Queue
+
+**Objective**: Complete tracing for all RPC operations
+
+### Tasks
+
+| Task | Description                                                                |
+| ---- | -------------------------------------------------------------------------- |
+| 2.1  | Implement W3C Trace Context HTTP header extraction                         |
+| 2.2  | Instrument `ServerHandler::onRequest()`                                    |
+| 2.3  | Instrument `RPCHandler::doCommand()`                                       |
+| 2.4  | Add RPC-specific attributes                                                |
+| 2.5  | Instrument WebSocket handler                                               |
+| 2.6  | PathFinding instrumentation (`pathfind.request`, `pathfind.compute` spans) |
+| 2.7  | TxQ instrumentation (`txq.enqueue`, `txq.apply` spans)                     |
+| 2.8  | Integration tests for RPC tracing                                          |
+| 2.9  | Performance benchmarks                                                     |
+| 2.10 | Documentation                                                              |
+
+### Exit Criteria
+
+- [ ] All RPC commands traced
+- [ ] Trace context propagates from HTTP headers
+- [ ] WebSocket and HTTP both instrumented
+- [ ] <1ms overhead per RPC call
+- [ ] Integration tests passing
+
+---
+
+## 6.4 Phase 3: Transaction Tracing (Weeks 5-6)
+
+**Objective**: Trace transaction lifecycle across network
+
+### Tasks
+
+| Task | Description                                          |
+| ---- | ---------------------------------------------------- |
+| 3.1  | Define `TraceContext` Protocol Buffer message        |
+| 3.2  | Implement protobuf context serialization             |
+| 3.3  | Instrument `PeerImp::handleTransaction()`            |
+| 3.4  | Instrument `NetworkOPs::submitTransaction()`         |
+| 3.5  | Instrument HashRouter integration                    |
+| 3.6  | Fee escalation instrumentation (`fee.escalate` span) |
+| 3.7  | Implement relay context propagation                  |
+| 3.8  | Integration tests (multi-node)                       |
+| 3.9  | Performance benchmarks                               |
+
+### Exit Criteria
+
+- [ ] Transaction traces span across nodes
+- [ ] Trace context in Protocol Buffer messages
+- [ ] HashRouter deduplication visible in traces
+- [ ] Multi-node integration tests passing
+- [ ] <5% overhead on transaction throughput
+
+---
+
+## 6.5 Phase 4: Consensus Tracing (Weeks 7-8)
+
+**Objective**: Full observability into consensus rounds
+
+### Tasks
+
+| Task | Description                                    |
+| ---- | ---------------------------------------------- |
+| 4.1  | Instrument `RCLConsensusAdaptor::startRound()` |
+| 4.2  | Instrument phase transitions                   |
+| 4.3  | Instrument proposal handling                   |
+| 4.4  | Instrument validation handling                 |
+| 4.5  | Add consensus-specific attributes              |
+| 4.6  | Correlate with transaction traces              |
+| 4.7  | Validator list and manifest tracing            |
+| 4.8  | Amendment voting tracing                       |
+| 4.9  | SHAMap sync tracing                            |
+| 4.10 | Multi-validator integration tests              |
+| 4.11 | Performance validation                         |
+
+### Exit Criteria
+
+- [ ] Complete consensus round traces
+- [ ] Phase transitions visible
+- [ ] Proposals and validations traced
+- [ ] No impact on consensus timing
+- [ ] Multi-validator test network validated
+
+### Implementation Status — Phase 4a Plan
+
+Phase 4a (establish-phase gap fill & cross-node correlation) will add:
+
+- **Deterministic trace ID** derived from `previousLedger.id()` so all validators
+  in the same round share the same `trace_id` (switchable via
+  `consensus_trace_strategy` config: `"deterministic"` or `"attribute"`).
+  See [Configuration Reference](./05-configuration-reference.md) for full
+  configuration options.
+- **Round lifecycle spans**: `consensus.round` with round-to-round span links.
+- **Establish phase**: `consensus.establish`, `consensus.update_positions` (with
+  `dispute.resolve` events), `consensus.check` (with threshold tracking).
+- **Mode changes**: `consensus.mode_change` spans.
+- **Validation**: `consensus.validation.send` with span link to round span
+  (thread-safe cross-thread access via `roundSpanContext_` snapshot).
+- **Separation of concerns**: telemetry extracted to private helpers
+  (`startRoundTracing`, `createValidationSpan`, `startEstablishTracing`,
+  `updateEstablishTracing`, `endEstablishTracing`).
+
+The `Phase4_taskList.md` spec document is introduced in the Phase 2 PR (#6424)
+and will contain the full task breakdown and implementation notes.
+
+---
+
+## 6.6 Phase 5: Documentation & Deployment (Week 9)
+
+**Objective**: Production readiness
+
+### Tasks
+
+| Task | Description                   |
+| ---- | ----------------------------- |
+| 5.1  | Operator runbook              |
+| 5.2  | Grafana dashboards            |
+| 5.3  | Alert definitions             |
+| 5.4  | Collector deployment examples |
+| 5.5  | Developer documentation       |
+| 5.6  | Training materials            |
+| 5.7  | Final integration testing     |
+
+---
+
+## 6.7 Risk Assessment
+
+```mermaid
+quadrantChart
+    title Risk Assessment Matrix
+    x-axis Low Impact --> High Impact
+    y-axis Low Likelihood --> High Likelihood
+    quadrant-1 Mitigate Immediately
+    quadrant-2 Plan Mitigation
+    quadrant-3 Accept Risk
+    quadrant-4 Monitor Closely
+
+    SDK Compat: [0.2, 0.18]
+    Protocol Chg: [0.75, 0.72]
+    Perf Overhead: [0.58, 0.42]
+    Context Prop: [0.4, 0.55]
+    Memory Leaks: [0.85, 0.25]
+```
+
+### Risk Details
+
+| Risk                                 | Likelihood | Impact | Mitigation                              |
+| ------------------------------------ | ---------- | ------ | --------------------------------------- |
+| Protocol changes break compatibility | Medium     | High   | Use high field numbers, optional fields |
+| Performance overhead unacceptable    | Medium     | Medium | Sampling, conditional compilation       |
+| Context propagation complexity       | Medium     | Medium | Phased rollout, extensive testing       |
+| SDK compatibility issues             | Low        | Medium | Pin SDK version, fallback to no-op      |
+| Memory leaks in long-running nodes   | Low        | High   | Memory profiling, bounded queues        |
+
+---
+
+## 6.8 Success Metrics
+
+| Metric                   | Target                                                         | Measurement           |
+| ------------------------ | -------------------------------------------------------------- | --------------------- |
+| Trace coverage           | >95% of transaction code paths (independent of sampling ratio) | Sampling verification |
+| CPU overhead             | <3%                                                            | Benchmark tests       |
+| Memory overhead          | <10 MB                                                         | Memory profiling      |
+| Latency impact (p99)     | <2%                                                            | Performance tests     |
+| Trace completeness       | >99% spans with required attrs                                 | Validation script     |
+| Cross-node trace linkage | >90% of multi-hop transactions                                 | Integration tests     |
+
+---
+
+## 6.9 Quick Wins and Crawl-Walk-Run Strategy
+
+> **TxQ** = Transaction Queue
+
+This section outlines a prioritized approach to maximize ROI with minimal initial investment.
+
+### 6.9.1 Crawl-Walk-Run Overview
+
+<div align="center">
+
+```mermaid
+flowchart TB
+    subgraph crawl["🐢 CRAWL (Week 1-2)"]
+        direction LR
+        c1[Core SDK Setup] ~~~ c2[RPC Tracing Only] ~~~ c3[PathFinding + TxQ Tracing] ~~~ c4[Single Node]
+    end
+
+    subgraph walk["🚶 WALK (Week 3-5)"]
+        direction LR
+        w1[Transaction Tracing] ~~~ w2[Fee Escalation Tracing] ~~~ w3[Cross-Node Context] ~~~ w4[Basic Dashboards]
+    end
+
+    subgraph run["🏃 RUN (Week 6-9)"]
+        direction LR
+        r1[Consensus Tracing] ~~~ r2[Validator, Amendment,<br/>SHAMap Tracing] ~~~ r3[Full Correlation] ~~~ r4[Production Deploy]
+    end
+
+    crawl --> walk --> run
+
+    style crawl fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style walk fill:#bf360c,stroke:#8c2809,color:#fff
+    style run fill:#0d47a1,stroke:#082f6a,color:#fff
+    style c1 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style c2 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style c3 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style c4 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style w1 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style w2 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style w3 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style w4 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style r1 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style r2 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style r3 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style r4 fill:#0d47a1,stroke:#082f6a,color:#fff
+```
+
+</div>
+
+**Reading the diagram:**
+
+- **CRAWL (Weeks 1-2)**: Minimal investment -- set up the SDK, instrument RPC and PathFinding/TxQ handlers, and verify on a single node. Delivers immediate latency visibility.
+- **WALK (Weeks 3-5)**: Expand to transaction lifecycle tracing, fee escalation, cross-node context propagation, and basic Grafana dashboards. This is where distributed tracing starts working.
+- **RUN (Weeks 6-9)**: Full consensus instrumentation, validator/amendment/SHAMap tracing, end-to-end correlation, and production deployment with sampling and alerting.
+- **Arrows (crawl → walk → run)**: Each phase builds on the prior one; you cannot skip ahead because later phases depend on infrastructure established earlier.
+
+### 6.9.2 Quick Wins (Immediate Value)
+
+| Quick Win                      | Value  | When to Deploy |
+| ------------------------------ | ------ | -------------- |
+| **RPC Command Tracing**        | High   | Week 2         |
+| **RPC Latency Histograms**     | High   | Week 2         |
+| **Error Rate Dashboard**       | Medium | Week 2         |
+| **Transaction Submit Tracing** | High   | Week 3         |
+| **Consensus Round Duration**   | Medium | Week 6         |
+
+### 6.9.3 CRAWL Phase (Weeks 1-2)
+
+**Goal**: Get basic tracing working with minimal code changes.
+
+**What You Get**:
+
+- RPC request/response traces for all commands
+- Latency breakdown per RPC command
+- PathFinding and TxQ tracing (directly impacts RPC latency)
+- Error visibility with stack traces
+- Basic Grafana dashboard
+
+**Code Changes**: ~15 lines in `ServerHandler.cpp`, ~40 lines in new telemetry module
+
+**Why Start Here**:
+
+- RPC is the lowest-risk, highest-visibility component
+- PathFinding and TxQ are RPC-adjacent and directly affect latency
+- Immediate value for debugging client issues
+- No cross-node complexity
+- Single file modification to existing code
+
+### 6.9.4 WALK Phase (Weeks 3-5)
+
+**Goal**: Add transaction lifecycle tracing across nodes.
+
+**What You Get**:
+
+- End-to-end transaction traces from submit to relay
+- Fee escalation tracing within the transaction pipeline
+- Cross-node correlation (see transaction path)
+- HashRouter deduplication visibility
+- Relay latency metrics
+
+**Code Changes**: ~120 lines across 4 files, plus protobuf extension
+
+**Why Do This Second**:
+
+- Builds on RPC tracing (transactions submitted via RPC)
+- Fee escalation is integral to the transaction processing pipeline
+- Moderate complexity (requires context propagation)
+- High value for debugging transaction issues
+
+### 6.9.5 RUN Phase (Weeks 6-9)
+
+**Goal**: Full observability including consensus.
+
+**What You Get**:
+
+- Complete consensus round visibility
+- Phase transition timing
+- Validator proposal tracking
+- Validator list and manifest tracing
+- Amendment voting tracing
+- SHAMap sync tracing
+- Full end-to-end traces (client → RPC → TX → consensus → ledger)
+
+**Code Changes**: ~100 lines across 3 consensus files, plus validator/amendment/SHAMap modules
+
+**Why Do This Last**:
+
+- Highest complexity (consensus is critical path)
+- Validator, amendment, and SHAMap components are lower priority
+- Requires thorough testing
+- Lower relative value (consensus issues are rarer)
+
+### 6.9.6 ROI Prioritization Matrix
+
+```mermaid
+quadrantChart
+    title Implementation ROI Matrix
+    x-axis Low Effort --> High Effort
+    y-axis Low Value --> High Value
+    quadrant-1 Quick Wins - Do First
+    quadrant-2 Major Projects - Plan Carefully
+    quadrant-3 Nice to Have - Optional
+    quadrant-4 Time Sinks - Avoid
+
+    RPC Tracing: [0.15, 0.92]
+    TX Submit Trace: [0.3, 0.78]
+    TX Relay Trace: [0.5, 0.88]
+    Consensus Trace: [0.72, 0.72]
+    Peer Msg Trace: [0.85, 0.3]
+    Ledger Acquire: [0.55, 0.52]
+```
+
+---
+
+## 6.10 Definition of Done
+
+> **TxQ** = Transaction Queue | **HA** = High Availability
+
+Clear, measurable criteria for each phase.
+
+### 6.10.1 Phase 1: Core Infrastructure
+
+| Criterion       | Measurement                                                | Target                       |
+| --------------- | ---------------------------------------------------------- | ---------------------------- |
+| SDK Integration | `cmake --build` succeeds with `-DXRPL_ENABLE_TELEMETRY=ON` | ✅ Compiles                  |
+| Runtime Toggle  | `enabled=0` produces zero overhead                         | <0.1% CPU difference         |
+| Span Creation   | Unit test creates and exports span                         | Span appears in Tempo        |
+| Configuration   | All config options parsed correctly                        | Config validation tests pass |
+| Documentation   | Developer guide exists                                     | PR approved                  |
+
+**Definition of Done**: All criteria met, PR merged, no regressions in CI.
+
+### 6.10.2 Phase 2: RPC Tracing
+
+| Criterion          | Measurement                        | Target                     |
+| ------------------ | ---------------------------------- | -------------------------- |
+| Coverage           | All RPC commands instrumented      | 100% of commands           |
+| Context Extraction | traceparent header propagates      | Integration test passes    |
+| Attributes         | Command, status, duration recorded | Validation script confirms |
+| Performance        | RPC latency overhead               | <1ms p99                   |
+| Dashboard          | Grafana dashboard deployed         | Screenshot in docs         |
+
+**Definition of Done**: RPC traces visible in Tempo for all commands, dashboard shows latency distribution.
+
+### 6.10.3 Phase 3: Transaction Tracing
+
+| Criterion        | Measurement                     | Target                             |
+| ---------------- | ------------------------------- | ---------------------------------- |
+| Local Trace      | Submit → validate → TxQ traced  | Single-node test passes            |
+| Cross-Node       | Context propagates via protobuf | Multi-node test passes             |
+| Relay Visibility | relay_count attribute correct   | Spot check 100 txs                 |
+| HashRouter       | Deduplication visible in trace  | Duplicate txs show suppressed=true |
+| Performance      | TX throughput overhead          | <5% degradation                    |
+
+**Definition of Done**: Transaction traces span 3+ nodes in test network, performance within bounds.
+
+### 6.10.4 Phase 4: Consensus Tracing
+
+| Criterion            | Measurement                   | Target                    |
+| -------------------- | ----------------------------- | ------------------------- |
+| Round Tracing        | startRound creates root span  | Unit test passes          |
+| Phase Visibility     | All phases have child spans   | Integration test confirms |
+| Proposer Attribution | Proposer ID in attributes     | Spot check 50 rounds      |
+| Timing Accuracy      | Phase durations match PerfLog | <5% variance              |
+| No Consensus Impact  | Round timing unchanged        | Performance test passes   |
+
+**Definition of Done**: Consensus rounds fully traceable, no impact on consensus timing.
+
+### 6.10.5 Phase 5: Production Deployment
+
+| Criterion    | Measurement                  | Target                     |
+| ------------ | ---------------------------- | -------------------------- |
+| Collector HA | Multiple collectors deployed | No single point of failure |
+| Sampling     | Tail sampling configured     | 10% base + errors + slow   |
+| Retention    | Data retained per policy     | 7 days hot, 30 days warm   |
+| Alerting     | Alerts configured            | Error spike, high latency  |
+| Runbook      | Operator documentation       | Approved by ops team       |
+| Training     | Team trained                 | Session completed          |
+
+**Definition of Done**: Telemetry running in production, operators trained, alerts active.
+
+### 6.10.6 Success Metrics Summary
+
+| Phase   | Primary Metric         | Secondary Metric            | Deadline      |
+| ------- | ---------------------- | --------------------------- | ------------- |
+| Phase 1 | SDK compiles and runs  | Zero overhead when disabled | End of Week 2 |
+| Phase 2 | 100% RPC coverage      | <1ms latency overhead       | End of Week 4 |
+| Phase 3 | Cross-node traces work | <5% throughput impact       | End of Week 6 |
+| Phase 4 | Consensus fully traced | No consensus timing impact  | End of Week 8 |
+| Phase 5 | Production deployment  | Operators trained           | End of Week 9 |
+
+---
+
+## 6.11 Recommended Implementation Order
+
+Based on ROI analysis, implement in this exact order:
+
+```mermaid
+flowchart TB
+    subgraph week1["Week 1"]
+        t1[1. OpenTelemetry SDK<br/>Conan/CMake integration]
+        t2[2. Telemetry interface<br/>SpanGuard, config]
+    end
+
+    subgraph week2["Week 2"]
+        t3[3. RPC ServerHandler<br/>instrumentation]
+        t4[4. Basic Tempo setup<br/>for testing]
+    end
+
+    subgraph week3["Week 3"]
+        t5[5. Transaction submit<br/>tracing]
+        t6[6. Grafana dashboard<br/>v1]
+    end
+
+    subgraph week4["Week 4"]
+        t7[7. Protobuf context<br/>extension]
+        t8[8. PeerImp tx.relay<br/>instrumentation]
+    end
+
+    subgraph week5["Week 5"]
+        t9[9. Multi-node<br/>integration tests]
+        t10[10. Performance<br/>benchmarks]
+    end
+
+    subgraph week6_8["Weeks 6-8"]
+        t11[11. Consensus<br/>instrumentation]
+        t12[12. Full integration<br/>testing]
+    end
+
+    subgraph week9["Week 9"]
+        t13[13. Production<br/>deployment]
+        t14[14. Documentation<br/>& training]
+    end
+
+    t1 --> t2 --> t3 --> t4
+    t4 --> t5 --> t6
+    t6 --> t7 --> t8
+    t8 --> t9 --> t10
+    t10 --> t11 --> t12
+    t12 --> t13 --> t14
+
+    style week1 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style week2 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style week3 fill:#bf360c,stroke:#8c2809,color:#fff
+    style week4 fill:#bf360c,stroke:#8c2809,color:#fff
+    style week5 fill:#bf360c,stroke:#8c2809,color:#fff
+    style week6_8 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style week9 fill:#4a148c,stroke:#2e0d57,color:#fff
+    style t1 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style t2 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style t3 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style t4 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style t5 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t6 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t7 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t8 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t9 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t10 fill:#ffe0b2,stroke:#ffcc80,color:#1e293b
+    style t11 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style t12 fill:#0d47a1,stroke:#082f6a,color:#fff
+    style t13 fill:#4a148c,stroke:#2e0d57,color:#fff
+    style t14 fill:#4a148c,stroke:#2e0d57,color:#fff
+```
+
+**Reading the diagram:**
+
+- **Week 1 (tasks 1-2)**: Foundation work -- integrate the OpenTelemetry SDK via Conan/CMake and build the `Telemetry` interface with `SpanGuard` and config parsing.
+- **Week 2 (tasks 3-4)**: First observable output -- instrument `ServerHandler` for RPC tracing and stand up Tempo so developers can see traces immediately.
+- **Weeks 3-5 (tasks 5-10)**: Transaction lifecycle -- add submit tracing, build the first Grafana dashboard, extend protobuf for cross-node context, instrument `PeerImp` relay, then validate with multi-node integration tests and performance benchmarks.
+- **Weeks 6-8 (tasks 11-12)**: Consensus deep-dive -- instrument consensus rounds and phases, then run full integration testing across all instrumented paths.
+- **Week 9 (tasks 13-14)**: Go-live -- deploy to production with sampling/alerting configured, and deliver documentation and operator training.
+- **Arrow chain (t1 → ... → t14)**: Strict sequential dependency; each task's output is a prerequisite for the next.
+
+---
+
+_Previous: [Configuration Reference](./05-configuration-reference.md)_ | _Next: [Observability Backends](./07-observability-backends.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/07-observability-backends.md

@@ -0,0 +1,407 @@
+# Observability Backend Recommendations
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Implementation Phases](./06-implementation-phases.md) | [Appendix](./08-appendix.md)
+
+---
+
+## 7.1 Development/Testing Backends
+
+> **OTLP** = OpenTelemetry Protocol
+
+| Backend    | Pros                                | Cons                   | Use Case            |
+| ---------- | ----------------------------------- | ---------------------- | ------------------- |
+| **Tempo**  | Cost-effective, Grafana integration | Requires Grafana stack | Local dev, CI, Prod |
+| **Zipkin** | Simple, lightweight                 | Basic features         | Quick prototyping   |
+
+### Quick Start with Tempo
+
+```bash
+# Start Tempo with OTLP support
+docker run -d --name tempo \
+    -p 3200:3200 \
+    -p 4317:4317 \
+    -p 4318:4318 \
+    grafana/tempo:2.6.1
+```
+
+---
+
+## 7.2 Production Backends
+
+> **APM** = Application Performance Monitoring
+
+| Backend           | Pros                                      | Cons                   | Use Case                    |
+| ----------------- | ----------------------------------------- | ---------------------- | --------------------------- |
+| **Grafana Tempo** | Cost-effective, Grafana integration       | Requires Grafana stack | Most production deployments |
+| **Elastic APM**   | Full observability stack, log correlation | Resource intensive     | Existing Elastic users      |
+| **Honeycomb**     | Excellent query, high cardinality         | SaaS cost              | Deep debugging needs        |
+| **Datadog APM**   | Full platform, easy setup                 | SaaS cost              | Enterprise with budget      |
+
+### Backend Selection Flowchart
+
+```mermaid
+flowchart TD
+    start[Select Backend] --> budget{Budget<br/>Constraints?}
+
+    budget -->|Yes| oss[Open Source]
+    budget -->|No| saas{Prefer<br/>SaaS?}
+
+    oss --> existing{Existing<br/>Stack?}
+    existing -->|Grafana| tempo[Grafana Tempo]
+    existing -->|Elastic| elastic[Elastic APM]
+    existing -->|None| tempo
+
+    saas -->|Yes| enterprise{Enterprise<br/>Support?}
+    saas -->|No| oss
+
+    enterprise -->|Yes| datadog[Datadog APM]
+    enterprise -->|No| honeycomb[Honeycomb]
+
+    tempo --> final[Configure Collector]
+    elastic --> final
+    honeycomb --> final
+    datadog --> final
+
+    style start fill:#0f172a,stroke:#020617,color:#fff
+    style budget fill:#334155,stroke:#1e293b,color:#fff
+    style oss fill:#1e293b,stroke:#0f172a,color:#fff
+    style existing fill:#334155,stroke:#1e293b,color:#fff
+    style saas fill:#334155,stroke:#1e293b,color:#fff
+    style enterprise fill:#334155,stroke:#1e293b,color:#fff
+    style final fill:#0f172a,stroke:#020617,color:#fff
+    style tempo fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style elastic fill:#bf360c,stroke:#8c2809,color:#fff
+    style honeycomb fill:#0d47a1,stroke:#082f6a,color:#fff
+    style datadog fill:#4a148c,stroke:#2e0d57,color:#fff
+```
+
+**Reading the diagram:**
+
+- **Budget Constraints? (Yes)**: Leads to open-source options. If you already run Grafana or Elastic, pick the matching backend; otherwise default to Grafana Tempo.
+- **Budget Constraints? (No) → Prefer SaaS?**: If you want a managed service, choose between Datadog (enterprise support) and Honeycomb (developer-focused). If not, fall back to open-source.
+- **Terminal nodes (Tempo / Elastic / Honeycomb / Datadog)**: Each represents a concrete backend choice, all of which feed into the same final step.
+- **Configure Collector**: Regardless of backend, you always finish by configuring the OTel Collector to export to your chosen destination.
+
+---
+
+## 7.3 Recommended Production Architecture
+
+> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring | **HA** = High Availability
+
+```mermaid
+flowchart TB
+    subgraph validators["Validator Nodes"]
+        v1[xrpld<br/>Validator 1]
+        v2[xrpld<br/>Validator 2]
+    end
+
+    subgraph stock["Stock Nodes"]
+        s1[xrpld<br/>Stock 1]
+        s2[xrpld<br/>Stock 2]
+    end
+
+    subgraph collector["OTel Collector Cluster"]
+        c1[Collector<br/>DC1]
+        c2[Collector<br/>DC2]
+    end
+
+    subgraph backends["Storage Backends"]
+        tempo[(Grafana<br/>Tempo)]
+        elastic[(Elastic<br/>APM)]
+        archive[(S3/GCS<br/>Archive)]
+    end
+
+    subgraph ui["Visualization"]
+        grafana[Grafana<br/>Dashboards]
+    end
+
+    v1 -->|OTLP| c1
+    v2 -->|OTLP| c1
+    s1 -->|OTLP| c2
+    s2 -->|OTLP| c2
+
+    c1 --> tempo
+    c1 --> elastic
+    c2 --> tempo
+    c2 --> archive
+
+    tempo --> grafana
+    elastic --> grafana
+
+    %% Note: simplified single-collector-per-DC topology shown for clarity
+
+    style validators fill:#b71c1c,stroke:#7f1d1d,color:#ffffff
+    style stock fill:#0d47a1,stroke:#082f6a,color:#ffffff
+    style collector fill:#bf360c,stroke:#8c2809,color:#ffffff
+    style backends fill:#1b5e20,stroke:#0d3d14,color:#ffffff
+    style ui fill:#4a148c,stroke:#2e0d57,color:#ffffff
+```
+
+**Reading the diagram:**
+
+- **Validator / Stock Nodes**: All xrpld nodes emit trace data via OTLP. Validators and stock nodes are grouped separately because they may reside in different network zones.
+- **Collector Cluster (DC1, DC2)**: Regional collectors receive OTLP from nodes in their datacenter, apply processing (sampling, enrichment), and fan out to multiple backends. Enrichment includes deployment-tier tagging: each collector stamps `deployment.environment` and (as a fallback) `xrpl.network.type` so one Grafana stack can filter data from many collectors by tier.
+- **Storage Backends**: Tempo and Elastic provide queryable trace storage; S3/GCS Archive provides long-term cold storage for compliance or post-incident analysis.
+- **Grafana Dashboards**: The single visualization layer that queries both Tempo and Elastic, giving operators a unified view of all traces.
+- **Data flow direction**: Nodes → Collectors → Storage → Grafana. Each arrow represents a network hop; minimizing collector-to-backend hops reduces latency.
+
+> **Note**: Production deployments should use multiple collector instances behind a load balancer for high availability. The diagram shows a simplified single-collector topology for clarity.
+
+---
+
+## 7.4 Architecture Considerations
+
+### 7.4.1 Collector Placement
+
+| Strategy      | Description          | Pros                     | Cons                    |
+| ------------- | -------------------- | ------------------------ | ----------------------- |
+| **Sidecar**   | Collector per node   | Isolation, simple config | Resource overhead       |
+| **DaemonSet** | Collector per host   | Shared resources         | Complexity              |
+| **Gateway**   | Central collector(s) | Centralized processing   | Single point of failure |
+
+**Recommendation**: Use **Gateway** pattern with regional collectors for xrpld networks:
+
+- One collector cluster per datacenter/region
+- Tail-based sampling at collector level
+- Multiple export destinations for redundancy
+
+### 7.4.2 Sampling Strategy
+
+```mermaid
+flowchart LR
+    subgraph head["Head Sampling (Node)"]
+        hs[Node-level head sampling<br/>fixed at 100%<br/>not configurable]
+    end
+
+    subgraph tail["Tail Sampling (Collector)"]
+        ts1[Keep all errors]
+        ts2[Keep slow >5s]
+        ts3[Keep 10% rest]
+    end
+
+    head --> tail
+
+    ts1 --> final[Final Traces]
+    ts2 --> final
+    ts3 --> final
+
+    style head fill:#0d47a1,stroke:#082f6a,color:#fff
+    style tail fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style hs fill:#0d47a1,stroke:#082f6a,color:#fff
+    style ts1 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style ts2 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style ts3 fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style final fill:#bf360c,stroke:#8c2809,color:#fff
+```
+
+**Reading the diagram:**
+
+- **Head Sampling (Node)**: xrpld pins head sampling at 100% (sample everything) and does not expose a configurable ratio. This is intentional: a per-node ratio would let different nodes make divergent keep/drop decisions for the same distributed trace, producing broken/partial traces. xrpld uses a `ParentBased` sampler so spans inheriting a remote parent honor the upstream decision. Volume reduction is delegated to the collector's tail sampling.
+- **Tail Sampling (Collector)**: The second filter -- the collector inspects completed traces and applies rules: keep all errors, keep anything slower than 5 seconds, and keep 10% of the remainder.
+- **Arrow head → tail**: All head-sampled traces flow to the collector, where tail sampling further reduces volume while preserving the most valuable data.
+- **Final Traces**: The output after both sampling stages; this is what gets stored and queried. The two-stage approach balances cost with debuggability.
+
+### 7.4.3 Data Retention
+
+| Environment | Hot Storage | Warm Storage | Cold Archive |
+| ----------- | ----------- | ------------ | ------------ |
+| Development | 24 hours    | N/A          | N/A          |
+| Staging     | 7 days      | N/A          | N/A          |
+| Production  | 7 days      | 30 days      | many years   |
+
+---
+
+## 7.5 Integration Checklist
+
+- [ ] Choose primary backend (Tempo recommended for cost/features)
+- [ ] Deploy collector cluster with high availability
+- [ ] Configure tail-based sampling for error/latency traces
+- [ ] Set up Grafana dashboards for trace visualization
+- [ ] Configure alerts for trace anomalies
+- [ ] Establish data retention policies
+- [ ] Test trace correlation with logs and metrics
+
+---
+
+## 7.6 Grafana Dashboard Examples
+
+Pre-built dashboards for xrpld observability.
+
+### 7.6.1 Consensus Health Dashboard
+
+A Tempo-backed dashboard (uid `xrpld-consensus-health`) with four panels, all driven by TraceQL:
+
+- **Consensus Round Duration** (timeseries, ms): average `consensus.round` span duration per node instance, with yellow/red thresholds at 4s/5s.
+- **Phase Duration Breakdown** (barchart): average duration of `consensus.phase.*` spans grouped by span name.
+- **Proposers per Round** (stat): average of the `span.proposers` attribute on `consensus.round` spans.
+- **Recent Slow Rounds (>5s)** (table): `consensus.round` spans filtered to `duration > 5s`.
+
+Each panel's TraceQL query is described inline in its bullet above.
+
+### 7.6.2 Node Overview Dashboard
+
+A Tempo-backed dashboard (uid `xrpld-node-overview`) with four panels:
+
+- **Active Nodes** (stat): count of distinct `resource.service.instance.id` values seen for the `xrpld` service.
+- **Total Transactions (1h)** (stat): count of `tx.receive` spans.
+- **Error Rate** (gauge, percent): ratio of `status.code=error` spans to all spans, with yellow/red thresholds at 1%/5%.
+- **Service Map** (nodeGraph): Tempo-generated service dependency graph.
+
+### 7.6.3 Alert Rules
+
+Grafana provisions three TraceQL-based alert rules (group `xrpld-tracing-alerts`, evaluated every 1m) against the Tempo datasource:
+
+- **Consensus Round Slow** (warning, `for: 5m`): fires when average `consensus.round` duration exceeds 5s.
+
+  ```
+  {resource.service.name="xrpld" && name="consensus.round"} | avg(duration) > 5s
+  ```
+
+- **RPC Error Rate Spike** (critical, `for: 2m`): fires when the error rate across `rpc.command.*` spans exceeds 5%. Error _rate_ is a ratio, so it must divide the error-span rate by the total-span rate — a single TraceQL `rate()` returns spans/second, not a percentage, and would fire on traffic volume alone. This uses span metrics emitted by the collector's `spanmetrics` connector (Prometheus datasource), not a TraceQL query:
+
+  ```
+  sum(rate(traces_spanmetrics_calls_total{service_name="xrpld", span_name=~"rpc.command.*", status_code="STATUS_CODE_ERROR"}[5m]))
+  /
+  sum(rate(traces_spanmetrics_calls_total{service_name="xrpld", span_name=~"rpc.command.*"}[5m]))
+  > 0.05
+  ```
+
+- **Transaction Throughput Drop** (warning, `for: 10m`): fires when the `tx.receive` span rate falls below 10/s.
+
+  ```
+  {resource.service.name="xrpld" && name="tx.receive"} | rate() < 10
+  ```
+
+> **Note**: The Consensus Round Slow and Transaction Throughput Drop rules use TraceQL aggregates (`avg(duration)`, `rate()`), which require Tempo 2.3+ with TraceQL metrics enabled. Verify aggregate query support in your Tempo version before provisioning. The RPC Error Rate Spike rule instead queries Prometheus span metrics (collector `spanmetrics` connector), so it needs that connector enabled in the collector pipeline.
+
+---
+
+## 7.7 PerfLog and Insight Correlation
+
+> **OTLP** = OpenTelemetry Protocol
+
+How to correlate OpenTelemetry traces with existing xrpld observability.
+
+### 7.7.1 Correlation Architecture
+
+```mermaid
+flowchart TB
+    subgraph xrpld["xrpld Node"]
+        otel[OpenTelemetry<br/>Spans]
+        perflog[PerfLog<br/>JSON Logs]
+        insight[Beast Insight<br/>StatsD Metrics]
+    end
+
+    subgraph collectors["Data Collection"]
+        otelc[OTel Collector]
+        promtail[Promtail/Fluentd]
+        statsd[StatsD Exporter]
+    end
+
+    subgraph storage["Storage"]
+        tempo[(Tempo)]
+        loki[(Loki)]
+        prom[(Prometheus)]
+    end
+
+    subgraph grafana["Grafana"]
+        traces[Trace View]
+        logs[Log View]
+        metrics[Metrics View]
+        corr[Correlation<br/>Panel]
+    end
+
+    otel -->|OTLP| otelc --> tempo
+    perflog -->|JSON| promtail --> loki
+    insight -->|StatsD| statsd --> prom
+
+    tempo --> traces
+    loki --> logs
+    prom --> metrics
+
+    traces --> corr
+    logs --> corr
+    metrics --> corr
+
+    style xrpld fill:#0d47a1,stroke:#082f6a,color:#fff
+    style collectors fill:#bf360c,stroke:#8c2809,color:#fff
+    style storage fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style grafana fill:#4a148c,stroke:#2e0d57,color:#fff
+    style otel fill:#0d47a1,stroke:#082f6a,color:#fff
+    style perflog fill:#0d47a1,stroke:#082f6a,color:#fff
+    style insight fill:#0d47a1,stroke:#082f6a,color:#fff
+    style otelc fill:#bf360c,stroke:#8c2809,color:#fff
+    style promtail fill:#bf360c,stroke:#8c2809,color:#fff
+    style statsd fill:#bf360c,stroke:#8c2809,color:#fff
+    style tempo fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style loki fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style prom fill:#1b5e20,stroke:#0d3d14,color:#fff
+    style traces fill:#4a148c,stroke:#2e0d57,color:#fff
+    style logs fill:#4a148c,stroke:#2e0d57,color:#fff
+    style metrics fill:#4a148c,stroke:#2e0d57,color:#fff
+    style corr fill:#4a148c,stroke:#2e0d57,color:#fff
+```
+
+**Reading the diagram:**
+
+- **xrpld Node (three sources)**: A single node emits three independent data streams -- OpenTelemetry spans, PerfLog JSON logs, and Beast Insight StatsD metrics.
+- **Data Collection layer**: Each stream has its own collector -- OTel Collector for spans, Promtail/Fluentd for logs, and a StatsD exporter for metrics. They operate independently.
+- **Storage layer (Tempo, Loki, Prometheus)**: Each data type lands in a purpose-built store optimized for its query patterns (trace search, log grep, metric aggregation).
+- **Grafana Correlation Panel**: The key integration point -- Grafana queries all three stores and links them via shared fields (`trace_id`, `tx_hash`, `ledger_seq`), enabling a single-pane debugging experience.
+
+### 7.7.2 Correlation Fields
+
+| Source      | Field               | Link To       | Purpose                    |
+| ----------- | ------------------- | ------------- | -------------------------- |
+| **Trace**   | `trace_id`          | Logs          | Find log entries for trace |
+| **Trace**   | `tx_hash`           | Logs, Metrics | Find TX-related data       |
+| **Trace**   | `ledger_seq`        | Logs          | Find ledger-related logs   |
+| **PerfLog** | `trace_id` (new)    | Traces        | Jump to trace from log     |
+| **PerfLog** | `ledger_seq`        | Traces        | Find consensus trace       |
+| **Insight** | `exemplar.trace_id` | Traces        | Jump from metric spike     |
+
+### 7.7.3 Example: Debugging a Slow Transaction
+
+**Step 1: Find the trace**
+
+```
+# In Grafana Explore with Tempo
+{resource.service.name="xrpld" && span.tx_hash="ABC123..."}
+```
+
+**Step 2: Get the trace_id from the trace view**
+
+```
+Trace ID: 4bf92f3577b34da6a3ce929d0e0e4736
+```
+
+**Step 3: Find related PerfLog entries**
+
+```
+# In Grafana Explore with Loki
+{job="xrpld"} |= "4bf92f3577b34da6a3ce929d0e0e4736"
+```
+
+**Step 4: Check Insight metrics for the time window**
+
+```
+# In Grafana with Prometheus
+rate(xrpld_tx_applied_total[1m])
+  @ timestamp_from_trace
+```
+
+### 7.7.4 Unified Dashboard Example
+
+A single dashboard (uid `xrpld-unified`) that ties traces, metrics, and logs together across the Tempo, Prometheus, and Loki datasources:
+
+- **Transaction Latency (Traces)** (timeseries, Tempo): `histogram_over_time(duration)` of `tx.receive` spans.
+- **Transaction Rate (Metrics)** (timeseries, Prometheus): `rate(xrpld_tx_received_total[5m])` per instance, with a data link that opens the matching `tx.receive` traces in Tempo.
+- **Recent Logs** (logs, Loki): `{job="xrpld"} | json`.
+- **Trace Search** (table, Tempo): all `xrpld` traces, with per-row data links on `traceID` that jump to the trace in Tempo and to the correlated logs in Loki (`{job="xrpld"} |= "<traceID>"`).
+
+The cross-datasource data links are what make this a single-pane debugging view; the correlation fields they rely on are listed in section 7.7.2.
+
+---
+
+_Previous: [Implementation Phases](./06-implementation-phases.md)_ | _Next: [Appendix](./08-appendix.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/08-appendix.md

@@ -0,0 +1,187 @@
+# Appendix
+
+> **Parent Document**: [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)
+> **Related**: [Observability Backends](./07-observability-backends.md)
+
+---
+
+## 8.1 Glossary
+
+> **OTLP** = OpenTelemetry Protocol | **TxQ** = Transaction Queue
+
+| Term                  | Definition                                                 |
+| --------------------- | ---------------------------------------------------------- |
+| **Span**              | A unit of work with start/end time, name, and attributes   |
+| **Trace**             | A collection of spans representing a complete request flow |
+| **Trace ID**          | 128-bit unique identifier for a trace                      |
+| **Span ID**           | 64-bit unique identifier for a span within a trace         |
+| **Context**           | Carrier for trace/span IDs across boundaries               |
+| **Propagator**        | Component that injects/extracts context                    |
+| **Sampler**           | Decides which traces to record                             |
+| **Exporter**          | Sends spans to backend                                     |
+| **Collector**         | Receives, processes, and forwards telemetry                |
+| **OTLP**              | OpenTelemetry Protocol (wire format)                       |
+| **W3C Trace Context** | Standard HTTP headers for trace propagation                |
+| **Baggage**           | Key-value pairs propagated across service boundaries       |
+| **Resource**          | Entity producing telemetry (service, host, etc.)           |
+| **Instrumentation**   | Code that creates telemetry data                           |
+
+### xrpld-Specific Terms
+
+| Term              | Definition                                                    |
+| ----------------- | ------------------------------------------------------------- |
+| **Overlay**       | P2P network layer managing peer connections                   |
+| **Consensus**     | XRP Ledger consensus algorithm (RCL)                          |
+| **Proposal**      | Validator's suggested transaction set for a ledger            |
+| **Validation**    | Validator's signature on a closed ledger                      |
+| **HashRouter**    | Component for transaction deduplication                       |
+| **JobQueue**      | Thread pool for asynchronous task execution                   |
+| **PerfLog**       | Existing performance logging system in xrpld                  |
+| **Beast Insight** | Existing metrics framework in xrpld                           |
+| **PathFinding**   | Payment path computation engine for cross-currency payments   |
+| **TxQ**           | Transaction queue managing fee-based prioritization           |
+| **LoadManager**   | Dynamic fee escalation based on network load                  |
+| **SHAMap**        | SHA-256 hash-based map (Merkle trie variant) for ledger state |
+
+---
+
+## 8.2 Span Hierarchy Visualization
+
+> **TxQ** = Transaction Queue
+
+```mermaid
+flowchart TB
+    subgraph trace["Trace: Transaction Lifecycle"]
+        rpc["rpc.request<br/>(entry point)"]
+        validate["tx.validate"]
+        relay["tx.relay<br/>(parent span)"]
+
+        subgraph peers["Peer Spans"]
+            p1["peer.send<br/>Peer A"]
+            p2["peer.send<br/>Peer B"]
+            p3["peer.send<br/>Peer C"]
+        end
+
+        subgraph pathfinding["PathFinding Spans"]
+            pathfind["pathfind.request"]
+            pathcomp["pathfind.compute"]
+        end
+
+        consensus["consensus.round"]
+        apply["tx.apply"]
+
+        subgraph txqueue["TxQ Spans"]
+            txq["txq.enqueue"]
+            txqApply["txq.apply"]
+        end
+
+        feeCalc["fee.escalate"]
+    end
+
+    subgraph validators["Validator Spans"]
+        valFetch["validator.list.fetch"]
+        valManifest["validator.manifest"]
+    end
+
+    rpc --> validate
+    rpc --> pathfind
+    pathfind --> pathcomp
+    validate --> relay
+    relay --> p1
+    relay --> p2
+    relay --> p3
+    p1 -.->|"context propagation"| consensus
+    consensus --> apply
+    apply --> txq
+    txq --> txqApply
+    txq --> feeCalc
+
+    style trace fill:#0f172a,stroke:#020617,color:#fff
+    style peers fill:#1e3a8a,stroke:#172554,color:#fff
+    style pathfinding fill:#134e4a,stroke:#0f766e,color:#fff
+    style txqueue fill:#064e3b,stroke:#047857,color:#fff
+    style validators fill:#4c1d95,stroke:#6d28d9,color:#fff
+    style rpc fill:#1d4ed8,stroke:#1e40af,color:#fff
+    style validate fill:#047857,stroke:#064e3b,color:#fff
+    style relay fill:#047857,stroke:#064e3b,color:#fff
+    style p1 fill:#0e7490,stroke:#155e75,color:#fff
+    style p2 fill:#0e7490,stroke:#155e75,color:#fff
+    style p3 fill:#0e7490,stroke:#155e75,color:#fff
+    style consensus fill:#fef3c7,stroke:#fde68a,color:#1e293b
+    style apply fill:#047857,stroke:#064e3b,color:#fff
+    style pathfind fill:#0e7490,stroke:#155e75,color:#fff
+    style pathcomp fill:#0e7490,stroke:#155e75,color:#fff
+    style txq fill:#047857,stroke:#064e3b,color:#fff
+    style txqApply fill:#047857,stroke:#064e3b,color:#fff
+    style feeCalc fill:#047857,stroke:#064e3b,color:#fff
+    style valFetch fill:#6d28d9,stroke:#4c1d95,color:#fff
+    style valManifest fill:#6d28d9,stroke:#4c1d95,color:#fff
+```
+
+**Reading the diagram:**
+
+- **rpc.request (blue, top)**: The entry point — every traced transaction starts as an RPC call; this root span is the parent of all downstream work.
+- **tx.validate and pathfind.request (green/teal, first fork)**: The RPC request fans out into transaction validation and, for cross-currency payments, a PathFinding branch (`pathfind.request` -> `pathfind.compute`).
+- **tx.relay -> Peer Spans (teal, middle)**: After validation, the transaction is relayed to peers A, B, and C in parallel; each `peer.send` is a sibling child span showing fan-out across the network.
+- **context propagation (dashed arrow)**: The dotted line from `peer.send Peer A` to `consensus.round` represents the trace context crossing a node boundary — the receiving validator picks up the same `trace_id` and continues the trace.
+- **consensus.round -> tx.apply -> TxQ Spans (green, lower)**: Once consensus accepts the transaction, it is applied to the ledger; the TxQ spans (`txq.enqueue`, `txq.apply`, `fee.escalate`) capture queue depth and fee escalation behavior.
+- **Validator Spans (purple, detached)**: `validator.list.fetch` and `validator.manifest` are independent workflows for UNL management — they run on their own traces and are linked to consensus via Span Links, not parent-child relationships.
+
+---
+
+## 8.3 References
+
+> **OTLP** = OpenTelemetry Protocol
+
+### OpenTelemetry Resources
+
+1. [OpenTelemetry C++ SDK](https://github.com/open-telemetry/opentelemetry-cpp)
+2. [OpenTelemetry Specification](https://opentelemetry.io/docs/specs/otel/)
+3. [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/)
+4. [OTLP Protocol Specification](https://opentelemetry.io/docs/specs/otlp/)
+
+### Standards
+
+5. [W3C Trace Context](https://www.w3.org/TR/trace-context/)
+6. [W3C Baggage](https://www.w3.org/TR/baggage/)
+7. [Protocol Buffers](https://protobuf.dev/)
+
+### xrpld Resources
+
+8. [xrpld Source Code](https://github.com/XRPLF/rippled)
+9. [XRP Ledger Documentation](https://xrpl.org/docs/)
+10. [xrpld Overlay README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/overlay/README.md)
+11. [xrpld RPC README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/rpc/README.md)
+12. [xrpld Consensus README](https://github.com/XRPLF/rippled/blob/develop/src/xrpld/app/consensus/README.md)
+
+---
+
+## 8.4 Version History
+
+| Version | Date       | Author | Changes                                                        |
+| ------- | ---------- | ------ | -------------------------------------------------------------- |
+| 1.0     | 2026-02-12 | -      | Initial implementation plan                                    |
+| 1.1     | 2026-02-13 | -      | Refactored into modular documents                              |
+| 1.2     | 2026-03-24 | -      | Review fixes: accuracy corrections, cross-document consistency |
+
+---
+
+## 8.5 Document Index
+
+### Plan Documents
+
+| Document                                                         | Description                                  |
+| ---------------------------------------------------------------- | -------------------------------------------- |
+| [OpenTelemetryPlan.md](./OpenTelemetryPlan.md)                   | Master overview and executive summary        |
+| [00-tracing-fundamentals.md](./00-tracing-fundamentals.md)       | Distributed tracing concepts and OTel primer |
+| [01-architecture-analysis.md](./01-architecture-analysis.md)     | xrpld architecture and trace points          |
+| [02-design-decisions.md](./02-design-decisions.md)               | SDK selection, exporters, span conventions   |
+| [03-implementation-strategy.md](./03-implementation-strategy.md) | Directory structure, performance analysis    |
+| [05-configuration-reference.md](./05-configuration-reference.md) | xrpld config, CMake, Collector configs       |
+| [06-implementation-phases.md](./06-implementation-phases.md)     | Timeline, tasks, risks, success metrics      |
+| [07-observability-backends.md](./07-observability-backends.md)   | Backend selection and architecture           |
+| [08-appendix.md](./08-appendix.md)                               | Glossary, references, version history        |
+
+---
+
+_Previous: [Observability Backends](./07-observability-backends.md)_ | _Back to: [Overview](./OpenTelemetryPlan.md)_

