Merge remote-tracking branch 'origin/develop' into FN-36-credential_pins_pseudo_account

Co-authored-by: Cursor <cursoragent@cursor.com>

.cspell.config.yaml

@@ -366,6 +366,7 @@ words:
   - venv
   - vfalco
   - vinnie
+  - vkeylet
   - wasmi
   - wextra
   - wptr

.github/actions/cargo-cache/action.yml

@@ -0,0 +1,39 @@
+name: Use cargo artifacts cache
+description: >
+  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
+  when saving the cache, rust-cache deletes all binaries that were already
+  present there, which on persistent self-hosted runners wipes the tools
+  installed by prepare-runner. Harmless on ephemeral runners, but kept
+  consistent everywhere.
+
+inputs:
+  workspaces:
+    description: "Workspaces to cache, as 'workspace -> target' lines."
+    required: false
+    default: crates
+  key:
+    description: "Additional part of the cache key."
+    required: false
+    default: ""
+  cache-directories:
+    description: "Additional non-workspace directories to cache."
+    required: false
+    default: ""
+  save-if:
+    description: >
+      Condition for saving the cache after the job. Defaults to save only from develop branch
+    required: false
+    default: ${{ github.ref == 'refs/heads/develop' }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Use cargo artifacts cache
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        cache-bin: "false"
+        cache-directories: ${{ inputs.cache-directories }}
+        key: ${{ inputs.key }}
+        save-if: ${{ inputs.save-if }}
+        workspaces: ${{ inputs.workspaces }}

.github/dependabot.yml

@@ -4,6 +4,7 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
+      - .github/actions/cargo-cache/
       - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/

.github/workflows/build-nix-images.yml

@@ -58,7 +58,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -39,7 +39,7 @@ jobs:
           # AlmaLinux rather than UBI9, which does not ship rpm-sign.
           - name: rhel
             base_image: almalinux:9
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/Dockerfile

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

.github/workflows/publish-docs.yml

@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -163,11 +163,10 @@ jobs:
           compiler: ${{ inputs.compiler }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           key: ${{ inputs.config_name }}
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           # two workspaces here because build artifacts are located in 2 places:
           # - crates/target when cargo is called directly
           # - build/cargo when cargo is called by cmake

.github/workflows/reusable-clang-tidy.yml

@@ -27,7 +27,7 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
 
   run-clang-tidy:
     name: Run clang tidy
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 
@@ -60,10 +60,9 @@ jobs:
           compiler: ${{ env.COMPILER }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
 
       - name: Setup Conan

.github/workflows/reusable-rust.yml

@@ -33,9 +33,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
@@ -48,9 +46,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
@@ -76,9 +72,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Build documentation
         env:

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
         with:
           enable_ccache: false
 

API-CHANGELOG.md

@@ -54,6 +54,9 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
+- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
 - `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
 - `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 

cmake/XrplCompiler.cmake

@@ -120,7 +120,10 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
+    target_link_libraries(
+        common
+        INTERFACE -errorreport:none -machine:X64 -ignore:4099
+    )
 else()
     target_compile_options(
         common

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,6 +8,7 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
+import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -53,28 +54,89 @@ def create_transaction_parser():
     return macro_parser
 
 
+# Defaults for xrpl::TxSettings members, mirroring
+# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
+# the members that differ from these.
+SETTING_DEFAULTS = {
+    "delegable": "Delegation::NotDelegable",
+    "amendment": "uint256{}",
+    "privileges": "Privilege::NoPriv",
+}
+
+
+def parse_settings(settings_str):
+    """Parse a TxSettings blob into a dict, filling in defaults.
+
+    Args:
+        settings_str: A string like '({.delegable = Delegation::NotDelegable,
+                      .privileges = Privilege::CreateAcct})', or '({})'.
+
+    Returns:
+        A dict with a value for every key in SETTING_DEFAULTS.
+    """
+    body = settings_str.strip()
+    if not (body.startswith("(") and body.endswith(")")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1].strip()
+    if not (body.startswith("{") and body.endswith("}")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1]
+
+    # Strip comments, which may be interleaved with the designated initializers.
+    body = re.sub(r"//[^\n]*", "", body)
+
+    settings = dict(SETTING_DEFAULTS)
+    seen = set()
+    # Each entry runs from '.key =' up to the next '.key =' or the end.
+    for key, value in re.findall(
+        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
+    ):
+        if key not in SETTING_DEFAULTS:
+            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
+        settings[key] = " ".join(value.split()).rstrip(",")
+        seen.add(key)
+
+    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
+    # Every '.member' in the blob must have been consumed above.
+    if len(re.findall(r"\.\w+", body)) != len(seen):
+        raise ValueError(f"Could not parse every setting in {settings_str!r}")
+
+    # A blob with content but no designated initializer is positional, which
+    # would otherwise be read as "all defaults" and silently generate the
+    # wrong output.
+    if body.strip() and not seen:
+        raise ValueError(
+            "TxSettings requires designated initializers (.member = value), "
+            f"got {settings_str!r}"
+        )
+
+    return settings
+
+
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
-                    'uint256{}', 'createAcct', '({...})']
+                   ['ttPAYMENT', '0', 'Payment',
+                    '({.privileges = Privilege::CreateAcct})', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 7:
+    if len(args_list) < 5:
         raise ValueError(
-            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    delegable = args_list[3]
-    amendments = args_list[4]
-    privileges = args_list[5]
+    settings = parse_settings(args_list[3])
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -84,9 +146,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": delegable,
-        "amendments": amendments,
-        "privileges": privileges,
+        "delegable": settings["delegable"],
+        "amendments": settings["amendment"],
+        "privileges": settings["privileges"],
         "fields": fields,
     }
 