OpenTelemetryPlan/OpenTelemetryPlan.md

@@ -0,0 +1,199 @@
+# [OpenTelemetry](00-tracing-fundamentals.md) Distributed Tracing Implementation Plan for xrpld
+
+## Executive Summary
+
+> **OTLP** = OpenTelemetry Protocol
+
+This document provides a comprehensive implementation plan for integrating OpenTelemetry distributed tracing into the xrpld XRP Ledger node software. The plan addresses the unique challenges of a decentralized peer-to-peer system where trace context must propagate across network boundaries between independent nodes.
+
+### Key Benefits
+
+- **End-to-end transaction visibility**: Track transactions from submission through consensus to ledger inclusion
+- **Consensus round analysis**: Understand timing and behavior of consensus phases across validators
+- **RPC performance insights**: Identify slow handlers and optimize response times
+- **Network topology understanding**: Visualize message propagation patterns between peers
+- **Incident debugging**: Correlate events across distributed nodes during issues
+
+### Estimated Performance Overhead
+
+| Metric        | Overhead   | Notes                                            |
+| ------------- | ---------- | ------------------------------------------------ |
+| CPU           | 1-3%       | Span creation and attribute setting              |
+| Memory        | <10 MB     | SDK statics + batch buffer + worker thread stack |
+| Network       | 10-50 KB/s | Compressed OTLP export to collector              |
+| Latency (p99) | <2%        | With proper sampling configuration               |
+
+---
+
+## Document Structure
+
+This implementation plan is organized into modular documents for easier navigation:
+
+<div align="center">
+
+```mermaid
+flowchart TB
+    overview["📋 OpenTelemetryPlan.md<br/>(This Document)"]
+
+    subgraph fundamentals["Fundamentals"]
+        fund["00-tracing-fundamentals.md"]
+    end
+
+    subgraph analysis["Analysis & Design"]
+        arch["01-architecture-analysis.md"]
+        design["02-design-decisions.md"]
+    end
+
+    subgraph impl["Implementation"]
+        strategy["03-implementation-strategy.md"]
+        config["05-configuration-reference.md"]
+    end
+
+    subgraph deploy["Deployment & Planning"]
+        phases["06-implementation-phases.md"]
+        backends["07-observability-backends.md"]
+        appendix["08-appendix.md"]
+    end
+
+    overview --> fundamentals
+    overview --> analysis
+    overview --> impl
+    overview --> deploy
+
+    fund --> arch
+    arch --> design
+    design --> strategy
+    strategy --> config
+    config --> phases
+    phases --> backends
+    backends --> appendix
+
+    style overview fill:#1b5e20,stroke:#0d3d14,color:#fff,stroke-width:2px
+    style fundamentals fill:#00695c,stroke:#004d40,color:#fff
+    style fund fill:#00695c,stroke:#004d40,color:#fff
+    style analysis fill:#0d47a1,stroke:#082f6a,color:#fff
+    style impl fill:#bf360c,stroke:#8c2809,color:#fff
+    style deploy fill:#4a148c,stroke:#2e0d57,color:#fff
+    style arch fill:#0d47a1,stroke:#082f6a,color:#fff
+    style design fill:#0d47a1,stroke:#082f6a,color:#fff
+    style strategy fill:#bf360c,stroke:#8c2809,color:#fff
+    style config fill:#bf360c,stroke:#8c2809,color:#fff
+    style phases fill:#4a148c,stroke:#2e0d57,color:#fff
+    style backends fill:#4a148c,stroke:#2e0d57,color:#fff
+    style appendix fill:#4a148c,stroke:#2e0d57,color:#fff
+```
+
+</div>
+
+---
+
+## Table of Contents
+
+| Section | Document                                                   | Description                                                            |
+| ------- | ---------------------------------------------------------- | ---------------------------------------------------------------------- |
+| **0**   | [Tracing Fundamentals](./00-tracing-fundamentals.md)       | Distributed tracing concepts, span relationships, context propagation  |
+| **1**   | [Architecture Analysis](./01-architecture-analysis.md)     | xrpld component analysis, trace points, instrumentation priorities     |
+| **2**   | [Design Decisions](./02-design-decisions.md)               | SDK selection, exporters, span naming, attributes, context propagation |
+| **3**   | [Implementation Strategy](./03-implementation-strategy.md) | Directory structure, key principles, performance optimization          |
+| **5**   | [Configuration Reference](./05-configuration-reference.md) | xrpld config, CMake integration, Collector configurations              |
+| **6**   | [Implementation Phases](./06-implementation-phases.md)     | 5-phase timeline, tasks, risks, success metrics                        |
+| **7**   | [Observability Backends](./07-observability-backends.md)   | Backend selection guide and production architecture                    |
+| **8**   | [Appendix](./08-appendix.md)                               | Glossary, references, version history                                  |
+
+---
+
+## 0. Tracing Fundamentals
+
+This document introduces distributed tracing concepts for readers unfamiliar with the domain. It covers what traces and spans are, how parent-child and follows-from relationships model causality, how context propagates across service boundaries, and how sampling controls data volume. It also maps these concepts to xrpld-specific scenarios like transaction relay and consensus.
+
+➡️ **[Read Tracing Fundamentals](./00-tracing-fundamentals.md)**
+
+---
+
+## 1. Architecture Analysis
+
+> **WS** = WebSocket | **TxQ** = Transaction Queue
+
+The xrpld node consists of several key components that require instrumentation for comprehensive distributed tracing. The main areas include the RPC server (HTTP/WebSocket), Overlay P2P network, Consensus mechanism (RCLConsensus), JobQueue for async task execution, PathFinding, Transaction Queue (TxQ), fee escalation (LoadManager), ledger acquisition, validator management, and existing observability infrastructure (PerfLog, Insight/StatsD, Journal logging).
+
+Key trace points span across transaction submission via RPC, peer-to-peer message propagation, consensus round execution, ledger building, path computation, transaction queue behavior, fee escalation, and validator health. The implementation prioritizes high-value, low-risk components first: RPC handlers provide immediate value with minimal risk, while consensus tracing requires careful implementation to avoid timing impacts.
+
+➡️ **[Read full Architecture Analysis](./01-architecture-analysis.md)**
+
+---
+
+## 2. Design Decisions
+
+> **OTLP** = OpenTelemetry Protocol | **CNCF** = Cloud Native Computing Foundation
+
+The OpenTelemetry C++ SDK is selected for its CNCF backing, active development, and native performance characteristics. Traces are exported via OTLP/HTTP to an OpenTelemetry Collector, which provides flexible routing and sampling. OTLP/gRPC is planned future work (see design decisions §2.2.2).
+
+Span naming follows a hierarchical `<component>.<operation>` convention (e.g., `rpc.submit`, `tx.relay`, `consensus.round`). Context propagation uses W3C Trace Context headers for HTTP and embedded Protocol Buffer fields for P2P messages. The implementation coexists with existing PerfLog and Insight observability systems through correlation IDs.
+
+**Data Collection & Privacy**: Telemetry collects only operational metadata (timing, counts, hashes) — never sensitive content (private keys, balances, amounts, raw payloads). Privacy protection includes account hashing, configurable redaction, sampling, and collector-level filtering. Node operators retain full control over telemetry configuration.
+
+➡️ **[Read full Design Decisions](./02-design-decisions.md)**
+
+---
+
+## 3. Implementation Strategy
+
+The telemetry code is organized under `include/xrpl/telemetry/` for headers and `src/libxrpl/telemetry/` for implementation. Key principles include RAII-based span management via `SpanGuard`, conditional compilation with `XRPL_ENABLE_TELEMETRY`, and minimal runtime overhead through batch processing and efficient sampling.
+
+Performance optimization strategies include head sampling fixed at 100% (intentionally not configurable, so trace keep/drop decisions stay coherent across nodes), tail-based sampling at the collector for errors and slow traces to reduce volume, batch export to reduce network overhead, and conditional instrumentation that compiles to no-ops when disabled.
+
+➡️ **[Read full Implementation Strategy](./03-implementation-strategy.md)**
+
+---
+
+## 5. Configuration Reference
+
+> **OTLP** = OpenTelemetry Protocol | **APM** = Application Performance Monitoring
+
+Configuration is handled through the `[telemetry]` section in `xrpld.cfg` with options for enabling/disabling, exporter selection, endpoint configuration, and component-level filtering. Head sampling is fixed at 1.0 (not operator-configurable); volume reduction is done by tail sampling in the collector. CMake integration includes a `XRPL_ENABLE_TELEMETRY` option for compile-time control.
+
+OpenTelemetry Collector configurations are provided for development and production (with tail-based sampling, Tempo, and Elastic APM). Docker Compose examples enable quick local development environment setup.
+
+➡️ **[View full Configuration Reference](./05-configuration-reference.md)**
+
+---
+
+## 6. Implementation Phases
+
+The implementation spans 9 weeks across 5 phases:
+
+| Phase | Duration  | Focus               | Key Deliverables                                    |
+| ----- | --------- | ------------------- | --------------------------------------------------- |
+| 1     | Weeks 1-2 | Core Infrastructure | SDK integration, Telemetry interface, Configuration |
+| 2     | Weeks 3-4 | RPC Tracing         | HTTP context extraction, Handler instrumentation    |
+| 3     | Weeks 5-6 | Transaction Tracing | Protocol Buffer context, Relay propagation          |
+| 4     | Weeks 7-8 | Consensus Tracing   | Round spans, Proposal/validation tracing            |
+| 5     | Week 9    | Documentation       | Runbook, Dashboards, Training                       |
+
+**Total Effort**: 47 person-days (2 developers working in parallel)
+
+➡️ **[View full Implementation Phases](./06-implementation-phases.md)**
+
+---
+
+## 7. Observability Backends
+
+> **APM** = Application Performance Monitoring | **GCS** = Google Cloud Storage
+
+Grafana Tempo is recommended for all environments due to its cost-effectiveness and Grafana integration, while Elastic APM is ideal for organizations with existing Elastic infrastructure.
+
+The recommended production architecture uses a gateway collector pattern with regional collectors performing tail-based sampling, routing traces to multiple backends (Tempo for primary storage, Elastic for log correlation, S3/GCS for long-term archive).
+
+➡️ **[View Observability Backend Recommendations](./07-observability-backends.md)**
+
+---
+
+## 8. Appendix
+
+The appendix contains a glossary of OpenTelemetry and xrpld-specific terms, references to external documentation and specifications, version history for this implementation plan, and a complete document index.
+
+➡️ **[View Appendix](./08-appendix.md)**
+
+---
+
+_This document provides a comprehensive implementation plan for integrating OpenTelemetry distributed tracing into the xrpld XRP Ledger node software. For detailed information on any section, follow the links to the corresponding sub-documents._

cmake/XrplCompiler.cmake

@@ -120,10 +120,7 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(
-        common
-        INTERFACE -errorreport:none -machine:X64 -ignore:4099
-    )
+    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
 else()
     target_compile_options(
         common

cmake/XrplCore.cmake

@@ -207,11 +207,7 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_module(xrpl consensus)
 target_link_libraries(

cmake/XrplSettings.cmake

@@ -32,6 +32,11 @@ endif()
 
 option(benchmark "Build benchmarks" ON)
 
+# When OFF, the crates directory is not added to the build at all: no Rust
+# toolchain is required, no cxxbridge bindings are generated, and the C++ tests
+# that consume those bindings are left out of the build tree.
+option(rust "Build the Rust crates and the C++ code that depends on them" OFF)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are

conanfile.py

@@ -152,12 +152,8 @@ class Xrpl(ConanFile):
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
-        "crates/*",
-        "crates/.cargo/*",
-        "!crates/target/*",
         "external/*",
         "include/*",
-        "rust-toolchain.toml",
         "src/*",
     )
 

crates/CMakeLists.txt

@@ -101,11 +101,4 @@ function(add_xrpl_crate name)
     add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()
 
-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)
+add_xrpl_crate(rs_hello_world CRATE rs_hello_world FILES lib.rs)

crates/Cargo.lock

@@ -8,18 +8,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
 [[package]]
 name = "cc"
 version = "1.2.61"
@@ -69,24 +57,24 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
+checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
 dependencies = [
  "cc",
  "cxx-build",
  "cxxbridge-cmd",
  "cxxbridge-flags",
  "cxxbridge-macro",
- "foldhash 0.2.0",
+ "foldhash",
  "link-cplusplus",
 ]
 
 [[package]]
 name = "cxx-build"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
+checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -99,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
+checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -113,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
+checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
+checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -141,27 +129,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.0"
@@ -175,21 +148,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown",
 ]
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "link-cplusplus"
 version = "1.0.12"
@@ -199,12 +160,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -223,18 +178,19 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rs-hello_world"
+version = "0.1.0"
+dependencies = [
+ "cxx",
+]
+
 [[package]]
 name = "scratch"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
 
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -271,22 +227,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -336,99 +276,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.239.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.239.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -452,46 +299,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]

crates/Cargo.toml

@@ -1,15 +1,9 @@
 [workspace]
-members = [
-    "xrpl-wasm-vm-ffi",
-    "xrpl-wasm-vm",
-    "xrpl-wasm-testkit",
-    "xrpl-host-functions",
-    "xrpl-host-functions-macros",
-]
+members = ["hello_world"]
 resolver = "3"
 
 [workspace.dependencies]
-cxx = { version = "1.0.199", features = ["c++20"] }
+cxx = { version = "1.0.198", features = ["c++20"] }
 
 [workspace.package]
 edition = "2024"

crates/hello_world/Cargo.toml

@@ -1,11 +1,10 @@
 [package]
-name = "xrpl-wasm-testkit"
+name = "rs-hello_world"
 version = "0.1.0"
 edition.workspace = true
 
 [lib]
-crate-type = ["staticlib", "rlib"]
+crate-type = ["staticlib"]
 
 [dependencies]
 cxx.workspace = true
-wat = "1"

crates/hello_world/src/lib.rs

@@ -0,0 +1,10 @@
+#[cxx::bridge(namespace = "rs::hello_world")]
+mod ffi {
+    extern "Rust" {
+        fn hello_world() -> String;
+    }
+}
+
+pub fn hello_world() -> String {
+    "hello_world".to_string()
+}

crates/xrpl-host-functions-macros/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The doctest declares host functions returning `HostResult`, which the facade
-# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
-# the library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"

crates/xrpl-host-functions-macros/src/errors.rs

@@ -1,12 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,405 +0,0 @@
-mod errors;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the declarations refer to and holds the one declaration
-/// block.
-///
-/// # What it generates
-///
-/// Three items, in the scope the block is written in:
-///
-/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
-///   receiver, parameters, return type and doc comment exactly as written. An
-///   execution environment implements it; the rest of the expansion does not
-///   mention it.
-/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
-///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
-///   carrying that declaration's doc comment. Its `const fn wasm_name` and
-///   `const fn gas` are the ABI metadata, and `ALL` is every variant in
-///   declaration order — what a wasm engine iterates to build its import table.
-/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
-///   so `wasm_name` and `gas` read from a single `match` over the declarations,
-///   and never appears in a signature a caller can name.
-///
-/// The expansion introduces no other name and reaches for none: the only paths in
-/// it are `Self::Variant` and whatever the declarations themselves spell. So the
-/// block compiles wherever the types it names — `HostResult` above — resolve.
-///
-/// ```
-/// use xrpl_host_functions::HostResult;
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // The trait's methods are the declarations, down to the `&self` receiver the
-/// // VM calls the host through.
-/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
-///     host.get_ledger_sqn(out)
-/// }
-///
-/// // The metadata is a `const` table, so gas and import names are available at
-/// // compile time rather than looked up at run time.
-/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
-/// assert_eq!(TRACE_GAS, 500);
-///
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
-/// assert_eq!(
-///     HostFunctionSpec::ALL,
-///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
-/// );
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self` and returning
-/// `HostResult<T>`, with no body and no generics: it maps to exactly one wasm
-/// import signature. Two declarations may not share a `wasm_name`, nor collapse to
-/// the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(generate(&parsed))
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec::wasm_name`] and
-        /// [`HostFunctionSpec::gas`] read from.
-        ///
-        /// Private, and the only reason it exists is to keep both of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self) -> HostResult < [u8 ; 4] > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , }",
-            "const fn spec (self) -> HostFnSpec",
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The expansion stands alone: every name in it is either generated here or
-    /// written in the declarations, so it cannot depend on the crate it lands in.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // `Self::Variant` is the only path the expansion may build: anything else
-        // would reach out of the generated code. Doc comments spell paths without
-        // spaces (`Self::ALL`), so they do not match.
-        for (index, _) in generated.match_indices(" :: ") {
-            assert!(
-                generated[..index].ends_with("Self"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap()
-        .to_string();
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions-macros/src/parsed_host_function.rs

@@ -1,859 +0,0 @@
-use proc_macro2::TokenStream;
-use quote::{ToTokens, format_ident, quote};
-use syn::{
-    Attribute, Ident, LitInt, LitStr, PathArguments, ReceiverKind, ReturnType, Safety, Signature,
-    TraitItemFn, Type, TypePath, parse::Parse,
-};
-
-use crate::errors;
-
-/// `#[gas = N]`: the base gas charged before the call runs.
-const GAS: &str = "gas";
-/// `#[wasm_name = "..."]`: the name the guest imports the function under.
-const WASM_NAME: &str = "wasm_name";
-/// `///` desugars to `#[doc = "..."]` before macro expansion.
-const DOC: &str = "doc";
-/// The alias every declaration returns its success type through.
-const HOST_RESULT: &str = "HostResult";
-
-/// One entry of a `host_functions!` block: its ABI metadata and its signature.
-pub(crate) struct ParsedHostFunction {
-    pub(crate) gas: u64,
-    /// Kept as the literal the user wrote, so diagnostics and the generated
-    /// string both carry that span.
-    pub(crate) wasm_name: LitStr,
-    /// Doc comments, in source order, to re-emit on the generated items.
-    pub(crate) docs: Vec<Attribute>,
-    /// The enum variant this declaration becomes, spanned at the function name.
-    pub(crate) variant: Ident,
-    pub(crate) signature: Signature,
-}
-
-impl ParsedHostFunction {
-    /// `#[doc …] fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;`
-    pub(crate) fn trait_method(&self) -> TokenStream {
-        let docs = &self.docs;
-        // The declaration is already a trait method: emitted verbatim, so what
-        // the block reads like is what the trait is.
-        let signature = &self.signature;
-
-        quote! {
-            #(#docs)*
-            #signature;
-        }
-    }
-
-    /// `#[doc …] GetLedgerSqn`
-    pub(crate) fn variant_declaration(&self) -> TokenStream {
-        let docs = &self.docs;
-        let variant = &self.variant;
-        quote! {
-            #(#docs)*
-            #variant
-        }
-    }
-
-    /// `Self::GetLedgerSqn => HostFnSpec { name: "ldgr_index", gas: 60u64 }`
-    pub(crate) fn spec_arm(&self) -> TokenStream {
-        let Self {
-            gas,
-            wasm_name,
-            variant,
-            ..
-        } = self;
-        quote! {
-            Self::#variant => HostFnSpec { name: #wasm_name, gas: #gas }
-        }
-    }
-
-    pub(crate) fn parse(function: TraitItemFn) -> syn::Result<Self> {
-        let mut gas = None;
-        let mut wasm_name = None;
-        let mut docs = Vec::new();
-        let mut errors = Vec::new();
-
-        // Tracked separately from `gas`/`wasm_name` so a malformed attribute is
-        // not also reported as a missing one.
-        let mut saw_gas = false;
-        let mut saw_wasm_name = false;
-
-        for attr in function.attrs {
-            if attr.path().is_ident(GAS) {
-                saw_gas = true;
-                if let Err(error) = int_value(&attr).and_then(|v| set_once(&mut gas, v, &attr)) {
-                    errors.push(error);
-                }
-            } else if attr.path().is_ident(WASM_NAME) {
-                saw_wasm_name = true;
-                if let Err(error) = value::<LitStr>(&attr, "a string literal")
-                    .and_then(|v| set_once(&mut wasm_name, v, &attr))
-                {
-                    errors.push(error);
-                }
-            } else if attr.path().is_ident(DOC) {
-                docs.push(attr);
-            } else {
-                errors.push(syn::Error::new_spanned(
-                    &attr,
-                    format!("unexpected attribute `{}`", path_name(&attr)),
-                ));
-            }
-        }
-
-        if !saw_gas {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                format!("missing `#[{GAS} = ...]` attribute"),
-            ));
-        }
-        if !saw_wasm_name {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                format!("missing `#[{WASM_NAME} = \"...\"]` attribute"),
-            ));
-        }
-        if let Some(body) = &function.default {
-            errors.push(syn::Error::new_spanned(
-                body,
-                "a host function is implemented by the host, so it must not have a body",
-            ));
-        }
-        if !function.sig.generics.params.is_empty() || function.sig.generics.where_clause.is_some()
-        {
-            errors.push(syn::Error::new_spanned(
-                &function.sig.ident,
-                "a host function must not be generic: it maps to one wasm import signature",
-            ));
-        }
-        errors.extend(check_receiver(&function.sig).err());
-        errors.extend(check_return_type(&function.sig).err());
-        if let Some(name) = &wasm_name {
-            errors.extend(check_wasm_name(name).err());
-        }
-        reject_modifiers(&function.sig, &mut errors);
-
-        // A name whose PascalCase form is not a legal variant is reported here
-        // rather than emitted, which would either panic or fail downstream.
-        let variant = match variant_ident(&function.sig.ident) {
-            Ok(variant) => Some(variant),
-            Err(error) => {
-                errors.push(error);
-                None
-            }
-        };
-
-        if let Some(error) = errors::combine(errors) {
-            return Err(error);
-        }
-
-        let (Some(gas), Some(wasm_name), Some(variant)) = (gas, wasm_name, variant) else {
-            unreachable!("every absent field is reported above");
-        };
-
-        Ok(Self {
-            gas,
-            wasm_name,
-            docs,
-            variant,
-            signature: function.sig,
-        })
-    }
-}
-
-/// Every declaration carries a receiver, and it is always `&self`.
-///
-/// `&self` is the only receiver that can work: the VM reaches the host through a
-/// shared `&dyn HostFunctions` stored in the wasmi `Store`, and a host that needs
-/// to mutate does so behind interior mutability. The receiver is not part of the
-/// wasm ABI — the guest passes no `self` — so it is uniform across the block.
-fn check_receiver(signature: &Signature) -> syn::Result<()> {
-    let Some(receiver) = signature.receiver() else {
-        return Err(syn::Error::new_spanned(
-            &signature.ident,
-            format!(
-                "a host function must declare its receiver: `fn {}(&self, ...)`",
-                signature.ident
-            ),
-        ));
-    };
-
-    // `&self` and nothing else: not `&mut self`, not `self`/`mut self`, not a
-    // typed `self: Box<Self>`, and not a spelled-out lifetime.
-    if !matches!(receiver.kind, ReceiverKind::Reference(_, None, None)) {
-        return Err(syn::Error::new_spanned(
-            receiver,
-            "a host function's receiver must be exactly `&self`: the VM calls the host \
-             through a shared `&dyn HostFunctions`",
-        ));
-    }
-    Ok(())
-}
-
-/// Every declaration returns `HostResult<T>`, including the ones that yield
-/// nothing (`HostResult<()>`).
-///
-/// One shape for every function is what lets a single dispatch adapter lower them
-/// all: lift the arguments out of guest memory, call the host, then turn `Ok(T)`
-/// into the wire's non-negative `i32` and `Err(e)` into a negative code or a trap.
-/// A function returning a bare `T` would need its own arm.
-fn check_return_type(signature: &Signature) -> syn::Result<()> {
-    const SHAPE: &str = "a host function must return `HostResult<T>` — \
-                         `HostResult<()>` if it yields nothing";
-
-    let ReturnType::Type(_, returned) = &signature.output else {
-        return Err(syn::Error::new_spanned(&signature.ident, SHAPE));
-    };
-
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = &**returned
-    else {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    };
-    // The last segment only, so `HostResult<T>` may be written qualified.
-    let Some(last) = path.segments.last() else {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    };
-    if last.ident != HOST_RESULT {
-        return Err(syn::Error::new_spanned(returned, SHAPE));
-    }
-
-    // `HostResult` without its success type is `HostResult` the alias, which names
-    // no type; rustc's own message for that is unhelpfully far from the cause.
-    let PathArguments::AngleBracketed(arguments) = &last.arguments else {
-        return Err(syn::Error::new_spanned(
-            returned,
-            format!("`{HOST_RESULT}` needs its success type: `{HOST_RESULT}<T>`"),
-        ));
-    };
-    if arguments.args.len() != 1 {
-        return Err(syn::Error::new_spanned(
-            arguments,
-            format!("`{HOST_RESULT}` takes exactly one type: `{HOST_RESULT}<T>`"),
-        ));
-    }
-    Ok(())
-}
-
-/// `const`, `async`, `unsafe`/`safe` and `extern "…"` have no meaning in the
-/// wasm ABI, and would otherwise pass silently into the generated trait.
-fn reject_modifiers(signature: &Signature, errors: &mut Vec<syn::Error>) {
-    const PLAIN: &str =
-        "a host function must be a plain `fn`: this modifier is not part of the wasm ABI";
-
-    if let Some(constness) = &signature.constness {
-        errors.push(syn::Error::new_spanned(constness, PLAIN));
-    }
-    if let Some(asyncness) = &signature.asyncness {
-        errors.push(syn::Error::new_spanned(asyncness, PLAIN));
-    }
-    match &signature.safety {
-        Safety::Default => {}
-        Safety::Safe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
-        Safety::Unsafe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
-    }
-    if let Some(abi) = &signature.abi {
-        errors.push(syn::Error::new_spanned(abi, PLAIN));
-    }
-}
-
-/// The wasm import name reaches the engine's import table verbatim, so it is
-/// held to what an import name can sanely be rather than to any string.
-fn check_wasm_name(name: &LitStr) -> syn::Result<()> {
-    let value = name.value();
-    if value.is_empty() {
-        return Err(syn::Error::new_spanned(
-            name,
-            "the wasm name must not be empty",
-        ));
-    }
-    if let Some(character) = value
-        .chars()
-        .find(|c| !c.is_ascii_alphanumeric() && *c != '_')
-    {
-        return Err(syn::Error::new_spanned(
-            name,
-            format!(
-                "a wasm name may only contain `A-Za-z0-9_`, but this one contains {character:?}"
-            ),
-        ));
-    }
-    Ok(())
-}
-
-/// The enum variant a declaration becomes: `get_ledger_sqn` -> `GetLedgerSqn`.
-///
-/// The result carries `ident`'s span, so anything the compiler says about the
-/// variant points at the declaration that produced it.
-fn variant_ident(ident: &Ident) -> syn::Result<Ident> {
-    // `to_string` spells raw identifiers `r#type`; the `r#` is not part of the name.
-    let name = ident.to_string();
-    let name = name.strip_prefix("r#").unwrap_or(&name);
-
-    let mut pascal = String::with_capacity(name.len());
-    let mut capitalize = true;
-    for character in name.chars() {
-        if character == '_' {
-            capitalize = true;
-        } else if capitalize {
-            pascal.extend(character.to_uppercase());
-            capitalize = false;
-        } else {
-            pascal.push(character);
-        }
-    }
-
-    // A name of nothing but underscores leaves `pascal` empty; the original is
-    // already a legal identifier, so keep it.
-    if pascal.is_empty() {
-        return Ok(ident.clone());
-    }
-
-    // `Ident::new` panics on a leading digit (`_2fa` -> `2fa`) and silently
-    // accepts keyword spellings (`self_` -> `Self`), which then fails to parse
-    // where the variant is emitted. Parsing rejects both, without panicking.
-    if let Err(error) = syn::parse_str::<Ident>(&pascal) {
-        return Err(syn::Error::new_spanned(
-            ident,
-            format!(
-                "this name becomes the enum variant `{pascal}`, which is not a valid \
-                 variant name ({error}); rename the host function"
-            ),
-        ));
-    }
-    Ok(format_ident!("{pascal}", span = ident.span()))
-}
-
-/// Records `value`, or reports that the attribute appeared more than once.
-fn set_once<T>(slot: &mut Option<T>, value: T, attr: &Attribute) -> syn::Result<()> {
-    if slot.replace(value).is_some() {
-        return Err(syn::Error::new_spanned(
-            attr,
-            format!("duplicate `{}` attribute", path_name(attr)),
-        ));
-    }
-    Ok(())
-}
-
-/// The value of `#[name = <value>]`, parsed as `T`.
-///
-/// `expected` completes "`gas` expects …": syn's own message for the wrong kind
-/// of literal names neither the attribute nor what it wanted.
-fn value<T: Parse>(attr: &Attribute, expected: &str) -> syn::Result<T> {
-    let expr = &attr.meta.require_name_value()?.value;
-    syn::parse2(expr.to_token_stream()).map_err(|_| {
-        syn::Error::new_spanned(expr, format!("`{}` expects {expected}", path_name(attr)))
-    })
-}
-
-fn int_value(attr: &Attribute) -> syn::Result<u64> {
-    let int: LitInt = value(attr, "an integer literal")?;
-    // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>` would
-    // report a negative value as "invalid digit found in string".
-    if int.base10_digits().starts_with('-') {
-        return Err(syn::Error::new_spanned(
-            int,
-            format!("`{}` must not be negative", path_name(attr)),
-        ));
-    }
-    int.base10_parse()
-}
-
-/// The attribute's path as written, for diagnostics: `gas`, or `foo::bar`.
-fn path_name(attr: &Attribute) -> String {
-    attr.path()
-        .segments
-        .iter()
-        .map(|segment| segment.ident.to_string())
-        .collect::<Vec<_>>()
-        .join("::")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use syn::{Expr, ExprLit, Lit, parse_quote};
-
-    /// The message of every diagnostic recorded by one failed `parse`.
-    ///
-    /// `expect_err` is unavailable here: it needs `T: Debug`, and syn only
-    /// implements `Debug` for its AST types under the `extra-traits` feature.
-    fn messages(function: TraitItemFn) -> Vec<String> {
-        let Err(error) = ParsedHostFunction::parse(function) else {
-            panic!("expected parsing to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    fn doc_text(attr: &Attribute) -> String {
-        match &attr.meta.require_name_value().unwrap().value {
-            Expr::Lit(ExprLit {
-                lit: Lit::Str(text),
-                ..
-            }) => text.value(),
-            _ => panic!("doc attribute is not a string literal"),
-        }
-    }
-
-    #[test]
-    fn reads_gas_and_wasm_name() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert_eq!(parsed.gas, 60);
-        assert_eq!(parsed.wasm_name.value(), "ldgr_index");
-        assert_eq!(parsed.signature.ident.to_string(), "get_ledger_sqn");
-        assert_eq!(parsed.variant.to_string(), "GetLedgerSqn");
-        assert!(parsed.docs.is_empty());
-    }
-
-    #[test]
-    fn derives_variant_names_from_function_names() {
-        for (function, variant) in [
-            ("get_ledger_sqn", "GetLedgerSqn"),
-            ("sha512_half", "Sha512Half"),
-            ("trace", "Trace"),
-            ("get_current_ledger_obj_field", "GetCurrentLedgerObjField"),
-            ("r#type", "Type"),
-            ("trace2", "Trace2"),
-            // Pathological, but must not panic: no letters to capitalize.
-            ("__", "__"),
-        ] {
-            let ident = format_ident!("{function}");
-            assert_eq!(
-                variant_ident(&ident).map(|v| v.to_string()).ok(),
-                Some(variant.to_owned()),
-                "{function}"
-            );
-        }
-    }
-
-    /// `_2fa` would PascalCase to `2fa`; building that `Ident` panics, and a
-    /// panic in a proc macro is reported with no useful span at all.
-    #[test]
-    fn rejects_a_name_that_becomes_a_leading_digit() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "two_factor"]
-            fn _2fa(&self) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("becomes the enum variant `2fa`"),
-            "{messages:?}"
-        );
-    }
-
-    /// `self_` PascalCases to `Self`, which `Ident::new` accepts and rustc then
-    /// rejects where the variant is emitted. `r#Self` is not a legal escape.
-    #[test]
-    fn rejects_a_name_that_becomes_a_keyword() {
-        for function in ["self_", "_self"] {
-            let ident = format_ident!("{function}");
-            let Err(error) = variant_ident(&ident) else {
-                panic!("expected `{function}` to be rejected");
-            };
-            assert!(
-                error.to_string().contains("variant `Self`"),
-                "{}",
-                error.to_string()
-            );
-        }
-    }
-
-    #[test]
-    fn rejects_negative_gas() {
-        let messages = messages(parse_quote! {
-            #[gas = -5]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert_eq!(messages[0], "`gas` must not be negative");
-    }
-
-    #[test]
-    fn rejects_unusable_wasm_names() {
-        let empty = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = ""]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(empty.len(), 1, "{empty:?}");
-        assert_eq!(empty[0], "the wasm name must not be empty");
-
-        let spaced = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(spaced.len(), 1, "{spaced:?}");
-        assert!(spaced[0].contains("may only contain"), "{spaced:?}");
-    }
-
-    #[test]
-    fn rejects_signature_modifiers() {
-        for declaration in [
-            quote! { unsafe fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { async fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { const fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-            quote! { extern "C" fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                #declaration
-            })
-            .unwrap();
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "{messages:?}");
-            assert!(messages[0].contains("must be a plain `fn`"), "{messages:?}");
-        }
-    }
-
-    #[test]
-    fn trait_method_keeps_the_declared_receiver_and_ends_in_a_semicolon() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            /// Hashes `data`.
-            #[gas = 2000]
-            #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
-        })
-        .unwrap();
-
-        // `///` reaches the macro as `#[doc = r"..."]`: rustc's lexer spells doc
-        // comments as raw string literals.
-        let method = parsed.trait_method().to_string();
-        assert!(
-            method.starts_with("# [doc = r\" Hashes `data`.\"]"),
-            "{method}"
-        );
-        assert!(
-            method
-                .contains("fn sha512_half (& self , data : & [u8]) -> HostResult < [u8 ; 32] > ;"),
-            "{method}"
-        );
-    }
-
-    #[test]
-    fn spec_arm_carries_the_name_and_the_gas() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert_eq!(
-            parsed.spec_arm().to_string(),
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }"
-        );
-    }
-
-    #[test]
-    fn keeps_doc_comments_in_source_order() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            /// First line.
-            ///
-            /// Third line.
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        let docs: Vec<_> = parsed.docs.iter().map(doc_text).collect();
-        assert_eq!(docs, vec![" First line.", "", " Third line."]);
-    }
-
-    #[test]
-    fn preserves_parameters_and_return_type() {
-        let traced = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 500]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data: &[u8], as_hex: bool) -> HostResult<()>;
-        })
-        .unwrap();
-        // The receiver is `inputs[0]`; the three wasm parameters follow it.
-        assert_eq!(traced.signature.inputs.len(), 4);
-        assert_eq!(
-            traced.signature.output.to_token_stream().to_string(),
-            "-> HostResult < () >"
-        );
-
-        let hashed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 2000]
-            #[wasm_name = "sha512_half"]
-            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; HASH_LEN]>;
-        })
-        .unwrap();
-        assert_eq!(
-            hashed.signature.output.to_token_stream().to_string(),
-            "-> HostResult < [u8 ; HASH_LEN] >"
-        );
-    }
-
-    #[test]
-    fn reports_both_missing_attributes_at_once() {
-        let messages = messages(parse_quote! {
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2);
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn names_the_unexpected_attribute() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wsam_name = "typo"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        // The typo'd attribute, plus the `wasm_name` it failed to be.
-        assert_eq!(messages.len(), 2);
-        assert!(
-            messages.iter().any(|m| m.contains("`wsam_name`")),
-            "{messages:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_wrong_literal_types() {
-        let gas = messages(parse_quote! {
-            #[gas = "60"]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(gas.len(), 1, "{gas:?}");
-        assert!(
-            gas[0].contains("`gas` expects an integer literal"),
-            "{gas:?}"
-        );
-
-        let name = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(name.len(), 1, "{name:?}");
-        assert!(
-            name[0].contains("`wasm_name` expects a string literal"),
-            "{name:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_gas_that_does_not_fit_in_u64() {
-        let messages = messages(parse_quote! {
-            #[gas = 99999999999999999999999]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("number too large"), "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_attribute_shapes_other_than_name_value() {
-        let bare = messages(parse_quote! {
-            #[gas]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(bare.len(), 1, "{bare:?}");
-        assert!(bare[0].contains("gas = ..."), "{bare:?}");
-
-        let list = messages(parse_quote! {
-            #[gas(60)]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-        assert_eq!(list.len(), 1, "{list:?}");
-    }
-
-    #[test]
-    fn rejects_duplicate_attributes() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[gas = 70]
-            #[wasm_name = "ldgr_index"]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("duplicate `gas`"), "{messages:?}");
-        assert!(
-            messages[1].contains("duplicate `wasm_name`"),
-            "{messages:?}"
-        );
-    }
-
-    /// A malformed attribute must not also be reported as an absent one.
-    #[test]
-    fn does_not_report_a_malformed_attribute_as_missing() {
-        let messages = messages(parse_quote! {
-            #[gas = "60"]
-            #[wasm_name = 7]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(
-            !messages.iter().any(|m| m.contains("missing")),
-            "{messages:?}"
-        );
-    }
-
-    #[test]
-    fn rejects_a_body() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> { Ok([0; 4]) }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("must not have a body"), "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_generics() {
-        let parameter = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn<T>(&self) -> HostResult<T>;
-        });
-        assert_eq!(parameter.len(), 1, "{parameter:?}");
-        assert!(
-            parameter[0].contains("must not be generic"),
-            "{parameter:?}"
-        );
-
-        let clause = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> where Self: Sized;
-        });
-        assert_eq!(clause.len(), 1, "{clause:?}");
-    }
-
-    #[test]
-    fn requires_a_receiver() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn() -> HostResult<[u8; 4]>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("must declare its receiver: `fn get_ledger_sqn(&self, ...)`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Anything but `&self` would need a host the VM cannot hand out: it holds
-    /// one shared `&dyn HostFunctions` for the whole run.
-    #[test]
-    fn rejects_receivers_other_than_shared_self() {
-        for receiver in [
-            quote! { &mut self },
-            quote! { self },
-            quote! { mut self },
-            quote! { self: Box<Self> },
-            quote! { &'a self },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                fn get_ledger_sqn(#receiver) -> HostResult<[u8; 4]>;
-            })
-            .unwrap_or_else(|_| panic!("`{receiver}` should parse"));
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "`{receiver}`: {messages:?}");
-            assert!(
-                messages[0].contains("must be exactly `&self`"),
-                "`{receiver}`: {messages:?}"
-            );
-        }
-    }
-
-    /// A bare `T` return would need its own lowering arm, so the uniform shape is
-    /// required rather than inferred.
-    #[test]
-    fn rejects_returns_that_are_not_host_result() {
-        for output in [
-            quote! {},
-            quote! { -> () },
-            quote! { -> [u8; 4] },
-            quote! { -> i32 },
-            quote! { -> Result<[u8; 4], HostError> },
-            quote! { -> impl Iterator<Item = u8> },
-        ] {
-            let function: TraitItemFn = syn::parse2(quote! {
-                #[gas = 60]
-                #[wasm_name = "ldgr_index"]
-                fn get_ledger_sqn(&self) #output;
-            })
-            .unwrap_or_else(|_| panic!("`{output}` should parse"));
-
-            let messages = messages(function);
-            assert_eq!(messages.len(), 1, "`{output}`: {messages:?}");
-            assert!(
-                messages[0].contains("must return `HostResult<T>`"),
-                "`{output}`: {messages:?}"
-            );
-        }
-    }
-
-    /// `HostResult` may be written qualified, since the trait method keeps whatever
-    /// path resolves where the block is written.
-    #[test]
-    fn accepts_a_qualified_host_result() {
-        let parsed = ParsedHostFunction::parse(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> xrpl_host_functions::HostResult<[u8; 4]>;
-        })
-        .unwrap();
-
-        assert!(
-            parsed
-                .trait_method()
-                .to_string()
-                .contains("xrpl_host_functions :: HostResult < [u8 ; 4] >"),
-            "{}",
-            parsed.trait_method()
-        );
-    }
-
-    /// `HostResult` with no success type names no type at all; rustc's own error
-    /// for that lands on the generated trait, far from the declaration.
-    #[test]
-    fn rejects_host_result_without_a_success_type() {
-        let messages = messages(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self) -> HostResult;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("needs its success type"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions/Cargo.toml

@@ -1,7 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"

crates/xrpl-host-functions/src/lib.rs

@@ -1,503 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`HostResult`], [`HASH_LEN`] — and everything
-//! derived from the declarations is generated. The expansion names nothing this file
-//! does not, so the two sides meet only in the block below.
-//!
-//! So this file is lists — error codes, trace data types, functions. The `macro_rules!`
-//! that expand the first two into enums live in `macros.rs`.
-
-#![no_std]
-
-#[macro_use]
-mod macros;
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::host_functions;
-
-host_errors! {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-trace_data_types! {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
-    /// the answer is `1` if enabled and `0` if not.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Answers the slot used.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
-    /// multiple of 4).
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
-    /// is valid, `0` if not, or a negative error.
-    #[gas = 300]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
-    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
-    /// issuer).
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
-    /// the account it authorizes.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
-    /// bit pattern.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id. `doc_id` is the guest's `u32` carried as its `i32` bit pattern.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number. `seq` is the
-    /// guest's `u32` carried as its `i32` bit pattern.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
-    /// bit pattern.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
-    /// its ticket sequence number. `seq` is the guest's `u32` carried as its `i32` bit
-    /// pattern.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    ///
-    /// It is also the one declaration that is **not** the wasm parameter order.
-    /// `data_type` is the third wasm parameter, between the two regions, because that
-    /// is where the guest stdlib declares it; `register.rs` takes the arguments in wasm
-    /// order and calls this in declaration order.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data: &[u8], data_type: TraceDataType) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
-    /// host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
-    /// bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
-    /// little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
-    /// little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
-    /// (four little-endian bytes), each written to its own output region.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        mode: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, returning a negative, zero, or positive scalar as
-    /// `x` is less than, equal to, or greater than `y`.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32>;
-
-    /// The float sum `x + y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
-}

crates/xrpl-host-functions/src/macros.rs

@@ -1,102 +0,0 @@
-//! The `macro_rules!` behind the two hand-listed enums, [`crate::HostError`] and
-//! [`crate::TraceDataType`].
-//!
-//! Each takes one list of `Variant = code,` and expands the enum together with the
-//! `ALL`/`code`/`from_code` set that must not fall behind it. The lists themselves stay
-//! in `lib.rs`, beside the `host_functions!` block.
-
-/// Declares [`crate::HostError`] from one list: the variants, `HostError::ALL` and
-/// `HostError::from_code`'s table all expand from the codes given.
-///
-/// One list is what makes `ALL` complete. Rust cannot enumerate an enum's
-/// variants — an exhaustive `match` forces an arm per variant but gives nothing to
-/// iterate — so a hand-written `ALL` beside a hand-written enum could only be kept
-/// in step by review, and `ALL`'s whole purpose is to be the set a test can trust.
-/// A code added to the list gains its `ALL` entry and its `from_code` arm by
-/// construction. `HostFunctionSpec::ALL` is complete the same way, from the
-/// `host_functions!` block.
-macro_rules! host_errors {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// Error codes a host function may return.
-        ///
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum HostError {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl HostError {
-            /// Every error a host function may return, in code order.
-            ///
-            /// The complete set, and complete by construction: a wasm engine's
-            /// split between the codes it hands the guest and the conditions it
-            /// traps on is a decision per variant, so the test that checks the
-            /// split iterates this and a code added to the ABI cannot slip past it.
-            pub const ALL: &'static [HostError] = &[$(HostError::$variant,)+];
-
-            /// The negative wire value a failed call returns. Every code but
-            /// `InternalFatal` is one a guest reads off that value.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// Reconstruct a `HostError` from its wire code.
-            ///
-            /// A code this ABI does not define is `InternalFatal`: an answer the
-            /// caller cannot act on is the call not having been served, and that is
-            /// the variant which says so. Positive values are not errors at all and go
-            /// the same way, since this is reached only once a negative return has
-            /// been read as a failure.
-            pub const fn from_code(code: i32) -> HostError {
-                match code {
-                    $($code => HostError::$variant,)+
-                    _ => HostError::InternalFatal,
-                }
-            }
-        }
-    };
-}
-
-/// Declares [`crate::TraceDataType`] from one list, so `TraceDataType::ALL`,
-/// `TraceDataType::code` and `TraceDataType::from_code` cannot fall behind the
-/// variants — the reason `host_errors!` above is written this way.
-macro_rules! trace_data_types {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// How [`HostFunctions::trace`] is to read its data buffer.
-        ///
-        /// The discriminants are wire values shared with the guest stdlib: append only,
-        /// never renumber. They start at 1, so a zeroed argument names no type rather
-        /// than the first one.
-        ///
-        /// This is the declaration a guest and a host both compile against. The host
-        /// side needs a second one — `cxx` cannot be a dependency here, since this
-        /// crate also links into the guest — so `xrpl-wasm-vm-ffi` declares a shared
-        /// enum for C++ and converts, exhaustively, from this.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum TraceDataType {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl TraceDataType {
-            /// Every data type a guest may name, in code order.
-            pub const ALL: &'static [TraceDataType] = &[$(TraceDataType::$variant,)+];
-
-            /// The wire value a guest passes to name this type.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The type `code` names, or `None`: the engine drops a call it cannot
-            /// read rather than guessing at a rendering the guest did not ask for.
-            pub const fn from_code(code: i32) -> Option<TraceDataType> {
-                match code {
-                    $($code => Some(TraceDataType::$variant),)+
-                    _ => None,
-                }
-            }
-        }
-    };
-}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -1,34 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are the ones the declarations themselves spell.
-
-use xrpl_host_functions::HostResult;
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}

crates/xrpl-host-functions/tests/generated_abi.rs

@@ -1,996 +0,0 @@
-//! Exercises the API that `host_functions!` generates, not the macro itself:
-//! the `HostFunctions` trait is implementable and callable both directly and
-//! through `&dyn`, and the generated `HostFunctionSpec` and `TraceDataType`
-//! tables agree with the declarations in `src/lib.rs`. The macro's own parsing
-//! and diagnostics are covered by the unit tests in `xrpl-host-functions-macros`.
-
-use std::cell::RefCell;
-use std::collections::HashSet;
-
-use xrpl_host_functions::{
-    HASH_LEN, HostError, HostFunctionSpec, HostFunctions, HostResult, TraceDataType,
-};
-
-/// Records what it was asked to do; enough to prove the trait is usable.
-///
-/// Every method takes `&self`, so a host that records anything keeps it behind
-/// interior mutability.
-#[derive(Default)]
-struct FakeHost {
-    traced: RefCell<Vec<String>>,
-}
-
-/// The contract every byte-producing host function follows: write only if the
-/// value fits, and report its true length either way, so the engine can turn a
-/// value that doesn't fit into `BufferTooSmall` without the host knowing the
-/// guest's buffer size.
-fn put(out: &mut [u8], value: &[u8]) -> HostResult<usize> {
-    if let Some(dst) = out.get_mut(..value.len()) {
-        dst.copy_from_slice(value);
-    }
-    Ok(value.len())
-}
-
-impl HostFunctions for FakeHost {
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize> {
-        put(out, &7u32.to_le_bytes())
-    }
-
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize> {
-        put(out, &9u32.to_le_bytes())
-    }
-
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize> {
-        put(out, &[0xab; HASH_LEN])
-    }
-
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize> {
-        put(out, &10u32.to_le_bytes())
-    }
-
-    /// Returns a flag rather than bytes, and reads its input: enabled unless empty.
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32> {
-        Ok(i32::from(!amendment.is_empty()))
-    }
-
-    /// Returns a slot: the requested one, or slot 1 when asked to pick.
-    fn cache_ledger_obj(&self, _obj_id: &[u8], cache_idx: i32) -> HostResult<i32> {
-        Ok(if cache_idx == 0 { 1 } else { cache_idx })
-    }
-
-    /// A field getter over the transaction; fails on a negative selector.
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize> {
-        if field < 0 {
-            return Err(HostError::FieldNotFound);
-        }
-        put(out, &[field as u8])
-    }
-
-    /// Fails on a field it doesn't know, so the error channel is exercised too.
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize> {
-        if field < 0 {
-            return Err(HostError::FieldNotFound);
-        }
-        put(out, &[field as u8])
-    }
-
-    /// A field getter over a cached object, keyed by slot and selector.
-    fn get_ledger_obj_field(
-        &self,
-        cache_idx: i32,
-        field: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if cache_idx <= 0 || field < 0 {
-            return Err(HostError::FieldNotFound);
-        }
-        put(out, &[cache_idx as u8, field as u8])
-    }
-
-    /// A nested-field getter over the transaction, keyed by the locator bytes.
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        put(out, &[locator[0], locator.len() as u8])
-    }
-
-    /// The same, over the current ledger object.
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        put(out, &[locator.len() as u8, locator[0]])
-    }
-
-    /// The same, over a cached object keyed by slot.
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if cache_idx <= 0 || locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        put(out, &[cache_idx as u8, locator[0]])
-    }
-
-    /// A scalar-in, scalar-out count; `NoArray` on a negative selector.
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32> {
-        if field < 0 {
-            return Err(HostError::NoArray);
-        }
-        Ok(field)
-    }
-
-    /// The same, over the current ledger object.
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32> {
-        if field < 0 {
-            return Err(HostError::NoArray);
-        }
-        Ok(field + 1)
-    }
-
-    /// The same, over a cached object keyed by slot.
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32> {
-        if cache_idx <= 0 || field < 0 {
-            return Err(HostError::NoArray);
-        }
-        Ok(cache_idx + field)
-    }
-
-    /// A nested array-length getter, keyed by the locator bytes.
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32> {
-        if locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        Ok(locator.len() as i32)
-    }
-
-    /// The same, over the current ledger object.
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32> {
-        if locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        Ok(locator.len() as i32 + 1)
-    }
-
-    /// The same, over a cached object keyed by slot.
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32> {
-        if cache_idx <= 0 || locator.is_empty() {
-            return Err(HostError::LocatorMalformed);
-        }
-        Ok(cache_idx + locator.len() as i32)
-    }
-
-    /// Reads three regions and returns a verdict: valid unless the signature is empty.
-    fn check_signature(
-        &self,
-        _message: &[u8],
-        signature: &[u8],
-        _pubkey: &[u8],
-    ) -> HostResult<i32> {
-        Ok(i32::from(!signature.is_empty()))
-    }
-
-    /// A keylet getter: reads an account, writes a 32-byte keylet; `InvalidAccount`
-    /// on an empty account.
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// A two-asset keylet getter; `InvalidParams` if the two assets are equal.
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if asset1 == asset2 {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[asset1.len() as u8; HASH_LEN])
-    }
-
-    /// A keylet from an account and a sequence; `InvalidAccount` on an empty account.
-    fn check_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// A keylet from subject, issuer, and credential type; `InvalidAccount` if either
-    /// account is empty, `InvalidParams` if the type is empty.
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if subject.is_empty() || issuer.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        if credential_type.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[subject[0]; HASH_LEN])
-    }
-
-    /// A keylet from two accounts; `InvalidAccount` if either is empty, `InvalidParams`
-    /// if they are equal.
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if account.is_empty() || authorize.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        if account == authorize {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same two-account shape, for a `DepositPreauth`.
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if account.is_empty() || authorize.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        if account == authorize {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[authorize[0]; HASH_LEN])
-    }
-
-    /// A single-account keylet, for a `DID`.
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The account-and-sequence shape, for an `Escrow`.
-    fn escrow_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// A keylet from two accounts and a currency; `InvalidAccount` if either account
-    /// is empty, `InvalidParams` if they are equal or the currency is empty.
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if account1.is_empty() || account2.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        if account1 == account2 || currency.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[account1[0]; HASH_LEN])
-    }
-
-    /// The issuer-and-sequence shape, for an `MPTokenIssuance`.
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        _seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if issuer.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[issuer[0]; HASH_LEN])
-    }
-
-    /// A keylet from an MPT id and a holder; `InvalidParams` if the id is empty,
-    /// `InvalidAccount` if the holder is empty.
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if mptid.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        if holder.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[mptid[0]; HASH_LEN])
-    }
-
-    /// The account-and-sequence shape, for an `NFTokenOffer`.
-    fn nftoken_offer_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same account-and-sequence shape, for an `Offer`.
-    fn offer_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same account-and-scalar shape, for an `Oracle` keyed by document id.
-    fn oracle_keylet(&self, account: &[u8], _doc_id: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// A two-account-and-sequence shape, for a `PayChannel`; `InvalidAccount` if
-    /// either account is empty.
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        _seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if account.is_empty() || destination.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same account-and-sequence shape, for a `PermissionedDomain`.
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        _seq: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The account-only shape, for a `SignerList`.
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same account-and-sequence shape, for a `Ticket`.
-    fn ticket_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// The same account-and-sequence shape, for a `Vault`.
-    fn vault_keylet(&self, account: &[u8], _seq: i32, out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() {
-            return Err(HostError::InvalidAccount);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        let mut digest = [0; HASH_LEN];
-        digest[0] = data.len() as u8;
-        put(out, &digest)
-    }
-
-    fn trace(&self, msg: &str, data: &[u8], data_type: TraceDataType) -> HostResult<()> {
-        self.traced
-            .borrow_mut()
-            .push(format!("{msg}/{data_type:?}/{}", data.len()));
-        Ok(())
-    }
-
-    /// Reads a data blob and returns the count of bytes stored.
-    fn update_data(&self, data: &[u8]) -> HostResult<i32> {
-        Ok(data.len() as i32)
-    }
-
-    /// Reads an account and an nft id, writes a byte value; `InvalidParams` if either
-    /// is empty.
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if account.is_empty() || nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[account[0]; HASH_LEN])
-    }
-
-    /// Reads an nft id, writes a byte value; `InvalidParams` on an empty id.
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[nft_id[0]; HASH_LEN])
-    }
-
-    /// The same, for the taxon.
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &nft_id[0].to_le_bytes())
-    }
-
-    /// Reads an nft id and returns a scalar; `InvalidParams` on an empty id.
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32> {
-        if nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        Ok(i32::from(nft_id[0]))
-    }
-
-    /// The same, for the transfer fee.
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32> {
-        if nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        Ok(i32::from(nft_id[0]))
-    }
-
-    /// The same byte-output shape, for the sequence number.
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize> {
-        if nft_id.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &nft_id[0].to_le_bytes())
-    }
-
-    /// A scalar-in float: writes the low byte of `x` as a stand-in float.
-    fn float_from_int(&self, x: i64, _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        put(out, &[x as u8])
-    }
-
-    /// A byte-in float; `InvalidParams` on an empty region.
-    fn float_from_uint(&self, x: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// The same, for a serialized amount.
-    fn float_from_stamount(&self, amount: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if amount.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[amount[0]])
-    }
-
-    /// The same, for a serialized number.
-    fn float_from_stnumber(&self, number: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if number.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[number[0]])
-    }
-
-    /// A float rounded to an integer, written as bytes.
-    fn float_to_int(&self, x: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// Writes a mantissa (its first byte) and an exponent (its first byte) to two
-    /// regions, returning their combined length.
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize> {
-        if x.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        let m = put(mantissa_out, &[x[0]])?;
-        let e = put(exponent_out, &[x[0]])?;
-        Ok(m + e)
-    }
-
-    /// A two-scalar-in float.
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        _exponent: i32,
-        _mode: i32,
-        out: &mut [u8],
-    ) -> HostResult<usize> {
-        put(out, &[mantissa as u8])
-    }
-
-    /// Reads two floats and returns a scalar; `InvalidParams` if either is empty.
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32> {
-        if x.is_empty() || y.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        Ok(i32::from(x[0]) - i32::from(y[0]))
-    }
-
-    /// A binary float operator; `InvalidParams` if either operand is empty.
-    fn float_add(&self, x: &[u8], y: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() || y.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// The same shape, for subtraction.
-    fn float_subtract(&self, x: &[u8], y: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() || y.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// The same shape, for multiplication.
-    fn float_multiply(&self, x: &[u8], y: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() || y.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// The same shape, for division.
-    fn float_divide(&self, x: &[u8], y: &[u8], _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() || y.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-
-    /// The same shape, for exponentiation.
-    fn float_power(&self, x: &[u8], _n: i32, _mode: i32, out: &mut [u8]) -> HostResult<usize> {
-        if x.is_empty() {
-            return Err(HostError::InvalidParams);
-        }
-        put(out, &[x[0]])
-    }
-}
-
-#[test]
-fn the_trait_is_implementable() {
-    let host = FakeHost::default();
-    let mut out = [0u8; HASH_LEN];
-
-    assert_eq!(host.get_ledger_sqn(&mut out), Ok(4));
-    assert_eq!(out[..4], [7, 0, 0, 0]);
-    assert_eq!(host.get_parent_ledger_time(&mut out), Ok(4));
-    assert_eq!(out[..4], [9, 0, 0, 0]);
-    assert_eq!(host.get_parent_ledger_hash(&mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 0xab);
-    assert_eq!(host.get_base_fee(&mut out), Ok(4));
-    assert_eq!(out[..4], [10, 0, 0, 0]);
-    assert_eq!(host.is_amendment_enabled(&[1; 32]), Ok(1));
-    assert_eq!(host.is_amendment_enabled(&[]), Ok(0));
-    assert_eq!(host.cache_ledger_obj(&[1; 32], 0), Ok(1));
-    assert_eq!(host.cache_ledger_obj(&[1; 32], 5), Ok(5));
-    assert_eq!(host.get_tx_field(5, &mut out), Ok(1));
-    assert_eq!(out[0], 5);
-    assert_eq!(host.get_current_ledger_obj_field(3, &mut out), Ok(1));
-    assert_eq!(out[0], 3);
-    assert_eq!(host.get_ledger_obj_field(2, 4, &mut out), Ok(2));
-    assert_eq!(out[..2], [2, 4]);
-    assert_eq!(host.get_tx_nested_field(&[9, 0, 0, 0], &mut out), Ok(2));
-    assert_eq!(out[..2], [9, 4]);
-    assert_eq!(
-        host.get_current_ledger_obj_nested_field(&[9, 0, 0, 0], &mut out),
-        Ok(2)
-    );
-    assert_eq!(out[..2], [4, 9]);
-    assert_eq!(
-        host.get_ledger_obj_nested_field(3, &[9, 0, 0, 0], &mut out),
-        Ok(2)
-    );
-    assert_eq!(out[..2], [3, 9]);
-    assert_eq!(host.get_tx_array_len(3), Ok(3));
-    assert_eq!(host.get_tx_array_len(-1), Err(HostError::NoArray));
-    assert_eq!(host.get_current_ledger_obj_array_len(3), Ok(4));
-    assert_eq!(
-        host.get_current_ledger_obj_array_len(-1),
-        Err(HostError::NoArray)
-    );
-    assert_eq!(host.get_ledger_obj_array_len(2, 3), Ok(5));
-    assert_eq!(host.get_ledger_obj_array_len(0, 3), Err(HostError::NoArray));
-    assert_eq!(host.get_tx_nested_array_len(&[9, 0, 0, 0]), Ok(4));
-    assert_eq!(
-        host.get_tx_nested_array_len(&[]),
-        Err(HostError::LocatorMalformed)
-    );
-    assert_eq!(
-        host.get_current_ledger_obj_nested_array_len(&[9, 0, 0, 0]),
-        Ok(5)
-    );
-    assert_eq!(
-        host.get_current_ledger_obj_nested_array_len(&[]),
-        Err(HostError::LocatorMalformed)
-    );
-    assert_eq!(
-        host.get_ledger_obj_nested_array_len(2, &[9, 0, 0, 0]),
-        Ok(6)
-    );
-    assert_eq!(
-        host.get_ledger_obj_nested_array_len(0, &[9, 0, 0, 0]),
-        Err(HostError::LocatorMalformed)
-    );
-    assert_eq!(host.check_signature(b"msg", b"sig", b"pk"), Ok(1));
-    assert_eq!(host.check_signature(b"msg", b"", b"pk"), Ok(0));
-    assert_eq!(host.account_keylet(&[7; 20], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.account_keylet(&[], &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.amm_keylet(&[1; 20], &[2; 40], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 20);
-    assert_eq!(
-        host.amm_keylet(&[1; 20], &[1; 20], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(host.check_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.check_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.credential_keylet(&[7; 20], &[8; 20], b"cred", &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.credential_keylet(&[], &[8; 20], b"cred", &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.delegate_keylet(&[7; 20], &[8; 20], &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.delegate_keylet(&[], &[8; 20], &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.deposit_preauth_keylet(&[7; 20], &[8; 20], &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 8);
-    assert_eq!(
-        host.deposit_preauth_keylet(&[7; 20], &[7; 20], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(host.did_keylet(&[7; 20], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.did_keylet(&[], &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.escrow_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.escrow_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.trust_line_keylet(&[7; 20], &[8; 20], &[1; 20], &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.trust_line_keylet(&[7; 20], &[7; 20], &[1; 20], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(
-        host.mptoken_issuance_keylet(&[7; 20], 5, &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.mptoken_issuance_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.mptoken_keylet(&[9; 24], &[8; 20], &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 9);
-    assert_eq!(
-        host.mptoken_keylet(&[], &[8; 20], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(
-        host.nftoken_offer_keylet(&[7; 20], 5, &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.nftoken_offer_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.offer_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.offer_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.oracle_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.oracle_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.paychannel_keylet(&[7; 20], &[8; 20], 5, &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.paychannel_keylet(&[7; 20], &[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(
-        host.permissioned_domain_keylet(&[7; 20], 5, &mut out),
-        Ok(HASH_LEN)
-    );
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.permissioned_domain_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.signer_list_keylet(&[7; 20], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.signer_list_keylet(&[], &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.ticket_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.ticket_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.vault_keylet(&[7; 20], 5, &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.vault_keylet(&[], 5, &mut out),
-        Err(HostError::InvalidAccount)
-    );
-    assert_eq!(host.sha512_half(b"abc", &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 3);
-    assert_eq!(host.trace("hello", b"xy", TraceDataType::AsHex), Ok(()));
-    assert_eq!(host.update_data(b"abcd"), Ok(4));
-    assert_eq!(host.get_nft(&[7; 20], &[9; 32], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 7);
-    assert_eq!(
-        host.get_nft(&[], &[9; 32], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(host.get_nft_issuer(&[9; 32], &mut out), Ok(HASH_LEN));
-    assert_eq!(out[0], 9);
-    assert_eq!(
-        host.get_nft_issuer(&[], &mut out),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(host.get_nft_taxon(&[9; 32], &mut out), Ok(1));
-    assert_eq!(host.get_nft_flags(&[9; 32]), Ok(9));
-    assert_eq!(host.get_nft_flags(&[]), Err(HostError::InvalidParams));
-    assert_eq!(host.get_nft_transfer_fee(&[9; 32]), Ok(9));
-    assert_eq!(host.get_nft_sequence(&[9; 32], &mut out), Ok(1));
-    assert_eq!(host.float_from_int(5, 0, &mut out), Ok(1));
-    assert_eq!(host.float_from_uint(&[3; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_from_stamount(&[3; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_from_stnumber(&[3; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_to_int(&[3; 8], 0, &mut out), Ok(1));
-    let mut mant = [0u8; 8];
-    let mut exp = [0u8; 4];
-    assert_eq!(host.float_to_mant_exp(&[3; 8], &mut mant, &mut exp), Ok(2));
-    assert_eq!(host.float_from_mant_exp(5, 0, 0, &mut out), Ok(1));
-    assert_eq!(host.float_compare(&[9; 8], &[4; 8]), Ok(5));
-    assert_eq!(
-        host.float_compare(&[], &[4; 8]),
-        Err(HostError::InvalidParams)
-    );
-    assert_eq!(host.float_add(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_subtract(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_multiply(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_divide(&[3; 8], &[4; 8], 0, &mut out), Ok(1));
-    assert_eq!(host.float_power(&[3; 8], 2, 0, &mut out), Ok(1));
-
-    assert_eq!(*host.traced.borrow(), ["hello/AsHex/2"]);
-}
-
-/// The error channel every declaration carries: an `Err` the VM turns into the
-/// wire's negative return code.
-#[test]
-fn a_failing_call_reports_its_error_code() {
-    let host = FakeHost::default();
-    let mut out = [0u8; 8];
-
-    assert_eq!(
-        host.get_current_ledger_obj_field(-1, &mut out),
-        Err(HostError::FieldNotFound)
-    );
-    assert_eq!(HostError::FieldNotFound.code(), -2);
-}
-
-/// A host reports the value's true length even when it cannot write it, which is
-/// what lets the engine answer `BufferTooSmall` on the guest's behalf.
-#[test]
-fn a_short_buffer_still_reports_the_true_length() {
-    let host = FakeHost::default();
-    let mut out = [0u8; 2];
-
-    assert_eq!(host.get_ledger_sqn(&mut out), Ok(4));
-    assert_eq!(
-        out,
-        [0, 0],
-        "nothing is written when the value does not fit"
-    );
-}
-
-/// The VM reaches the host as one shared trait object held in the wasmi `Store`,
-/// which is what the `&self` receivers are for.
-#[test]
-fn the_trait_is_callable_through_a_shared_trait_object() {
-    let fake = FakeHost::default();
-    let host: &dyn HostFunctions = &fake;
-    let mut out = [0u8; 4];
-
-    assert_eq!(host.get_ledger_sqn(&mut out), Ok(4));
-    assert_eq!(
-        host.trace("count", &1i64.to_le_bytes(), TraceDataType::Int64),
-        Ok(())
-    );
-
-    assert_eq!(*fake.traced.borrow(), ["count/Int64/8"]);
-}
-
-/// The whole table, written out: the one place the ABI's wire names and gas costs
-/// appear as literals, and a deliberate change-detector, since both are consensus
-/// input. Everything else reads `HostFunctionSpec::gas()` instead.
-///
-/// `ALL` is in declaration order, so comparing the whole vec pins the order and the
-/// membership too.
-#[test]
-fn the_spec_table_matches_the_declarations() {
-    let table: Vec<(&str, u64)> = HostFunctionSpec::ALL
-        .iter()
-        .map(|function| (function.wasm_name(), function.gas()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            ("ldgr_index", 60),
-            ("parent_ldgr_time", 60),
-            ("parent_ldgr_hash", 60),
-            ("base_fee", 60),
-            ("amendment_enabled", 100),
-            ("cache_le", 5000),
-            ("tx_field", 70),
-            ("home_le_field", 70),
-            ("le_field", 70),
-            ("tx_inner", 110),
-            ("home_le_inner", 110),
-            ("le_inner", 110),
-            ("tx_arr_len", 40),
-            ("home_le_arr_len", 40),
-            ("le_arr_len", 40),
-            ("tx_inner_arr_len", 70),
-            ("home_le_inner_arr_len", 70),
-            ("le_inner_arr_len", 70),
-            ("check_sig", 300),
-            ("accountroot_id", 350),
-            ("amm_id", 450),
-            ("check_id", 350),
-            ("credential_id", 350),
-            ("delegate_id", 350),
-            ("deposit_preauth_id", 350),
-            ("did_id", 350),
-            ("escrow_id", 350),
-            ("trustline_id", 400),
-            ("mpt_issuance_id", 350),
-            ("mptoken_id", 500),
-            ("nft_offer_id", 350),
-            ("offer_id", 350),
-            ("oracle_id", 350),
-            ("paychan_id", 350),
-            ("permissioned_domain_id", 350),
-            ("signers_id", 350),
-            ("ticket_id", 350),
-            ("vault_id", 350),
-            ("sha512_half", 2000),
-            ("trace", 30),
-            ("set_data", 1000),
-            ("nft_uri", 5000),
-            ("nft_issuer", 70),
-            ("nft_taxon", 60),
-            ("nft_flags", 60),
-            ("nft_xfer_fee", 60),
-            ("nft_serial", 60),
-            ("float_from_int", 100),
-            ("float_from_uint", 130),
-            ("float_from_stamount", 150),
-            ("float_from_stnumber", 150),
-            ("float_to_int", 130),
-            ("float_to_mant_exp", 130),
-            ("float_from_mant_exp", 100),
-            ("float_cmp", 80),
-            ("float_add", 160),
-            ("float_sub", 160),
-            ("float_mult", 300),
-            ("float_div", 300),
-            ("float_pow", 5500),
-        ]
-    );
-}
-
-/// The other half of the wire vocabulary, and the same change-detector argument: the
-/// codes are what a guest passes, so they are pinned as literals here. `ALL` is in code
-/// order, so the round trip pins the discriminants and not just the membership.
-#[test]
-fn every_trace_data_type_survives_the_wire() {
-    let codes: Vec<i32> = TraceDataType::ALL.iter().map(|t| t.code()).collect();
-
-    assert_eq!(codes, [1, 2, 3, 4, 5, 6, 7]);
-    for &data_type in TraceDataType::ALL {
-        assert_eq!(TraceDataType::from_code(data_type.code()), Some(data_type));
-    }
-}
-
-/// A code no declaration names is refused rather than read as a neighbouring type.
-/// Zero is the one worth naming: it is what a guest sends by omission.
-#[test]
-fn an_unnamed_trace_data_type_code_is_refused() {
-    for code in [0, -1, 8, i32::MAX, i32::MIN] {
-        assert_eq!(TraceDataType::from_code(code), None, "code {code}");
-    }
-}
-
-/// `ALL` is what a wasm engine iterates to register imports, so no two declarations
-/// may collapse to the same wire name. The table above pins membership and order;
-/// this adds only uniqueness, and restates nothing.
-#[test]
-fn every_variant_appears_in_all_exactly_once() {
-    let names: HashSet<&str> = HostFunctionSpec::ALL
-        .iter()
-        .map(|function| function.wasm_name())
-        .collect();
-
-    assert_eq!(names.len(), HostFunctionSpec::ALL.len());
-}
-
-/// Both accessors are `const`, so an engine can build its import and gas tables at
-/// compile time rather than on every invocation. The assertions sit in `const`
-/// blocks so they are checked while compiling, which is the claim; the values
-/// themselves are pinned above.
-#[test]
-fn the_table_is_usable_in_const_context() {
-    const NAME: &str = HostFunctionSpec::Trace.wasm_name();
-    const GAS: u64 = HostFunctionSpec::Trace.gas();
-
-    const { assert!(!NAME.is_empty()) };
-    const { assert!(GAS > 0) };
-}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -1,102 +0,0 @@
-//! Exercises what `host_errors!` generates: the wire codes, the set
-//! [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), error, "{error:?}");
-    }
-}
-
-/// A code from outside the set is `InternalFatal`: a host answering something this ABI
-/// does not define has not served the call, whatever it meant by it, and success is not
-/// an error at all.
-///
-/// `-21` is the code xrpld would append next, so it is the one that decides whether a
-/// list this crate has not caught up with reaches a guest or stops the run. `i32::MIN +
-/// 1` is next to the sentinel and unassigned, which is what makes the sentinel a value
-/// rather than a range.
-#[test]
-fn a_code_outside_the_set_is_internal_fatal() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(
-            HostError::from_code(code),
-            HostError::InternalFatal,
-            "{code}"
-        );
-    }
-}

crates/xrpl-wasm-testkit/src/lib.rs

@@ -1,49 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
-//! into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::compile_wat;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }

crates/xrpl-wasm-vm/Cargo.toml

@@ -1,11 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "1.1.0", default-features = false, features = ["std"] }
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-
-[dev-dependencies]
-wat = "1"

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,824 +0,0 @@
-use crate::region::Region;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use core::ops::Range;
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// [`Region::read`] of the guest's memory, for a call that reads and writes nothing
-/// back (`trace`).
-pub(crate) fn read_borrowed<'a>(
-    caller: &'a Caller<'_, VmState<'_>>,
-    input: Region,
-) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(input.read(mem.data(caller))?)
-}
-
-/// Decode a guest `u32` argument — a keylet's sequence number or document id — from
-/// its four little-endian bytes, carried on to the host as its `i32` bit pattern.
-///
-/// The ABI transports these as a 4-byte region rather than a wasm scalar (the guest
-/// SDK passes `seq.to_le_bytes()`), so the region must be exactly four bytes;
-/// `InvalidParams` otherwise.
-pub(crate) fn read_u32_arg(bytes: &[u8]) -> HostResult<i32> {
-    let arr: [u8; 4] = bytes.try_into().map_err(|_| HostError::InvalidParams)?;
-    Ok(i32::from_le_bytes(arr))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region, the
-/// cap, nor the budget, and all three checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: Region,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can borrow any number of input
-/// regions with [`Region::read`] — which a `&mut` view of that memory would forbid.
-/// That is why the answer goes through a buffer instead of straight into the guest
-/// as [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: Region,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
-    let region = data
-        .get(range.clone())
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if region.len() < width {
-        return Err(HostError::BufferTooSmall);
-    }
-    Ok(())
-}
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: Region,
-    exponent_out: Region,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    let mant_range = mantissa_out.range()?;
-    check_fits(data, &mant_range, MANTISSA_BYTES)?;
-    let exp_range = exponent_out.range()?;
-    check_fits(data, &exp_range, EXPONENT_BYTES)?;
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::TraceDataType;
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data: &[u8], _data_type: TraceDataType) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _mode: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/lib.rs

@@ -1,28 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-
-mod abi;
-mod preflight;
-mod region;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check};
-pub use vm::{
-    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError, RunFailure,
-    RunOutcome, TRANSFER_LIMIT_BYTES, run,
-};

crates/xrpl-wasm-vm/src/preflight.rs

@@ -1,407 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the three stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two things it deliberately does not screen. A module exporting **no** linear
-//! memory passes: a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section
-//! passes: it is guest code, and executing it is the one thing a check must not do
-//! — a trap in one is charged to the contract like any other trap.
-//!
-//! Two things it screens that a run can only discover: an exported memory, or an
-//! exported table, larger than the engine grants. Both read the same export list, so
-//! [`check_exported_resources`] is one pass — see it for what stays invisible, and
-//! why the table case leaves much more of it there.
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::HostFunctionSpec;
-
-use crate::register::HOST_MODULE;
-use crate::vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, compile};
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-    /// The module asks for a larger table than the engine grants.
-    Table(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-            CheckError::Table(detail) => write!(f, "table: {detail}"),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
-/// have.
-///
-/// The stages are ordered by how much of the module each explains. An import fault
-/// is reported before a missing entry point because the imports are what the rest of
-/// the module is built on; the resource caps come last, being a request rather than a
-/// mistake about the ABI.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let module = compile(wasm).map_err(CheckError::Compile)?;
-    check_imports(&module)?;
-    check_entry_point(&module, function_name)?;
-    check_exported_resources(&module)
-}
-
-/// Every import must be one the linker defines. The first that is not ends the
-/// check, so a module with several faults reports the earliest.
-fn check_imports(module: &Module) -> Result<(), CheckError> {
-    for import in module.imports() {
-        check_import(import.module(), import.name(), import.ty()).map_err(CheckError::Import)?;
-    }
-    Ok(())
-}
-
-/// Whether the engine defines this one import.
-///
-/// The set of names is [`HostFunctionSpec::ALL`], which is also what
-/// [`crate::register::register_host_functions`] iterates — so a check and a run
-/// cannot disagree about which names exist, and adding a host function extends
-/// both at once. The one thing this does not compare is `ty`'s *signature*, which
-/// still parts a module from the engine at instantiation; the kind is compared
-/// because the engine defines these names as functions and as nothing else.
-///
-/// The rules are ordered, not merely alternatives: a guest importing `env::malloc`
-/// is told about the namespace rather than that `malloc` is not a host function,
-/// because the namespace is the one that explains every other import it has too.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    if !HostFunctionSpec::ALL
-        .iter()
-        .any(|op| op.wasm_name() == name)
-    {
-        return Err(format!("no host function '{name}'"));
-    }
-    if !matches!(ty, ExternType::Func(_)) {
-        return Err(format!("'{HOST_MODULE}::{name}' is not a function"));
-    }
-    Ok(())
-}
-
-fn check_entry_point(module: &Module, name: &str) -> Result<(), CheckError> {
-    match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => Ok(()),
-        found => Err(CheckError::EntryPoint(entry_point_fault(found, name))),
-    }
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may declare no more linear memory, and no larger a table, than the
-/// engine grants. One pass over the exports, since both rules read the same list and
-/// the export table is the only place either is visible.
-///
-/// **A memory or table the module keeps to itself is therefore not screened**: it is
-/// absent from the exports, and the store's limiter is what refuses it, at
-/// instantiation. That gap is wide for tables — Rust exports
-/// `__indirect_function_table` only under `--export-table`, so unexported is the
-/// normal shape — and narrow for memories, since a contract needs an exported one to
-/// make any host call at all.
-///
-/// A module faulting on both is reported by whichever it declares first. Neither
-/// fault explains the other, so there is no precedence to preserve — only the need
-/// for every node to reach the same verdict, which export order already gives.
-fn check_exported_resources(module: &Module) -> Result<(), CheckError> {
-    for export in module.exports() {
-        match export.ty() {
-            ExternType::Memory(ty) => {
-                check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
-            }
-            ExternType::Table(ty) => {
-                check_initial_elements(ty.minimum()).map_err(CheckError::Table)?;
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a table of this declared initial size.
-///
-/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
-/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
-/// than it was declared and a declared maximum past the cap is simply unreachable.
-fn check_initial_elements(elements: u64) -> Result<(), String> {
-    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
-    if elements > cap {
-        return Err(format!(
-            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`]; what is here is
-/// what a module cannot state precisely — which rule fires, in which order, and in
-/// what words the caller logs it.
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// A host function as a guest declares it. Any function type will do: the
-    /// signature is not what [`check_import`] compares.
-    fn a_function() -> ExternType {
-        ExternType::Func(FuncType::new([ValType::I32], [ValType::I32]))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served. Derived from `ALL` rather than
-    /// listed, so a host function added to the ABI is covered the day it lands.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for op in HostFunctionSpec::ALL {
-            assert_eq!(
-                check_import(HOST_MODULE, op.wasm_name(), &a_function()),
-                Ok(()),
-                "{}",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = check_import(namespace, a_host_function_name(), &a_function())
-                .expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal =
-            check_import(HOST_MODULE, "no_such_function", &a_function()).expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = check_import(HOST_MODULE, name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = check_import("env", "no_such_function", &a_function())
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(Some(a_function()), "finish"),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The cap itself is granted; one element past it is not. The boundary is the
-    /// whole rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
-        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
-        assert_eq!(check_initial_elements(0), Ok(()));
-        assert_eq!(check_initial_elements(cap), Ok(()));
-
-        let past = cap + 1;
-        let refusal = check_initial_elements(past).expect_err("one element past the cap");
-        assert_eq!(
-            refusal,
-            format!(
-                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-            )
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
-            "table: initial table of 1025 elements"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/region.rs

@@ -1,50 +0,0 @@
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{HostError, HostResult};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// Every byte parameter in this ABI is such a pair, so pairing them once at the wire
-/// boundary is what keeps the helpers in `abi.rs` from each taking two loose integers
-/// they could be handed in either order.
-///
-/// It lives in a module of its own so that the fields are out of reach and
-/// [`range`](Region::range) is the *only* way to indices — the check cannot be
-/// skipped, only deferred. Construction is infallible for that reason: a call whose
-/// output region is malformed is then refused in the order its own helper chooses,
-/// rather than at the moment the pair happened to be formed.
-#[derive(Copy, Clone)]
-pub(crate) struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    pub(crate) fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check — it fails on
-    /// exactly the negative values — and the addition guards a 32-bit `usize`, where
-    /// two `i32`s can sum past the end.
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. No copy: the slice aliases
-    /// `data`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}

crates/xrpl-wasm-vm/src/vm.rs

@@ -1,404 +0,0 @@
-use std::cell::Cell;
-use std::fmt;
-use std::sync::LazyLock;
-use wasmi::{
-    Config, Engine, Export, Linker, Memory, Module, Store, StoreLimits, StoreLimitsBuilder,
-    TrapCode,
-};
-use xrpl_host_functions::HostFunctions;
-
-use crate::abi::{FatalHostError, Fault};
-use crate::preflight::entry_point_fault;
-use crate::register::register_host_functions;
-
-/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
-const WASM_PAGE_BYTES: u32 = 64 * 1024;
-
-/// Linear-memory page cap.
-pub const MAX_MEMORY_PAGES: u32 = 128;
-
-/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
-pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
-
-/// Cap on a table's element count.
-///
-/// A table entry is 8 bytes and wasmi materializes every one of them inside
-/// `instantiate_and_start` — before the guest's first instruction, so no gas charge
-/// can reach the cost. Without this cap the ceiling is the validator's, `u32::MAX`
-/// entries, which a module asks for in five bytes of LEB128 and pays for in ~34 GiB.
-pub const MAX_TABLE_ELEMENTS: usize = 1024;
-
-/// Total bytes the host may write into guest memory in one [`run`], separate from
-/// gas.
-///
-/// One direction only. What the guest passes in is not charged: it reaches the host
-/// as a borrowed slice of guest memory, capped per value at [`MAX_FIELD_BYTES`] by
-/// `Region::read` and in number by gas, and a host that keeps a copy (`update_data`)
-/// bounds it on its own side.
-pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
-
-/// Size cap on any single value crossing the boundary, in either direction; over
-/// it is `DataFieldTooLarge`.
-///
-/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
-pub const MAX_FIELD_BYTES: usize = 1024;
-
-/// State threaded through every host call, stored in the wasmi [`Store`].
-pub(crate) struct VmState<'h> {
-    pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`store_limits`] via `Store::limiter`, which needs a `&mut` into it
-    /// from `&mut VmState` — hence a field rather than a local.
-    pub(crate) mem_limits: StoreLimits,
-    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
-    ///
-    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
-    /// invocation touches the store, so the lack of `Sync` costs nothing.
-    ///
-    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
-    /// until this ABI gains a `FieldLocator` host function.
-    pub(crate) transfer_budget: Cell<u64>,
-    /// The guest's linear memory, resolved once by [`run`] after instantiation so
-    /// no host call pays for an export lookup.
-    ///
-    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
-    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
-    /// re-derive the slice per call.
-    ///
-    /// The handle is scoped to one store, so this assumes **one module, one
-    /// instance, one store per `run`**. Module linking or nested execution would
-    /// have to resolve per instance: a cached handle would serve a call against the
-    /// wrong instance's memory, which is a wrong answer rather than an error.
-    pub(crate) memory: Option<Memory>,
-    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
-    /// to the guest. One buffer per run, so no call zero-fills one of its own.
-    ///
-    /// Inline rather than boxed: the store's data is built once and then only
-    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
-    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
-    /// stack buffer is zero-filled — per call, which is the cost this removes.
-    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
-}
-
-/// Outcome of running an escrow contract to completion.
-#[derive(Debug)]
-pub struct RunOutcome {
-    /// The value returned by the exported entry point (`finish`): `> 0` means
-    /// allow the escrow to finish.
-    pub result: i32,
-    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
-    /// the per-call host charges.
-    pub fuel_used: u64,
-}
-
-/// Why a run produced no result. Each variant is one outcome for the caller to
-/// map to a TER.
-#[derive(Debug)]
-pub enum RunError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// The module compiled but the engine would not accept it: an import the
-    /// linker does not define, or an initial memory past the page cap. Not guest
-    /// code failing — a start section that traps is [`RunError::Trap`].
-    Instantiate(String),
-    /// No export named `function_name` with signature `() -> i32`: absent, not a
-    /// function, or a function of another type — which the detail tells apart.
-    EntryPoint(String),
-    /// Gas exhausted — by the guest's own instructions or by a host call's
-    /// charge. [`RunFailure::fuel_used`] is the whole limit.
-    OutOfGas,
-    /// The host could not serve a call.
-    Internal,
-    /// A host call had no linear memory to work in: the module exports none, or
-    /// the call came from a start section, which runs before there is an instance
-    /// to resolve the memory from.
-    NoMemory,
-    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
-    /// access, or `memory.grow` past the page cap. Wherever the guest was
-    /// executing, including a start section during instantiation.
-    Trap(String),
-}
-
-impl fmt::Display for RunError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            RunError::Compile(detail) => write!(f, "compile: {detail}"),
-            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            RunError::EntryPoint(detail) => write!(f, "{detail}"),
-            RunError::OutOfGas => write!(f, "out of gas"),
-            RunError::Internal => write!(f, "internal error"),
-            RunError::NoMemory => write!(f, "no exported memory"),
-            RunError::Trap(detail) => write!(f, "trap: {detail}"),
-        }
-    }
-}
-
-/// A failed run, with the gas it still owes: a contract that traps or exhausts
-/// its gas is charged for what it burned.
-#[derive(Debug)]
-pub struct RunFailure {
-    pub error: RunError,
-    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
-    /// when the module never ran.
-    pub fuel_used: u64,
-}
-
-impl fmt::Display for RunFailure {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
-    }
-}
-
-impl RunFailure {
-    /// A failure with no fuel accounted: it stopped the run at or before the guest's
-    /// first instruction, or under a store with no meter to read.
-    fn owing_nothing(error: RunError) -> RunFailure {
-        RunFailure {
-            error,
-            fuel_used: 0,
-        }
-    }
-}
-
-/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
-/// trap and refusal all report it the same way.
-///
-/// `Store::get_fuel` fails only on a store without fuel metering, which
-/// [`build_wasm_engine`] rules out and `run`'s `set_fuel` would already have
-/// caught — so a failure here is a defect in this crate. It must not become a
-/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
-/// everything. [`RunError::Internal`] instead.
-fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
-    store
-        .get_fuel()
-        .map(|remaining| gas.saturating_sub(remaining))
-        .map_err(|_| RunError::Internal)
-}
-
-/// Report `error` with the run's cost attached. A cost that cannot be read replaces
-/// the outcome rather than being invented — see [`fuel_used`].
-fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
-    match fuel_used(store, gas) {
-        Ok(fuel_used) => RunFailure { error, fuel_used },
-        Err(unmetered) => RunFailure::owing_nothing(unmetered),
-    }
-}
-
-/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
-/// the stage that raised it.
-///
-/// Two ways a run halts mid-flight: a host call that could not be served, which
-/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
-/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
-///
-/// Both can happen anywhere the guest executes — including a start section, which
-/// is guest code running during instantiation — so every stage from there on asks
-/// this before naming a failure after itself.
-fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
-    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
-        return Some(fatal.0.into());
-    }
-    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
-}
-
-/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
-/// that can arise anywhere.
-///
-/// A start section is guest code, so it can trap on its own — `unreachable`, a
-/// division by zero, an out-of-bounds access — and a trap is the guest's fault
-/// wherever it happens. Naming that after the *stage* would file it beside the
-/// module faults a caller treats as its own defect, and charge nothing for
-/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
-/// module the linker or the store would not accept at all.
-fn instantiation_failure(error: &wasmi::Error) -> RunError {
-    match error.as_trap_code() {
-        Some(_) => RunError::Trap(error.to_string()),
-        None => RunError::Instantiate(error.to_string()),
-    }
-}
-
-/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
-///
-/// Total and one arm each, because a `Fault` is only ever a condition that stops the
-/// run — the guest-visible codes cannot reach here, which is what
-/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
-/// compile.
-impl From<Fault> for RunError {
-    fn from(fault: Fault) -> RunError {
-        match fault {
-            Fault::OutOfGas => RunError::OutOfGas,
-            Fault::Internal => RunError::Internal,
-            Fault::NoMemory => RunError::NoMemory,
-        }
-    }
-}
-
-/// The process-wide wasmi engine, built once on first use.
-///
-/// The configuration is consensus-fixed and identical for every invocation, and an
-/// [`Engine`] is an internally `Arc`ed `Send + Sync` handle, so one shared engine
-/// serves concurrent [`run`] calls.
-pub(crate) fn wasm_engine() -> &'static Engine {
-    static ENGINE: LazyLock<Engine> = LazyLock::new(build_wasm_engine);
-    &ENGINE
-}
-
-/// Build the wasmi engine the escrow VM requires: deterministic, minimal
-/// features, fuel metering on.
-fn build_wasm_engine() -> Engine {
-    let mut config = Config::default();
-    config.consume_fuel(true);
-    config.ignore_custom_sections(true);
-    config.wasm_mutable_global(false);
-    config.wasm_multi_value(false);
-    config.wasm_sign_extension(false);
-    config.wasm_saturating_float_to_int(false);
-    config.wasm_bulk_memory(false);
-    config.wasm_reference_types(false);
-    config.wasm_tail_call(false);
-    config.wasm_extended_const(false);
-    config.floats(false);
-    config.wasm_multi_memory(false);
-    config.wasm_custom_page_sizes(false);
-    config.wasm_memory64(false);
-    config.wasm_wide_arithmetic(false);
-    // TODO: enable option to reject wasm code containing start section after wasmi 2.0 release
-    Engine::new(&config)
-}
-
-/// Every resource ceiling a run is given, in one place.
-///
-/// The two *size* caps are what a contract can reach today. The three *count* caps
-/// are set to 1 although [`build_wasm_engine`] already forces each: turning
-/// `wasm_reference_types` on would let a module declare up to
-/// `wasmparser::MAX_WASM_TABLES` tables, `wasm_multi_memory` likewise for memories,
-/// and both size caps are **per table and per memory, not aggregate** — so a feature
-/// flag flipped in isolation would multiply the ceiling by a hundred rather than
-/// leave it be. The counts are what keeps those two decisions independent.
-///
-/// wasmi enforces the counts by asking the limiter before it allocates
-/// (`can_create_more_instances`/`_memories`/`_tables`); they default to 10000, so
-/// leaving them unset is not the same as their being unreachable.
-fn store_limits() -> StoreLimits {
-    StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .table_elements(MAX_TABLE_ELEMENTS)
-        .instances(1)
-        .tables(1)
-        .memories(1)
-        .trap_on_grow_failure(true)
-        .build()
-}
-
-/// Compile `wasm` for this engine.
-///
-/// The one path to a [`Module`]: the configuration is what decides whether a
-/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
-/// compile against different ones.
-pub(crate) fn compile(wasm: &[u8]) -> Result<Module, String> {
-    Module::new(wasm_engine(), wasm).map_err(|e| e.to_string())
-}
-
-/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
-/// calls through `host`, and call the exported `function_name`.
-pub fn run<'h>(
-    wasm: &[u8],
-    gas: u64,
-    host: &'h dyn HostFunctions,
-    function_name: &str,
-) -> Result<RunOutcome, RunFailure> {
-    let engine = wasm_engine();
-    let module =
-        compile(wasm).map_err(|detail| RunFailure::owing_nothing(RunError::Compile(detail)))?;
-
-    let mut store = Store::new(
-        engine,
-        VmState {
-            host,
-            mem_limits: store_limits(),
-            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        },
-    );
-
-    store
-        .set_fuel(gas)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-    store.limiter(|state| &mut state.mem_limits);
-
-    let mut linker = Linker::<VmState<'h>>::new(engine);
-    register_host_functions(&mut linker)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-
-    let instance = match linker.instantiate_and_start(&mut store, &module) {
-        Ok(instance) => instance,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
-            return Err(failed(&store, gas, error));
-        }
-    };
-    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
-
-    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
-        Ok(function) => function,
-        Err(e) => {
-            let found = instance
-                .get_export(&store, function_name)
-                .map(|export| export.ty(&store));
-            let error =
-                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let result = match function.call(&mut store, ()) {
-        Ok(result) => result,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
-    Ok(RunOutcome { result, fuel_used })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_engine_is_one_engine() {
-        assert!(Engine::same(wasm_engine(), wasm_engine()));
-    }
-
-    /// One instance, one table, one memory — asserted here rather than through a
-    /// module, because no module can reach these. `wasm_reference_types(false)` and
-    /// `wasm_multi_memory(false)` make a module declaring a second table or memory
-    /// fail *validation*, so a run never gets far enough to consult the limiter.
-    /// That is exactly why the counts are worth pinning: they are the ceiling that
-    /// survives one of those flags being turned on, and nothing else would fail if
-    /// they were silently dropped.
-    #[test]
-    fn the_store_grants_one_of_each_thing_a_module_can_own() {
-        use wasmi::ResourceLimiter;
-
-        let limits = store_limits();
-        assert_eq!(limits.instances(), 1);
-        assert_eq!(limits.tables(), 1);
-        assert_eq!(limits.memories(), 1);
-    }
-
-    /// The only place these numbers appear as literals; every other test derives
-    /// them from the constants.
-    #[test]
-    fn the_limits_are_the_protocol_limits() {
-        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
-        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
-        assert_eq!(MAX_TABLE_ELEMENTS, 1024, "table-element cap");
-        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
-        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
-    }
-}