crates/Cargo.lock

@@ -57,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
 dependencies = [
  "cc",
  "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
 dependencies = [
  "indexmap",
  "proc-macro2",

docs/install.md

@@ -65,7 +65,7 @@ wherever it appears in the repository configuration.
 4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
         sudo tee /etc/apt/sources.list.d/xrplf.list
     ```
 
@@ -92,19 +92,19 @@ wherever it appears in the repository configuration.
 2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    cat << REPOFILE | sudo tee /etc/yum.repos.d/xrplf.repo
+    cat << 'REPOFILE' | sudo tee /etc/yum.repos.d/xrplf.repo
     [xrplf-stable]
     name=XRP Ledger Packages
     enabled=1
-    baseurl=https://packages.xrplf.org/repository/rpm-stable/
+    baseurl=https://packages.xrplf.org/repository/rpm-stable/$basearch/
     gpgcheck=1
-    repo_gpgcheck=0
+    repo_gpgcheck=1
     gpgkey=https://packages.xrplf.org/xrplf.asc
     REPOFILE
     ```
 
     `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed.
+    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
 
 3.  Install the `xrpld` package:
 

include/xrpl/ledger/View.h

@@ -24,6 +24,7 @@
 #include <optional>
 #include <set>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
@@ -198,7 +199,10 @@ dirLink(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -209,7 +213,8 @@ canWithdraw(
     AccountID const& to,
     SLE::const_ref toSle,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
@@ -222,7 +227,10 @@ canWithdraw(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -232,20 +240,25 @@ canWithdraw(
     AccountID const& from,
     AccountID const& to,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
- * destination account (sfDestination).
+ * destination account (sfDestination). Credentials, if any, are taken from the
+ * transaction's sfCredentialIDs field.
  *
  *    - Checks that the receiver account exists.
  *    - If the receiver requires a destination tag, check that one exists, even
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials in sfCredentialIDs to already exist in the
+ *      ledger, and returns an internal error otherwise. Validate them
+ *      beforehand with credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */

include/xrpl/ledger/helpers/CredentialHelpers.h

@@ -14,6 +14,7 @@
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/TER.h>
 
+#include <cstdint>
 #include <memory>
 #include <set>
 #include <utility>
@@ -33,6 +34,32 @@ checkExpired(SLE const& sleCredential, NetClock::time_point const& closed);
 [[nodiscard]] TER
 deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j);
 
+/**
+ * @brief Remove credentials pinned to a pseudo-account's owner directory.
+ *
+ * Cleans up credentials that were linked to a pseudo-account (Vault, LoanBroker,
+ * AMM), which such an account can neither accept nor delete. Only credentials
+ * are removed; every other object is left in place. The walk visits at most
+ * @p maxNodesToDelete directory entries and charges the ones it leaves alone
+ * against that budget too, so a directory holding other objects yields fewer
+ * than @p maxNodesToDelete deletions. On reaching the bound the result is
+ * `tecINCOMPLETE` and the caller must propagate it so a later transaction
+ * resumes.
+ *
+ * @param view Mutable ledger view.
+ * @param pseudoAcct The pseudo-account whose directory is cleaned.
+ * @param maxNodesToDelete Upper bound on directory entries processed in one call.
+ * @param j Journal for diagnostics.
+ * @return tesSUCCESS once no credentials remain, tecINCOMPLETE if the bound was
+ *         reached, or a deletion error.
+ */
+[[nodiscard]] TER
+deletePseudoAccountCredentials(
+    ApplyView& view,
+    AccountID const& pseudoAcct,
+    std::uint16_t maxNodesToDelete,
+    beast::Journal j);
+
 // Amendment and parameters checks for sfCredentialIDs field
 NotTEC
 checkFields(STTx const& tx, Rules const& rules, beast::Journal j);

include/xrpl/protocol/AMMCore.h

@@ -91,6 +91,17 @@ getFee(std::uint16_t tfee)
     return Number{tfee} / kAuctionSlotFeeScaleFactor;
 }
 