crates/xrpl-wasm-vm/tests/budgets.rs

@@ -1,922 +0,0 @@
-//! The two budgets a run spends: gas (fuel), and the transfer limit on bytes
-//! crossing the boundary. Both are consensus input, so several of these tests
-//! assert exact numbers.
-
-mod support;
-
-use support::{
-    Answer, EMPTY_REGION, FakeHost, ONE_PAGE, PLENTY_OF_GAS, code, import, module, run,
-    run_with_gas, trace_call,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, HostFunctionSpec, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError, TRANSFER_LIMIT_BYTES};
-
-// ---------------------------------------------------------------------------
-// Gas
-// ---------------------------------------------------------------------------
-
-/// The fuel a module of `body` burns, given gas to spare.
-fn fuel_for(body: &str, parts: &[&str], host: &FakeHost) -> u64 {
-    let wat = module(parts, body);
-    run(&wat, host).expect("the module should run").fuel_used
-}
-
-/// The fuel a module burns doing nothing but returning a constant; every figure
-/// below builds on it. wasmi's number, pinned deliberately because wasmi's fuel
-/// table is consensus input.
-const EMPTY_MODULE_FUEL: u64 = 30;
-
-/// wasmi's own fuel for a host call whose operands are all constants under 64: 14
-/// per `*.const`, plus 1 for the call. Our gas sits on top.
-///
-/// The formula holds only under 64, because wasmi widens a constant's encoding
-/// above that, each tier costing 7 more. Every call in [`call_for`] keeps its
-/// operands small for that reason; one with a larger constant fails here by a
-/// multiple of 7.
-fn wasmi_call_fuel(small_const_operands: u64) -> u64 {
-    14 * small_const_operands + 1
-}
-
-/// What wasmi charges on top of that for a call to a function with no result —
-/// `trace`'s shape, and nothing else in the ABI. Per call, not per module. Measured
-/// and pinned like the figures above.
-const WASMI_NO_RESULT_FUEL: u64 = 14;
-
-/// wasmi's fuel for one `(drop …)`, which is how a module makes more than one call
-/// and keeps only the last result. Pinned like the two above.
-const WASMI_DROP_FUEL: u64 = 21;
-
-/// The wasm a test needs in order to call one host function: the `(import …)`
-/// declaration, a call with small-constant operands, and how many it pushes.
-struct Call {
-    import: &'static str,
-    call: &'static str,
-    operands: u64,
-    /// Whether the call leaves an `i32` behind. `trace` does not, which is why
-    /// [`Call::body`] ends every module with a constant instead of the call.
-    yields: bool,
-}
-
-impl Call {
-    /// `n` calls in a row, leaving one `i32` for the module to return: the last
-    /// answer where there is one, and a constant where the call has none.
-    fn body(&self, n: usize) -> String {
-        if self.yields {
-            format!(
-                "{}{}",
-                format!("(drop {}) ", self.call).repeat(n - 1),
-                self.call
-            )
-        } else {
-            format!("{}(i32.const 0)", format!("{} ", self.call).repeat(n))
-        }
-    }
-
-    /// What [`Call::body`] burns beside the calls' own gas and the module's floor:
-    /// one `drop` between consecutive answers, or wasmi's own surcharge on a call
-    /// that has none.
-    fn overhead(&self, n: u64) -> u64 {
-        if self.yields {
-            (n - 1) * WASMI_DROP_FUEL
-        } else {
-            n * WASMI_NO_RESULT_FUEL
-        }
-    }
-}
-
-/// The test wasm for each host function. The `match` is exhaustive, so a function
-/// added to the ABI fails to compile until it has wasm here, and iterating
-/// [`HostFunctionSpec::ALL`] then covers the whole ABI.
-fn call_for(op: HostFunctionSpec) -> Call {
-    let (import, call, operands) = match op {
-        HostFunctionSpec::GetLedgerSqn => (
-            import::LDGR_INDEX,
-            "(call $ldgr_index (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetParentLedgerTime => (
-            import::PARENT_LDGR_TIME,
-            "(call $parent_ldgr_time (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetParentLedgerHash => (
-            import::PARENT_LDGR_HASH,
-            "(call $parent_ldgr_hash (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetBaseFee => (
-            import::BASE_FEE,
-            "(call $base_fee (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::IsAmendmentEnabled => (
-            import::AMENDMENT_ENABLED,
-            "(call $amendment_enabled (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::CacheLedgerObj => (
-            import::CACHE_LE,
-            "(call $cache_le (i32.const 0) (i32.const 32) (i32.const 0))",
-            3,
-        ),
-        HostFunctionSpec::GetTxField => (
-            import::TX_FIELD,
-            "(call $tx_field (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjField => (
-            import::HOME_LE_FIELD,
-            "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::GetLedgerObjField => (
-            import::LE_FIELD,
-            "(call $le_field (i32.const 1) (i32.const 1) (i32.const 0) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetTxNestedField => (
-            import::TX_INNER,
-            "(call $tx_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjNestedField => (
-            import::HOME_LE_INNER,
-            "(call $home_le_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetLedgerObjNestedField => (
-            import::LE_INNER,
-            "(call $le_inner (i32.const 1) (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
-            5,
-        ),
-        HostFunctionSpec::GetTxArrayLen => {
-            (import::TX_ARR_LEN, "(call $tx_arr_len (i32.const 1))", 1)
-        }
-        HostFunctionSpec::GetCurrentLedgerObjArrayLen => (
-            import::HOME_LE_ARR_LEN,
-            "(call $home_le_arr_len (i32.const 1))",
-            1,
-        ),
-        HostFunctionSpec::GetLedgerObjArrayLen => (
-            import::LE_ARR_LEN,
-            "(call $le_arr_len (i32.const 1) (i32.const 1))",
-            2,
-        ),
-        HostFunctionSpec::GetTxNestedArrayLen => (
-            import::TX_INNER_ARR_LEN,
-            "(call $tx_inner_arr_len (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetCurrentLedgerObjNestedArrayLen => (
-            import::HOME_LE_INNER_ARR_LEN,
-            "(call $home_le_inner_arr_len (i32.const 0) (i32.const 4))",
-            2,
-        ),
-        HostFunctionSpec::GetLedgerObjNestedArrayLen => (
-            import::LE_INNER_ARR_LEN,
-            "(call $le_inner_arr_len (i32.const 1) (i32.const 0) (i32.const 4))",
-            3,
-        ),
-        HostFunctionSpec::CheckSignature => (
-            import::CHECK_SIG,
-            "(call $check_sig (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0))",
-            6,
-        ),
-        HostFunctionSpec::AccountKeylet => (
-            import::ACCOUNTROOT_ID,
-            "(call $accountroot_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::AmmKeylet => (
-            import::AMM_ID,
-            "(call $amm_id (i32.const 0) (i32.const 20) (i32.const 24) (i32.const 40) (i32.const 0) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::CheckKeylet => (
-            import::CHECK_ID,
-            "(call $check_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::CredentialKeylet => (
-            import::CREDENTIAL_ID,
-            "(call $credential_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 4) (i32.const 44) (i32.const 20))",
-            8,
-        ),
-        HostFunctionSpec::DelegateKeylet => (
-            import::DELEGATE_ID,
-            "(call $delegate_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::DepositPreauthKeylet => (
-            import::DEPOSIT_PREAUTH_ID,
-            "(call $deposit_preauth_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::DidKeylet => (
-            import::DID_ID,
-            "(call $did_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::EscrowKeylet => (
-            import::ESCROW_ID,
-            "(call $escrow_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::TrustLineKeylet => (
-            import::TRUSTLINE_ID,
-            "(call $trustline_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 20) (i32.const 60) (i32.const 32))",
-            8,
-        ),
-        HostFunctionSpec::MptokenIssuanceKeylet => (
-            import::MPT_ISSUANCE_ID,
-            "(call $mpt_issuance_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::MptokenKeylet => (
-            import::MPTOKEN_ID,
-            "(call $mptoken_id (i32.const 0) (i32.const 24) (i32.const 24) (i32.const 20) (i32.const 44) (i32.const 20))",
-            6,
-        ),
-        HostFunctionSpec::NftokenOfferKeylet => (
-            import::NFT_OFFER_ID,
-            "(call $nft_offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::OfferKeylet => (
-            import::OFFER_ID,
-            "(call $offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::OracleKeylet => (
-            import::ORACLE_ID,
-            "(call $oracle_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::PaychannelKeylet => (
-            import::PAYCHAN_ID,
-            "(call $paychan_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 40) (i32.const 20))",
-            8,
-        ),
-        HostFunctionSpec::PermissionedDomainKeylet => (
-            import::PERMISSIONED_DOMAIN_ID,
-            "(call $permissioned_domain_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::SignerListKeylet => (
-            import::SIGNERS_ID,
-            "(call $signers_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::TicketKeylet => (
-            import::TICKET_ID,
-            "(call $ticket_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::VaultKeylet => (
-            import::VAULT_ID,
-            "(call $vault_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
-            6,
-        ),
-        HostFunctionSpec::Sha512Half => (
-            import::SHA512_HALF,
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 32))",
-            4,
-        ),
-        HostFunctionSpec::Trace => (
-            import::TRACE,
-            "(call $trace (i32.const 0) (i32.const 0) (i32.const 1) (i32.const 0) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::UpdateData => (
-            import::SET_DATA,
-            "(call $set_data (i32.const 0) (i32.const 8))",
-            2,
-        ),
-        HostFunctionSpec::GetNft => (
-            import::NFT_URI,
-            "(call $nft_uri (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 32) (i32.const 52) (i32.const 12))",
-            6,
-        ),
-        HostFunctionSpec::GetNftIssuer => (
-            import::NFT_ISSUER,
-            "(call $nft_issuer (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 20))",
-            4,
-        ),
-        HostFunctionSpec::GetNftTaxon => (
-            import::NFT_TAXON,
-            "(call $nft_taxon (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::GetNftFlags => (
-            import::NFT_FLAGS,
-            "(call $nft_flags (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetNftTransferFee => (
-            import::NFT_XFER_FEE,
-            "(call $nft_xfer_fee (i32.const 0) (i32.const 32))",
-            2,
-        ),
-        HostFunctionSpec::GetNftSequence => (
-            import::NFT_SERIAL,
-            "(call $nft_serial (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
-            4,
-        ),
-        HostFunctionSpec::FloatFromInt => (
-            import::FLOAT_FROM_INT,
-            "(call $float_from_int (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 0))",
-            4,
-        ),
-        HostFunctionSpec::FloatFromUint => (
-            import::FLOAT_FROM_UINT,
-            "(call $float_from_uint (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatFromStamount => (
-            import::FLOAT_FROM_STAMOUNT,
-            "(call $float_from_stamount (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatFromStnumber => (
-            import::FLOAT_FROM_STNUMBER,
-            "(call $float_from_stnumber (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatToInt => (
-            import::FLOAT_TO_INT,
-            "(call $float_to_int (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatToMantExp => (
-            import::FLOAT_TO_MANT_EXP,
-            "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 4))",
-            6,
-        ),
-        HostFunctionSpec::FloatFromMantExp => (
-            import::FLOAT_FROM_MANT_EXP,
-            "(call $float_from_mant_exp (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 0))",
-            5,
-        ),
-        HostFunctionSpec::FloatCompare => (
-            import::FLOAT_CMP,
-            "(call $float_cmp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8))",
-            4,
-        ),
-        HostFunctionSpec::FloatAdd => (
-            import::FLOAT_ADD,
-            "(call $float_add (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatSubtract => (
-            import::FLOAT_SUB,
-            "(call $float_sub (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatMultiply => (
-            import::FLOAT_MULT,
-            "(call $float_mult (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatDivide => (
-            import::FLOAT_DIV,
-            "(call $float_div (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
-            7,
-        ),
-        HostFunctionSpec::FloatPower => (
-            import::FLOAT_POW,
-            "(call $float_pow (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
-            6,
-        ),
-    };
-    Call {
-        import,
-        call,
-        operands,
-        yields: !matches!(op, HostFunctionSpec::Trace),
-    }
-}
-
-#[test]
-fn an_empty_module_burns_a_fixed_amount_of_fuel() {
-    let fuel = fuel_for("(i32.const 0)", &[ONE_PAGE], &FakeHost::new());
-    assert_eq!(fuel, EMPTY_MODULE_FUEL);
-}
-
-/// Calling a host function `n` times costs `n` times its gas, to the unit. Every
-/// other term is known — the module's floor, wasmi's fuel per call, one `drop` per
-/// answered call — so the total is a closed form, with the gas read from the spec
-/// table rather than restated. `n = 1` pins the charge, `n > 1` pins that it lands
-/// on every call rather than once per run.
-#[test]
-fn a_host_call_costs_its_gas_every_time_it_is_called() {
-    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
-
-    for &op in HostFunctionSpec::ALL {
-        let call = call_for(op);
-        let per_call = wasmi_call_fuel(call.operands) + op.gas();
-
-        for n in 1..=3 {
-            let body = call.body(n);
-            let n = n as u64;
-
-            assert_eq!(
-                fuel_for(&body, &[call.import, ONE_PAGE], &host),
-                EMPTY_MODULE_FUEL + n * per_call + call.overhead(n),
-                "{n} x {}",
-                call.call
-            );
-        }
-    }
-}
-
-/// The gas charge precedes the call's body, so a failing call costs exactly what a
-/// successful one costs. Field 1 is answered and field 7 is not; the two modules
-/// are otherwise identical, so their totals are comparable.
-#[test]
-fn a_failing_host_call_costs_exactly_what_a_successful_one_costs() {
-    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
-    let call = |field: i32| {
-        module(
-            &[import::HOME_LE_FIELD, ONE_PAGE],
-            &format!("(call $home_le_field (i32.const {field}) (i32.const 0) (i32.const 4))"),
-        )
-    };
-
-    let answered = run(&call(1), &host).expect("the module should run");
-    let refused = run(&call(7), &host).expect("the module should run");
-
-    assert_eq!(answered.result, 1);
-    assert_eq!(refused.result, code(HostError::FieldNotFound));
-    assert_eq!(refused.fuel_used, answered.fuel_used);
-}
-
-/// `fuel_used` is `gas - remaining`: what the run spent, not what was left or what
-/// it was handed. The gas figures are derived from the run's cost, so the boundary
-/// — exactly enough, and one short — is among the cases.
-#[test]
-fn fuel_used_is_what_was_spent_not_what_was_supplied() {
-    let host = FakeHost::new();
-    let op = HostFunctionSpec::GetLedgerSqn;
-    let call = call_for(op);
-    let wat = module(&[call.import, ONE_PAGE], call.call);
-    let cost = EMPTY_MODULE_FUEL + wasmi_call_fuel(call.operands) + op.gas();
-
-    // Exactly its cost is enough, and no amount above it changes the figure. The
-    // result is checked too, so the figure belongs to a run that did the work
-    // rather than to one that was cut short.
-    for gas in [cost, cost + 1, cost * 100, PLENTY_OF_GAS] {
-        let outcome = run_with_gas(&wat, gas, &host).expect("should run");
-        assert_eq!(
-            outcome.result, 4,
-            "gas {gas}: the call should have succeeded"
-        );
-        assert_eq!(outcome.fuel_used, cost, "gas {gas}");
-    }
-
-    // One fuel short: the run ends at the call it cannot pay for and still owes the
-    // whole limit, because `charge` spends what is left.
-    let short = run_with_gas(&wat, cost - 1, &host).expect_err("one fuel short must not complete");
-    assert!(
-        matches!(short.error, RunError::OutOfGas),
-        "expected the run to end out of gas, got: {short}"
-    );
-    assert_eq!(short.fuel_used, cost - 1);
-}
-
-/// Fuel is metered, so the same module burns the same fuel every time — a
-/// property consensus depends on.
-#[test]
-fn the_same_run_burns_the_same_fuel() {
-    let call = call_for(HostFunctionSpec::Trace);
-    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
-
-    let first = run(&wat, &FakeHost::new()).expect("should run").fuel_used;
-    for _ in 0..4 {
-        assert_eq!(
-            run(&wat, &FakeHost::new()).expect("should run").fuel_used,
-            first
-        );
-    }
-    assert!(first > HostFunctionSpec::Trace.gas());
-}
-
-/// Too little gas to finish stops the run: the meter refuses the guest's own
-/// instructions before it ever reaches the host call.
-#[test]
-fn a_run_that_cannot_afford_itself_fails() {
-    let host = FakeHost::new();
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-
-    for gas in [0, 1, 10] {
-        let Err(failure) = run_with_gas(&wat, gas, &host) else {
-            panic!("gas {gas} should not have completed");
-        };
-        assert!(
-            matches!(failure.error, RunError::OutOfGas),
-            "gas {gas}: expected the run to end out of gas, got: {failure}"
-        );
-    }
-}
-
-/// A guest looping forever is stopped by gas rather than running away, and owes
-/// the gas it burned doing it.
-#[test]
-fn an_endless_loop_is_stopped_by_gas() {
-    const GAS: u64 = 100_000;
-
-    let host = FakeHost::new();
-    let wat = module(&[ONE_PAGE], "(loop $l (br $l)) (i32.const 0)");
-
-    let failure = run_with_gas(&wat, GAS, &host).expect_err("an endless loop must not complete");
-    assert!(
-        matches!(failure.error, RunError::OutOfGas),
-        "expected the meter to stop it, got: {failure}"
-    );
-    assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway guest burns the whole limit"
-    );
-}
-
-/// A host call refused its gas stops the run: the guest never gets a chance to
-/// ignore the refusal and carry on, and it is charged the whole limit.
-///
-/// The gas range is every amount that reaches the call and cannot pay for it, so
-/// the case is the whole boundary rather than one number. `trace` is the call under
-/// it because it is the one that could not report a refusal even if it wanted to:
-/// stopping the run is the whole of what the guest sees.
-#[test]
-fn a_host_call_refused_its_gas_stops_the_run() {
-    let host = FakeHost::new();
-    let op = HostFunctionSpec::Trace;
-    let call = call_for(op);
-    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
-    // Measured rather than derived: the whole run's cost, less the call's own gas,
-    // is the least a guest can be given and still reach the call. Below that the
-    // meter stops the guest's own instructions instead, which is
-    // `a_run_that_cannot_afford_itself_fails`'s case, not this one.
-    let cost = run(&wat, &FakeHost::new())
-        .expect("the module should run")
-        .fuel_used;
-
-    for gas in cost - op.gas()..cost {
-        let Err(failure) = run_with_gas(&wat, gas, &host) else {
-            panic!("gas {gas}: the run completed, so the guest was handed the refusal");
-        };
-        assert!(
-            matches!(failure.error, RunError::OutOfGas),
-            "gas {gas}: expected the run to end out of gas, got: {failure}"
-        );
-        assert_eq!(
-            failure.fuel_used, gas,
-            "gas {gas}: a call it cannot afford burns the whole limit"
-        );
-    }
-    assert!(host.traces().is_empty(), "the host body must not have run");
-}
-
-// ---------------------------------------------------------------------------
-// The transfer limit
-// ---------------------------------------------------------------------------
-
-/// A module that repeats `call` while `keep_going` holds, then returns the last
-/// status, so a budget can be run to exhaustion inside one invocation.
-fn until_refused(imports: &str, call: &str, keep_going: &str) -> String {
-    module(
-        &[imports, ONE_PAGE],
-        &format!(
-            "(local $r i32)
-             (loop $l
-               (local.set $r {call})
-               (br_if $l {keep_going}))
-             (local.get $r)"
-        ),
-    )
-}
-
-/// For a call whose success is a positive byte count.
-const WHILE_POSITIVE: &str = "(i32.gt_s (local.get $r) (i32.const 0))";
-
-/// Bytes written into guest memory are charged against the run's budget, and the
-/// budget is a per-run total: 1 MiB of 1 KiB values exhausts it.
-#[test]
-fn writes_spend_the_transfer_budget() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let wat = until_refused(
-        import::HOME_LE_FIELD,
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-        WHILE_POSITIVE,
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
-    assert_eq!(
-        host.fields_asked.borrow().len() as u64,
-        TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1,
-        "one call per 1 KiB of budget, plus the one that was refused"
-    );
-}
-
-/// The budget is per run, not per call: a fresh run starts with a full budget.
-#[test]
-fn each_run_gets_its_own_budget() {
-    let wat = until_refused(
-        import::HOME_LE_FIELD,
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-        WHILE_POSITIVE,
-    );
-
-    for _ in 0..2 {
-        let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-        let outcome = run(&wat, &host).expect("the module should run");
-        assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
-        assert_eq!(
-            host.fields_asked.borrow().len() as u64,
-            TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1
-        );
-    }
-}
-
-/// A run well inside the budget never sees it.
-#[test]
-fn a_modest_run_never_meets_the_budget() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, MAX_FIELD_BYTES as i32);
-}
-
-/// A write the budget refuses is a write that did not happen. `float_to_mant_exp` is
-/// the case worth pinning: its two regions are charged as one, so a call that cannot
-/// pay for both must leave both alone rather than place the mantissa and refuse.
-#[test]
-fn a_write_the_budget_refuses_reaches_guest_memory_in_no_part() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::filler(MAX_FIELD_BYTES))
-        .answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    // Spend the budget on 1 KiB fields at offset 0, then ask for a mantissa and an
-    // exponent at offsets well clear of them.
-    let call = "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 2048) (i32.const 8) (i32.const 2064) (i32.const 4))";
-    let spent = |tail: &str| {
-        module(
-            &[import::HOME_LE_FIELD, import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-            &format!(
-                "(local $r i32)
-                 (loop $l
-                   (local.set $r (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
-                   (br_if $l {WHILE_POSITIVE}))
-                 {tail}"
-            ),
-        )
-    };
-
-    let refused = run(&spent(call), &host).expect("the module should run");
-    assert_eq!(refused.result, code(HostError::OutOfTransferLimit));
-
-    let wat = spent(&format!(
-        "(drop {call})
-         (i32.or (i32.load8_u (i32.const 2048)) (i32.load8_u (i32.const 2064)))"
-    ));
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, 0, "neither region should be written");
-}
-
-/// The same rule on the path that writes straight into guest memory: `write_into`
-/// hands the host a slice *of the guest's own buffer*, so a value the budget cannot
-/// pay for has to be kept out of that slice before the host fills it.
-///
-/// The probe region is one the spending loop never writes to, so anything found there
-/// came from the refused call.
-#[test]
-fn a_straight_write_the_budget_refuses_reaches_guest_memory_in_no_part() {
-    /// Clear of the offset the spending loop writes to.
-    const PROBE: usize = 2048;
-    /// Every byte of the value, so the fold sees a prefix as readily as the whole.
-    const MARK: u8 = 0xff;
-
-    let host = FakeHost::new().answering_field(1, Answer::bytes(vec![MARK; MAX_FIELD_BYTES]));
-    let call = format!(
-        "(call $home_le_field (i32.const 1) (i32.const {PROBE}) (i32.const {MAX_FIELD_BYTES}))"
-    );
-
-    // Every local the tails below use is declared here: wasm wants them all ahead of
-    // the first instruction.
-    let spent = |tail: &str| {
-        module(
-            &[import::HOME_LE_FIELD, ONE_PAGE],
-            &format!(
-                "(local $r i32) (local $i i32) (local $seen i32)
-                 (loop $l
-                   (local.set $r (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
-                   (br_if $l {WHILE_POSITIVE}))
-                 {tail}"
-            ),
-        )
-    };
-
-    let refused = run(&spent(&call), &host).expect("the module should run");
-    assert_eq!(refused.result, code(HostError::OutOfTransferLimit));
-
-    // Guest memory starts zero-filled, so or-ing the region together reports whether
-    // any byte of it was written.
-    let wat = spent(&format!(
-        "(drop {call})
-         (loop $l
-           (local.set $seen (i32.or (local.get $seen)
-                                    (i32.load8_u (i32.add (i32.const {PROBE}) (local.get $i)))))
-           (local.set $i (i32.add (local.get $i) (i32.const 1)))
-           (br_if $l (i32.lt_u (local.get $i) (i32.const {MAX_FIELD_BYTES}))))
-         (local.get $seen)"
-    ));
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(outcome.result, 0, "not one byte should have been written");
-}
-
-/// What a write may deliver is what is *left* of the budget, to the byte.
-///
-/// The prologue spends all but `LEFT`, and field 3's host answers with as much as it
-/// is offered — so the window `write_into` opened is what it reports and what it
-/// leaves in guest memory, and both are read off as `LEFT`. A mark is a 1, so the
-/// fold over the probe's whole buffer counts the bytes that reached it.
-///
-/// `LEFT` is under [`MAX_FIELD_BYTES`] and the buffer is wider than both probes'
-/// values, so it is the budget answering and neither the field cap nor the guest's
-/// capacity. Field 4 is the byte past it: a host whose value is one larger than what
-/// is left, which no window can hold.
-#[test]
-fn a_write_may_deliver_what_is_left_of_the_budget_and_not_a_byte_more() {
-    /// Full-cap writes, all the prologue can make without overshooting.
-    const BULK: u64 = TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 - 1;
-    /// What the prologue leaves unspent.
-    const LEFT: usize = MAX_FIELD_BYTES / 2;
-    /// The write that trims what [`BULK`] leaves down to [`LEFT`].
-    const TRIM: usize = MAX_FIELD_BYTES - LEFT;
-    /// Clear of the offset the prologue writes to.
-    const PROBE: usize = 2048;
-    const BUFFER: usize = MAX_FIELD_BYTES;
-    /// One per byte written, so the fold below sums to how many there were.
-    const MARK: u8 = 1;
-
-    assert_eq!(
-        BULK * MAX_FIELD_BYTES as u64 + TRIM as u64 + LEFT as u64,
-        TRANSFER_LIMIT_BYTES,
-        "the prologue must spend all but LEFT of the budget"
-    );
-
-    let host = FakeHost::new()
-        .answering_field(1, Answer::filler(MAX_FIELD_BYTES))
-        .answering_field(2, Answer::filler(TRIM))
-        .answering_field(3, Answer::as_much_as_offered(MARK))
-        .answering_field(4, Answer::claiming(LEFT + 1));
-
-    let probe = |field: i32| {
-        format!(
-            "(call $home_le_field (i32.const {field}) (i32.const {PROBE}) (i32.const {BUFFER}))"
-        )
-    };
-    // Every local the tails use, declared where wasm wants them.
-    let after_prologue = |tail: String| {
-        let wat = module(
-            &[import::HOME_LE_FIELD, ONE_PAGE],
-            &format!(
-                "(local $i i32) (local $marks i32)
-                 (loop $l
-                   (drop (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES})))
-                   (local.set $i (i32.add (local.get $i) (i32.const 1)))
-                   (br_if $l (i32.lt_u (local.get $i) (i32.const {BULK}))))
-                 (drop (call $home_le_field (i32.const 2) (i32.const 0) (i32.const {TRIM})))
-                 (local.set $i (i32.const 0))
-                 {tail}"
-            ),
-        );
-        run(&wat, &host).expect("the module should run").result
-    };
-
-    assert_eq!(
-        after_prologue(probe(3)),
-        LEFT as i32,
-        "the host should be offered exactly what is left"
-    );
-
-    // Guest memory starts zero-filled, so summing the probe's whole buffer counts the
-    // marks in it.
-    assert_eq!(
-        after_prologue(format!(
-            "(drop {})
-             (loop $l
-               (local.set $marks (i32.add (local.get $marks)
-                                          (i32.load8_u (i32.add (i32.const {PROBE}) (local.get $i)))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $marks)",
-            probe(3)
-        )),
-        LEFT as i32,
-        "and that many marks, no more, should reach guest memory"
-    );
-
-    assert_eq!(
-        after_prologue(probe(4)),
-        code(HostError::OutOfTransferLimit),
-        "a value one byte past what is left fits no window"
-    );
-}
-
-/// Reads leave the budget alone: `read_borrowed` hands the host a slice *aliasing*
-/// guest memory, so there are no copied bytes to charge. What bounds how many reads
-/// a run can make is gas, which every host call pays before its body runs.
-///
-/// The observation is the write at the end, not the reads: the module reads four
-/// times the whole budget first, so a rule that charged reads would have nothing
-/// left, and the write would answer `OutOfTransferLimit` instead of a byte count.
-#[test]
-fn reads_do_not_spend_the_transfer_budget() {
-    /// 1 KiB reads, four times over the budget.
-    const READS: u64 = 4 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
-
-    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
-    let read = trace_call(
-        TraceDataType::AsHex,
-        EMPTY_REGION,
-        &format!("(i32.const 0) (i32.const {MAX_FIELD_BYTES})"),
-    );
-    let wat = module(
-        &[import::TRACE, import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (loop $l
-               {read}
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {READS}))))
-             (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"
-        ),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(
-        host.traces().len() as u64,
-        READS,
-        "every read should have been served"
-    );
-    assert_eq!(
-        outcome.result, MAX_FIELD_BYTES as i32,
-        "the write after {READS} reads of {MAX_FIELD_BYTES} bytes should still have its budget"
-    );
-}
-
-/// Only the output half of a read-write call spends the budget. `sha512_half`'s
-/// input is a borrowed read like any other, aliasing guest memory rather than
-/// crossing the boundary, so a run may hash far more bytes than the budget holds as
-/// long as the digests it writes fit inside it.
-///
-/// The two totals are asserted, so the arithmetic that makes the case is in the
-/// test rather than in a comment: the inputs alone would overrun the budget, the
-/// digests alone are a small fraction of it.
-#[test]
-fn only_the_output_half_of_a_read_write_spends_the_budget() {
-    /// Enough 1 KiB inputs to overrun the budget twice over.
-    const CALLS: u64 = 2 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
-
-    assert!(
-        CALLS * MAX_FIELD_BYTES as u64 > TRANSFER_LIMIT_BYTES,
-        "the inputs alone must overrun the budget"
-    );
-    assert!(
-        CALLS * HASH_LEN as u64 <= TRANSFER_LIMIT_BYTES / 2,
-        "the digests alone must stay well inside it"
-    );
-
-    let host = FakeHost::new().answering_digest(Answer::filler(HASH_LEN));
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $r i32)
-             (loop $l
-               (local.set $r (call $sha512_half (i32.const 0) (i32.const {MAX_FIELD_BYTES})
-                                                (i32.const 0) (i32.const {HASH_LEN})))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {CALLS}))))
-             (local.get $r)"
-        ),
-    );
-
-    let outcome = run(&wat, &host).expect("the module should run");
-    assert_eq!(
-        host.digested.borrow().len() as u64,
-        CALLS,
-        "every call should have been served"
-    );
-    assert_eq!(
-        outcome.result, HASH_LEN as i32,
-        "only the digests are charged, and they fit"
-    );
-}

crates/xrpl-wasm-vm/tests/memory_policy.rs

@@ -1,621 +0,0 @@
-//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
-//! crossing the boundary. This is the policy the guest observes, so each rule is
-//! pinned to the code it answers with.
-
-mod support;
-
-use support::{
-    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
-    traced,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
-
-/// One page, so anything at or past 65536 is out of bounds.
-const PAGE: i64 = 64 * 1024;
-
-/// The per-field size cap, as a wasm operand.
-const CAP: i64 = MAX_FIELD_BYTES as i64;
-/// One byte over the cap: the smallest value the engine must refuse.
-const OVER_CAP: i64 = CAP + 1;
-
-// ---------------------------------------------------------------------------
-// Output regions (`write_into`)
-// ---------------------------------------------------------------------------
-
-/// The whole output region must be in bounds, not merely its start — the engine
-/// checks `[dst, dst + cap)` before the host is allowed to write.
-#[test]
-fn an_output_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// A region ending exactly at the last byte of memory is in bounds.
-#[test]
-fn an_output_region_ending_at_the_last_byte_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
-    );
-    assert_eq!(status(&wat, &host), 4);
-}
-
-/// The wire carries `i32`, so a guest can present a negative pointer or length.
-#[test]
-fn a_negative_output_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// The host reports a value's true length whether or not it fitted; a value that
-/// did not fit is the guest's error, not the host's.
-#[test]
-fn a_value_larger_than_the_buffer_is_refused() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(64));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
-}
-
-/// A zero-length output region is in bounds and simply cannot hold anything.
-#[test]
-fn a_zero_length_output_region_is_in_bounds_but_too_small() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 0))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-}
-
-/// A host that reports more than the per-field cap is refused even when the
-/// guest offered room for it: the cap is the engine's rule, not the buffer's.
-#[test]
-fn a_value_past_the_field_cap_is_refused() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::claiming(OVER_CAP as usize))
-        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
-}
-
-/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
-/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
-/// declared, so a value past the cap does not fit the region it is offered and no
-/// prefix of it can reach guest memory either.
-///
-/// The host answers with a real over-cap value: [`Answer::claiming`] writes
-/// nothing whatever the engine does, so it could not tell the two apart. The
-/// second module folds the *whole* declared buffer rather than one byte, so the
-/// claim is about the region and not about its first byte.
-#[test]
-fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
-    /// The buffer the guest declares: well over the cap, so the clamp bites.
-    const BUFFER: usize = 4096;
-
-    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
-    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
-    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
-
-    // The status the guest sees, from a module that returns it directly.
-    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
-    assert_eq!(
-        status(&refusing, &host),
-        code(HostError::DataFieldTooLarge),
-        "the value is refused"
-    );
-
-    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
-    // so any byte the host wrote shows up here.
-    let reading = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $seen i32)
-             (drop {call})
-             (loop $l
-               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $seen)"
-        ),
-    );
-    assert_eq!(
-        status(&reading, &host),
-        0,
-        "and not one of its bytes is in the guest's buffer"
-    );
-}
-
-/// The field cap is checked before the buffer-fit rule, so a value that breaks both
-/// is reported as over-cap. The guest branches on the code, and the two rules
-/// answer different questions, so the order is worth pinning.
-#[test]
-fn the_field_cap_precedes_the_buffer_fit_check() {
-    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
-
-    // A 63-byte buffer: the value is both over the cap and far too big to fit.
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-}
-
-// ---------------------------------------------------------------------------
-// Input regions (`Region::read`, via `sha512_half`)
-//
-// `sha512_half`'s first pair is an input region like any other, and it is the
-// input the guest gets a status back from: `trace`, the other reader, answers
-// nothing at all. So the codes are pinned here and the silence below.
-// ---------------------------------------------------------------------------
-
-/// An input region is bounds-checked the same way an output region is. Every case
-/// here stays within the field cap, which on an input is checked first.
-#[test]
-fn an_input_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "ptr {ptr} len {len}"
-        );
-        assert!(host.digested.borrow().is_empty(), "the host is not called");
-    }
-}
-
-#[test]
-fn a_negative_input_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "ptr {ptr} len {len}"
-        );
-    }
-}
-
-/// The field cap bounds what the guest may hand *in*, too.
-#[test]
-fn an_input_past_the_field_cap_is_refused() {
-    let host = FakeHost::new();
-    let digest = |len: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const 0) (i32.const {len})
-                                    (i32.const 2048) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    assert_eq!(
-        status(&digest(OVER_CAP), &host),
-        code(HostError::DataFieldTooLarge)
-    );
-    assert!(host.digested.borrow().is_empty());
-
-    assert_eq!(
-        status(&digest(CAP), &host),
-        HASH_LEN as i32,
-        "the cap itself is allowed"
-    );
-}
-
-/// The two directions check in opposite orders: an input's length is known before
-/// the read, so the cap comes first, while an output's region has to be resolved
-/// before the host can produce a value, so bounds come first there.
-#[test]
-fn the_field_cap_precedes_the_bounds_check_on_an_input() {
-    let host = FakeHost::new();
-
-    let reading = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {})
-                                (i32.const 0) (i32.const {HASH_LEN}))",
-            PAGE + 1
-        ),
-    );
-    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
-
-    let writing = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
-    );
-    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
-}
-
-// ---------------------------------------------------------------------------
-// The reader with no result (`read_borrowed`, via `trace`)
-// ---------------------------------------------------------------------------
-
-/// `trace` reads two regions and either one being bad refuses the call. The same
-/// rule as above, and the guest is told nothing: the refusal is the host not being
-/// called, and the run carries on to the constant that follows.
-#[test]
-fn both_of_traces_regions_are_checked_silently() {
-    let host = FakeHost::new();
-    let regions = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-            EMPTY_REGION.to_owned(),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const 0) (i32.const {OVER_CAP})"),
-        ),
-        (
-            "(i32.const -1) (i32.const 1)".to_owned(),
-            EMPTY_REGION.to_owned(),
-        ),
-    ];
-
-    for (msg, data) in regions {
-        let wat = module(
-            &[import::TRACE, ONE_PAGE],
-            &traced(TraceDataType::AsHex, &msg, &data),
-        );
-        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
-        assert!(
-            host.traces().is_empty(),
-            "msg {msg} data {data}: the host must not be called"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Both at once (`write_buffered`, via `sha512_half`)
-// ---------------------------------------------------------------------------
-
-/// A call with an input and an output region decides everything about the input
-/// before anything about the output, so a bad input is reported however the output
-/// region is wrong — out of bounds, or a pointer that is not one at all.
-///
-/// The whole output region, params included, is judged after the host has answered.
-/// Hoisting any part of that above the call would put the output's verdict first for
-/// these cases, and there is no half of it that can be hoisted on a principle the
-/// other half shares.
-#[test]
-fn a_read_write_checks_its_input_before_its_output() {
-    let host = FakeHost::new();
-    let digest = |src: i64, src_len: i64, dst: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
-                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    let over_cap = digest(0, OVER_CAP, 0);
-    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
-
-    let out_of_bounds = digest(PAGE, 4, 0);
-    assert_eq!(
-        status(&out_of_bounds, &host),
-        code(HostError::PointerOutOfBounds)
-    );
-
-    // A bad input against each way the output can be wrong: the input's verdict is
-    // the one reported, and the host is never asked for a value nobody can take.
-    for dst in [PAGE, -1] {
-        let both_bad = digest(0, OVER_CAP, dst);
-        assert_eq!(
-            status(&both_bad, &host),
-            code(HostError::DataFieldTooLarge),
-            "dst {dst}"
-        );
-    }
-    assert!(host.digested.borrow().is_empty(), "the host is not reached");
-}
-
-/// The output half of a read-write call obeys the same rules as a plain write.
-#[test]
-fn a_read_write_output_obeys_the_write_rules() {
-    let host = FakeHost::new().answering_digest(Answer::filler(32));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// A refused value reaches guest memory in no part, however much of it the host
-/// wrote. The host answers with 32 bytes it did write and a length it did not, so
-/// the refusal happens with the value sitting in the run's output buffer — and the
-/// guest's buffer has to come back untouched.
-///
-/// Stronger than the contract asks for: a guest must not read its buffer on a
-/// negative status. It holds because the buffer is copied to the guest only after
-/// the length, the bounds, the fit and the budget have all passed, so there is no
-/// window in which a refused value is in guest memory.
-#[test]
-fn a_refused_value_leaves_nothing_in_guest_memory() {
-    const MARKER: u8 = 77;
-
-    // The two refusals a value can meet after the host has produced it: longer
-    // than the field cap, and longer than the buffer the guest offered.
-    let refusals = [
-        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
-        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
-    ];
-
-    for (claimed, cap, expected) in refusals {
-        let host =
-            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
-        let call = format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
-        );
-
-        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
-        assert_eq!(
-            status(&refused, &host),
-            code(expected),
-            "claiming {claimed}"
-        );
-
-        // The same call, reporting what is at the output region afterwards.
-        let inspect = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
-        );
-        assert_eq!(
-            status(&inspect, &host),
-            0,
-            "claiming {claimed}: the refused value must not have been written"
-        );
-    }
-}
-
-/// An input region may overlap the output region: the host is served the input as
-/// it stands and its answer lands afterwards, so the two cannot interfere. The
-/// marker is any byte distinct from the input's first (`a`), so `finish` returning
-/// it proves the write landed.
-#[test]
-fn an_input_may_overlap_the_output() {
-    const MARKER: u8 = 99;
-
-    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
-
-    let wat = module(
-        &[
-            import::SHA512_HALF,
-            ONE_PAGE,
-            r#"(data (i32.const 0) "abcd")"#,
-        ],
-        &format!(
-            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
-                                      (i32.const 0) (i32.const {HASH_LEN})))
-             (i32.load8_u (i32.const 0))"
-        ),
-    );
-    assert_eq!(
-        status(&wat, &host),
-        i32::from(MARKER),
-        "the output overwrote the input"
-    );
-    assert_eq!(
-        *host.digested.borrow(),
-        vec![b"abcd".to_vec()],
-        "the host saw the input as it was"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The memory export itself
-// ---------------------------------------------------------------------------
-
-/// A host call with no memory to work in ends the run instead of answering the
-/// guest: there is no buffer for a status to describe, and nothing the guest could
-/// do about the answer — which is what puts this beside out-of-gas on the fatal
-/// channel. What the guest burned getting there is still charged.
-fn assert_no_memory(wat: &str, host: &FakeHost) {
-    let failure = failure(wat, host);
-    assert!(
-        matches!(failure.error, RunError::NoMemory),
-        "expected the run to end for want of a memory export, got: {failure}"
-    );
-    assert!(failure.fuel_used > 0, "{failure}");
-}
-
-/// Every region is relative to the guest's exported memory, so a module without
-/// one cannot make a host call at all.
-#[test]
-fn a_module_that_exports_no_memory_cannot_call_the_host() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, "(memory 1)"],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// Having no memory is answered before anything about a call's arguments, so a
-/// module without one ends the run even when its arguments would have earned a
-/// guest-visible code of their own (here an input over the field cap).
-///
-/// The order is deliberate: no memory is a fact about the instance, not about this
-/// call, and a region cannot be validated against a memory that is not there. It
-/// costs the guest nothing — every call such a module makes ends the run anyway.
-#[test]
-fn no_memory_is_answered_before_a_calls_arguments_are() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::SHA512_HALF, "(memory 1)"],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
-                                (i32.const 0) (i32.const {HASH_LEN}))"
-        ),
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// The memory's export *name* is not part of the contract: the engine takes the
-/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
-/// to `"memory"` — it is a toolchain convention, so the kind decides.
-#[test]
-fn a_memory_exported_under_any_name_is_the_guests_memory() {
-    let host = FakeHost::new();
-
-    for name in ["mem", "linear", "the memory"] {
-        let wat = module(
-            &[
-                import::LDGR_INDEX,
-                &format!(r#"(memory (export "{name}") 1)"#),
-            ],
-            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-             (i32.load (i32.const 64))",
-        );
-        assert_eq!(
-            status(&wat, &host),
-            7,
-            "the host wrote into the memory exported as '{name}'"
-        );
-    }
-}
-
-/// One memory exported under several names is one memory. The engine resolves the
-/// first export of kind memory, and with at most one memory per module every such
-/// export is that memory, so the order the exports are walked in cannot change the
-/// answer.
-#[test]
-fn one_memory_exported_under_several_names_is_still_that_memory() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
-        ],
-        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-         (i32.load (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 7);
-}
-
-/// The export has to *be* a memory: a global named `memory` is not one, and it
-/// neither serves as the guest's memory nor hides the memory the module really
-/// exports. The kind decides, so the conventional name carries no weight on
-/// either side.
-#[test]
-fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
-    let host = FakeHost::new();
-
-    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
-
-    let wrong_kind = module(
-        &[
-            import::LDGR_INDEX,
-            "(memory 1)",
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_no_memory(&wrong_kind, &host);
-
-    let shadowed = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "mem") 1)"#,
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_eq!(
-        status(&shadowed, &host),
-        4,
-        "the real memory is found past the global that took its name"
-    );
-}
-
-/// Bounds follow the memory the module actually declared, not a fixed page.
-#[test]
-fn bounds_follow_the_declared_memory_size() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
-        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
-    );
-    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
-}

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -1,591 +0,0 @@
-//! What screening refuses, and that it refuses nothing a run would have served.
-//!
-//! `check` reaches its verdict from the compiled module alone, so these tests take
-//! no host — except the ones that put the same module through `run` to compare the
-//! two.
-
-mod support;
-
-use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
-use xrpl_host_functions::HostFunctionSpec;
-use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage screening refused a module at, because the caller maps the
-/// stages separately. The error comes back out for the tests that also read its
-/// message.
-macro_rules! assert_stage {
-    ($refusal:expr, $stage:pat) => {{
-        let refusal = $refusal;
-        assert!(
-            matches!(refusal, $stage),
-            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
-            refusal
-        );
-        refusal
-    }};
-}
-
-/// Screens `wat`, which must assemble.
-fn check(wat: &str) -> Result<(), CheckError> {
-    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
-}
-
-fn refusal(wat: &str) -> CheckError {
-    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
-}
-
-fn passes(wat: &str) {
-    if let Err(refusal) = check(wat) {
-        panic!("expected this module to pass, but: {refusal}\n{wat}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Compiling
-// ---------------------------------------------------------------------------
-
-/// A contract that imports a host function, exports its memory and exports the
-/// entry point is what screening is looking for.
-#[test]
-fn a_runnable_contract_passes() {
-    passes(&module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    ));
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_pass() {
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// Screening takes wasm binaries, and text is not one — the same rule the VM
-/// applies, from the same `wasmi` built without its `wat` feature. Turning that
-/// feature on would make this transaction blob valid at both ends.
-#[test]
-fn a_text_format_module_does_not_pass() {
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let refusal =
-        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
-    assert_stage!(refusal, CheckError::Compile(_));
-
-    // The same module, assembled first, passes: the text is sound and only the
-    // format was refused.
-    passes(&text);
-}
-
-/// A feature the engine disables is refused here too, because both stages compile
-/// against the one engine. `vm_limits.rs` walks every disabled feature; this pins
-/// that screening sees the same configuration.
-#[test]
-fn a_disabled_feature_does_not_pass() {
-    let refusal = refusal(&module(
-        &[ONE_PAGE],
-        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// Every host function the ABI declares, spelled as a guest imports it. The count
-/// is asserted against the ABI so a function added to it cannot be left out here.
-const ALL_IMPORTS: [&str; 61] = [
-    import::LDGR_INDEX,
-    import::PARENT_LDGR_TIME,
-    import::PARENT_LDGR_HASH,
-    import::BASE_FEE,
-    import::AMENDMENT_ENABLED,
-    import::CACHE_LE,
-    import::TX_FIELD,
-    import::HOME_LE_FIELD,
-    import::LE_FIELD,
-    import::TX_INNER,
-    import::HOME_LE_INNER,
-    import::LE_INNER,
-    import::TX_ARR_LEN,
-    import::HOME_LE_ARR_LEN,
-    import::LE_ARR_LEN,
-    import::TX_INNER_ARR_LEN,
-    import::HOME_LE_INNER_ARR_LEN,
-    import::LE_INNER_ARR_LEN,
-    import::CHECK_SIG,
-    import::ACCOUNTROOT_ID,
-    import::AMM_ID,
-    import::CHECK_ID,
-    import::CREDENTIAL_ID,
-    import::DELEGATE_ID,
-    import::DEPOSIT_PREAUTH_ID,
-    import::DID_ID,
-    import::ESCROW_ID,
-    import::TRUSTLINE_ID,
-    import::MPT_ISSUANCE_ID,
-    import::MPTOKEN_ID,
-    import::NFT_OFFER_ID,
-    import::OFFER_ID,
-    import::ORACLE_ID,
-    import::PAYCHAN_ID,
-    import::PERMISSIONED_DOMAIN_ID,
-    import::SIGNERS_ID,
-    import::TICKET_ID,
-    import::VAULT_ID,
-    import::SHA512_HALF,
-    import::TRACE,
-    import::SET_DATA,
-    import::NFT_URI,
-    import::NFT_ISSUER,
-    import::NFT_TAXON,
-    import::NFT_FLAGS,
-    import::NFT_XFER_FEE,
-    import::NFT_SERIAL,
-    import::FLOAT_FROM_INT,
-    import::FLOAT_FROM_UINT,
-    import::FLOAT_FROM_STAMOUNT,
-    import::FLOAT_FROM_STNUMBER,
-    import::FLOAT_TO_INT,
-    import::FLOAT_TO_MANT_EXP,
-    import::FLOAT_FROM_MANT_EXP,
-    import::FLOAT_CMP,
-    import::FLOAT_ADD,
-    import::FLOAT_SUB,
-    import::FLOAT_MULT,
-    import::FLOAT_DIV,
-    import::FLOAT_POW,
-];
-
-#[test]
-fn every_declared_host_function_may_be_imported() {
-    assert_eq!(
-        ALL_IMPORTS.len(),
-        HostFunctionSpec::ALL.len(),
-        "the ABI gained a host function with no import declaration in this test"
-    );
-
-    let mut parts = ALL_IMPORTS.to_vec();
-    parts.push(ONE_PAGE);
-    passes(&module(&parts, "(i32.const 0)"));
-}
-
-/// A module may import fewer host functions than are registered, but not more.
-#[test]
-fn an_unknown_host_function_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("no host function 'no_such_function'"),
-        "{refusal}"
-    );
-}
-
-/// Host functions live under one module name — `host_lib` — and an import naming
-/// another is refused even when the function name is real. `env` is in the list
-/// because that is what plain clang emits.
-#[test]
-fn an_import_from_another_module_does_not_pass() {
-    for module_name in ["host", "env", ""] {
-        let refusal = refusal(&module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        ));
-        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-    }
-}
-
-/// A host function's name imported as something other than a function. The engine
-/// defines it as a function and nothing else, so this does not link either.
-#[test]
-fn a_host_function_imported_as_a_global_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
-            ONE_PAGE,
-        ],
-        "(global.get $g)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("'host_lib::ldgr_index' is not a function"),
-        "{refusal}"
-    );
-}
-
-/// A module faulty at two stages is refused by the earlier one — it imports what no
-/// engine serves *and* exports no entry point. The imports are what the rest of the
-/// module depends on, so that is the message worth having.
-#[test]
-fn the_earlier_stage_is_the_one_reported() {
-    let refusal = refusal(
-        r#"(module
-             (import "host_lib" "no_such_function" (func $f (result i32)))
-             (memory (export "memory") 1)
-             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
-    );
-
-    assert_stage!(refusal, CheckError::Import(_));
-}
-
-/// The signature is the one part of an import screening does not compare, so a
-/// module that will not link can still pass. Recorded here because it is the gap
-/// this stage leaves, not because it is wanted.
-#[test]
-fn an_import_with_the_wrong_signature_still_passes() {
-    let wat = module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(i32.const 0)",
-    );
-    passes(&wat);
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a mistyped import must not link");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1)
-                              (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "no entry point 'finish'");
-}
-
-/// The entry point is looked up by the name the caller asks for, as a run looks it
-/// up: screening a contract for one entry point says nothing about another.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let wasm = assemble(
-        r#"(module (memory (export "memory") 1)
-             (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-
-    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
-    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
-}
-
-/// Both halves of the entry point's type are screened: a module returning the
-/// wrong thing, or taking anything at all, would fail the run's typed lookup.
-#[test]
-fn an_entry_point_of_the_wrong_type_does_not_pass() {
-    for (signature, body) in [
-        ("(result i64)", "(i64.const 0)"),
-        ("(param i32) (result i32)", "(i32.const 0)"),
-        ("", "(nop)"),
-    ] {
-        let refusal = refusal(&format!(
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") {signature} {body}))"#
-        ));
-        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-        assert_eq!(
-            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
-            "{signature}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "export 'finish' is not a function");
-}
-
-// ---------------------------------------------------------------------------
-// Agreement with a run
-// ---------------------------------------------------------------------------
-
-/// A module with no linear memory to export passes. A contract that makes no host
-/// call needs none, and one that does is refused at the call and charged — a
-/// runtime fault, not a malformed module.
-#[test]
-fn a_module_exporting_no_memory_passes() {
-    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
-    passes(wat);
-
-    let host = FakeHost::new();
-    assert_eq!(
-        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
-            .expect("a module that calls no host function needs no memory")
-            .result,
-        0
-    );
-}
-
-/// Modules spanning what screening decides, each also put through a run.
-fn modules() -> Vec<(&'static str, String)> {
-    vec![
-        (
-            "a runnable contract",
-            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
-        ),
-        (
-            "a contract that traps",
-            module(&[ONE_PAGE], "(unreachable)"),
-        ),
-        (
-            "a disabled feature",
-            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
-        ),
-        (
-            "an unknown host function",
-            module(
-                &[
-                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(call $f)",
-            ),
-        ),
-        (
-            "an import from another module",
-            module(
-                &[
-                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "a host function imported as a global",
-            module(
-                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
-                "(global.get $g)",
-            ),
-        ),
-        (
-            "no entry point",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "other") (result i32) (i32.const 0)))"#
-                .to_string(),
-        ),
-        (
-            "an entry point of the wrong type",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") (result i64) (i64.const 0)))"#
-                .to_string(),
-        ),
-    ]
-}
-
-/// Screening refuses a module exactly when a run would refuse it at one of the
-/// three stages screening covers — nothing it rejects would have run, and nothing
-/// it passes stops before the entry point is called. The exceptions are the ones
-/// [`what_static_screening_cannot_see`] lists.
-#[test]
-fn screening_and_a_run_agree() {
-    let host = FakeHost::new();
-
-    for (label, wat) in modules() {
-        let wasm = assemble(&wat);
-        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => matches!(
-                failure.error,
-                RunError::Compile(_) | RunError::Instantiate(_) | RunError::EntryPoint(_)
-            ),
-            Ok(_) => false,
-        };
-
-        assert_eq!(
-            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
-            refused_early,
-            "{label}"
-        );
-    }
-}
-
-/// A module asking for more memory than the engine grants is refused, so the
-/// contract that could never run does not reach the ledger. The cap itself passes.
-#[test]
-fn an_exported_memory_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
-    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    ));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, so screening
-/// must not turn it away: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(memory (export "memory") 1 {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// A module asking for more table than the engine grants is refused for the same
-/// reason a memory is. The cap itself passes.
-#[test]
-fn an_exported_table_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(table (export "t") {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Table(_)).to_string();
-    assert!(refusal.contains("past the 1024-element cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") {MAX_TABLE_ELEMENTS} funcref)"#
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// Both caps are applied in one pass over the exports, so neither may end the walk
-/// early: a passing memory must not hide a failing table declared after it, and a
-/// passing table must not hide a failing memory.
-#[test]
-fn one_pass_screens_both_resources() {
-    let after_a_passing_memory = refusal(&module(
-        &[
-            ONE_PAGE,
-            &format!(r#"(table (export "t") {} funcref)"#, MAX_TABLE_ELEMENTS + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_memory, CheckError::Table(_));
-
-    let after_a_passing_table = refusal(&module(
-        &[
-            r#"(table (export "t") 1 funcref)"#,
-            &format!(r#"(memory (export "memory") {})"#, MAX_MEMORY_PAGES + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_table, CheckError::Memory(_));
-}
-
-/// As with memory, a declared *maximum* past the cap is unreachable rather than
-/// wrong: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_table_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") 1 {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// The gap, listed rather than described. A memory or a table a module keeps to
-/// itself is not in its exports, so these are the modules that pass screening and
-/// then fail to *instantiate* — which is why a run's refusal at that stage cannot be
-/// read as the node's fault.
-///
-/// The two entries are not equally remote. A contract needs an exported memory to
-/// make any host call, so the memory row can do nothing but compute and the SDK does
-/// not produce one. A table, though, is *normally* unexported — Rust exports
-/// `__indirect_function_table` only under `--export-table` — so the table row is the
-/// shape a hostile module actually takes, and the store's limiter is the only thing
-/// standing in front of it.
-#[test]
-fn what_static_screening_cannot_see() {
-    let host = FakeHost::new();
-
-    for (label, declaration) in [
-        ("memory", format!("(memory {})", MAX_MEMORY_PAGES + 1)),
-        (
-            "table",
-            format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1),
-        ),
-    ] {
-        let wat = format!(
-            r#"(module {declaration}
-                 (func (export "finish") (result i32) (i32.const 0)))"#
-        );
-
-        passes(&wat);
-
-        let failure = match xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => failure,
-            Ok(outcome) => panic!(
-                "the store's limiter must refuse the {label}, but the module returned {}",
-                outcome.result
-            ),
-        };
-        assert!(
-            matches!(failure.error, RunError::Instantiate(_)),
-            "{label}: {failure}"
-        );
-    }
-}
-
-/// A start section is guest code, so screening cannot see whether it traps — and does
-/// not have to. A trap is the guest's fault wherever it happens, so the run charges the
-/// contract for what it burned instead of reporting a module the node should have
-/// screened.
-#[test]
-fn a_start_section_screening_cannot_see_is_charged_as_a_trap() {
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    passes(&wat);
-
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a start section that traps must not complete the run");
-    assert!(matches!(failure.error, RunError::Trap(_)), "{failure}");
-    assert!(
-        failure.fuel_used > 0,
-        "charged for what it burned: {failure}"
-    );
-}

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -1,642 +0,0 @@
-//! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the memory and table caps.
-//!
-//! These are the sandbox's outer wall. Everything here fails the run rather than
-//! returning a code to the guest, so each test reads the failure's message.
-
-mod support;
-
-use support::{
-    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
-};
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage a run failed at, because the caller maps the stages to
-/// different outcomes. A stage is one `RunError` variant, so the expectation is a
-/// pattern; the failure comes back out for the tests that also read its message.
-macro_rules! assert_stage {
-    ($failure:expr, $stage:pat) => {{
-        let failure = $failure;
-        assert!(
-            matches!(failure.error, $stage),
-            concat!("expected a ", stringify!($stage), " failure, got: {}"),
-            failure
-        );
-        failure
-    }};
-}
-
-// ---------------------------------------------------------------------------
-// Linear memory
-// ---------------------------------------------------------------------------
-
-/// A module declaring more than the cap fails to instantiate — the limit applies
-/// to the initial memory, not only to growth.
-#[test]
-fn an_initial_memory_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_memory_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
-/// `memory.grow` otherwise would, because the engine's limiter sets
-/// `trap_on_grow_failure(true)`.
-#[test]
-fn growth_stops_at_the_cap() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
-    );
-    assert_eq!(
-        run(&wat, &host).expect("should run").result,
-        1,
-        "growing to exactly the cap answers the previous size"
-    );
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// A module may declare a maximum above the cap: the cap is enforced on the initial
-/// memory and on growth, not on the memory type's declared bound.
-#[test]
-fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
-
-    let wat = module(&[&memory], "(i32.const 0)");
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    let wat = module(
-        &[&memory],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-// ---------------------------------------------------------------------------
-// Tables
-// ---------------------------------------------------------------------------
-
-/// A table's whole cost is paid at instantiation: wasmi writes all 8 bytes of every
-/// element before the guest's first instruction, so a module declaring more than the
-/// cap must be refused there rather than charged for it.
-#[test]
-fn an_initial_table_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_table_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {MAX_TABLE_ELEMENTS} funcref)")],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// The cap binds a table the module keeps to itself, which is the case that matters:
-/// a contract has no reason to export its table, so screening never sees the one a
-/// hostile module declares.
-#[test]
-fn the_table_cap_binds_an_unexported_table() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", u32::from(u16::MAX) * 100)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, mirroring what
-/// linear memory allows. Nothing can reach it: `table.grow` is a reference-types
-/// instruction and the engine turns that feature off, so a table's declared minimum
-/// is also its final size.
-#[test]
-fn a_declared_table_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            "(table 1 {} funcref)",
-            u64::try_from(MAX_TABLE_ELEMENTS).expect("fits") + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Engine configuration
-// ---------------------------------------------------------------------------
-
-/// One row per feature `build_wasm_engine` turns off: the smallest module that uses
-/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
-/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
-/// instead.
-fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
-    vec![
-        (
-            "wasm_multi_value",
-            vec![
-                ONE_PAGE,
-                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
-            ],
-            "(call $two) (drop) (drop) (i32.const 0)",
-            "multi-value",
-        ),
-        (
-            "wasm_sign_extension",
-            vec![ONE_PAGE],
-            "(i32.extend8_s (i32.const 1))",
-            "sign extension",
-        ),
-        (
-            "wasm_bulk_memory",
-            vec![ONE_PAGE],
-            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
-            "bulk memory",
-        ),
-        (
-            "wasm_reference_types",
-            vec![ONE_PAGE, "(table 1 externref)"],
-            "(i32.const 0)",
-            "reference types",
-        ),
-        // The proposal covers mutable globals crossing the module boundary; an
-        // internal one is core wasm and stays allowed — see the test below.
-        (
-            "wasm_mutable_global",
-            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
-            "(i32.const 0)",
-            "mutable global",
-        ),
-        (
-            "wasm_tail_call",
-            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
-            "(return_call $f)",
-            "tail call",
-        ),
-        // Arithmetic in a constant initialiser. wasmi names the operator rather
-        // than the proposal here.
-        (
-            "wasm_extended_const",
-            vec![
-                ONE_PAGE,
-                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
-            ],
-            "(global.get $g)",
-            "non-constant operator",
-        ),
-        (
-            "wasm_multi_memory",
-            vec![ONE_PAGE, "(memory 1)"],
-            "(i32.const 0)",
-            "multiple memories",
-        ),
-        (
-            "wasm_memory64",
-            vec![r#"(memory (export "memory") i64 1)"#],
-            "(i32.const 0)",
-            "memory64",
-        ),
-        (
-            "wasm_custom_page_sizes",
-            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
-            "(i32.const 0)",
-            "custom page sizes",
-        ),
-        (
-            "wasm_wide_arithmetic",
-            vec![ONE_PAGE],
-            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
-             (i32.const 0)",
-            "wide arithmetic",
-        ),
-        // Determinism across nodes is the reason floats are off.
-        (
-            "floats",
-            vec![ONE_PAGE],
-            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-            "floating-point",
-        ),
-    ]
-}
-
-/// Every feature the engine disables is refused, and refused for that reason.
-///
-/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
-/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against this engine's own config.
-#[test]
-fn every_disabled_feature_is_refused_by_name() {
-    let host = FakeHost::new();
-
-    for (knob, parts, body, expected) in disabled_features() {
-        let wat = module(&parts, body);
-        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-
-        assert!(
-            failure.contains(expected),
-            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
-        );
-    }
-}
-
-/// The three knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// engine is a process-wide `LazyLock`, so a test observes the one configuration
-/// `build_wasm_engine` makes: a knob masked by another, or with no caller-visible
-/// effect, has no distinguishing module.
-#[test]
-fn the_knobs_without_a_module_of_their_own() {
-    let host = FakeHost::new();
-
-    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
-    // float operand, so `floats(false)` refuses it first, as the message shows.
-    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
-    let refusal = failure(&wat, &host).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-    assert!(!refusal.contains("saturating"), "{refusal}");
-
-    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
-    // sections, not accept/reject, so this pins only that one is harmless.
-    let wat = module(
-        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
-    // before instantiating, so every test in the suite fails.
-    let wat = module(&[ONE_PAGE], "(i32.const 0)");
-    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
-}
-
-/// A mutable global the module keeps to itself is core wasm, so the disabled
-/// proposal does not reach it: a guest can still have mutable state.
-#[test]
-fn an_internal_mutable_global_is_still_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
-        "(global.set $g (i32.const 7)) (global.get $g)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 7);
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_compile() {
-    let host = FakeHost::new();
-
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
-            .expect_err("garbage must not compile");
-        assert_stage!(failure, RunError::Compile(_));
-    }
-}
-
-/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
-/// default and would have `Module::new` assemble text too, so the crate builds
-/// wasmi without it; turning it back on would make this transaction blob valid.
-#[test]
-fn the_vm_refuses_a_text_format_module() {
-    let host = FakeHost::new();
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
-        .expect_err("text must not compile as a module");
-    assert_stage!(failure, RunError::Compile(_));
-
-    // The same module, assembled first, runs: the text is sound and only the
-    // format was refused.
-    assert_eq!(run(&text, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// A module may import fewer host functions than are registered, but not more:
-/// an import the linker does not define fails instantiation.
-#[test]
-fn an_unknown_import_fails_instantiation() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// Host functions are registered under one module name — `host_lib`, the name the
-/// guest SDK and this repo's fixtures import from — and a guest naming a different
-/// one does not link. `env` is in the list because that is what plain clang emits.
-#[test]
-fn the_import_module_name_must_match() {
-    let host = FakeHost::new();
-
-    for module_name in ["host", "env", ""] {
-        let wat = module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// An import spelled with the wrong signature does not link even under the right
-/// name, which is what makes the registered signatures load-bearing.
-#[test]
-fn an_import_with_the_wrong_signature_fails_instantiation() {
-    let host = FakeHost::new();
-
-    for signature in [
-        "(param i32) (result i32)",         // too few parameters
-        "(param i32 i32 i32) (result i32)", // too many
-        "(param i64 i64) (result i32)",     // wrong parameter types
-        "(param i32 i32) (result i64)",     // wrong result type
-        "(param i32 i32)",                  // no result
-    ] {
-        let wat = module(
-            &[
-                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// A module that imports a host function it never calls still has to link.
-#[test]
-fn an_unused_import_is_still_linked() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// The start section
-// ---------------------------------------------------------------------------
-
-/// A start section runs guest code during instantiation, before the entry point
-/// is even looked up, and `set_fuel` and the memory limiter are both installed by
-/// then — so it is metered like any other guest code, and a run it stops is
-/// charged for what it burned.
-///
-/// Reported as a **trap**, not as a module that would not instantiate: a trap is the
-/// guest's fault wherever it happens, and the stage a run stopped at is not what the
-/// caller maps. Filing it under the stage would put a contract's own defect among the
-/// faults a caller treats as the node's, and charge nothing for the instructions the
-/// contract burned reaching it.
-#[test]
-fn a_trapping_start_section_is_a_guest_trap_and_is_charged() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a start section that traps must not complete the run"),
-        RunError::Trap(_)
-    );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section's instructions are metered: {failure}"
-    );
-}
-
-/// What `RunError::Instantiate` is left to mean: a module the linker or the store
-/// would not accept, rather than one whose guest code failed. Its two shapes, so the
-/// variant is not left standing for nothing.
-#[test]
-fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
-    let host = FakeHost::new();
-
-    // The linker defines no such import.
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-
-    // The store's limiter will not grant the memory, and does not trap to say so.
-    let wat = module(
-        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A start section that runs out of gas is reported as out of gas, not as a module
-/// that would not instantiate. The stage a run stopped at is not what the caller
-/// maps — the reason is — and gas exhaustion is one outcome wherever the guest
-/// reaches it.
-#[test]
-fn a_start_section_that_exhausts_gas_is_out_of_gas_not_an_instantiation_failure() {
-    const GAS: u64 = 10_000;
-
-    let host = FakeHost::new();
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (loop $l (br $l)))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, GAS, &host).expect_err("an endless start section must not instantiate"),
-        RunError::OutOfGas
-    );
-    assert_eq!(
-        failure.fuel_used, GAS,
-        "a runaway start section burns the whole limit"
-    );
-}
-
-/// A start section cannot make a host call that needs guest memory, even in a
-/// module that exports one: the memory is resolved from the *instance's* exports,
-/// and instantiation is what produces the instance, so a call made while it is
-/// still running has no memory to work in and ends the run.
-///
-/// Not a choice: `Module::instantiate` is `pub(crate)` in wasmi, so instantiation
-/// cannot be split from the start section to resolve the memory in between.
-#[test]
-fn a_start_section_cannot_make_a_host_call() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ldgr_index} {ONE_PAGE}
-             (func $init (drop (call $ldgr_index (i32.const 0) (i32.const 4))))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#,
-        ldgr_index = import::LDGR_INDEX
-    );
-
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a host call from a start section must not be served"),
-        RunError::NoMemory
-    );
-    assert!(
-        failure.fuel_used > 0,
-        "the start section is metered up to the refused call: {failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_fails() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module without the entry point must not run"),
-        RunError::EntryPoint(_)
-    );
-    assert!(
-        failure.to_string().contains("no entry point 'finish'"),
-        "{failure}"
-    );
-}
-
-/// The entry point is looked up by the name the caller asks for.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
-    let outcome = run_entry(wat, &host, "other").expect("should run");
-    assert_eq!(outcome.result, 9);
-}
-
-/// The entry point must take nothing and return an `i32`. A module that exports the
-/// name with another signature is told so, rather than being told the export is
-/// missing: wasmi answers both cases with one error, and "no entry point" would send
-/// a contract author looking for a function they already have.
-#[test]
-fn an_entry_point_of_the_wrong_type_fails() {
-    let host = FakeHost::new();
-
-    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
-        let body = if signature.contains("result i64") {
-            "(i64.const 0)"
-        } else if signature.is_empty() {
-            "(nop)"
-        } else {
-            "(i32.const 0)"
-        };
-        let wat = format!(
-            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
-        );
-        let failure = assert_stage!(
-            run_with_gas(&wat, PLENTY_OF_GAS, &host)
-                .expect_err("a wrongly-typed entry point must not run"),
-            RunError::EntryPoint(_)
-        )
-        .to_string();
-        assert!(
-            failure.contains("entry point 'finish' has the wrong signature"),
-            "{signature}: {failure}"
-        );
-        assert!(
-            !failure.contains("no entry point"),
-            "a present export must not be reported as absent — {signature}: {failure}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_fails() {
-    let host = FakeHost::new();
-
-    let wat =
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
-        RunError::EntryPoint(_)
-    )
-    .to_string();
-    assert!(
-        failure.contains("export 'finish' is not a function"),
-        "{failure}"
-    );
-}
-
-/// A guest that traps fails the run rather than returning a value.
-#[test]
-fn a_trapping_guest_fails_the_run() {
-    let host = FakeHost::new();
-
-    let wat = module(&[ONE_PAGE], "(unreachable)");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-
-    // An out-of-bounds guest access is a trap too, caught by the engine rather
-    // than anything the host is asked about.
-    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}

docs/build/environment.md

@@ -1,5 +1,5 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
-environment complete with Git, Python, Conan, CMake, Rust, and a C++ compiler.
+environment complete with Git, Python, Conan, CMake, and a C++ compiler.
 This document explains how to set one up.
 
 [BUILD.md]: ../../BUILD.md
@@ -36,17 +36,19 @@ compiler building. Treat support for anything outside the table as best-effort.
 
 Besides a compiler, building `xrpld` requires:
 
-| Tool                                        | Minimum version          |
-| ------------------------------------------- | ------------------------ |
-| [Git](https://git-scm.com/downloads)        | any recent               |
-| [Python](https://www.python.org/downloads/) | 3.11                     |
-| [Conan](https://conan.io/downloads.html)    | 2.17                     |
-| [CMake](https://cmake.org/download/)        | 3.16                     |
-| [Rust](https://rustup.rs)                   | 1.95 (see [Rust](#rust)) |
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |
 
 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
 (see below). On Windows they have to be installed manually.
 
+Building with `-Drust=ON` additionally requires a Rust toolchain, see
+[Rust](#rust). A default build does not, so it is not in the table above.
+
 Once they are in place, verify that everything is installed and runnable with:
 
 ```bash
@@ -120,14 +122,18 @@ manually:
   "x64 Native Tools Command Prompt". CI configures CMake with the
   `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- Python, Conan, CMake, and Rust, at the versions listed in
+- Python, Conan, and CMake, at the versions listed in
   [Required tools](#required-tools).
+- a [Rust toolchain](https://rustup.rs) — only needed to build with
+  `-Drust=ON`, see [Rust](#rust)
 
 ## Rust
 
 The repository contains a Rust workspace in [`crates/`](../../crates), whose
-crates are exposed to C++ through [cxx](https://cxx.rs) bindings and compiled by
-the CMake build, so a Rust toolchain is required.
+crates are exposed to C++ through [cxx](https://cxx.rs) bindings. It is **not**
+part of a default build: the CMake `rust` option is OFF by default, and with it
+off no Rust toolchain is needed. It is only required when configuring with
+`-Drust=ON` (which is what CI does), see [Options](../../BUILD.md#options).
 
 The toolchain (`cargo`, `rustc`) is pinned to the channel in
 [`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If

docs/build/nix.md

@@ -128,8 +128,9 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
-The Rust toolchain the build needs is included too: every shell provides the
-channel pinned in [`rust-toolchain.toml`](../../rust-toolchain.toml) (see
+Builds of the Rust crates (`-Drust=ON`) also work out of the box: every shell
+provides the Rust toolchain pinned in
+[`rust-toolchain.toml`](../../rust-toolchain.toml) (see
 [Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
 `cargo-nextest` plugins.
 

docs/install.md

@@ -65,7 +65,7 @@ wherever it appears in the repository configuration.
 4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \
         sudo tee /etc/apt/sources.list.d/xrplf.list
     ```
 
@@ -98,13 +98,13 @@ wherever it appears in the repository configuration.
     enabled=1
     baseurl=https://packages.xrplf.org/repository/rpm-stable/
     gpgcheck=1
-    repo_gpgcheck=1
+    repo_gpgcheck=0
     gpgkey=https://packages.xrplf.org/xrplf.asc
     REPOFILE
     ```
 
     `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
+    `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed.
 
 3.  Install the `xrpld` package:
 

include/xrpl/basics/Number.h

@@ -543,21 +543,8 @@ public:
     setround(RoundingMode inMode);
 
     /**
-     * Convert an integer to a RoundingMode, validating that it is in range.
+     * Returns which mantissa scale is currently in use for normalization.
      *
-     * Returns std::nullopt if the value does not correspond to a valid
-     * RoundingMode.
-     */
-    static std::optional<RoundingMode>
-    checkedRoundingMode(int mode) noexcept
-    {
-        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
-            mode > static_cast<int>(RoundingMode::Upward))
-            return std::nullopt;
-        return static_cast<RoundingMode>(mode);
-    }
-
-    /**
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale

include/xrpl/protocol/Protocol.h

@@ -364,16 +364,6 @@ constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono:
  */
 constexpr std::uint8_t kMaxAssetCheckDepth = 5;
 
-/**
- * Maximum length of a Data field in Escrow object that can be updated by WASM code.
- */
-constexpr std::size_t kMaxWasmDataLength = 1 * 1024;  // 1KB
-
-/**
- * Maximum amount of data transfer across hostfunction<->wasm border.
- */
-constexpr std::size_t kWasmTransferLimit = 1 << 20;  // 1MB
-
 /**
  * A ledger index.
  */

include/xrpl/protocol/TER.h

@@ -129,10 +129,8 @@ enum TEMcodes : TERUnderlyingType {
     temARRAY_TOO_LARGE,
     temBAD_TRANSFER_FEE,
     temINVALID_INNER_BATCH,
-
     temBAD_MPT,
     temBAD_CIPHERTEXT,
-    temBAD_WASM,
 };
 
 //------------------------------------------------------------------------------
@@ -372,7 +370,6 @@ enum TECcodes : TERUnderlyingType {
     tecNO_DELEGATE_PERMISSION = 198,
     tecBAD_PROOF = 199,
     tecNO_SPONSOR_PERMISSION = 200,
-    tecOUT_OF_GAS = 201,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/tx/wasm/HostContext.h

@@ -1,419 +0,0 @@
-#pragma once
-
-#include <rust/cxx.h>
-
-#include <cstdint>
-
-namespace xrpl {
-// `xrpl::HostFunctions` is forward-declared rather than included: this header is
-// `include!()`d by the cxxbridge-generated translation unit, whose target gets only the
-// project's `include/` directory - not the Boost paths that HostFunc.h -> Slice.h ->
-// strHex.h transitively need. A reference member and declarations alone do not require a
-// complete type; HostContext.cpp, compiled into libxrpl, includes the real header.
-class HostFunctions;
-
-// Defined by the cxx bridge, which emits it into `xrpl_wasm_vm_ffi_cxxbridge/lib.h` from the
-// declaration in `crates/xrpl-wasm-vm-ffi` - so the data types and their wire values are
-// written once, in Rust, rather than kept in step with a copy here.
-//
-// Forward-declared for the reason `HostFunctions` above is: that generated header includes
-// this one, so naming its definition here would be circular. A scoped enum with a fixed
-// underlying type needs no definition to appear in a signature; `HostContext.cpp` includes
-// the generated header for the `switch`.
-enum class TraceDataType : std::int32_t;
-
-// The host handed to the Rust wasm engine: one method per entry in the wasm host ABI,
-// each forwarding to `xrpl::HostFunctions` - the single source of truth for ledger
-// access - and lowering its typed `std::expected` result onto the ABI's wire form.
-//
-// Every method is `noexcept`, and every body catches everything: a C++ exception
-// unwinding into the Rust frames that called it would be undefined behaviour, so a caught
-// one leaves here as `HostFunctionError::InternalFatal`, which the engine reads as a fatal
-// error and reports as `tecINTERNAL`.
-//
-// Not an owner: it borrows the `HostFunctions` it is built over for the length of one run.
-class HostContext
-{
-    // Non-const so a host function that mutates (`cacheLedgerObj`, `updateData`) can be
-    // reached from the `const` methods below: constness of the reference is not
-    // constness of the referent.
-    HostFunctions& hostFunctions_;
-
-public:
-    HostContext(HostFunctions& hostFunctions);
-
-    // A byte-producing call is handed `out` - a slice aliasing either guest linear
-    // memory or the engine's output buffer - writes the value only if the whole of it
-    // fits, and returns the value's *true* length, which may exceed `out`. That is how a
-    // guest learns the size to ask for, and it is why these methods never need to know
-    // the guest's capacity: the engine owns the buffer-fit, field-cap and transfer-budget
-    // rules and derives all three from the length returned here.
-    //
-    // A negative return is a `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    getLedgerSqn(rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getParentLedgerTime(rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getParentLedgerHash(rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getBaseFee(rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The amendment is either a 32-byte id or a name; a 32-byte input is tried as an
-    // id first and falls back to a name lookup. Answers 1 or 0, or a negative
-    // `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    isAmendmentEnabled(rust::Slice<std::uint8_t const> amendment) const noexcept;
-
-    // The object id must be a 32-byte uint256, else `InvalidParams`. `cacheIdx` selects
-    // the slot (0 = pick a free one). Answers the slot used, or a negative
-    // `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    cacheLedgerObj(rust::Slice<std::uint8_t const> objId, std::int32_t cacheIdx) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getTxField(std::int32_t field, rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getCurrentLedgerObjField(std::int32_t field, rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getLedgerObjField(std::int32_t cacheIdx, std::int32_t field, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // The locator is a path of little-endian i32 steps, so its byte length must be a
-    // non-zero multiple of 4, else `LocatorMalformed`.
-    [[nodiscard]] std::int32_t
-    getTxNestedField(rust::Slice<std::uint8_t const> locator, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getCurrentLedgerObjNestedField(
-        rust::Slice<std::uint8_t const> locator,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getLedgerObjNestedField(
-        std::int32_t cacheIdx,
-        rust::Slice<std::uint8_t const> locator,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Answers the array's element count directly, or a negative `HostFunctionError`
-    // code (`NoArray` if the field is not an array).
-    [[nodiscard]] std::int32_t
-    getTxArrayLen(std::int32_t field) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getCurrentLedgerObjArrayLen(std::int32_t field) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getLedgerObjArrayLen(std::int32_t cacheIdx, std::int32_t field) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getTxNestedArrayLen(rust::Slice<std::uint8_t const> locator) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getCurrentLedgerObjNestedArrayLen(rust::Slice<std::uint8_t const> locator) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    getLedgerObjNestedArrayLen(std::int32_t cacheIdx, rust::Slice<std::uint8_t const> locator)
-        const noexcept;
-
-    // Answers 1/0 for a valid/invalid signature, or a negative `HostFunctionError`.
-    [[nodiscard]] std::int32_t
-    checkSignature(
-        rust::Slice<std::uint8_t const> message,
-        rust::Slice<std::uint8_t const> signature,
-        rust::Slice<std::uint8_t const> pubkey) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    accountKeylet(rust::Slice<std::uint8_t const> account, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // Each asset is decoded by length (24 = MPT, 20 = XRP, 40 = issue), else
-    // `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    ammKeylet(
-        rust::Slice<std::uint8_t const> asset1,
-        rust::Slice<std::uint8_t const> asset2,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    checkKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Subject and issuer must each be 20 bytes, else `InvalidParams`. Writes the
-    // 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    credentialKeylet(
-        rust::Slice<std::uint8_t const> subject,
-        rust::Slice<std::uint8_t const> issuer,
-        rust::Slice<std::uint8_t const> credentialType,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Both accounts must be 20 bytes, else `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    delegateKeylet(
-        rust::Slice<std::uint8_t const> account,
-        rust::Slice<std::uint8_t const> authorize,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Both accounts must be 20 bytes, else `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    depositPreauthKeylet(
-        rust::Slice<std::uint8_t const> account,
-        rust::Slice<std::uint8_t const> authorize,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    didKeylet(rust::Slice<std::uint8_t const> account, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    escrowKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Both accounts and the currency must each be 20 bytes, else `InvalidParams`.
-    // Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    trustLineKeylet(
-        rust::Slice<std::uint8_t const> account1,
-        rust::Slice<std::uint8_t const> account2,
-        rust::Slice<std::uint8_t const> currency,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The issuer id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    mptokenIssuanceKeylet(
-        rust::Slice<std::uint8_t const> issuer,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The MPT id must be 24 bytes and the holder 20, else `InvalidParams`. Writes the
-    // 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    mptokenKeylet(
-        rust::Slice<std::uint8_t const> mptid,
-        rust::Slice<std::uint8_t const> holder,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    nftokenOfferKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    offerKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `docId` carries the
-    // guest's u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    oracleKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t docId,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Both account ids must be 20 bytes, else `InvalidParams`. `seq` carries the
-    // guest's u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    paychannelKeylet(
-        rust::Slice<std::uint8_t const> account,
-        rust::Slice<std::uint8_t const> destination,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    permissionedDomainKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    signerListKeylet(rust::Slice<std::uint8_t const> account, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    ticketKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The account id must be 20 bytes, else `InvalidParams`. `seq` carries the guest's
-    // u32 as its i32 bit pattern. Writes the 32-byte keylet.
-    [[nodiscard]] std::int32_t
-    vaultKeylet(
-        rust::Slice<std::uint8_t const> account,
-        std::int32_t seq,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    sha512Half(rust::Slice<std::uint8_t const> data, rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Renders `data` as `dataType` says, and hands the text to `HostFunctions::trace`, which
-    // is what puts it in this node's log.
-    //
-    // The one call that answers nothing: the guest's wasm function has no result, and this
-    // node's own log is the only thing a trace touches, so a buffer that does not hold what
-    // it claims is logged here and dropped rather than reported to a contract.
-    void
-    trace(rust::Str msg, rust::Slice<std::uint8_t const> data, TraceDataType dataType)
-        const noexcept;
-
-    // Stores `data` as the current object's data field and returns the number of bytes
-    // stored, or a negative `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    updateData(rust::Slice<std::uint8_t const> data) const noexcept;
-
-    // The account id must be 20 bytes and the nft id 32 bytes, else `InvalidParams`.
-    // Writes the token's URI bytes.
-    [[nodiscard]] std::int32_t
-    getNFT(
-        rust::Slice<std::uint8_t const> account,
-        rust::Slice<std::uint8_t const> nftId,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The nft id must be 32 bytes, else `InvalidParams`. Writes the 20-byte issuer
-    // account encoded in the id.
-    [[nodiscard]] std::int32_t
-    getNFTIssuer(rust::Slice<std::uint8_t const> nftId, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // The nft id must be 32 bytes, else `InvalidParams`. Writes the taxon as its four
-    // little-endian bytes.
-    [[nodiscard]] std::int32_t
-    getNFTTaxon(rust::Slice<std::uint8_t const> nftId, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // The nft id must be 32 bytes, else `InvalidParams`. Returns the flags, or a
-    // negative `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    getNFTFlags(rust::Slice<std::uint8_t const> nftId) const noexcept;
-
-    // The nft id must be 32 bytes, else `InvalidParams`. Returns the transfer fee, or a
-    // negative `HostFunctionError` code.
-    [[nodiscard]] std::int32_t
-    getNFTTransferFee(rust::Slice<std::uint8_t const> nftId) const noexcept;
-
-    // The nft id must be 32 bytes, else `InvalidParams`. Writes the sequence number as
-    // its four little-endian bytes.
-    [[nodiscard]] std::int32_t
-    getNFTSequence(rust::Slice<std::uint8_t const> nftId, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // Float / number arithmetic. A float is an XRPL `Number` in serialized form;
-    // `mode` is a rounding mode. Each writes the result float bytes unless noted.
-
-    [[nodiscard]] std::int32_t
-    floatFromInt(std::int64_t x, std::int32_t mode, rust::Slice<std::uint8_t> out) const noexcept;
-
-    // The integer region must be eight bytes, else `InvalidParams`.
-    [[nodiscard]] std::int32_t
-    floatFromUint(
-        rust::Slice<std::uint8_t const> x,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // `amount` must be a serialized `STAmount`, else `InvalidParams`.
-    [[nodiscard]] std::int32_t
-    floatFromSTAmount(
-        rust::Slice<std::uint8_t const> amount,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // `number` must be a serialized `STNumber`, else `InvalidParams`.
-    [[nodiscard]] std::int32_t
-    floatFromSTNumber(
-        rust::Slice<std::uint8_t const> number,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Rounds the float to an integer, written as its eight little-endian bytes.
-    [[nodiscard]] std::int32_t
-    floatToInt(rust::Slice<std::uint8_t const> x, std::int32_t mode, rust::Slice<std::uint8_t> out)
-        const noexcept;
-
-    // Writes the mantissa (eight little-endian bytes) and the exponent (four little-
-    // endian bytes) to two output regions; returns their total size.
-    [[nodiscard]] std::int32_t
-    floatToMantExp(
-        rust::Slice<std::uint8_t const> x,
-        rust::Slice<std::uint8_t> mantissaOut,
-        rust::Slice<std::uint8_t> exponentOut) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatFromMantExp(
-        std::int64_t mantissa,
-        std::int32_t exponent,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    // Returns a negative, zero, or positive scalar as `x` is less than, equal to, or
-    // greater than `y`, or a negative `HostFunctionError` code on failure.
-    [[nodiscard]] std::int32_t
-    floatCompare(rust::Slice<std::uint8_t const> x, rust::Slice<std::uint8_t const> y)
-        const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatAdd(
-        rust::Slice<std::uint8_t const> x,
-        rust::Slice<std::uint8_t const> y,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatSubtract(
-        rust::Slice<std::uint8_t const> x,
-        rust::Slice<std::uint8_t const> y,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatMultiply(
-        rust::Slice<std::uint8_t const> x,
-        rust::Slice<std::uint8_t const> y,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatDivide(
-        rust::Slice<std::uint8_t const> x,
-        rust::Slice<std::uint8_t const> y,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-
-    [[nodiscard]] std::int32_t
-    floatPower(
-        rust::Slice<std::uint8_t const> x,
-        std::int32_t n,
-        std::int32_t mode,
-        rust::Slice<std::uint8_t> out) const noexcept;
-};
-
-}  // namespace xrpl

include/xrpl/tx/wasm/HostFunc.h

@@ -1,464 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/UintTypes.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <string>
-#include <string_view>
-
-namespace xrpl {
-
-namespace wasm_float {
-
-std::string
-floatToString(Slice const& data);
-
-std::expected<Bytes, HostFunctionError>
-floatFromIntImpl(int64_t x, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatFromUintImpl(uint64_t x, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatFromSTAmountImpl(STAmount const& x, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatFromSTNumberImpl(STNumber const& x, int32_t mode);
-
-std::expected<int64_t, HostFunctionError>
-floatToIntImpl(Slice const& x, int32_t mode);
-
-std::expected<FloatPair, HostFunctionError>
-floatToMantExpImpl(Slice const& x);
-
-std::expected<Bytes, HostFunctionError>
-floatFromMantExpImpl(int64_t mantissa, int32_t exponent, int32_t mode);
-
-std::expected<int32_t, HostFunctionError>
-floatCompareImpl(Slice const& x, Slice const& y);
-
-std::expected<Bytes, HostFunctionError>
-floatAddImpl(Slice const& x, Slice const& y, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatSubtractImpl(Slice const& x, Slice const& y, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatMultiplyImpl(Slice const& x, Slice const& y, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatDivideImpl(Slice const& x, Slice const& y, int32_t mode);
-
-std::expected<Bytes, HostFunctionError>
-floatPowerImpl(Slice const& x, int32_t n, int32_t mode);
-
-}  // namespace wasm_float
-
-// Intended to work only through wasm runtime. Don't call them directly, except with unit tests
-class HostFunctions
-{
-protected:
-    beast::Journal j_;
-
-public:
-    HostFunctions(beast::Journal j = beast::Journal{beast::Journal::getNullSink()}) : j_(j)
-    {
-    }
-
-    [[nodiscard]] beast::Journal
-    getJournal() const
-    {
-        return j_;
-    }
-
-    // LCOV_EXCL_START
-
-    [[nodiscard]] virtual bool
-    checkSelf() const
-    {
-        return true;
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
-    getLedgerSqn() const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
-    getParentLedgerTime() const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Hash, HostFunctionError>
-    getParentLedgerHash() const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<uint32_t, HostFunctionError>
-    getBaseFee() const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(uint256 const& amendmentId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(std::string_view const& amendmentName) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    virtual std::expected<int32_t, HostFunctionError>
-    cacheLedgerObj(uint256 const& objId, int32_t cacheIdx)
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getTxField(SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjField(SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getLedgerObjField(int32_t cacheIdx, SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getTxNestedField(FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjNestedField(FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getTxArrayLen(SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjArrayLen(SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getTxNestedArrayLen(FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    virtual std::expected<int32_t, HostFunctionError>
-    updateData(Slice const& data)
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    checkSignature(Slice const& message, Slice const& signature, Slice const& pubkey) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Hash, HostFunctionError>
-    computeSha512HalfHash(Slice const& data) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    accountKeylet(AccountID const& account) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    ammKeylet(Asset const& issue1, Asset const& issue2) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    checkKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    credentialKeylet(AccountID const& subject, AccountID const& issuer, Slice const& credentialType)
-        const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    didKeylet(AccountID const& account) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    delegateKeylet(AccountID const& account, AccountID const& authorize) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    depositPreauthKeylet(AccountID const& account, AccountID const& authorize) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    escrowKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    trustLineKeylet(AccountID const& account1, AccountID const& account2, Currency const& currency)
-        const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    mptokenIssuanceKeylet(AccountID const& issuer, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    mptokenKeylet(MPTID const& mptid, AccountID const& holder) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    nftokenOfferKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    offerKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    oracleKeylet(AccountID const& account, std::uint32_t docId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    paychannelKeylet(AccountID const& account, AccountID const& destination, std::uint32_t seq)
-        const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    permissionedDomainKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    signerListKeylet(AccountID const& account) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    ticketKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    vaultKeylet(AccountID const& account, std::uint32_t seq) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getNFT(AccountID const& account, uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    getNFTIssuer(uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
-    getNFTTaxon(uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getNFTFlags(uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    getNFTTransferFee(uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<std::uint32_t, HostFunctionError>
-    getNFTSequence(uint256 const& nftId) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    // A no-op rather than Unimplemented: trace only writes to the local log.
-    // trace_wrap has already rendered the guest's buffer into `data`.
-    virtual void
-    trace(std::string_view const& msg, std::string_view const& data) const
-    {
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatFromInt(int64_t x, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatFromUint(uint64_t x, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatFromSTAmount(STAmount const& x, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatFromSTNumber(STNumber const& x, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int64_t, HostFunctionError>
-    floatToInt(Slice const& x, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<FloatPair, HostFunctionError>
-    floatToMantExp(Slice const& x) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<int32_t, HostFunctionError>
-    floatCompare(Slice const& x, Slice const& y) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatAdd(Slice const& x, Slice const& y, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatSubtract(Slice const& x, Slice const& y, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatMultiply(Slice const& x, Slice const& y, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatDivide(Slice const& x, Slice const& y, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] [[nodiscard]] virtual std::expected<Bytes, HostFunctionError>
-    floatPower(Slice const& x, int32_t n, int32_t mode) const
-    {
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    virtual ~HostFunctions() = default;
-    // LCOV_EXCL_STOP
-};
-
-}  // namespace xrpl

include/xrpl/tx/wasm/HostFuncImpl.h

@@ -1,287 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/core/ServiceRegistry.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Keylet.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/UintTypes.h>
-#include <xrpl/tx/ApplyContext.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <algorithm>
-#include <array>
-#include <cstdint>
-#include <expected>
-#include <memory>
-#include <optional>
-#include <string_view>
-
-namespace xrpl {
-
-// Intended to work only through wasm runtime. Don't call them directly, except with unit tests
-class WasmHostFunctionsImpl : public HostFunctions
-{
-    ApplyContext& ctx_;
-
-    Keylet leKey_;
-    mutable std::optional<std::shared_ptr<SLE const>> currentLedgerObj_;
-
-    static int constexpr maxCache = 256;
-    std::array<std::shared_ptr<SLE const>, maxCache> cache_;
-
-    std::optional<Bytes> data_;
-
-public:
-    std::expected<std::shared_ptr<SLE const>, HostFunctionError>
-    getCurrentLedgerObj() const
-    {
-        if (!currentLedgerObj_)
-            currentLedgerObj_ = ctx_.view().read(leKey_);
-        if (*currentLedgerObj_)
-            return *currentLedgerObj_;
-        return std::unexpected(HostFunctionError::LedgerObjNotFound);
-    }
-
-    std::expected<int32_t, HostFunctionError>
-    normalizeCacheIndex(int32_t cacheIdx) const
-    {
-        --cacheIdx;
-        if (cacheIdx < 0 || cacheIdx >= maxCache)
-            return std::unexpected(HostFunctionError::SlotOutRange);
-        if (!cache_[cacheIdx])
-            return std::unexpected(HostFunctionError::EmptySlot);
-        return cacheIdx;
-    }
-
-    template <typename F>
-    void
-    log(std::string_view const& msg, F&& dataFn) const
-    {
-#ifdef DEBUG_OUTPUT
-        auto& j = std::cerr;
-#else
-        if (!getJournal().active(beast::Severity::Trace))
-            return;
-        auto j = getJournal().trace();
-#endif
-        j << "WasmTrace[" << toShortString(leKey_.key) << "]: " << msg << " " << dataFn();
-
-#ifdef DEBUG_OUTPUT
-        j << std::endl;
-#endif
-    }
-
-public:
-    WasmHostFunctionsImpl(ApplyContext& ct, Keylet const& leKey)
-        : HostFunctions(ct.journal), ctx_(ct), leKey_(leKey)
-    {
-    }
-
-    bool
-    checkSelf() const override
-    {
-        return !currentLedgerObj_ && !data_ &&
-            std::ranges::none_of(cache_, [](auto const& p) { return !!p; });
-    }
-
-    std::optional<Bytes> const&
-    getData() const
-    {
-        return data_;
-    }
-
-    std::expected<std::uint32_t, HostFunctionError>
-    getLedgerSqn() const override;
-
-    std::expected<std::uint32_t, HostFunctionError>
-    getParentLedgerTime() const override;
-
-    std::expected<Hash, HostFunctionError>
-    getParentLedgerHash() const override;
-
-    std::expected<std::uint32_t, HostFunctionError>
-    getBaseFee() const override;
-
-    std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(uint256 const& amendmentId) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(std::string_view const& amendmentName) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    cacheLedgerObj(uint256 const& objId, int32_t cacheIdx) override;
-
-    std::expected<Bytes, HostFunctionError>
-    getTxField(SField const& fname) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjField(SField const& fname) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getLedgerObjField(int32_t cacheIdx, SField const& fname) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getTxNestedField(FieldLocator const& locator) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjNestedField(FieldLocator const& locator) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getTxArrayLen(SField const& fname) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjArrayLen(SField const& fname) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getTxNestedArrayLen(FieldLocator const& locator) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    updateData(Slice const& data) override;
-
-    std::expected<int32_t, HostFunctionError>
-    checkSignature(Slice const& message, Slice const& signature, Slice const& pubkey)
-        const override;
-
-    std::expected<Hash, HostFunctionError>
-    computeSha512HalfHash(Slice const& data) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    accountKeylet(AccountID const& account) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    ammKeylet(Asset const& issue1, Asset const& issue2) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    checkKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    credentialKeylet(AccountID const& subject, AccountID const& issuer, Slice const& credentialType)
-        const override;
-
-    std::expected<Bytes, HostFunctionError>
-    didKeylet(AccountID const& account) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    delegateKeylet(AccountID const& account, AccountID const& authorize) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    depositPreauthKeylet(AccountID const& account, AccountID const& authorize) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    escrowKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    trustLineKeylet(AccountID const& account1, AccountID const& account2, Currency const& currency)
-        const override;
-
-    std::expected<Bytes, HostFunctionError>
-    mptokenIssuanceKeylet(AccountID const& issuer, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    mptokenKeylet(MPTID const& mptid, AccountID const& holder) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    nftokenOfferKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    offerKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    oracleKeylet(AccountID const& account, std::uint32_t docId) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    paychannelKeylet(AccountID const& account, AccountID const& destination, std::uint32_t seq)
-        const override;
-
-    std::expected<Bytes, HostFunctionError>
-    permissionedDomainKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    signerListKeylet(AccountID const& account) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    ticketKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    vaultKeylet(AccountID const& account, std::uint32_t seq) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getNFT(AccountID const& account, uint256 const& nftId) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    getNFTIssuer(uint256 const& nftId) const override;
-
-    std::expected<std::uint32_t, HostFunctionError>
-    getNFTTaxon(uint256 const& nftId) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getNFTFlags(uint256 const& nftId) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    getNFTTransferFee(uint256 const& nftId) const override;
-
-    std::expected<std::uint32_t, HostFunctionError>
-    getNFTSequence(uint256 const& nftId) const override;
-
-    void
-    trace(std::string_view const& msg, std::string_view const& data) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatFromInt(int64_t x, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatFromUint(uint64_t x, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatFromSTAmount(STAmount const& x, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatFromSTNumber(STNumber const& x, int32_t mode) const override;
-
-    std::expected<int64_t, HostFunctionError>
-    floatToInt(Slice const& x, int32_t mode) const override;
-
-    std::expected<FloatPair, HostFunctionError>
-    floatToMantExp(Slice const& x) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const override;
-
-    std::expected<int32_t, HostFunctionError>
-    floatCompare(Slice const& x, Slice const& y) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatAdd(Slice const& x, Slice const& y, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatSubtract(Slice const& x, Slice const& y, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatMultiply(Slice const& x, Slice const& y, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatDivide(Slice const& x, Slice const& y, int32_t mode) const override;
-
-    std::expected<Bytes, HostFunctionError>
-    floatPower(Slice const& x, int32_t n, int32_t mode) const override;
-};
-
-}  // namespace xrpl

include/xrpl/tx/wasm/README.md

@@ -1,41 +0,0 @@
-# WASM Module for Programmable Escrows
-
-WebAssembly execution for programmable escrows. When an escrow is finished, its contract
-runs to decide whether the release conditions are met. Specification:
-[XLS-0102: WASM VM](https://xls.xrpl.org/xls/XLS-0102-wasm-vm.html).
-
-The engine itself is Rust (`crates/xrpl-wasm-vm`, over wasmi), reached through a cxx
-bridge.
-
-## What is in this directory
-
-- **`WasmVM.h`** — the entry points xrpld calls: `runEscrowWasm` (execute a contract,
-  returning a result and its gas cost, or a `WasmTER`) and `preflightEscrowWasm` (screen a
-  module with no host and no execution). Both own their TER maps.
-- **`HostFunc.h`** — the `HostFunctions` interface: one virtual per host function, each
-  defaulting to `Unimplemented`, returning `std::expected<T, HostFunctionError>`.
-- **`HostFuncImpl.h`** — `WasmHostFunctionsImpl`, the implementation over an
-  `ApplyContext&`. Bodies are split across `HostFuncImpl*.cpp` by category.
-- **`HostContext.h`** — the bridge's C++ half: an ABI-shaped, `noexcept` view of
-  `HostFunctions` that the engine calls back into. Nothing may unwind into Rust, so every
-  method catches everything — through `guarded()`, except `trace`, which answers the guest
-  nothing and so has its own catch that only logs.
-- **`WasmCommon.h`** — the shared vocabulary: `HostFunctionError` (the codes a contract
-  sees), `Bytes`, `FieldLocator`, `WasmTER`, `adjustWasmEndianess`, which is where the
-  boundary's byte order is decided, and `guarded()`, the catch that turns a throwing host
-  body into a code the engine can read.
-
-## Host functions
-
-Grouped by what they reach: ledger information; transaction and ledger-object field access;
-keylet construction; cryptography; float arithmetic; NFT queries; tracing.
-
-The wire names and per-call gas costs are declared in `crates/xrpl-host-functions` —
-one `host_functions!` block that generates the ABI trait and the spec table. That
-declaration is the single source of truth; `HostFunc.h` is the C++ side of it.
-
-## Entry point
-
-A module must export `escrow_finish` (`escrowFunctionName`) taking no parameters and
-returning `int32_t`: positive means the conditions are met, zero or negative rejects the
-finish. Everything the contract needs it asks for through a host call.

include/xrpl/tx/wasm/WasmCommon.h

@@ -1,187 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/contract.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/TER.h>
-
-#include <bit>
-#include <cstddef>
-#include <cstdint>
-#include <exception>
-#include <limits>
-#include <optional>
-#include <source_location>
-#include <stdexcept>
-#include <type_traits>
-#include <utility>
-#include <vector>
-
-namespace xrpl {
-
-using Bytes = std::vector<std::uint8_t>;
-using Hash = xrpl::uint256;
-using FloatPair = std::pair<int64_t, int32_t>;
-
-enum class HostFunctionError : int32_t {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-
-    // The call was not served at all, so the engine stops the run and the transaction is
-    // tecINTERNAL rather than the contract being handed a code to interpret. `guarded`
-    // answers it for a host body that throws.
-    //
-    // The only entry outside the -1 ..= -20 range a contract reads: it needs no number
-    // there, and INT32_MIN cannot collide with a code appended above. Negative so that a
-    // reader treating it as an ordinary failure is still right.
-    InternalFatal = std::numeric_limits<int32_t>::min(),
-};
-
-template <typename T>
-struct WasmResult
-{
-    T result;
-    int64_t cost;
-};
-using EscrowResult = WasmResult<int32_t>;
-
-// Engine error when wasm does not run to completion. `cost` is the gas consumed
-// when meaningful (tecOUT_OF_GAS / tecFAILED_PROCESSING; caller writes it to tx
-// metadata); std::nullopt for tecINTERNAL and malformed input (no gas reported).
-struct WasmTER
-{
-    TER ter;
-    std::optional<int64_t> cost;
-};
-
-class FieldLocator
-{
-    int32_t const* ptr_ = nullptr;
-    uint32_t size_ = 0;
-    std::vector<int32_t> buf_;
-
-public:
-    FieldLocator(std::vector<int32_t>&& buf)
-        : ptr_(&buf[0]), size_(buf.size()), buf_(std::move(buf))
-    {
-    }
-
-    FieldLocator(int32_t const* ptr, uint32_t const size) : ptr_(ptr), size_(size)
-    {
-    }
-
-    FieldLocator(FieldLocator const&) = delete;
-    FieldLocator&
-    operator=(FieldLocator const&) = delete;
-    FieldLocator(FieldLocator&&) = default;
-    FieldLocator&
-    operator=(FieldLocator&&) = default;
-
-    int32_t
-    operator[](unsigned i) const
-    {
-        if (i >= size_)
-            Throw<std::runtime_error>("index out of bounds");
-        return ptr_[i];
-    }
-
-    [[nodiscard]] uint32_t
-    size() const
-    {
-        return size_;
-    }
-
-    [[nodiscard]] int32_t const*
-    data() const
-    {
-        return ptr_;
-    }
-
-    [[nodiscard]] bool
-    empty() const
-    {
-        return size_ == 0;
-    }
-};
-
-template <typename T, size_t Size = sizeof(T)>
-constexpr T
-adjustWasmEndianessHlp(T x)
-{
-    static_assert(std::is_integral_v<T>, "Only integral types");
-    if constexpr (Size > 1)
-    {
-        using U = std::make_unsigned_t<T>;
-        U u = static_cast<U>(x);
-        U const low = (u & 0xFF) << ((Size - 1) << 3);
-        u = adjustWasmEndianessHlp<U, Size - 1>(u >> 8);
-        return static_cast<T>(low | u);
-    }
-
-    return x;
-}
-
-template <typename T, size_t Size = sizeof(T)>
-constexpr T
-adjustWasmEndianess(T x)
-{
-    // LCOV_EXCL_START
-    static_assert(std::is_integral_v<T>, "Only integral types");
-    if constexpr (std::endian::native == std::endian::big)
-    {
-        return adjustWasmEndianessHlp(x);
-    }
-    return x;
-    // LCOV_EXCL_STOP
-}
-
-constexpr int32_t
-hfErrorToInt(HostFunctionError e)
-{
-    return static_cast<int32_t>(e);
-}
-
-template <class Body>
-std::invoke_result_t<Body>
-guarded(
-    beast::Journal journal,
-    std::invoke_result_t<Body> onThrow,
-    Body&& body,
-    std::source_location const location = std::source_location::current()) noexcept
-{
-    try
-    {
-        return body();
-    }
-    catch (std::exception const& e)
-    {
-        JLOG(journal.error()) << "wasm: " << location.function_name() << " threw: " << e.what();
-    }
-    catch (...)
-    {
-        JLOG(journal.error()) << "wasm: " << location.function_name() << " threw";
-    }
-
-    return onThrow;
-}
-
-}  // namespace xrpl

include/xrpl/tx/wasm/WasmVM.h

@@ -1,50 +0,0 @@
-#pragma once
-
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <string_view>
-
-namespace xrpl {
-
-// The export a programmable escrow's contract is run through.
-std::string_view inline constexpr escrowFunctionName = "escrow_finish";
-
-// Run `wasmCode`'s `funcName` export with `gasLimit` gas, servicing its host calls
-// through `hfs`.
-//
-// On success the result is what the contract returned - positive means the escrow may
-// finish - together with the gas it consumed. On failure it is the TER to apply and,
-// when the number means anything, the gas to write to transaction metadata: a contract
-// that traps or exhausts its budget is charged for what it burned, while a `tecINTERNAL`
-// reports no cost because the fault is the node's rather than the transaction's.
-std::expected<EscrowResult, WasmTER>
-runEscrowWasm(
-    Bytes const& wasmCode,
-    HostFunctions& hfs,
-    std::int64_t gasLimit,
-    std::string_view funcName = escrowFunctionName) noexcept;
-
-// Screen `wasmCode`: whether `runEscrowWasm` would refuse it before the contract's
-// first instruction. Compiles the module and reads its imports and exports; runs
-// nothing.
-//
-// Takes no `HostFunctions`, because the verdict comes from the compiled module alone.
-// That is what makes this callable from a transactor's `preflight`, which has no view
-// to build a host over.
-//
-// `temBAD_WASM` for every fault in the module - the transaction carries something this
-// engine cannot run, so it is refused before it can reach the ledger.
-// `telFAILED_PROCESSING` if the engine itself failed: nothing was learned about the
-// module, and a defect here is not evidence that the transaction is malformed.
-NotTEC
-preflightEscrowWasm(
-    Bytes const& wasmCode,
-    beast::Journal j,
-    std::string_view funcName = escrowFunctionName) noexcept;
-
-}  // namespace xrpl

package/README.md

@@ -126,15 +126,15 @@ release defaults to 1 and is overridable with `-Dpkg_release=N`.
 
 Packages are published to the XRPLF repositories on Sonatype Nexus at
 `https://packages.xrplf.org`. The `release-info` action decides the channel from
-the event, and `publish_pkg.sh` maps that channel to its repositories:
+the event, and `publish_pkg.sh` maps that channel to a repository pair:
 
-| Event                    | Version           | Channel        | DEB repository     | RPM upload repository     |
-| ------------------------ | ----------------- | -------------- | ------------------ | ------------------------- |
-| tag                      | `X.Y.Z`           | `stable`       | `deb-stable`       | `rpm-stable-hosted`       |
-| tag                      | `X.Y.Z-rcN`       | `unstable`     | `deb-unstable`     | `rpm-unstable-hosted`     |
-| tag                      | `X.Y.Z-bN`        | `experimental` | `deb-experimental` | `rpm-experimental-hosted` |
-| push to `develop`        | `xrpld --version` | `develop`      | `deb-develop`      | `rpm-develop-hosted`      |
-| tag, non-public codebase | _any_             | `private`      | `deb-private`      | `rpm-private-hosted`      |
+| Event                    | Version           | Channel        | DEB repository     | RPM repository     |
+| ------------------------ | ----------------- | -------------- | ------------------ | ------------------ |
+| tag                      | `X.Y.Z`           | `stable`       | `deb-stable`       | `rpm-stable`       |
+| tag                      | `X.Y.Z-rcN`       | `unstable`     | `deb-unstable`     | `rpm-unstable`     |
+| tag                      | `X.Y.Z-bN`        | `experimental` | `deb-experimental` | `rpm-experimental` |
+| push to `develop`        | `xrpld --version` | `develop`      | `deb-develop`      | `rpm-develop`      |
+| tag, non-public codebase | _any_             | `private`      | `deb-private`      | `rpm-private`      |
 
 Only a tag names a channel — do not extend that to `develop`, where
 `BuildInfo.cpp`'s `versionString` moves through `-bN`, `-rcN` and even the final
@@ -155,15 +155,12 @@ Conan remote.
 
 Nexus owns the repository metadata; nothing here indexes anything. Worth knowing:
 
-- Each apt-hosted repository needs a distribution (ours use `any`) and a PGP
-  signing keypair configured in Nexus, which rejects one created without a
-  keypair. Nexus signs the apt metadata with it, never the packages.
-- Hosted yum repositories cannot be signed by Nexus, so each `rpm-<channel>-hosted`
-  repository sits behind a `rpm-<channel>` yum group repository whose metadata
-  Nexus signs. Uploads go to the hosted repository; clients point at the group
-  and verify the metadata with `repo_gpgcheck=1`. Nexus never signs the RPMs
-  themselves, so `sign_rpm.sh` signs them before they are uploaded, and clients
-  verify them with `gpgcheck=1`.
+- Each apt-hosted repository needs a distribution and a PGP signing keypair
+  configured in Nexus, which rejects one created without a keypair. Nexus signs
+  the apt metadata with it, never the packages.
+- Hosted yum repositories cannot be signed by Nexus at all, so `sign_rpm.sh`
+  signs the RPMs before they are uploaded, and rpm clients verify with
+  `gpgcheck=1` rather than `repo_gpgcheck=1`.
 - yum metadata is rebuilt asynchronously, so a successful publish is not
   immediately installable.
 - Each job uploads only what it built, and uploads are not transactional, so a

package/publish_pkg.sh

@@ -7,13 +7,10 @@ set -euo pipefail
 # Usage: publish_pkg.sh <channel> [package-dir]
 #
 #   channel      release channel, selecting the 'deb-<channel>' and
-#                'rpm-<channel>-hosted' repositories
+#                'rpm-<channel>' repository pair
 #   package-dir  searched recursively for *.deb, *.ddeb and *.rpm ('build' by
 #                default)
 #
-# RPMs are uploaded to the hosted repository, but yum clients install from the
-# 'rpm-<channel>' group repository in front of it, which serves signed metadata.
-#
 # NEXUS_USERNAME and NEXUS_PASSWORD are required. NEXUS_URL overrides the target
 # instance, and DRY_RUN=1 lists the uploads without performing them.
 
@@ -27,7 +24,7 @@ if [[ -z "${channel}" ]]; then
 fi
 
 deb_repo="deb-${channel}"
-rpm_repo="rpm-${channel}-hosted"
+rpm_repo="rpm-${channel}"
 
 if [[ -z "${DRY_RUN:-}" ]]; then
     : "${NEXUS_USERNAME:?is required}" "${NEXUS_PASSWORD:?is required}"

package/sign_rpm.sh

@@ -1,10 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Sign the RPMs built by build_pkg.sh. Nexus signs the yum repository metadata
-# (via the 'rpm-<channel>' group repository), but never the packages themselves,
-# so they carry their own signature. Clients verify the packages with gpgcheck=1
-# and the metadata with repo_gpgcheck=1.
+# Sign the RPMs built by build_pkg.sh. Nexus cannot sign hosted yum metadata, so
+# the packages carry the signature themselves and rpm clients verify them with
+# gpgcheck=1.
 #
 # Usage: sign_rpm.sh [package-dir]
 #
@@ -13,9 +12,8 @@ set -euo pipefail
 # PKG_SIGNING_KEY must hold an armoured PGP private key. It has no flag, to keep
 # the key out of the process list.
 #
-# The DEBs are deliberately not signed: embedded DEB signatures exist (debsigs),
-# but apt does not verify them by default and trusts the repository metadata,
-# which Nexus signs, instead.
+# There is no DEB equivalent: apt trusts the repository metadata, which Nexus
+# signs, rather than the packages themselves.
 
 pkg_dir="${1:-build}"
 

src/libxrpl/protocol/TER.cpp

@@ -108,7 +108,6 @@ transResults()
         MAKE_ERROR(tecPRECISION_LOSS,                "The amounts used by the transaction cannot interact."),
         MAKE_ERROR(tecBAD_PROOF,                     "Proof cannot be verified"),
         MAKE_ERROR(tecNO_SPONSOR_PERMISSION,         "Sponsor has not authorized this transaction."),
-        MAKE_ERROR(tecOUT_OF_GAS,                    "The WASM code ran out of gas during execution."),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -205,7 +204,6 @@ transResults()
         MAKE_ERROR(temBAD_TRANSFER_FEE,          "Malformed: Transfer fee is outside valid range."),
         MAKE_ERROR(temINVALID_INNER_BATCH,       "Malformed: Invalid inner batch transaction."),
         MAKE_ERROR(temBAD_CIPHERTEXT,            "Malformed: Invalid ciphertext."),
-        MAKE_ERROR(temBAD_WASM,                  "Malformed: Provided WASM code is invalid."),
 
         MAKE_ERROR(terRETRY,                  "Retry transaction."),
         MAKE_ERROR(terFUNDS_SPENT,            "DEPRECATED."),

src/libxrpl/tx/wasm/HostFuncImpl.cpp

@@ -1,59 +0,0 @@
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-
-#include <xrpl/basics/Slice.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/PublicKey.h>
-#include <xrpl/protocol/digest.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <string_view>
-
-namespace xrpl {
-
-// =========================================================
-// SECTION: WRITE FUNCTION
-// =========================================================
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::updateData(Slice const& data)
-{
-    if (data.size() > kMaxWasmDataLength)
-        return std::unexpected(HostFunctionError::DataFieldTooLarge);
-
-    data_ = Bytes(data.begin(), data.end());
-    return data_->size();
-}
-
-// =========================================================
-// SECTION: UTILS
-// =========================================================
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::checkSignature(
-    Slice const& message,
-    Slice const& signature,
-    Slice const& pubkey) const
-{
-    if (!publicKeyType(pubkey))
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    PublicKey const pk(pubkey);
-    return verify(pk, message, signature);
-}
-
-std::expected<Hash, HostFunctionError>
-WasmHostFunctionsImpl::computeSha512HalfHash(Slice const& data) const
-{
-    auto const hash = sha512Half(data);
-    return hash;
-}
-
-void
-WasmHostFunctionsImpl::trace(std::string_view const& msg, std::string_view const& data) const
-{
-    log(msg, [&data] { return data; });
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/HostFuncImplFloat.cpp

@@ -1,498 +0,0 @@
-#include <xrpl/basics/Number.h>
-#include <xrpl/basics/Slice.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STNumber.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <boost/algorithm/hex.hpp>
-
-#include <cstdint>
-#include <expected>
-#include <iterator>
-#include <optional>
-#include <string>
-#include <utility>
-
-#ifdef _DEBUG
-// #define DEBUG_OUTPUT 1
-#endif
-
-namespace xrpl {
-
-namespace wasm_float {
-
-namespace detail {
-
-// Decode a serialized STNumber float payload. Returns nullopt if the data is
-// not a well-formed encoding.
-std::optional<Number>
-floatDecode(Slice const& data)
-{
-    static unsigned constexpr encodedFloatSize = 12;
-    if (data.size() != encodedFloatSize)
-        return std::nullopt;
-    try
-    {
-        SerialIter it(data);
-        return STNumber(it, sfNumber).value();
-    }
-    catch (...)
-    {
-        return std::nullopt;
-    }
-}
-
-// Build a Number from a raw mantissa/exponent pair. Returns nullopt if the
-// value cannot be represented, e.g. the exponent is out of range.
-std::optional<Number>
-numberFromMantExp(int64_t mantissa, int32_t exponent)
-{
-    try
-    {
-        return Number(mantissa, exponent);
-    }
-    catch (...)
-    {
-        return std::nullopt;
-    }
-}
-
-// Serialize a Number to the STNumber float encoding.
-std::expected<Bytes, HostFunctionError>
-floatEncode(Number const& n)
-{
-    Serializer msg;
-    STNumber(sfNumber, n).add(msg);
-    auto data = msg.getData();
-
-#ifdef DEBUG_OUTPUT
-    std::cout << "m: " << std::setw(20) << n.mantissa() << ", e: " << std::setw(12) << n.exponent()
-              << ", hex: ";
-    std::cout << std::hex << std::uppercase << std::setfill('0');
-    for (auto const& c : data)
-        std::cout << std::setw(2) << (unsigned)c << " ";
-    std::cout << std::dec << std::setfill(' ') << std::endl;
-#endif
-    return std::expected<Bytes, HostFunctionError>(std::move(data));
-}
-
-struct FloatState
-{
-    // Set only when the requested mode is valid; sets the rounding mode on
-    // construction and restores the previous mode on destruction.
-    std::optional<NumberRoundModeGuard> guard;
-
-    explicit FloatState(int32_t mode)
-    {
-        if (auto const rm = Number::checkedRoundingMode(mode))
-            guard.emplace(*rm);
-    }
-
-    explicit
-    operator bool() const
-    {
-        return guard.has_value();
-    }
-};
-
-}  // namespace detail
-
-std::string
-floatToString(Slice const& data)
-{
-    // set default mode as we don't expect it will be used here
-    detail::FloatState const rm(static_cast<int32_t>(Number::RoundingMode::ToNearest));
-    auto const num = detail::floatDecode(data);
-    if (!num)
-    {
-        std::string hex;
-        hex.reserve(data.size() * 2);
-        boost::algorithm::hex(data.begin(), data.end(), std::back_inserter(hex));
-        return "Invalid data: " + hex;
-    }
-    return to_string(*num);
-}
-
-std::expected<Bytes, HostFunctionError>
-floatFromIntImpl(int64_t x, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(Number(x));
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatFromUintImpl(uint64_t x, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(Number(x, 0, Number::Normalized{}));
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatFromSTAmountImpl(STAmount const& x, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(static_cast<Number>(x));
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatFromSTNumberImpl(STNumber const& x, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(x.value());
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<int64_t, HostFunctionError>
-floatToIntImpl(Slice const& x, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        auto const num = detail::floatDecode(x);
-        if (!num)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);  // LCOV_EXCL_LINE
-        return static_cast<int64_t>(*num);
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<FloatPair, HostFunctionError>
-floatToMantExpImpl(Slice const& x)
-{
-    try
-    {
-        detail::FloatState const rm(static_cast<int32_t>(Number::RoundingMode::ToNearest));
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        auto const num = detail::floatDecode(x);
-        if (!num)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);  // LCOV_EXCL_LINE
-
-        return FloatPair(num->mantissa(), num->exponent());
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatFromMantExpImpl(int64_t mantissa, int32_t exponent, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const num = detail::numberFromMantExp(mantissa, exponent);
-        if (!num)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        return detail::floatEncode(*num);
-    }
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-}
-
-std::expected<int32_t, HostFunctionError>
-floatCompareImpl(Slice const& x, Slice const& y)
-{
-    try
-    {
-        // set default mode as we don't expect it will be used here
-        detail::FloatState const rm(static_cast<int32_t>(Number::RoundingMode::ToNearest));
-
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const yy = detail::floatDecode(y);
-        if (!yy)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        if (*xx < *yy)
-            return 2;
-        if (*xx == *yy)
-            return 0;
-        return 1;
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatAddImpl(Slice const& x, Slice const& y, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const yy = detail::floatDecode(y);
-        if (!yy)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(*xx + *yy);
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatSubtractImpl(Slice const& x, Slice const& y, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const yy = detail::floatDecode(y);
-        if (!yy)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(*xx - *yy);
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatMultiplyImpl(Slice const& x, Slice const& y, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const yy = detail::floatDecode(y);
-        if (!yy)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(*xx * *yy);
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-std::expected<Bytes, HostFunctionError>
-floatDivideImpl(Slice const& x, Slice const& y, int32_t mode)
-{
-    try
-    {
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        auto const yy = detail::floatDecode(y);
-        if (!yy)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        return detail::floatEncode(*xx / *yy);
-    }
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-}
-
-std::expected<Bytes, HostFunctionError>
-floatPowerImpl(Slice const& x, int32_t n, int32_t mode)
-{
-    try
-    {
-        if ((n < 0) || (n > Number::kMaxExponent))
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        detail::FloatState const rm(mode);
-        if (!rm)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-
-        auto const xx = detail::floatDecode(x);
-        if (!xx)
-            return std::unexpected(HostFunctionError::FloatInputMalformed);
-        if (*xx == Number() && (n == 0))
-            return std::unexpected(HostFunctionError::InvalidParams);
-
-        return detail::floatEncode(power(*xx, n, 1));
-    }
-    // LCOV_EXCL_START
-    catch (...)
-    {
-        return std::unexpected(HostFunctionError::FloatComputationError);
-    }
-    // LCOV_EXCL_STOP
-}
-
-}  // namespace wasm_float
-
-// =========================================================
-// ACTUAL HOST FUNCTIONS
-// =========================================================
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatFromInt(int64_t x, int32_t mode) const
-{
-    return wasm_float::floatFromIntImpl(x, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatFromUint(uint64_t x, int32_t mode) const
-{
-    return wasm_float::floatFromUintImpl(x, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatFromSTAmount(STAmount const& x, int32_t mode) const
-{
-    return wasm_float::floatFromSTAmountImpl(x, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatFromSTNumber(STNumber const& x, int32_t mode) const
-{
-    return wasm_float::floatFromSTNumberImpl(x, mode);
-}
-
-std::expected<int64_t, HostFunctionError>
-WasmHostFunctionsImpl::floatToInt(Slice const& x, int32_t mode) const
-{
-    return wasm_float::floatToIntImpl(x, mode);
-}
-
-std::expected<FloatPair, HostFunctionError>
-WasmHostFunctionsImpl::floatToMantExp(Slice const& x) const
-{
-    return wasm_float::floatToMantExpImpl(x);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const
-{
-    return wasm_float::floatFromMantExpImpl(mantissa, exponent, mode);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::floatCompare(Slice const& x, Slice const& y) const
-{
-    return wasm_float::floatCompareImpl(x, y);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatAdd(Slice const& x, Slice const& y, int32_t mode) const
-{
-    return wasm_float::floatAddImpl(x, y, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatSubtract(Slice const& x, Slice const& y, int32_t mode) const
-{
-    return wasm_float::floatSubtractImpl(x, y, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatMultiply(Slice const& x, Slice const& y, int32_t mode) const
-{
-    return wasm_float::floatMultiplyImpl(x, y, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatDivide(Slice const& x, Slice const& y, int32_t mode) const
-{
-    return wasm_float::floatDivideImpl(x, y, mode);
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::floatPower(Slice const& x, int32_t n, int32_t mode) const
-{
-    return wasm_float::floatPowerImpl(x, n, mode);
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/HostFuncImplGetter.cpp

@@ -1,400 +0,0 @@
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/basics/contract.h>
-#include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/STBitString.h>
-#include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/Serializer.h>
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <stdexcept>
-#include <utility>
-#include <variant>
-
-namespace xrpl {
-
-using FieldValue = std::variant<STBase const*, uint256 const*>;
-
-template <class T>
-Bytes
-getIntBytes(STBase const* obj)
-{
-    static_assert(std::is_integral_v<T>, "Only integral types");
-    XRPL_ASSERT(obj, "getIntBytes null pointer");
-
-    auto const* num(static_cast<STInteger<T> const*>(obj));  // NOLINT
-    T const data = adjustWasmEndianess(num->value());
-    auto const* b = reinterpret_cast<uint8_t const*>(&data);
-    return Bytes{b, b + sizeof(T)};
-}
-
-static std::expected<Bytes, HostFunctionError>
-getAnyFieldData(STBase const* obj)
-{
-    if (obj == nullptr)
-        return std::unexpected(HostFunctionError::FieldNotFound);
-
-    auto const stype = obj->getSType();
-    switch (stype)
-    {
-        // LCOV_EXCL_START
-        case STI_UNKNOWN:
-        case STI_NOTPRESENT:
-            return std::unexpected(HostFunctionError::FieldNotFound);
-            // LCOV_EXCL_STOP
-
-        case STI_OBJECT:
-        case STI_ARRAY:
-        case STI_VECTOR256:
-            return std::unexpected(HostFunctionError::NotLeafField);
-
-        case STI_ACCOUNT: {
-            auto const* account(static_cast<STAccount const*>(obj));  // NOLINT
-            auto const& data = account->value();
-            return Bytes{data.begin(), data.end()};
-        }
-
-        case STI_ISSUE: {
-            auto const* issue(static_cast<STIssue const*>(obj));  // NOLINT
-            Asset const& asset(issue->value());
-            // XRP and IOU will be processed by serializer
-            if (asset.holds<MPTIssue>())
-            {
-                auto const& mptIssue = asset.get<MPTIssue>();
-                auto const& mptID = mptIssue.getMptID();
-                return Bytes{mptID.cbegin(), mptID.cend()};
-            }
-            break;  // Use serializer
-        }
-
-        case STI_VL: {
-            auto const* vl(static_cast<STBlob const*>(obj));  // NOLINT
-            auto const& data = vl->value();
-            return Bytes{data.begin(), data.end()};
-        }
-
-        case STI_UINT16:
-            return getIntBytes<std::uint16_t>(obj);
-
-        case STI_UINT32:
-            return getIntBytes<std::uint32_t>(obj);
-
-        // LCOV_EXCL_START
-        case STI_UINT64:
-            return getIntBytes<std::uint64_t>(obj);
-
-        case STI_INT32:
-            return getIntBytes<std::int32_t>(obj);
-
-        case STI_INT64:
-            return getIntBytes<std::int64_t>(obj);
-            // LCOV_EXCL_STOP
-
-        case STI_UINT256: {
-            auto const* uint256Obj(static_cast<STUInt256 const*>(obj));  // NOLINT
-            auto const& data = uint256Obj->value();
-            return Bytes{data.begin(), data.end()};
-        }
-
-        case STI_AMOUNT:
-        case STI_NUMBER:
-        default:
-            break;  // Use serializer
-    }
-
-    Serializer msg;
-    obj->add(msg);
-    return msg.getData();
-}
-
-static std::expected<Bytes, HostFunctionError>
-getAnyFieldData(FieldValue const& variantObj)
-{
-    if (STBase const* const* obj = std::get_if<STBase const*>(&variantObj))
-        return getAnyFieldData(*obj);
-
-    if (uint256 const* const* u = std::get_if<uint256 const*>(&variantObj))
-        return Bytes((*u)->begin(), (*u)->end());
-
-    // Unreachable: the variant only holds the two alternatives above. If not, it is an
-    // xrpld bug, and `guarded` turns the throw into `InternalFatal`, which stops the run ->
-    // tecINTERNAL.
-    Throw<std::runtime_error>("field value variant holds neither alternative");  // LCOV_EXCL_LINE
-}
-
-static inline bool
-noField(STBase const* field)
-{
-    return (field == nullptr) || (STI_NOTPRESENT == field->getSType()) ||
-        (STI_UNKNOWN == field->getSType());
-}
-
-static std::expected<FieldValue, HostFunctionError>
-locateField(STObject const& obj, FieldLocator const& locator)
-{
-    STBase const* field = nullptr;
-    auto const& knownSFields = SField::getKnownCodeToField();
-
-    {
-        int32_t const sfieldCode = adjustWasmEndianess(locator[0]);
-        auto const it = knownSFields.find(sfieldCode);
-        if (it == knownSFields.end())
-            return std::unexpected(HostFunctionError::InvalidField);
-
-        auto const& fname(*it->second);
-        field = obj.peekAtPField(fname);
-        if (noField(field))
-            return std::unexpected(HostFunctionError::FieldNotFound);
-    }
-
-    for (unsigned i = 1; i < locator.size(); ++i)
-    {
-        int32_t const sfieldCode = adjustWasmEndianess(locator[i]);
-
-        if (STI_ARRAY == field->getSType())
-        {
-            auto const* arr = static_cast<STArray const*>(field);  // NOLINT
-            if (sfieldCode < 0 || std::cmp_greater_equal(sfieldCode, arr->size()))
-                return std::unexpected(HostFunctionError::IndexOutOfBounds);
-            field = &(arr->operator[](sfieldCode));
-        }
-        else if (STI_OBJECT == field->getSType())
-        {
-            auto const* o = static_cast<STObject const*>(field);  // NOLINT
-
-            auto const it = knownSFields.find(sfieldCode);
-            if (it == knownSFields.end())
-                return std::unexpected(HostFunctionError::InvalidField);
-
-            auto const& fname(*it->second);
-            field = o->peekAtPField(fname);
-        }
-        else if (STI_VECTOR256 == field->getSType())
-        {
-            auto const* v = static_cast<STVector256 const*>(field);  // NOLINT
-            if (sfieldCode < 0 || std::cmp_greater_equal(sfieldCode, v->size()))
-                return std::unexpected(HostFunctionError::IndexOutOfBounds);
-            return FieldValue(&(v->operator[](sfieldCode)));
-        }
-        else  // simple field must be the last one
-        {
-            return std::unexpected(HostFunctionError::LocatorMalformed);
-        }
-
-        if (noField(field))
-            return std::unexpected(HostFunctionError::FieldNotFound);
-    }
-
-    return FieldValue(field);
-}
-
-static inline std::expected<int32_t, HostFunctionError>
-getArrayLen(FieldValue const& variantField)
-{
-    if (STBase const* const* field = std::get_if<STBase const*>(&variantField))
-    {
-        if ((*field)->getSType() == STI_VECTOR256)
-            return static_cast<STVector256 const*>(*field)->size();  // NOLINT
-        if ((*field)->getSType() == STI_ARRAY)
-            return static_cast<STArray const*>(*field)->size();  // NOLINT
-    }
-    // uint256 is not an array so that variant should still return NO_ARRAY
-
-    return std::unexpected(HostFunctionError::NoArray);  // LCOV_EXCL_LINE
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::cacheLedgerObj(uint256 const& objId, int32_t cacheIdx)
-{
-    auto const& keylet = keylet::unchecked(objId);
-    if (cacheIdx < 0 || cacheIdx > maxCache)
-        return std::unexpected(HostFunctionError::SlotOutRange);
-
-    if (cacheIdx == 0)
-    {
-        for (cacheIdx = 0; cacheIdx < maxCache; ++cacheIdx)
-        {
-            if (!cache_[cacheIdx])
-                break;
-        }
-    }
-    else
-    {
-        cacheIdx--;  // convert to 0-based index
-    }
-
-    if (cacheIdx >= maxCache)
-        return std::unexpected(HostFunctionError::SlotsFull);
-
-    cache_[cacheIdx] = ctx_.view().read(keylet);
-    if (!cache_[cacheIdx])
-        return std::unexpected(HostFunctionError::LedgerObjNotFound);
-    return cacheIdx + 1;  // return 1-based index
-}
-
-// Subsection: top level getters
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getTxField(SField const& fname) const
-{
-    return getAnyFieldData(ctx_.tx.peekAtPField(fname));
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getCurrentLedgerObjField(SField const& fname) const
-{
-    auto const sle = getCurrentLedgerObj();
-    if (!sle.has_value())
-        return std::unexpected(sle.error());
-    return getAnyFieldData(sle.value()->peekAtPField(fname));
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getLedgerObjField(int32_t cacheIdx, SField const& fname) const
-{
-    auto const normalizedIdx = normalizeCacheIndex(cacheIdx);
-    if (!normalizedIdx.has_value())
-        return std::unexpected(normalizedIdx.error());
-    return getAnyFieldData(cache_[normalizedIdx.value()]->peekAtPField(fname));
-}
-
-// Subsection: nested getters
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getTxNestedField(FieldLocator const& locator) const
-{
-    auto const r = locateField(ctx_.tx, locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    return getAnyFieldData(r.value());
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getCurrentLedgerObjNestedField(FieldLocator const& locator) const
-{
-    auto const sle = getCurrentLedgerObj();
-    if (!sle.has_value())
-        return std::unexpected(sle.error());
-
-    auto const r = locateField(*sle.value(), locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    return getAnyFieldData(r.value());
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const
-{
-    auto const normalizedIdx = normalizeCacheIndex(cacheIdx);
-    if (!normalizedIdx.has_value())
-        return std::unexpected(normalizedIdx.error());
-
-    auto const r = locateField(*cache_[normalizedIdx.value()], locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    return getAnyFieldData(r.value());
-}
-
-// Subsection: array length getters
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getTxArrayLen(SField const& fname) const
-{
-    if (fname.fieldType != STI_ARRAY && fname.fieldType != STI_VECTOR256)
-        return std::unexpected(HostFunctionError::NoArray);
-
-    auto const* field = ctx_.tx.peekAtPField(fname);
-    if (noField(field))
-        return std::unexpected(HostFunctionError::FieldNotFound);
-
-    return getArrayLen(field);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getCurrentLedgerObjArrayLen(SField const& fname) const
-{
-    if (fname.fieldType != STI_ARRAY && fname.fieldType != STI_VECTOR256)
-        return std::unexpected(HostFunctionError::NoArray);
-
-    auto const sle = getCurrentLedgerObj();
-    if (!sle.has_value())
-        return std::unexpected(sle.error());
-
-    auto const* field = sle.value()->peekAtPField(fname);
-    if (noField(field))
-        return std::unexpected(HostFunctionError::FieldNotFound);
-
-    return getArrayLen(field);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const
-{
-    if (fname.fieldType != STI_ARRAY && fname.fieldType != STI_VECTOR256)
-        return std::unexpected(HostFunctionError::NoArray);
-
-    auto const normalizedIdx = normalizeCacheIndex(cacheIdx);
-    if (!normalizedIdx.has_value())
-        return std::unexpected(normalizedIdx.error());
-
-    auto const* field = cache_[normalizedIdx.value()]->peekAtPField(fname);
-    if (noField(field))
-        return std::unexpected(HostFunctionError::FieldNotFound);
-
-    return getArrayLen(field);
-}
-
-// Subsection: nested array length getters
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getTxNestedArrayLen(FieldLocator const& locator) const
-{
-    auto const r = locateField(ctx_.tx, locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    auto const& field = r.value();
-    return getArrayLen(field);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const
-{
-    auto const sle = getCurrentLedgerObj();
-    if (!sle.has_value())
-        return std::unexpected(sle.error());
-    auto const r = locateField(*sle.value(), locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    auto const& field = r.value();
-    return getArrayLen(field);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator)
-    const
-{
-    auto const normalizedIdx = normalizeCacheIndex(cacheIdx);
-    if (!normalizedIdx.has_value())
-        return std::unexpected(normalizedIdx.error());
-
-    auto const r = locateField(*cache_[normalizedIdx.value()], locator);
-    if (!r)
-        return std::unexpected(r.error());
-
-    auto const& field = r.value();
-    return getArrayLen(field);
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/HostFuncImplKeylet.cpp

@@ -1,223 +0,0 @@
-#include <xrpl/basics/Slice.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/SeqProxy.h>
-#include <xrpl/protocol/UintTypes.h>
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-
-namespace xrpl {
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::accountKeylet(AccountID const& account) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::account(account);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::ammKeylet(Asset const& issue1, Asset const& issue2) const
-{
-    if (issue1 == issue2)
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    // note: this should be removed with the MPT DEX amendment
-    if (issue1.holds<MPTIssue>() || issue2.holds<MPTIssue>())
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    auto const keylet = keylet::amm(issue1, issue2);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::checkKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::check(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::credentialKeylet(
-    AccountID const& subject,
-    AccountID const& issuer,
-    Slice const& credentialType) const
-{
-    if (!subject || !issuer)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-
-    if (credentialType.empty() || credentialType.size() > kMaxCredentialTypeLength)
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    auto const keylet = keylet::credential(subject, issuer, credentialType);
-
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::didKeylet(AccountID const& account) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::did(account);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::delegateKeylet(AccountID const& account, AccountID const& authorize) const
-{
-    if (!account || !authorize)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    if (account == authorize)
-        return std::unexpected(HostFunctionError::InvalidParams);
-    auto const keylet = keylet::delegate(account, authorize);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::depositPreauthKeylet(AccountID const& account, AccountID const& authorize)
-    const
-{
-    if (!account || !authorize)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    if (account == authorize)
-        return std::unexpected(HostFunctionError::InvalidParams);
-    auto const keylet = keylet::depositPreauth(account, authorize);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::escrowKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::escrow(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::trustLineKeylet(
-    AccountID const& account1,
-    AccountID const& account2,
-    Currency const& currency) const
-{
-    if (!account1 || !account2)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    if (account1 == account2)
-        return std::unexpected(HostFunctionError::InvalidParams);
-    if (currency.isZero())
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    auto const keylet = keylet::trustLine(account1, account2, currency);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::mptokenIssuanceKeylet(AccountID const& issuer, std::uint32_t seq) const
-{
-    if (!issuer)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-
-    auto const keylet = keylet::mptokenIssuance(makeMptID(seq, issuer));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::mptokenKeylet(MPTID const& mptid, AccountID const& holder) const
-{
-    if (!mptid)
-        return std::unexpected(HostFunctionError::InvalidParams);
-    if (!holder)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-
-    auto const keylet = keylet::mptoken(mptid, holder);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::nftokenOfferKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::nftokenOffer(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::offerKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::offer(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::oracleKeylet(AccountID const& account, std::uint32_t documentId) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::oracle(account, documentId);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::paychannelKeylet(
-    AccountID const& account,
-    AccountID const& destination,
-    std::uint32_t seq) const
-{
-    if (!account || !destination)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    if (account == destination)
-        return std::unexpected(HostFunctionError::InvalidParams);
-    auto const keylet = keylet::payChannel(account, destination, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::permissionedDomainKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::permissionedDomain(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::signerListKeylet(AccountID const& account) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::signerList(account);
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::ticketKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::ticket(account, SeqProxy::rawTicket(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::vaultKeylet(AccountID const& account, std::uint32_t seq) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-    auto const keylet = keylet::vault(account, SeqProxy::rawSequence(seq));
-    return Bytes{keylet.key.begin(), keylet.key.end()};
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/HostFuncImplLedgerHeader.cpp

@@ -1,55 +0,0 @@
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/ledger/AmendmentTable.h>
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <string>
-#include <string_view>
-
-namespace xrpl {
-
-// =========================================================
-// SECTION: LEDGER HEADER FUNCTIONS
-// =========================================================
-
-std::expected<std::uint32_t, HostFunctionError>
-WasmHostFunctionsImpl::getLedgerSqn() const
-{
-    return ctx_.view().seq();
-}
-
-std::expected<std::uint32_t, HostFunctionError>
-WasmHostFunctionsImpl::getParentLedgerTime() const
-{
-    return ctx_.view().parentCloseTime().time_since_epoch().count();
-}
-
-std::expected<Hash, HostFunctionError>
-WasmHostFunctionsImpl::getParentLedgerHash() const
-{
-    return ctx_.view().header().parentHash;
-}
-
-std::expected<std::uint32_t, HostFunctionError>
-WasmHostFunctionsImpl::getBaseFee() const
-{
-    return ctx_.view().fees().base.drops();
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::isAmendmentEnabled(uint256 const& amendmentId) const
-{
-    return ctx_.view().rules().enabled(amendmentId);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::isAmendmentEnabled(std::string_view const& amendmentName) const
-{
-    auto const& table = ctx_.registry.get().getAmendmentTable();
-    auto const amendment = table.find(std::string(amendmentName));
-    return ctx_.view().rules().enabled(amendment);
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/HostFuncImplNFT.cpp

@@ -1,74 +0,0 @@
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/ledger/helpers/NFTokenHelpers.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/nft.h>
-#include <xrpl/tx/wasm/HostFuncImpl.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-
-namespace xrpl {
-
-// =========================================================
-// SECTION: NFT UTILS
-// =========================================================
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getNFT(AccountID const& account, uint256 const& nftId) const
-{
-    if (!account)
-        return std::unexpected(HostFunctionError::InvalidAccount);
-
-    if (!nftId)
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    auto obj = nft::findToken(ctx_.view(), account, nftId);
-    if (!obj)
-        return std::unexpected(HostFunctionError::LedgerObjNotFound);
-
-    auto objUri = obj->at(~sfURI);
-    if (!objUri)
-        return std::unexpected(HostFunctionError::FieldNotFound);
-
-    Slice const s = objUri->value();
-    return Bytes(s.begin(), s.end());
-}
-
-std::expected<Bytes, HostFunctionError>
-WasmHostFunctionsImpl::getNFTIssuer(uint256 const& nftId) const
-{
-    auto const issuer = nft::getIssuer(nftId);
-    if (!issuer)
-        return std::unexpected(HostFunctionError::InvalidParams);
-
-    return Bytes{issuer.begin(), issuer.end()};
-}
-
-std::expected<std::uint32_t, HostFunctionError>
-WasmHostFunctionsImpl::getNFTTaxon(uint256 const& nftId) const
-{
-    return nft::toUInt32(nft::getTaxon(nftId));
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getNFTFlags(uint256 const& nftId) const
-{
-    return nft::getFlags(nftId);
-}
-
-std::expected<int32_t, HostFunctionError>
-WasmHostFunctionsImpl::getNFTTransferFee(uint256 const& nftId) const
-{
-    return nft::getTransferFee(nftId);
-}
-
-std::expected<std::uint32_t, HostFunctionError>
-WasmHostFunctionsImpl::getNFTSequence(uint256 const& nftId) const
-{
-    return nft::getSequence(nftId);
-}
-
-}  // namespace xrpl

src/libxrpl/tx/wasm/WasmVM.cpp

@@ -1,186 +0,0 @@
-#include <xrpl/tx/wasm/WasmVM.h>
-
-#include <xrpl/basics/Log.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/beast/utility/instrumentation.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/tx/wasm/HostContext.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <rust/cxx.h>
-#include <xrpl_wasm_vm_ffi_cxxbridge/lib.h>
-
-#include <cstdint>
-#include <expected>
-#include <optional>
-#include <stdexcept>
-#include <string_view>
-
-namespace xrpl {
-
-namespace {
-
-using RunStatus = rs::wasm_vm::RunStatus;
-using CheckStatus = rs::wasm_vm::CheckStatus;
-
-// The engine's outcome as the caller's: a value with its gas cost, or a TER with the gas cost
-// to record beside it.
-//
-// A `tecINTERNAL` reports no cost. It says the fault is the node's, and charging a
-// transaction for a node's defect would write that defect into the ledger.
-//
-// Exhaustive over the status enum, with no `default`: the enum is generated from the
-// engine's `RunError`, so an outcome added there fails this switch under -Wswitch -Werror
-// rather than quietly picking up a neighbour's TER. The return past the switch is for the
-// compilers that will not call an exhaustive switch exhaustive; it sits after the switch,
-// not in a `default`, so the coverage check above still holds.
-std::expected<EscrowResult, WasmTER>
-outcome(rs::wasm_vm::RunResult const& run)
-{
-    auto const cost = static_cast<std::int64_t>(run.gas_used);
-
-    switch (run.status)
-    {
-        case RunStatus::Ok:
-            return EscrowResult{.result = run.result, .cost = cost};
-
-        // The cost is the whole limit: XLS-0102 halts the guest the instant the meter runs
-        // out, and the run is charged for all of it.
-        case RunStatus::OutOfGas:
-            return std::unexpected{WasmTER{.ter = tecOUT_OF_GAS, .cost = cost}};
-
-        // The contract's own fault - it trapped, or it never exported the linear memory
-        // its host calls need - so it is charged for what it burned reaching that point.
-        case RunStatus::Trap:
-        case RunStatus::NoMemory:
-        // A module that will not instantiate is the contract's fault too. Screening
-        // cannot see every way this happens - a linear memory the module keeps to itself
-        // is absent from its exports - so a module can pass preflight and still be
-        // refused here. It is a deterministic property of the code either way, and one
-        // this node's own conduct had no part in.
-        case RunStatus::Instantiate:
-            return std::unexpected{WasmTER{.ter = tecFAILED_PROCESSING, .cost = cost}};
-
-        // A module that will not compile, or does not expose the entry point, should have
-        // been refused at preflight with `temBAD_WASM`: screening decides both from the
-        // same bytes and the same engine, so agreeing here is not a matter of degree.
-        // Reaching apply means the screening did not happen, which is a node-side fault
-        // rather than the transaction's.
-        case RunStatus::Compile:
-        case RunStatus::EntryPoint:
-        // The host could not serve a call, or it threw and `HostContext` caught it.
-        case RunStatus::Internal:
-        // The engine panicked: a defect in the engine, reported rather than fatal to the
-        // node.
-        case RunStatus::Panic:
-            return std::unexpected{WasmTER{.ter = tecINTERNAL, .cost = std::nullopt}};
-    }
-    UNREACHABLE("xrpl::outcome : unknown RunStatus");
-    return std::unexpected{WasmTER{.ter = tecINTERNAL, .cost = std::nullopt}};
-}
-
-// A screening verdict as a TER.
-//
-// `temBAD_WASM` says the transaction carries something this engine cannot run: a
-// malformed transaction, refused before it can reach the ledger. A panic inside the
-// engine is different in kind - nothing was learned about the module - so the answer is
-// node-local rather than a claim about the transaction.
-//
-// Exhaustive over the status enum, with no `default`, for the same reason `outcome` is.
-NotTEC
-verdict(CheckStatus status)
-{
-    switch (status)
-    {
-        case CheckStatus::Ok:
-            return tesSUCCESS;
-
-        // The module will not compile, imports what no engine of this ABI serves, does
-        // not export the entry point as `() -> i32`, or asks for more linear memory or
-        // table than it may have.
-        case CheckStatus::Compile:
-        case CheckStatus::Import:
-        case CheckStatus::EntryPoint:
-        case CheckStatus::Memory:
-        case CheckStatus::Table:
-            return temBAD_WASM;
-
-        // The engine panicked: a defect in the engine, reported rather than fatal to
-        // the node, and not the transaction's fault.
-        case CheckStatus::Panic:
-            return telFAILED_PROCESSING;
-    }
-    UNREACHABLE("xrpl::verdict : unknown CheckStatus");
-    return telFAILED_PROCESSING;
-}
-
-}  // namespace
-
-std::expected<EscrowResult, WasmTER>
-runEscrowWasm(
-    Bytes const& wasmCode,
-    HostFunctions& hfs,
-    std::int64_t gasLimit,
-    std::string_view funcName) noexcept
-{
-    XRPL_ASSERT(
-        gasLimit > 0,
-        "::xrpl::runEscrowWasm : gas limit is positive (should be checked in preflight)");
-    // A run needs a budget to spend. Refused here rather than in the engine because what a
-    // non-positive limit means is a transaction-validity rule; the engine's own budget is
-    // therefore an unsigned quantity with no invalid value to represent.
-    if (gasLimit <= 0)
-        return std::unexpected{WasmTER{.ter = temBAD_AMOUNT, .cost = std::nullopt}};
-
-    auto const nodeSideFault = std::unexpected{WasmTER{.ter = tecINTERNAL, .cost = std::nullopt}};
-
-    return guarded(hfs.getJournal(), nodeSideFault, [&]() -> std::expected<EscrowResult, WasmTER> {
-        // The host caches the current ledger object, the slot table and the
-        // contract's data for the length of one run, so a reused one would answer a
-        // later contract out of an earlier contract's state.
-        XRPL_ASSERT(
-            hfs.checkSelf(), "::xrpl::runEscrowWasm : host functions not clean before the run");
-        if (!hfs.checkSelf())
-        {
-            throw std::runtime_error("host functions not clean before the run");
-        }
-
-        HostContext const ctx{hfs};
-        auto const run = rs::wasm_vm::run_escrow(
-            ctx,
-            rust::Slice<std::uint8_t const>{wasmCode.data(), wasmCode.size()},
-            static_cast<std::uint64_t>(gasLimit),
-            rust::Str{funcName.data(), funcName.size()});
-
-        auto const result = outcome(run);
-        if (!result)
-        {
-            JLOG(hfs.getJournal().warn())
-                << "wasm: " << std::string_view{run.detail.data(), run.detail.size()}
-                << ", ter: " << transToken(result.error().ter);
-        }
-        return result;
-    });
-}
-
-NotTEC
-preflightEscrowWasm(Bytes const& wasmCode, beast::Journal j, std::string_view funcName) noexcept
-{
-    return guarded(j, NotTEC{telFAILED_PROCESSING}, [&]() {
-        auto const checked = rs::wasm_vm::check_escrow(
-            rust::Slice<std::uint8_t const>{wasmCode.data(), wasmCode.size()},
-            rust::Str{funcName.data(), funcName.size()});
-
-        auto const ter = verdict(checked.status);
-        if (!isTesSuccess(ter))
-        {
-            JLOG(j.warn()) << "wasm: "
-                           << std::string_view{checked.detail.data(), checked.detail.size()}
-                           << ", ter: " << transToken(ter);
-        }
-        return ter;
-    });
-}
-
-}  // namespace xrpl

src/test/app/TestHostFunctions.h

@@ -1,492 +0,0 @@
-#pragma once
-
-#include <test/jtx/Env.h>
-#include <test/unit_test/SuiteJournal.h>
-
-#include <xrpl/basics/Slice.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/ledger/detail/ApplyViewBase.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/SeqProxy.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/WasmCommon.h>
-
-#include <cstdint>
-#include <expected>
-#include <string>
-#include <string_view>
-
-namespace xrpl::test {
-
-class TestLedgerDataProvider : public HostFunctions
-{
-    jtx::Env& env_;
-
-public:
-    TestLedgerDataProvider(jtx::Env& env) : HostFunctions(env.journal), env_(env)
-    {
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getLedgerSqn() const override
-    {
-        return env_.current()->seq();
-    }
-};
-
-class TestHostFunctions : public HostFunctions
-{
-protected:
-    test::jtx::Env& env_;
-    AccountID accountID_;
-    Bytes data_;
-
-public:
-    TestHostFunctions(test::jtx::Env& env) : HostFunctions(env.journal), env_(env)
-    {
-        accountID_ = env.master.id();
-        std::string t = "10000";
-        data_ = Bytes{t.begin(), t.end()};
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getLedgerSqn() const override
-    {
-        return 12345;
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getParentLedgerTime() const override
-    {
-        return 67890;
-    }
-
-    [[nodiscard]] std::expected<Hash, HostFunctionError>
-    getParentLedgerHash() const override
-    {
-        return env_.current()->header().parentHash;
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getBaseFee() const override
-    {
-        return 10;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(uint256 const& amendmentId) const override
-    {
-        return 1;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    isAmendmentEnabled(std::string_view const& amendmentName) const override
-    {
-        return 1;
-    }
-
-    std::expected<int32_t, HostFunctionError>
-    cacheLedgerObj(uint256 const& objId, int32_t cacheIdx) override
-    {
-        return 1;
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getTxField(SField const& fname) const override
-    {
-        if (fname == sfAccount)
-            return Bytes(accountID_.begin(), accountID_.end());
-
-        if (fname == sfFee)
-        {
-            int64_t x = 235;
-            auto const* p = reinterpret_cast<uint8_t const*>(&x);
-            return Bytes{p, p + sizeof(x)};
-        }
-
-        if (fname == sfSequence)
-        {
-            auto const x = getLedgerSqn();
-            if (!x)
-                return std::unexpected(x.error());
-            std::uint32_t const data = x.value();
-            auto const* b = reinterpret_cast<uint8_t const*>(&data);
-            auto const* e = reinterpret_cast<uint8_t const*>(&data + 1);
-            return Bytes{b, e};
-        }
-
-        return Bytes();
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjField(SField const& fname) const override
-    {
-        auto const& sn = fname.getName();
-        if (sn == "Destination" || sn == "Account")
-            return Bytes(accountID_.begin(), accountID_.end());
-        if (sn == "Data")
-            return data_;
-        if (sn == "FinishAfter")
-        {
-            auto t = env_.current()->parentCloseTime().time_since_epoch().count();
-            std::string s = std::to_string(t);
-            return Bytes{s.begin(), s.end()};
-        }
-
-        return std::unexpected(HostFunctionError::Unimplemented);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getLedgerObjField(int32_t, SField const& fname) const override
-    {
-        if (fname == sfBalance)
-        {
-            int64_t x = 10'000;
-            auto const* p = reinterpret_cast<uint8_t const*>(&x);
-            return Bytes{p, p + sizeof(x)};
-        }
-
-        if (fname == sfAccount)
-            return Bytes(accountID_.begin(), accountID_.end());
-
-        return data_;
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getTxNestedField(FieldLocator const& locator) const override
-    {
-        if (locator.size() == 1)
-        {
-            int32_t const* l = locator.data();
-            int32_t const sfield = l[0];
-            if (sfield == sfAccount.getCode())
-                return Bytes(accountID_.begin(), accountID_.end());
-        }
-
-        uint8_t const a[] = {0x2b, 0x6a, 0x23, 0x2a, 0xa4, 0xc4, 0xbe, 0x41, 0xbf, 0x49, 0xd2,
-                             0x45, 0x9f, 0xa4, 0xa0, 0x34, 0x7e, 0x1b, 0x54, 0x3a, 0x4c, 0x92,
-                             0xfc, 0xee, 0x08, 0x21, 0xc0, 0x20, 0x1e, 0x2e, 0x9a, 0x00};
-        return Bytes(&a[0], &a[sizeof(a)]);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getCurrentLedgerObjNestedField(FieldLocator const& locator) const override
-    {
-        if (locator.size() == 1)
-        {
-            int32_t const* l = locator.data();
-            int32_t const sfield = l[0];
-            if (sfield == sfAccount.getCode())
-                return Bytes(accountID_.begin(), accountID_.end());
-        }
-
-        uint8_t const a[] = {0x2b, 0x6a, 0x23, 0x2a, 0xa4, 0xc4, 0xbe, 0x41, 0xbf, 0x49, 0xd2,
-                             0x45, 0x9f, 0xa4, 0xa0, 0x34, 0x7e, 0x1b, 0x54, 0x3a, 0x4c, 0x92,
-                             0xfc, 0xee, 0x08, 0x21, 0xc0, 0x20, 0x1e, 0x2e, 0x9a, 0x00};
-        return Bytes(&a[0], &a[sizeof(a)]);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getLedgerObjNestedField(int32_t cacheIdx, FieldLocator const& locator) const override
-    {
-        if (locator.size() == 1)
-        {
-            int32_t const* l = locator.data();
-            int32_t const sfield = l[0];
-            if (sfield == sfAccount.getCode())
-                return Bytes(accountID_.begin(), accountID_.end());
-        }
-
-        uint8_t const a[] = {0x2b, 0x6a, 0x23, 0x2a, 0xa4, 0xc4, 0xbe, 0x41, 0xbf, 0x49, 0xd2,
-                             0x45, 0x9f, 0xa4, 0xa0, 0x34, 0x7e, 0x1b, 0x54, 0x3a, 0x4c, 0x92,
-                             0xfc, 0xee, 0x08, 0x21, 0xc0, 0x20, 0x1e, 0x2e, 0x9a, 0x00};
-        return Bytes(&a[0], &a[sizeof(a)]);
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getTxArrayLen(SField const& fname) const override
-    {
-        return 32;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjArrayLen(SField const& fname) const override
-    {
-        return 32;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getLedgerObjArrayLen(int32_t cacheIdx, SField const& fname) const override
-    {
-        return 32;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getTxNestedArrayLen(FieldLocator const& locator) const override
-    {
-        return 32;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getCurrentLedgerObjNestedArrayLen(FieldLocator const& locator) const override
-    {
-        return 32;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getLedgerObjNestedArrayLen(int32_t cacheIdx, FieldLocator const& locator) const override
-    {
-        return 32;
-    }
-
-    std::expected<int32_t, HostFunctionError>
-    updateData(Slice const& data) override
-    {
-        return data.size();
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    checkSignature(Slice const& message, Slice const& signature, Slice const& pubkey) const override
-    {
-        return 1;
-    }
-
-    [[nodiscard]] std::expected<Hash, HostFunctionError>
-    computeSha512HalfHash(Slice const& data) const override
-    {
-        return env_.current()->header().parentHash;
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    accountKeylet(AccountID const& account) const override
-    {
-        if (!account)
-            return std::unexpected(HostFunctionError::InvalidAccount);
-        auto const keylet = keylet::account(account);
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    ammKeylet(Asset const& issue1, Asset const& issue2) const override
-    {
-        if (issue1 == issue2)
-            return std::unexpected(HostFunctionError::InvalidParams);
-        if (issue1.holds<MPTIssue>() || issue2.holds<MPTIssue>())
-            return std::unexpected(HostFunctionError::InvalidParams);
-        auto const keylet = keylet::amm(issue1, issue2);
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    checkKeylet(AccountID const& account, std::uint32_t seq) const override
-    {
-        if (!account)
-            return std::unexpected(HostFunctionError::InvalidAccount);
-        auto const keylet = keylet::check(account, SeqProxy::rawSequence(seq));
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    credentialKeylet(AccountID const& subject, AccountID const& issuer, Slice const& credentialType)
-        const override
-    {
-        if (!subject || !issuer || credentialType.empty() ||
-            credentialType.size() > kMaxCredentialTypeLength)
-            return std::unexpected(HostFunctionError::InvalidAccount);
-        auto const keylet = keylet::credential(subject, issuer, credentialType);
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    escrowKeylet(AccountID const& account, std::uint32_t seq) const override
-    {
-        if (!account)
-            return std::unexpected(HostFunctionError::InvalidAccount);
-        auto const keylet = keylet::escrow(account, SeqProxy::rawSequence(seq));
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    oracleKeylet(AccountID const& account, std::uint32_t documentId) const override
-    {
-        if (!account)
-            return std::unexpected(HostFunctionError::InvalidAccount);
-        auto const keylet = keylet::oracle(account, documentId);
-        return Bytes{keylet.key.begin(), keylet.key.end()};
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getNFT(AccountID const& account, uint256 const& nftId) const override
-    {
-        if (!account || !nftId)
-            return std::unexpected(HostFunctionError::InvalidParams);
-
-        std::string s = "https://ripple.com";
-        return Bytes(s.begin(), s.end());
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    getNFTIssuer(uint256 const& nftId) const override
-    {
-        return Bytes(accountID_.begin(), accountID_.end());
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getNFTTaxon(uint256 const& nftId) const override
-    {
-        return 4;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getNFTFlags(uint256 const& nftId) const override
-    {
-        return 8;
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    getNFTTransferFee(uint256 const& nftId) const override
-    {
-        return 10;
-    }
-
-    [[nodiscard]] std::expected<std::uint32_t, HostFunctionError>
-    getNFTSequence(uint256 const& nftId) const override
-    {
-        return 4;
-    }
-
-    template <typename F>
-    void
-    log(std::string_view const& msg, F&& dataFn) const
-    {
-#ifdef DEBUG_OUTPUT
-        auto& j = std::cerr;
-#else
-        if (!getJournal().active(beast::Severity::Trace))
-            return;
-        auto j = getJournal().trace();
-#endif
-        j << "WasmTrace: " << msg << " " << dataFn();
-
-#ifdef DEBUG_OUTPUT
-        j << std::endl;
-#endif
-    }
-
-    void
-    trace(std::string_view const& msg, std::string_view const& data) const override
-    {
-        log(msg, [&data] { return data; });
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatFromInt(int64_t x, int32_t mode) const override
-    {
-        return wasm_float::floatFromIntImpl(x, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatFromUint(uint64_t x, int32_t mode) const override
-    {
-        return wasm_float::floatFromUintImpl(x, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatFromSTAmount(STAmount const& x, int32_t mode) const override
-    {
-        return wasm_float::floatFromSTAmountImpl(x, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatFromSTNumber(STNumber const& x, int32_t mode) const override
-    {
-        return wasm_float::floatFromSTNumberImpl(x, mode);
-    }
-
-    [[nodiscard]] std::expected<int64_t, HostFunctionError>
-    floatToInt(Slice const& x, int32_t mode) const override
-    {
-        return wasm_float::floatToIntImpl(x, mode);
-    }
-
-    [[nodiscard]] std::expected<FloatPair, HostFunctionError>
-    floatToMantExp(Slice const& x) const override
-    {
-        return wasm_float::floatToMantExpImpl(x);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatFromMantExp(int64_t mantissa, int32_t exponent, int32_t mode) const override
-    {
-        return wasm_float::floatFromMantExpImpl(mantissa, exponent, mode);
-    }
-
-    [[nodiscard]] std::expected<int32_t, HostFunctionError>
-    floatCompare(Slice const& x, Slice const& y) const override
-    {
-        return wasm_float::floatCompareImpl(x, y);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatAdd(Slice const& x, Slice const& y, int32_t mode) const override
-    {
-        return wasm_float::floatAddImpl(x, y, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatSubtract(Slice const& x, Slice const& y, int32_t mode) const override
-    {
-        return wasm_float::floatSubtractImpl(x, y, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatMultiply(Slice const& x, Slice const& y, int32_t mode) const override
-    {
-        return wasm_float::floatMultiplyImpl(x, y, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatDivide(Slice const& x, Slice const& y, int32_t mode) const override
-    {
-        return wasm_float::floatDivideImpl(x, y, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatRoot(Slice const& x, int32_t n, int32_t mode) const override
-    {
-        return wasm_float::floatRootImpl(x, n, mode);
-    }
-
-    [[nodiscard]] std::expected<Bytes, HostFunctionError>
-    floatPower(Slice const& x, int32_t n, int32_t mode) const override
-    {
-        return wasm_float::floatPowerImpl(x, n, mode);
-    }
-};
-
-class TestHostFunctionsSink : public TestHostFunctions
-{
-    test::StreamSink sink_;
-
-public:
-    explicit TestHostFunctionsSink(test::jtx::Env& env)
-        : TestHostFunctions(env), sink_(beast::Severity::Debug)
-    {
-        j_ = beast::Journal(sink_);
-    }
-
-    test::StreamSink&
-    getSink()
-    {
-        return sink_;
-    }
-};
-
-}  // namespace xrpl::test

src/test/app/Wasm_test.cpp

@@ -1,477 +0,0 @@
-// Not built. These suites drive a C++ wasm engine interface -- WasmVM over the wasm.h C API,
-// HostFuncWrapper, WasmImportsHelper -- that this tree does not provide; the VM lives in the
-// Rust crates. Kept as the coverage target for the port. The body is one comment block, and
-// the fixtures it reads (wasm_fixtures/fixtures.cpp) are disabled the same way; re-enabling
-// the suites means uncommenting both.
-
-/*
-#include <expected>
-#ifdef _DEBUG
-// #define DEBUG_OUTPUT 1
-#endif
-
-#include <test/app/TestHostFunctions.h>
-#include <test/app/wasm_fixtures/fixtures.h>
-#include <test/jtx/Env.h>
-
-#include <xrpl/beast/unit_test/suite.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/tx/wasm/HostFunc.h>
-#include <xrpl/tx/wasm/HostFuncWrapper.h>  // IWYU pragma: keep
-#include <xrpl/tx/wasm/WasmCommon.h>
-#include <xrpl/tx/wasm/WasmImportsHelper.h>
-#include <xrpl/tx/wasm/WasmVM.h>
-
-#include <boost/algorithm/hex.hpp>
-
-#include <wasm.h>
-
-#include <cstdint>
-#include <limits>
-#include <source_location>
-#include <string>
-#include <vector>
-
-namespace xrpl::test {
-
-bool
-testGetDataIncrement();
-
-using Add_proto = int32_t(int32_t, int32_t);
-static wasm_trap_t*
-add(HostFunctions&, wasm_val_vec_t const* params, wasm_val_vec_t* results)
-{
-    int32_t const val1 = params->data[0].of.i32;
-    int32_t const val2 = params->data[1].of.i32;
-    // printf("Host function \"Add\": %d + %d\n", Val1, Val2);
-    results->data[0] = WASM_I32_VAL(val1 + val2);
-    return nullptr;
-}
-
-std::vector<uint8_t>
-hexToBytes(std::string const& hex)
-{
-    auto const ws = boost::algorithm::unhex(hex);
-    return Bytes(ws.begin(), ws.end());
-}
-
-struct Wasm_test : public beast::unit_test::Suite
-{
-    void
-    checkResult(
-        std::expected<WasmResult<int32_t>, WasmTER> re,
-        int32_t expectedResult,
-        int64_t expectedCost,
-        std::source_location const location = std::source_location::current())
-    {
-        auto const lineStr = " (" + std::to_string(location.line()) + ")";
-        if (BEAST_EXPECTS(re.has_value(), transToken(re.error().ter) + lineStr))
-        {
-            BEAST_EXPECTS(re->result == expectedResult, std::to_string(re->result) + lineStr);
-            BEAST_EXPECTS(re->cost == expectedCost, std::to_string(re->cost) + lineStr);
-        }
-    }
-
-    void
-    testGetDataHelperFunctions()
-    {
-        testcase("getData helper functions");
-        BEAST_EXPECT(testGetDataIncrement());
-    }
-
-    void
-    testWasmLib()
-    {
-        testcase("wasm lib test");
-        // clang-format off
-        // The WASM module buffer. //
-        Bytes const wasm = {// WASM header //
-                          0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00,
-                          // Type section //
-                          0x01, 0x07, 0x01,
-                          // function type {i32, i32} -> {i32} //
-                          0x60, 0x02, 0x7F, 0x7F, 0x01, 0x7F,
-                          // Import section //
-                          0x02, 0x13, 0x01,
-                          // module name: "extern" //
-                          0x06, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6E,
-                          // extern name: "func-add" //
-                          0x08, 0x66, 0x75, 0x6E, 0x63, 0x2D, 0x61, 0x64, 0x64,
-                          // import desc: func 0 //
-                          0x00, 0x00,
-                          // Function section //
-                          0x03, 0x02, 0x01, 0x00,
-                          // Export section //
-                          0x07, 0x0A, 0x01,
-                          // export name: "addTwo" //
-                          0x06, 0x61, 0x64, 0x64, 0x54, 0x77, 0x6F,
-                          // export desc: func 0 //
-                          0x00, 0x01,
-                          // Code section //
-                          0x0A, 0x0A, 0x01,
-                          // code body //
-                          0x08, 0x00, 0x20, 0x00, 0x20, 0x01, 0x10, 0x00, 0x0B};
-        // clang-format on
-        auto& vm = WasmEngine::instance();
-
-        HostFunctions hfs;
-        ImportVec imports;
-        WasmImpFunc<Add_proto>(imports, "func-add", add, hfs);
-
-        auto re = vm.run(wasm, hfs, 10'000'000, "addTwo", wasmParams(1234, 5678), imports);
-
-        // if (res) printf("invokeAdd get the result: %d\n", res.value());
-
-        checkResult(re, 6'912, 59);
-    }
-
-    void
-    testBadWasm()
-    {
-        testcase("bad wasm test");
-
-        using namespace test::jtx;
-
-        Env const env{*this};
-        HostFunctions hfs(env.journal);
-
-        {
-            auto wasm = hexToBytes("00000000");
-            std::string const funcName("mock_escrow");
-
-            auto re = runEscrowWasm(wasm, hfs, 15, funcName, {});
-            BEAST_EXPECT(!re);
-        }
-
-        {
-            auto wasm = hexToBytes("00112233445566778899AA");
-            std::string const funcName("mock_escrow");
-
-            auto const re = preflightEscrowWasm(wasm, hfs, funcName);
-            BEAST_EXPECT(!isTesSuccess(re));
-        }
-
-        {
-            // FinishFunction wrong function name
-            // pub fn bad() -> bool {
-            //     unsafe { host_lib::getLedgerSqn() >= 5 }
-            // }
-            auto const badWasm = hexToBytes(
-                "0061736d010000000105016000017f02190108686f73745f6c69620c6765"
-                "744c656467657253716e00000302010005030100100611027f00418080c0"
-                "000b7f00418080c0000b072b04066d656d6f727902000362616400010a5f"
-                "5f646174615f656e6403000b5f5f686561705f6261736503010a09010700"
-                "100041044a0b004d0970726f64756365727302086c616e67756167650104"
-                "52757374000c70726f6365737365642d6279010572757374631d312e3835"
-                "2e31202834656231363132353020323032352d30332d31352900490f7461"
-                "726765745f6665617475726573042b0f6d757461626c652d676c6f62616c"
-                "732b087369676e2d6578742b0f7265666572656e63652d74797065732b0a"
-                "6d756c746976616c7565");
-
-            auto const re = preflightEscrowWasm(badWasm, hfs, escrowFunctionName);
-            BEAST_EXPECT(!isTesSuccess(re));
-        }
-    }
-
-    void
-    testWasmLedgerSqn()
-    {
-        testcase("Wasm get ledger sequence");
-
-        auto ledgerSqnWasm = hexToBytes(kLedgerSqnWasmHex);
-
-        using namespace test::jtx;
-
-        Env env{*this};
-        TestLedgerDataProvider hfs(env);
-        ImportVec imports;
-        WASM_IMPORT_FUNC2(imports, getLedgerSqn, "ldgr_index", hfs, 33);
-        auto& engine = WasmEngine::instance();
-
-        auto re =
-            engine.run(ledgerSqnWasm, hfs, 1'000'000, escrowFunctionName, {}, imports, env.journal);
-
-        checkResult(re, 0, 440);
-
-        env.close();
-        env.close();
-
-        // empty module, throwing exception
-        re = engine.run({}, hfs, 1'000'000, escrowFunctionName, {}, imports, env.journal);
-        BEAST_EXPECT(!re);
-        env.close();
-    }
-
-    void
-    testHFCost()
-    {
-        testcase("wasm test host functions cost");
-
-        using namespace test::jtx;
-
-        Env env(*this);
-        {
-            auto const allHostFuncWasm = hexToBytes(kAllHostFunctionsWasmHex);
-
-            auto& engine = WasmEngine::instance();
-
-            TestHostFunctions hfs(env);
-            auto imp = createWasmImport(hfs);
-            for (auto& i : imp)
-                i.second.second.gas = 0;
-
-            auto re = engine.run(
-                allHostFuncWasm, hfs, 1'000'000, escrowFunctionName, {}, imp, env.journal);
-
-            checkResult(re, 1, 30'760);
-
-            env.close();
-        }
-
-        env.close();
-        env.close();
-        env.close();
-        env.close();
-        env.close();
-
-        {
-            auto const allHostFuncWasm = hexToBytes(kAllHostFunctionsWasmHex);
-
-            auto& engine = WasmEngine::instance();
-
-            TestHostFunctions hfs(env);
-            auto const imp = createWasmImport(hfs);
-
-            auto re = engine.run(
-                allHostFuncWasm, hfs, 1'000'000, escrowFunctionName, {}, imp, env.journal);
-
-            checkResult(re, 1, 48'580);
-
-            env.close();
-        }
-
-        // not enough gas
-        {
-            auto const allHostFuncWasm = hexToBytes(kAllHostFunctionsWasmHex);
-
-            auto& engine = WasmEngine::instance();
-
-            TestHostFunctions hfs(env);
-            auto const imp = createWasmImport(hfs);
-
-            auto re =
-                engine.run(allHostFuncWasm, hfs, 200, escrowFunctionName, {}, imp, env.journal);
-
-            if (BEAST_EXPECT(!re))
-            {
-                // Running out of gas now terminates with tecOUT_OF_GAS (was
-                // previously collapsed into tecFAILED_PROCESSING).
-                BEAST_EXPECTS(
-                    re.error().ter == tecOUT_OF_GAS, std::to_string(TERtoInt(re.error().ter)));
-            }
-
-            env.close();
-        }
-    }
-
-    void
-    testEscrowWasmDN()
-    {
-        testcase("escrow wasm devnet test");
-
-        auto const allHFWasm = hexToBytes(kAllHostFunctionsWasmHex);
-
-        using namespace test::jtx;
-        Env env{*this};
-        {
-            TestHostFunctions hfs(env);
-            auto re = runEscrowWasm(allHFWasm, hfs, 100'000, escrowFunctionName, {});
-            checkResult(re, 1, 48'580);
-        }
-
-        {
-            // Invalid gas limit (0) should be rejected (boundary condition)
-            TestHostFunctions hfs(env);
-            auto re = runEscrowWasm(allHFWasm, hfs, -1, escrowFunctionName, {});
-            BEAST_EXPECT(!re.has_value());
-            BEAST_EXPECT(re.error().ter == temBAD_AMOUNT);
-        }
-
-        {
-            // Invalid gas limit (-1) should be rejected
-            TestHostFunctions hfs(env);
-            auto re = runEscrowWasm(allHFWasm, hfs, 0, escrowFunctionName, {});
-            BEAST_EXPECT(!re.has_value());
-            BEAST_EXPECT(re.error().ter == temBAD_AMOUNT);
-        }
-
-        {
-            // max<int64_t>() gas
-            TestHostFunctions hfs(env);
-            auto re = runEscrowWasm(
-                allHFWasm, hfs, std::numeric_limits<int64_t>::max(), escrowFunctionName, {});
-            checkResult(re, 1, 48'580);
-        }
-
-        {  // fail because trying to access nonexistent field
-            struct FieldNotFoundHostFunctions : public TestHostFunctions
-            {
-                explicit FieldNotFoundHostFunctions(Env& env) : TestHostFunctions(env)
-                {
-                }
-                [[nodiscard]] std::expected<Bytes, HostFunctionError>
-                getTxField(SField const& fname) const override
-                {
-                    return std::unexpected(HostFunctionError::FieldNotFound);
-                }
-            };
-
-            FieldNotFoundHostFunctions hfs(env);
-            auto re = runEscrowWasm(allHFWasm, hfs, 100'000, escrowFunctionName, {});
-            checkResult(re, -201, 28'329);
-        }
-
-        {  // fail because trying to allocate more than MAX_PAGES memory
-            struct OversizedFieldHostFunctions : public TestHostFunctions
-            {
-                explicit OversizedFieldHostFunctions(Env& env) : TestHostFunctions(env)
-                {
-                }
-                [[nodiscard]] std::expected<Bytes, HostFunctionError>
-                getTxField(SField const& fname) const override
-                {
-                    return Bytes((128 + 1) * 64 * 1024, 1);
-                }
-            };
-
-            OversizedFieldHostFunctions hfs(env);
-            auto re = runEscrowWasm(allHFWasm, hfs, 100'000, escrowFunctionName, {});
-            checkResult(re, -201, 28'329);
-        }
-    }
-
-    void
-    testCodecovWasm()
-    {
-        testcase("Codecov wasm test");
-
-        using namespace test::jtx;
-
-        Env env{*this};
-
-        auto const codecovWasm = hexToBytes(kCodecovTestsWasmHex);
-        TestHostFunctions hfs(env);
-
-        auto const allowance = 125'667;
-        auto re = runEscrowWasm(codecovWasm, hfs, allowance, escrowFunctionName, {});
-
-        checkResult(re, 1, allowance);
-    }
-
-    void
-    testBadAlign()
-    {
-        testcase("Wasm Bad Align");
-
-        // bad_align.c
-        auto const badAlignWasm = hexToBytes(kBadAlignWasmHex);
-
-        using namespace test::jtx;
-
-        Env env{*this};
-        TestHostFunctions hfs(env);
-        auto imports = createWasmImport(hfs);
-
-        {  // Calls float_from_uint with bad alignment.
-           // Can be checked through codecov
-            auto& engine = WasmEngine::instance();
-
-            auto re = engine.run(badAlignWasm, hfs, 1'000'000, "test", {}, imports, env.journal);
-            if (BEAST_EXPECTS(re, transToken(re.error().ter)))
-            {
-                BEAST_EXPECTS(re->result == 0x47308594, std::to_string(re->result));
-            }
-        }
-
-        env.close();
-    }
-
-    void
-    testSwapBytes()
-    {
-        testcase("Wasm swap bytes");
-
-        uint64_t const swapDataU64 = 0x123456789abcdeffull;
-        uint64_t const reverseSwapDataU64 = 0xffdebc9a78563412ull;
-        int64_t const swapDataI64 = 0x123456789abcdeffll;
-        int64_t const reverseSwapDataI64 = 0xffdebc9a78563412ll;
-
-        uint32_t const swapDataU32 = 0x12789aff;
-        uint32_t const reverseSwapDataU32 = 0xff9a7812;
-        int32_t const swapDataI32 = 0x12789aff;
-        int32_t const reverseSwapDataI32 = 0xff9a7812;
-
-        uint16_t const swapDataU16 = 0x12ff;
-        uint16_t const reverseSwapDataU16 = 0xff12;
-        int16_t const swapDataI16 = 0x12ff;
-        int16_t const reverseSwapDataI16 = 0xff12;
-
-        uint64_t b1 = swapDataU64;
-        int64_t b2 = swapDataI64;
-        b1 = adjustWasmEndianessHlp(b1);
-        b2 = adjustWasmEndianessHlp(b2);
-        BEAST_EXPECT(b1 == reverseSwapDataU64);
-        BEAST_EXPECT(b2 == reverseSwapDataI64);
-        b1 = adjustWasmEndianessHlp(b1);
-        b2 = adjustWasmEndianessHlp(b2);
-        BEAST_EXPECT(b1 == swapDataU64);
-        BEAST_EXPECT(b2 == swapDataI64);
-
-        uint32_t b3 = swapDataU32;
-        int32_t b4 = swapDataI32;
-        b3 = adjustWasmEndianessHlp(b3);
-        b4 = adjustWasmEndianessHlp(b4);
-        BEAST_EXPECT(b3 == reverseSwapDataU32);
-        BEAST_EXPECT(b4 == reverseSwapDataI32);
-        b3 = adjustWasmEndianessHlp(b3);
-        b4 = adjustWasmEndianessHlp(b4);
-        BEAST_EXPECT(b3 == swapDataU32);
-        BEAST_EXPECT(b4 == swapDataI32);
-
-        uint16_t b5 = swapDataU16;
-        int16_t b6 = swapDataI16;
-        b5 = adjustWasmEndianessHlp(b5);
-        b6 = adjustWasmEndianessHlp(b6);
-        BEAST_EXPECT(b5 == reverseSwapDataU16);
-        BEAST_EXPECT(b6 == reverseSwapDataI16);
-        b5 = adjustWasmEndianessHlp(b5);
-        b6 = adjustWasmEndianessHlp(b6);
-        BEAST_EXPECT(b5 == swapDataU16);
-        BEAST_EXPECT(b6 == swapDataI16);
-    }
-
-    void
-    run() override
-    {
-        using namespace test::jtx;
-
-        testGetDataHelperFunctions();
-        testWasmLib();
-        testBadWasm();
-        testWasmLedgerSqn();
-
-        testHFCost();
-        testEscrowWasmDN();
-
-        testCodecovWasm();
-
-        testBadAlign();
-        testSwapBytes();
-    }
-};
-
-BEAST_DEFINE_TESTSUITE(Wasm, app, xrpl);
-
-}  // namespace xrpl::test
-*/

src/test/app/wasm_fixtures/.gitignore

@@ -1,3 +0,0 @@
-**/target
-**/debug
-*.wasm

src/test/app/wasm_fixtures/all_host_functions/Cargo.lock

@@ -1,180 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "all_host_functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-common-stdlib",
- "xrpl-escrow-stdlib",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "bs58"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
-]
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "typenum"
-version = "1.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "xrpl-common-stdlib"
-version = "0.8.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "xrpl-macros",
-]
-
-[[package]]
-name = "xrpl-escrow-stdlib"
-version = "0.1.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "xrpl-common-stdlib",
-]
-
-[[package]]
-name = "xrpl-macros"
-version = "0.1.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "bs58",
- "proc-macro2",
- "quote",
- "sha2",
- "syn",
-]

src/test/app/wasm_fixtures/all_host_functions/Cargo.toml

@@ -1,22 +0,0 @@
-[package]
-name = "all_host_functions"
-version = "0.1.0"
-edition = "2024"
-
-# This empty workspace definition keeps this project independent of the parent workspace
-[workspace]
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-xrpl-std = { git = "https://github.com/ripple/xrpl-wasm-stdlib.git", package = "xrpl-common-stdlib", branch = "error-and-trace" }
-xrpl-escrow = { git = "https://github.com/ripple/xrpl-wasm-stdlib.git", package = "xrpl-escrow-stdlib", branch = "error-and-trace" }
-
-[profile.dev]
-panic = "abort"
-
-[profile.release]
-panic = "abort"
-opt-level = "z"
-lto = true

src/test/app/wasm_fixtures/all_host_functions/src/lib.rs

@@ -1,760 +0,0 @@
-#![cfg_attr(target_arch = "wasm32", no_std)]
-
-#[cfg(not(target_arch = "wasm32"))]
-extern crate std;
-
-//
-// Host Functions Test
-// Tests 26 host functions (across 7 categories)
-//
-// With craft you can run this test with:
-//   craft test --project host_functions_test --test-case host_functions_test
-//
-// Amount Format Update:
-// - XRP amounts now return as 8-byte serialized rippled objects
-// - IOU and MPT amounts return in variable-length serialized format
-// - Format details: https://xrpl.org/docs/references/protocol/binary-format#amount-fields
-//
-// Error Code Ranges:
-// -100 to -199: Ledger Header Functions (3 functions)
-// -200 to -299: Transaction Data Functions (5 functions)
-// -300 to -399: Current Ledger Object Functions (4 functions)
-// -400 to -499: Any Ledger Object Functions (5 functions)
-// -500 to -599: Keylet Generation Functions (4 functions)
-// -600 to -699: Utility Functions (4 functions)
-// -700 to -799: Data Update Functions (1 function)
-//
-
-use xrpl_escrow::current_tx::escrow_finish::EscrowFinish;
-use xrpl_std::current_tx::traits::TransactionCommonFields;
-use xrpl_std::host;
-use xrpl_std::host::trace::TraceDataType;
-use xrpl_std::host::trace::{trace, trace_acct_buf, trace_hex, trace_num};
-use xrpl_std::sfield;
-
-#[unsafe(no_mangle)]
-pub extern "C" fn escrow_finish() -> i32 {
-    let _ = trace("=== HOST FUNCTIONS TEST ===");
-    let _ = trace("Testing 26 host functions");
-
-    // Category 1: Ledger Header Data Functions (3 functions)
-    // Error range: -100 to -199
-    match test_ledger_header_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 2: Transaction Data Functions (5 functions)
-    // Error range: -200 to -299
-    match test_transaction_data_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 3: Current Ledger Object Functions (4 functions)
-    // Error range: -300 to -399
-    match test_current_ledger_object_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 4: Any Ledger Object Functions (5 functions)
-    // Error range: -400 to -499
-    match test_any_ledger_object_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 5: Keylet Generation Functions (4 functions)
-    // Error range: -500 to -599
-    match test_keylet_generation_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 6: Utility Functions (4 functions)
-    // Error range: -600 to -699
-    match test_utility_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    // Category 7: Data Update Functions (1 function)
-    // Error range: -700 to -799
-    match test_data_update_functions() {
-        0 => (),
-        err => return err,
-    }
-
-    let _ = trace("SUCCESS: All host function tests passed!");
-    1 // Success return code for WASM finish function
-}
-
-/// Test Category 1: Ledger Header Data Functions (3 functions)
-/// - get_ledger_sqn() - Get ledger sequence number
-/// - get_parent_ledger_time() - Get parent ledger timestamp
-/// - get_parent_ledger_hash() - Get parent ledger hash
-fn test_ledger_header_functions() -> i32 {
-    let _ = trace("--- Category 1: Ledger Header Functions ---");
-
-    // Test 1.1: get_ledger_sqn() - should return current ledger sequence number
-    let mut sqn_buffer = [0u8; 4];
-    let sqn_result = unsafe { host::ldgr_index(sqn_buffer.as_mut_ptr(), sqn_buffer.len()) };
-
-    if sqn_result <= 0 {
-        let _ = trace_num("ERROR: get_ledger_sqn failed:", sqn_result as i64);
-        return -101; // Ledger sequence number test failed
-    }
-    let ledger_sqn = u32::from_be_bytes(sqn_buffer);
-    let _ = trace_num("Ledger sequence number:", ledger_sqn as i64);
-
-    // Test 1.2: get_parent_ledger_time() - should return parent ledger timestamp
-    let mut time_buffer = [0u8; 4];
-    let time_result =
-        unsafe { host::parent_ldgr_time(time_buffer.as_mut_ptr(), time_buffer.len()) };
-
-    if time_result <= 0 {
-        let _ = trace_num("ERROR: get_parent_ledger_time failed:", time_result as i64);
-        return -102; // Parent ledger time test failed
-    }
-    let parent_ledger_time = u32::from_be_bytes(time_buffer);
-    let _ = trace_num("Parent ledger time:", parent_ledger_time as i64);
-
-    // Test 1.3: get_parent_ledger_hash() - should return parent ledger hash (32 bytes)
-    let mut hash_buffer = [0u8; 32];
-    let hash_result =
-        unsafe { host::parent_ldgr_hash(hash_buffer.as_mut_ptr(), hash_buffer.len()) };
-
-    if hash_result != 32 {
-        let _ = trace_num(
-            "ERROR: get_parent_ledger_hash wrong length:",
-            hash_result as i64,
-        );
-        return -103; // Parent ledger hash test failed - should be exactly 32 bytes
-    }
-    let _ = trace_hex("Parent ledger hash:", &hash_buffer);
-
-    let _ = trace("SUCCESS: Ledger header functions");
-    0
-}
-
-/// Test Category 2: Transaction Data Functions (5 functions)
-/// Tests all functions for accessing current transaction data
-fn test_transaction_data_functions() -> i32 {
-    let _ = trace("--- Category 2: Transaction Data Functions ---");
-
-    // Test 2.1: get_tx_field() - Basic transaction field access
-    // Test with Account field (required, 20 bytes)
-    let mut account_buffer = [0u8; 20];
-    let account_len = unsafe {
-        host::tx_field(
-            sfield::Account.into(),
-            account_buffer.as_mut_ptr(),
-            account_buffer.len(),
-        )
-    };
-
-    if account_len != 20 {
-        let _ = trace_num(
-            "ERROR: get_tx_field(Account) wrong length:",
-            account_len as i64,
-        );
-        return -201; // Basic transaction field test failed
-    }
-    let _ = trace_acct_buf("Transaction Account:", &account_buffer);
-
-    // Test with Fee field (XRP amount - 8 bytes in new serialized format)
-    // New format: XRP amounts are always 8 bytes (positive: value | cPositive flag, negative: just value)
-    let mut fee_buffer = [0u8; 8];
-    let fee_len = unsafe {
-        host::tx_field(
-            sfield::Fee.into(),
-            fee_buffer.as_mut_ptr(),
-            fee_buffer.len(),
-        )
-    };
-
-    if fee_len != 8 {
-        let _ = trace_num(
-            "ERROR: get_tx_field(Fee) wrong length (expected 8 bytes for XRP):",
-            fee_len as i64,
-        );
-        return -202; // Fee field test failed - XRP amounts should be exactly 8 bytes
-    }
-    let _ = trace_num("Transaction Fee length:", fee_len as i64);
-    let _ = trace_hex("Transaction Fee (serialized XRP amount):", &fee_buffer);
-
-    // Test with Sequence field (required, 4 bytes uint32)
-    let mut seq_buffer = [0u8; 4];
-    let seq_len = unsafe {
-        host::tx_field(
-            sfield::Sequence.into(),
-            seq_buffer.as_mut_ptr(),
-            seq_buffer.len(),
-        )
-    };
-
-    if seq_len != 4 {
-        let _ = trace_num(
-            "ERROR: get_tx_field(Sequence) wrong length:",
-            seq_len as i64,
-        );
-        return -203; // Sequence field test failed
-    }
-    let _ = trace_hex("Transaction Sequence:", &seq_buffer);
-
-    // NOTE: get_tx_field2() through get_tx_field6() have been deprecated.
-    // Use get_tx_field() with appropriate parameters for all transaction field access.
-
-    // Test 2.2: get_tx_nested_field() - Nested field access with locator
-    let locator = [
-        0x01_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8,
-    ]; // Two int32s in little-endian: [1, 0]
-    let mut nested_buffer = [0u8; 32];
-    let nested_result = unsafe {
-        host::tx_inner(
-            locator.as_ptr(),
-            locator.len(),
-            nested_buffer.as_mut_ptr(),
-            nested_buffer.len(),
-        )
-    };
-
-    if nested_result < 0 {
-        let _ = trace_num(
-            "INFO: get_tx_nested_field not applicable:",
-            nested_result as i64,
-        );
-        // Expected - locator may not match transaction structure
-    } else {
-        let _ = trace_num("Nested field length:", nested_result as i64);
-        let _ = trace_hex("Nested field:", &nested_buffer[..nested_result as usize]);
-    }
-
-    // Test 2.3: get_tx_array_len() - Get array length
-    let signers_len = unsafe { host::tx_arr_len(sfield::Signers.into()) };
-    let _ = trace_num("Signers array length:", signers_len as i64);
-
-    let memos_len = unsafe { host::tx_arr_len(sfield::Memos.into()) };
-    let _ = trace_num("Memos array length:", memos_len as i64);
-
-    // Test 2.4: get_tx_nested_array_len() - Get nested array length with locator
-    let nested_array_len = unsafe { host::tx_inner_arr_len(locator.as_ptr(), locator.len()) };
-
-    if nested_array_len < 0 {
-        let _ = trace_num(
-            "INFO: get_tx_nested_array_len not applicable:",
-            nested_array_len as i64,
-        );
-    } else {
-        let _ = trace_num("Nested array length:", nested_array_len as i64);
-    }
-
-    let _ = trace("SUCCESS: Transaction data functions");
-    0
-}
-
-/// Test Category 3: Current Ledger Object Functions (4 functions)
-/// Tests functions that access the current ledger object being processed
-fn test_current_ledger_object_functions() -> i32 {
-    let _ = trace("--- Category 3: Current Ledger Object Functions ---");
-
-    // Test 3.1: get_current_ledger_obj_field() - Access field from current ledger object
-    // Test with Balance field (XRP amount - 8 bytes in new serialized format)
-    let mut balance_buffer = [0u8; 8];
-    let balance_result = unsafe {
-        host::home_le_field(
-            sfield::Balance.into(),
-            balance_buffer.as_mut_ptr(),
-            balance_buffer.len(),
-        )
-    };
-
-    if balance_result <= 0 {
-        let _ = trace_num(
-            "INFO: get_current_ledger_obj_field(Balance) failed (may be expected):",
-            balance_result as i64,
-        );
-        // This might fail if current ledger object doesn't have balance field
-    } else if balance_result == 8 {
-        let _ = trace_num(
-            "Current object balance length (XRP amount):",
-            balance_result as i64,
-        );
-        let _ = trace_hex(
-            "Current object balance (serialized XRP amount):",
-            &balance_buffer,
-        );
-    } else {
-        let _ = trace_num(
-            "Current object balance length (non-XRP amount):",
-            balance_result as i64,
-        );
-        let _ = trace_hex(
-            "Current object balance:",
-            &balance_buffer[..balance_result as usize],
-        );
-    }
-
-    // Test with Account field
-    let mut current_account_buffer = [0u8; 20];
-    let current_account_result = unsafe {
-        host::home_le_field(
-            sfield::Account.into(),
-            current_account_buffer.as_mut_ptr(),
-            current_account_buffer.len(),
-        )
-    };
-
-    if current_account_result <= 0 {
-        let _ = trace_num(
-            "INFO: get_current_ledger_obj_field(Account) failed:",
-            current_account_result as i64,
-        );
-    } else {
-        let _ = trace_acct_buf("Current ledger object account:", &current_account_buffer);
-    }
-
-    // Test 3.2: get_current_ledger_obj_nested_field() - Nested field access
-    let locator = [
-        0x01_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8,
-    ]; // Two int32s in little-endian: [1, 0]
-    let mut current_nested_buffer = [0u8; 32];
-    let current_nested_result = unsafe {
-        host::home_le_inner(
-            locator.as_ptr(),
-            locator.len(),
-            current_nested_buffer.as_mut_ptr(),
-            current_nested_buffer.len(),
-        )
-    };
-
-    if current_nested_result < 0 {
-        let _ = trace_num(
-            "INFO: get_current_ledger_obj_nested_field not applicable:",
-            current_nested_result as i64,
-        );
-    } else {
-        let _ = trace_num("Current nested field length:", current_nested_result as i64);
-        let _ = trace_hex(
-            "Current nested field:",
-            &current_nested_buffer[..current_nested_result as usize],
-        );
-    }
-
-    // Test 3.3: get_current_ledger_obj_array_len() - Array length in current object
-    let current_array_len = unsafe { host::home_le_arr_len(sfield::Signers.into()) };
-    let _ = trace_num(
-        "Current object Signers array length:",
-        current_array_len as i64,
-    );
-
-    // Test 3.4: get_current_ledger_obj_nested_array_len() - Nested array length
-    let current_nested_array_len =
-        unsafe { host::home_le_inner_arr_len(locator.as_ptr(), locator.len()) };
-
-    if current_nested_array_len < 0 {
-        let _ = trace_num(
-            "INFO: get_current_ledger_obj_nested_array_len not applicable:",
-            current_nested_array_len as i64,
-        );
-    } else {
-        let _ = trace_num(
-            "Current nested array length:",
-            current_nested_array_len as i64,
-        );
-    }
-
-    let _ = trace("SUCCESS: Current ledger object functions");
-    0
-}
-
-/// Test Category 4: Any Ledger Object Functions (5 functions)
-/// Tests functions that work with cached ledger objects
-fn test_any_ledger_object_functions() -> i32 {
-    let _ = trace("--- Category 4: Any Ledger Object Functions ---");
-
-    // First we need to cache a ledger object to test the other functions
-    // Get the account from transaction and generate its keylet
-    let escrow_finish = EscrowFinish;
-    let account_id = escrow_finish.get_account().unwrap();
-
-    // Test 4.1: cache_ledger_obj() - Cache a ledger object
-    let mut keylet_buffer = [0u8; 32];
-    let keylet_result = unsafe {
-        host::accountroot_id(
-            account_id.0.as_ptr(),
-            account_id.0.len(),
-            keylet_buffer.as_mut_ptr(),
-            keylet_buffer.len(),
-        )
-    };
-
-    if keylet_result != 32 {
-        let _ = trace_num(
-            "ERROR: accountroot_id failed for caching test:",
-            keylet_result as i64,
-        );
-        return -401; // Keylet generation failed for caching test
-    }
-
-    let cache_result = unsafe { host::cache_le(keylet_buffer.as_ptr(), keylet_result as usize, 0) };
-
-    if cache_result <= 0 {
-        let _ = trace_num(
-            "INFO: cache_ledger_obj failed (expected with test fixtures):",
-            cache_result as i64,
-        );
-        // Test fixtures may not contain the account object - this is expected
-        // We'll test the interface but expect failures
-
-        // Test 4.2-4.5 with invalid slot (should fail gracefully)
-        let mut test_buffer = [0u8; 32];
-
-        // Test get_ledger_obj_field with invalid slot
-        let field_result = unsafe {
-            host::le_field(
-                1,
-                sfield::Balance.into(),
-                test_buffer.as_mut_ptr(),
-                test_buffer.len(),
-            )
-        };
-        if field_result < 0 {
-            let _ = trace_num(
-                "INFO: get_ledger_obj_field failed as expected (no cached object):",
-                field_result as i64,
-            );
-        }
-
-        // Test get_ledger_obj_nested_field with invalid slot
-        let locator = [
-            0x01_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8,
-        ]; // Two int32s in little-endian: [1, 0]
-        let nested_result = unsafe {
-            host::le_inner(
-                1,
-                locator.as_ptr(),
-                locator.len(),
-                test_buffer.as_mut_ptr(),
-                test_buffer.len(),
-            )
-        };
-        if nested_result < 0 {
-            let _ = trace_num(
-                "INFO: get_ledger_obj_nested_field failed as expected:",
-                nested_result as i64,
-            );
-        }
-
-        // Test get_ledger_obj_array_len with invalid slot
-        let array_result = unsafe { host::le_arr_len(1, sfield::Signers.into()) };
-        if array_result < 0 {
-            let _ = trace_num(
-                "INFO: get_ledger_obj_array_len failed as expected:",
-                array_result as i64,
-            );
-        }
-
-        // Test get_ledger_obj_nested_array_len with invalid slot
-        let nested_array_result =
-            unsafe { host::le_inner_arr_len(1, locator.as_ptr(), locator.len()) };
-        if nested_array_result < 0 {
-            let _ = trace_num(
-                "INFO: get_ledger_obj_nested_array_len failed as expected:",
-                nested_array_result as i64,
-            );
-        }
-
-        let _ = trace("SUCCESS: Any ledger object functions (interface tested)");
-        return 0;
-    }
-
-    // If we successfully cached an object, test the access functions
-    let slot = cache_result;
-    let _ = trace_num("Successfully cached object in slot:", slot as i64);
-
-    // Test 4.2: get_ledger_obj_field() - Access field from cached object
-    let mut cached_balance_buffer = [0u8; 8];
-    let cached_balance_result = unsafe {
-        host::le_field(
-            slot,
-            sfield::Balance.into(),
-            cached_balance_buffer.as_mut_ptr(),
-            cached_balance_buffer.len(),
-        )
-    };
-
-    if cached_balance_result <= 0 {
-        let _ = trace_num(
-            "INFO: get_ledger_obj_field(Balance) failed:",
-            cached_balance_result as i64,
-        );
-    } else if cached_balance_result == 8 {
-        let _ = trace_num(
-            "Cached object balance length (XRP amount):",
-            cached_balance_result as i64,
-        );
-        let _ = trace_hex(
-            "Cached object balance (serialized XRP amount):",
-            &cached_balance_buffer,
-        );
-    } else {
-        let _ = trace_num(
-            "Cached object balance length (non-XRP amount):",
-            cached_balance_result as i64,
-        );
-        let _ = trace_hex(
-            "Cached object balance:",
-            &cached_balance_buffer[..cached_balance_result as usize],
-        );
-    }
-
-    // Test 4.3: get_ledger_obj_nested_field() - Nested field from cached object
-    let locator = [
-        0x01_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8, 0x00_u8,
-    ]; // Two int32s in little-endian: [1, 0]
-    let mut cached_nested_buffer = [0u8; 32];
-    let cached_nested_result = unsafe {
-        host::le_inner(
-            slot,
-            locator.as_ptr(),
-            locator.len(),
-            cached_nested_buffer.as_mut_ptr(),
-            cached_nested_buffer.len(),
-        )
-    };
-
-    if cached_nested_result < 0 {
-        let _ = trace_num(
-            "INFO: get_ledger_obj_nested_field not applicable:",
-            cached_nested_result as i64,
-        );
-    } else {
-        let _ = trace_num("Cached nested field length:", cached_nested_result as i64);
-        let _ = trace_hex(
-            "Cached nested field:",
-            &cached_nested_buffer[..cached_nested_result as usize],
-        );
-    }
-
-    // Test 4.4: get_ledger_obj_array_len() - Array length from cached object
-    let cached_array_len = unsafe { host::le_arr_len(slot, sfield::Signers.into()) };
-    let _ = trace_num(
-        "Cached object Signers array length:",
-        cached_array_len as i64,
-    );
-
-    // Test 4.5: get_ledger_obj_nested_array_len() - Nested array length from cached object
-    let cached_nested_array_len =
-        unsafe { host::le_inner_arr_len(slot, locator.as_ptr(), locator.len()) };
-
-    if cached_nested_array_len < 0 {
-        let _ = trace_num(
-            "INFO: get_ledger_obj_nested_array_len not applicable:",
-            cached_nested_array_len as i64,
-        );
-    } else {
-        let _ = trace_num(
-            "Cached nested array length:",
-            cached_nested_array_len as i64,
-        );
-    }
-
-    let _ = trace("SUCCESS: Any ledger object functions");
-    0
-}
-
-/// Test Category 5: Keylet Generation Functions (4 functions)
-/// Tests keylet generation functions for different ledger entry types
-fn test_keylet_generation_functions() -> i32 {
-    let _ = trace("--- Category 5: Keylet Generation Functions ---");
-
-    let escrow_finish = EscrowFinish;
-    let account_id = escrow_finish.get_account().unwrap();
-
-    // Test 5.1: accountroot_id() - Generate keylet for account
-    let mut accountroot_id_buffer = [0u8; 32];
-    let accountroot_id_result = unsafe {
-        host::accountroot_id(
-            account_id.0.as_ptr(),
-            account_id.0.len(),
-            accountroot_id_buffer.as_mut_ptr(),
-            accountroot_id_buffer.len(),
-        )
-    };
-
-    if accountroot_id_result != 32 {
-        let _ = trace_num(
-            "ERROR: accountroot_id failed:",
-            accountroot_id_result as i64,
-        );
-        return -501; // Account keylet generation failed
-    }
-    let _ = trace_hex("Account keylet:", &accountroot_id_buffer);
-
-    // Test 5.2: credential_keylet() - Generate keylet for credential
-    let mut credential_keylet_buffer = [0u8; 32];
-    let credential_keylet_result = unsafe {
-        host::credential_id(
-            account_id.0.as_ptr(), // Subject
-            account_id.0.len(),
-            account_id.0.as_ptr(), // Issuer - same account for test
-            account_id.0.len(),
-            b"TestType".as_ptr(), // Credential type
-            9usize,               // Length of "TestType"
-            credential_keylet_buffer.as_mut_ptr(),
-            credential_keylet_buffer.len(),
-        )
-    };
-
-    if credential_keylet_result <= 0 {
-        let _ = trace_num(
-            "INFO: credential_keylet failed (expected - interface issue):",
-            credential_keylet_result as i64,
-        );
-        // This is expected to fail due to unusual parameter types
-    } else {
-        let _ = trace_hex(
-            "Credential keylet:",
-            &credential_keylet_buffer[..credential_keylet_result as usize],
-        );
-    }
-
-    // Test 5.3: escrow_keylet() - Generate keylet for escrow
-    let mut escrow_keylet_buffer = [0u8; 32];
-    let sequence_number: i32 = 1000;
-    let sequence_number_bytes = sequence_number.to_be_bytes();
-    let escrow_keylet_result = unsafe {
-        host::escrow_id(
-            account_id.0.as_ptr(),
-            account_id.0.len(),
-            sequence_number_bytes.as_ptr(),
-            sequence_number_bytes.len(),
-            escrow_keylet_buffer.as_mut_ptr(),
-            escrow_keylet_buffer.len(),
-        )
-    };
-
-    if escrow_keylet_result != 32 {
-        let _ = trace_num("ERROR: escrow_keylet failed:", escrow_keylet_result as i64);
-        return -503; // Escrow keylet generation failed
-    }
-    let _ = trace_hex("Escrow keylet:", &escrow_keylet_buffer);
-
-    // Test 5.4: oracle_keylet() - Generate keylet for oracle
-    let mut oracle_keylet_buffer = [0u8; 32];
-    let document_id: i32 = 42;
-    let document_id_bytes = document_id.to_be_bytes();
-    let oracle_keylet_result = unsafe {
-        host::oracle_id(
-            account_id.0.as_ptr(),
-            account_id.0.len(),
-            document_id_bytes.as_ptr(),
-            document_id_bytes.len(),
-            oracle_keylet_buffer.as_mut_ptr(),
-            oracle_keylet_buffer.len(),
-        )
-    };
-
-    if oracle_keylet_result != 32 {
-        let _ = trace_num("ERROR: oracle_keylet failed:", oracle_keylet_result as i64);
-        return -504; // Oracle keylet generation failed
-    }
-    let _ = trace_hex("Oracle keylet:", &oracle_keylet_buffer);
-
-    let _ = trace("SUCCESS: Keylet generation functions");
-    0
-}
-
-/// Test Category 6: Utility Functions (4 functions)
-/// Tests utility functions for hashing, NFT access, and tracing
-fn test_utility_functions() -> i32 {
-    let _ = trace("--- Category 6: Utility Functions ---");
-
-    // Test 6.1: compute_sha512_half() - SHA512 hash computation (first 32 bytes)
-    let test_data = b"Hello, XRPL WASM world!";
-    let mut hash_output = [0u8; 32];
-    let hash_result = unsafe {
-        host::sha512_half(
-            test_data.as_ptr(),
-            test_data.len(),
-            hash_output.as_mut_ptr(),
-            hash_output.len(),
-        )
-    };
-
-    if hash_result != 32 {
-        let _ = trace_num("ERROR: compute_sha512_half failed:", hash_result as i64);
-        return -601; // SHA512 half computation failed
-    }
-    let _ = trace_hex("Input data:", test_data);
-    let _ = trace_hex("SHA512 half hash:", &hash_output);
-
-    // Test 6.2: get_nft() - NFT data retrieval
-    let escrow_finish = EscrowFinish;
-    let account_id = escrow_finish.get_account().unwrap();
-    let nft_id = [0u8; 32]; // Dummy NFT ID for testing
-    let mut nft_buffer = [0u8; 256];
-    let nft_result = unsafe {
-        host::nft_uri(
-            account_id.0.as_ptr(),
-            account_id.0.len(),
-            nft_id.as_ptr(),
-            nft_id.len(),
-            nft_buffer.as_mut_ptr(),
-            nft_buffer.len(),
-        )
-    };
-
-    if nft_result <= 0 {
-        let _ = trace_num(
-            "INFO: get_nft failed (expected - no such NFT):",
-            nft_result as i64,
-        );
-        // This is expected - test account likely doesn't own the dummy NFT
-    } else {
-        let _ = trace_num("NFT data length:", nft_result as i64);
-        let _ = trace_hex("NFT data:", &nft_buffer[..nft_result as usize]);
-    }
-
-    // Test 6.3: trace() - Debug logging with data
-    let trace_message = b"Test trace message";
-    let trace_data_payload = b"payload";
-    unsafe {
-        host::trace(
-            trace_message.as_ptr(),
-            trace_message.len(),
-            TraceDataType::AsHex as i32,
-            trace_data_payload.as_ptr(),
-            trace_data_payload.len(),
-        )
-    };
-
-    // Test 6.4: trace_num() - Debug logging with number
-    let test_number = 42i64;
-    trace_num("Test number trace", test_number);
-
-    let _ = trace("SUCCESS: Utility functions");
-    0
-}
-
-/// Test Category 7: Data Update Functions (1 function)
-/// Tests the function for modifying the current ledger entry
-fn test_data_update_functions() -> i32 {
-    let _ = trace("--- Category 7: Data Update Functions ---");
-
-    // Test 7.1: update_data() - Update current ledger entry data
-    let update_payload = b"Updated ledger entry data from WASM test";
-
-    let update_result = unsafe { host::set_data(update_payload.as_ptr(), update_payload.len()) };
-
-    if update_result != update_payload.len() as i32 {
-        let _ = trace_num("ERROR: update_data failed:", update_result as i64);
-        return -701; // Data update failed
-    }
-
-    let _ = trace_hex("Successfully updated ledger entry with:", update_payload);
-    let _ = trace("SUCCESS: Data update functions");
-    0
-}

src/test/app/wasm_fixtures/all_keylets/Cargo.lock

@@ -1,171 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "all_keylets"
-version = "0.0.1"
-dependencies = [
- "xrpl-wasm-stdlib",
-]
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "bs58"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "typenum"
-version = "1.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "xrpl-macros"
-version = "0.1.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=renames#21c522f34a24b460297ebb6be1822680459bf37e"
-dependencies = [
- "bs58",
- "quote",
- "sha2",
- "syn",
-]
-
-[[package]]
-name = "xrpl-wasm-stdlib"
-version = "0.8.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=renames#21c522f34a24b460297ebb6be1822680459bf37e"
-dependencies = [
- "xrpl-macros",
-]

src/test/app/wasm_fixtures/all_keylets/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-edition = "2024"
-name = "all_keylets"
-version = "0.0.1"
-
-# This empty workspace definition keeps this project independent of the parent workspace
-[workspace]
-
-[lib]
-crate-type = ["cdylib"]
-
-[profile.release]
-lto = true
-opt-level = 's'
-panic = "abort"
-
-[dependencies]
-xrpl-std = { git = "https://github.com/ripple/xrpl-wasm-stdlib.git", package = "xrpl-wasm-stdlib", branch = "renames" }
-
-[profile.dev]
-panic = "abort"

src/test/app/wasm_fixtures/all_keylets/src/lib.rs

@@ -1,176 +0,0 @@
-#![cfg_attr(target_arch = "wasm32", no_std)]
-
-#[cfg(not(target_arch = "wasm32"))]
-extern crate std;
-
-use crate::host::{Error, Result, Result::Err, Result::Ok};
-use xrpl_std::core::keylets;
-use xrpl_std::core::ledger_objects::current_escrow::get_current_escrow;
-use xrpl_std::core::ledger_objects::current_escrow::CurrentEscrow;
-use xrpl_std::core::ledger_objects::ledger_object;
-use xrpl_std::core::ledger_objects::traits::CurrentEscrowFields;
-use xrpl_std::core::ledger_objects::LedgerObjectFieldGetter;
-use xrpl_std::core::types::currency::Currency;
-use xrpl_std::core::types::issue::{IouIssue, Issue, XrpIssue};
-use xrpl_std::core::types::mpt_id::MptId;
-use xrpl_std::host;
-use xrpl_std::host::trace::{trace, trace_acct, trace_data, trace_num, DataRepr};
-use xrpl_std::sfield;
-
-pub fn object_exists<T: LedgerObjectFieldGetter, const CODE: i32>(
-    keylet_result: Result<keylets::KeyletBytes>,
-    keylet_type: &str,
-    sfield: sfield::SField<T, CODE>,
-) -> Result<bool> {
-    let field = CODE;
-    match keylet_result {
-        Ok(keylet) => {
-            let _ = trace_data(keylet_type, &keylet, DataRepr::AsHex);
-
-            let slot = unsafe { host::cache_le(keylet.as_ptr(), keylet.len(), 0) };
-            if slot <= 0 {
-                let _ = trace_num("Error: ", slot.into());
-                return Err(Error::from_code(slot));
-            }
-            if field == 0 {
-                let new_field = sfield::PreviousTxnID;
-                let _ = trace_num("Getting field: ", new_field.clone().into());
-                match ledger_object::get_field(slot, new_field) {
-                    Ok(data) => {
-                        let _ = trace_data("Field data: ", &data.0, DataRepr::AsHex);
-                    }
-                    Err(result_code) => {
-                        let _ = trace_num("Error getting field: ", result_code.into());
-                        return Err(result_code);
-                    }
-                }
-            } else {
-                let _ = trace_num("Getting field: ", field.into());
-                match ledger_object::get_field(slot, sfield) {
-                    Ok(_data) => {
-                        let _ = trace("Field data: retrieved");
-                    }
-                    Err(result_code) => {
-                        let _ = trace_num("Error getting field: ", result_code.into());
-                        return Err(result_code);
-                    }
-                }
-            }
-
-            Ok(true)
-        }
-        Err(error) => {
-            let _ = trace_num("Error getting keylet: ", error.into());
-            Err(error)
-        }
-    }
-}
-
-#[unsafe(no_mangle)]
-pub extern "C" fn escrow_finish() -> i32 {
-    let _ = trace("$$$$$ STARTING WASM EXECUTION $$$$$");
-
-    let escrow: CurrentEscrow = get_current_escrow();
-
-    let account = escrow.get_account().unwrap_or_panic();
-    let _ = trace_acct("Account:", &account);
-
-    let destination = escrow.get_destination().unwrap_or_panic();
-    let _ = trace_acct("Destination:", &destination);
-
-    let mut seq = 5;
-
-    macro_rules! check_object_exists {
-        ($keylet:expr, $type:expr, $field:expr) => {
-            match object_exists($keylet, $type, $field) {
-                Ok(_exists) => {
-                    // false isn't returned
-                    let _ = trace(concat!(
-                        $type,
-                        " object exists, proceeding with escrow finish."
-                    ));
-                }
-                Err(error) => {
-                    let _ = trace_num("Current seq value:", seq.try_into().unwrap());
-                    return error.code();
-                }
-            }
-        };
-    }
-
-    let accountroot_id = keylets::accountroot_id(&account);
-    check_object_exists!(accountroot_id, "Account", sfield::Account);
-
-    let currency_code: &[u8; 3] = b"USD";
-    let currency: Currency = Currency::from(*currency_code);
-    let trustline_id = keylets::trustline_id(&account, &destination, &currency);
-    check_object_exists!(trustline_id, "Trustline", sfield::Generic);
-    seq += 1;
-
-    let asset1 = Issue::XRP(XrpIssue {});
-    let asset2 = Issue::IOU(IouIssue::new(destination, currency));
-    check_object_exists!(keylets::amm_id(&asset1, &asset2), "AMM", sfield::Account);
-
-    let check_id = keylets::check_id(&account, seq);
-    check_object_exists!(check_id, "Check", sfield::Account);
-    seq += 1;
-
-    let cred_type: &[u8] = b"termsandconditions";
-    let credential_id = keylets::credential_id(&account, &account, cred_type);
-    check_object_exists!(credential_id, "Credential", sfield::Subject);
-    seq += 1;
-
-    let delegate_id = keylets::delegate_id(&account, &destination);
-    check_object_exists!(delegate_id, "Delegate", sfield::Account);
-    seq += 1;
-
-    let deposit_preauth_id = keylets::deposit_preauth_id(&account, &destination);
-    check_object_exists!(deposit_preauth_id, "DepositPreauth", sfield::Account);
-    seq += 1;
-
-    let did_id = keylets::did_id(&account);
-    check_object_exists!(did_id, "DID", sfield::Account);
-    seq += 1;
-
-    let escrow_id = keylets::escrow_id(&account, seq);
-    check_object_exists!(escrow_id, "Escrow", sfield::Account);
-    seq += 1;
-
-    let mpt_issuance_id = keylets::mpt_issuance_id(&account, seq);
-    let mpt_id = MptId::new(seq.try_into().unwrap(), account);
-    check_object_exists!(mpt_issuance_id, "MPTIssuance", sfield::Issuer);
-    seq += 1;
-
-    let mptoken_id = keylets::mptoken_id(&mpt_id, &destination);
-    check_object_exists!(mptoken_id, "MPToken", sfield::Account);
-
-    let nft_offer_id = keylets::nft_offer_id(&destination, 6);
-    check_object_exists!(nft_offer_id, "NFTokenOffer", sfield::Owner);
-
-    let offer_id = keylets::offer_id(&account, seq);
-    check_object_exists!(offer_id, "Offer", sfield::Account);
-    seq += 1;
-
-    let paychan_id = keylets::paychan_id(&account, &destination, seq);
-    check_object_exists!(paychan_id, "PayChannel", sfield::Account);
-    seq += 1;
-
-    let pd_id = keylets::permissioned_domain_id(&account, seq);
-    check_object_exists!(pd_id, "PermissionedDomain", sfield::Owner);
-    seq += 1;
-
-    let signers_id = keylets::signers_id(&account);
-    check_object_exists!(signers_id, "SignerList", sfield::Generic);
-    seq += 1;
-
-    seq += 1; // ticket sequence number is one greater
-    let ticket_id = keylets::ticket_id(&account, seq);
-    check_object_exists!(ticket_id, "Ticket", sfield::Account);
-    seq += 1;
-
-    let vault_id = keylets::vault_id(&account, seq);
-    check_object_exists!(vault_id, "Vault", sfield::Account);
-    // seq += 1;
-
-    1 // All keylets exist, finish the escrow.
-}

src/test/app/wasm_fixtures/bad_align.c

@@ -1,42 +0,0 @@
-#include <stdint.h>
-
-int32_t float_from_uint(uint8_t const *, int32_t, uint8_t *, int32_t, int32_t);
-int32_t check_id(uint8_t const *, int32_t, uint8_t const *, int32_t, uint8_t *,
-                 int32_t);
-
-uint8_t e_data1[32 * 1024];
-uint8_t e_data2[32 * 1024];
-
-int32_t test1()
-{
-  e_data1[1] = 0xFF;
-  e_data1[2] = 0xFF;
-  e_data1[3] = 0xFF;
-  e_data1[4] = 0xFF;
-  e_data1[5] = 0xFF;
-  e_data1[6] = 0xFF;
-  e_data1[7] = 0xFF;
-  e_data1[8] = 0xFF;
-  int32_t result = float_from_uint(&e_data1[1], 8, &e_data1[35], 12, 0);
-  return result >= 0 ? *((int32_t *)(&e_data1[36])) : result;
-}
-
-int32_t test2()
-{
-  // Set up misaligned uint32 (seq) at offset 1
-  e_data2[1] = 0xFF;
-  e_data2[2] = 0xFF;
-  e_data2[3] = 0xFF;
-  e_data2[4] = 0xFF;
-  // Set up valid non-zero AccountID (20 bytes) at offset 10
-  for (int i = 0; i < 20; i++)
-    e_data2[10 + i] = i + 1;
-  // Call check_id with misaligned uint32 at &e_data2[1] to hit line 72 in
-  // HostFuncWrapper.cpp
-  int32_t result = check_id(&e_data2[10], 20, &e_data2[1], 4, &e_data2[35], 32);
-  // Return the misaligned value directly to validate it was read correctly (-1
-  // if all 0xFF)
-  return result >= 0 ? *((int32_t *)(&e_data2[36])) : result;
-}
-
-int32_t test() { return test1() + test2(); }

src/test/app/wasm_fixtures/codecov_tests/Cargo.lock

@@ -1,180 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "bs58"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
-
-[[package]]
-name = "codecov_tests"
-version = "0.0.1"
-dependencies = [
- "xrpl-common-stdlib",
- "xrpl-escrow-stdlib",
-]
-
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
-]
-
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.186"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
-[[package]]
-name = "typenum"
-version = "1.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "xrpl-common-stdlib"
-version = "0.8.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "xrpl-macros",
-]
-
-[[package]]
-name = "xrpl-escrow-stdlib"
-version = "0.1.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "xrpl-common-stdlib",
-]
-
-[[package]]
-name = "xrpl-macros"
-version = "0.1.0"
-source = "git+https://github.com/ripple/xrpl-wasm-stdlib.git?branch=error-and-trace#b008b097237ce0d1a2dffc72ba39dd9fc50020a9"
-dependencies = [
- "bs58",
- "proc-macro2",
- "quote",
- "sha2",
- "syn",
-]

src/test/app/wasm_fixtures/codecov_tests/Cargo.toml

@@ -1,19 +0,0 @@
-[package]
-edition = "2024"
-name = "codecov_tests"
-version = "0.0.1"
-
-# This empty workspace definition keeps this project independent of the parent workspace
-[workspace]
-
-[lib]
-crate-type = ["cdylib"]
-
-[profile.release]
-lto = true
-opt-level = 's'
-panic = "abort"
-
-[dependencies]
-xrpl-std = { git = "https://github.com/ripple/xrpl-wasm-stdlib.git", package = "xrpl-common-stdlib", branch = "error-and-trace" }
-xrpl-escrow = { git = "https://github.com/ripple/xrpl-wasm-stdlib.git", package = "xrpl-escrow-stdlib", branch = "error-and-trace" }

src/test/app/wasm_fixtures/codecov_tests/src/host_bindings_loose.rs

@@ -1,56 +0,0 @@
-//TODO add docs after discussing the interface
-//Note that Craft currently does not honor the rounding modes
-#[allow(unused)]
-pub const FLOAT_ROUNDING_MODES_TO_NEAREST: i32 = 0;
-#[allow(unused)]
-pub const FLOAT_ROUNDING_MODES_TOWARDS_ZERO: i32 = 1;
-#[allow(unused)]
-pub const FLOAT_ROUNDING_MODES_DOWNWARD: i32 = 2;
-#[allow(unused)]
-pub const FLOAT_ROUNDING_MODES_UPWARD: i32 = 3;
-
-// pub enum RippledRoundingModes{
-//     ToNearest = 0,
-//     TowardsZero = 1,
-//     DOWNWARD = 2,
-//     UPWARD = 3
-// }
-
-#[allow(unused)]
-#[link(wasm_import_module = "host_lib")]
-unsafe extern "C" {
-    pub fn parent_ldgr_hash(out_buff_ptr: i32, out_buff_len: i32) -> i32;
-
-    pub fn cache_le(keylet_ptr: i32, keylet_len: i32, cache_num: i32) -> i32;
-
-    pub fn tx_inner_arr_len(locator_ptr: i32, locator_len: i32) -> i32;
-
-    pub fn accountroot_id(
-        account_ptr: i32,
-        account_len: i32,
-        out_buff_ptr: *mut u8,
-        out_buff_len: usize,
-    ) -> i32;
-
-    pub fn trustline_id(
-        account1_ptr: *const u8,
-        account1_len: usize,
-        account2_ptr: *const u8,
-        account2_len: usize,
-        currency_ptr: i32,
-        currency_len: i32,
-        out_buff_ptr: *mut u8,
-        out_buff_len: usize,
-    ) -> i32;
-
-    // Same wasm functype as the real binding, so this is not a second import of
-    // host_lib.trace. Loose i32 pointers exercise the out-of-bounds path.
-    #[link_name = "trace"]
-    pub fn trace_loose(
-        msg_read_ptr: i32,
-        msg_read_len: i32,
-        data_type: i32,
-        data_read_ptr: i32,
-        data_read_len: i32,
-    );
-}