+/**
+ * Minimum auction slot price: LPTokens * TradingFee / kAuctionSlotMinFeeFraction
+ * @param lptAMMBalance  AMM LP token balance
+ * @param tradingFee     trading fee in {0, 1000}
+ */
+inline Number
+ammAuctionMinSlotPrice(Number const& lptAMMBalance, std::uint16_t tradingFee)
+{
+    return lptAMMBalance * getFee(tradingFee) / kAuctionSlotMinFeeFraction;
+}
+
 /**
  * Get fee multiplier (1 - tfee)
  * @tfee trading fee in basis points

include/xrpl/protocol/Permissions.h

@@ -4,6 +4,7 @@
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/TxSettings.h>
 
 #include <cstdint>
 #include <functional>
@@ -38,11 +39,6 @@ enum GranularPermissionType : std::uint32_t {
 #pragma pop_macro("GRANULAR_PERMISSION")
 };
 
-// Injected bare enumerators (xrpl::delegable / xrpl::notDelegable) are required by preprocessor
-// tricks in tests and macro-generated code; enum class would break that.
-// NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-enum Delegation { Delegable, NotDelegable };
-
 class Permission
 {
 private:
@@ -65,7 +61,7 @@ private:
     struct TxDelegationEntry
     {
         uint256 amendment;
-        Delegation delegable{NotDelegable};
+        Delegation delegable{Delegation::NotDelegable};
     };
 
     std::unordered_set<TxType> granularTxTypes_;

include/xrpl/protocol/Protocol.h

@@ -396,6 +396,16 @@ using TxID = uint256;
  */
 constexpr std::uint16_t kMaxDeletableAmmTrustLines = 512;
 
+/**
+ * The maximum number of owner-directory entries to walk when clearing
+ * credentials pinned to a pseudo-account, in a single transaction.
+ *
+ * The walk stops after this many entries whether or not each one turns out to
+ * be a credential, so a directory that also holds other objects yields fewer
+ * deletions per transaction.
+ */
+constexpr std::uint16_t kMaxDeletablePseudoAccountCredentials = 512;
+
 /**
  * The maximum length of a URI inside an Oracle
  */

include/xrpl/protocol/TxSettings.h

@@ -0,0 +1,96 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/safe_cast.h>
+
+#include <cstdint>
+#include <type_traits>
+
+namespace xrpl {
+
+enum class Delegation { Delegable, NotDelegable };
+
+/**
+ * Operations a transaction is permitted to perform, as a bitfield.
+ *
+ * These are declared per-transaction in transactions.macro (via
+ * TxSettings::privileges) and enforced in InvariantCheck.cpp.
+ */
+enum class Privilege : std::uint16_t {
+    NoPriv = 0x0000,              // The transaction can not do any of the enumerated operations
+    CreateAcct = 0x0001,          // The transaction can create a new ACCOUNT_ROOT object.
+    CreatePseudoAcct = 0x0002,    // The transaction can create a pseudo account,
+                                  // which implies createAcct
+    MustDeleteAcct = 0x0004,      // The transaction must delete an ACCOUNT_ROOT object
+    MayDeleteAcct = 0x0008,       // The transaction may delete an ACCOUNT_ROOT
+                                  // object, but does not have to
+    OverrideFreeze = 0x0010,      // The transaction can override some freeze rules
+    ChangeNftCounts = 0x0020,     // The transaction can mint or burn an NFT
+    CreateMptIssuance = 0x0040,   // The transaction can create a new MPT issuance
+    DestroyMptIssuance = 0x0080,  // The transaction can destroy an MPT issuance
+    MustAuthorizeMpt = 0x0100,    // The transaction MUST create or delete an MPT
+                                  // object (except by issuer)
+    MayAuthorizeMpt = 0x0200,     // The transaction MAY create or delete an MPT
+                                  // object (except by issuer)
+    MayDeleteMpt = 0x0400,        // The transaction MAY delete an MPT object. May not create.
+    MustModifyVault = 0x0800,     // The transaction must modify, delete or create, a vault
+    MayModifyVault = 0x1000,      // The transaction MAY modify, delete or create, a vault
+    MayCreateMpt = 0x2000,        // The transaction MAY create an MPT object, except for issuer.
+};
+
+// The inner static_cast is not redundant: the underlying type is narrower than
+// `int`, so the operands integer-promote and the result has to be narrowed back.
+// safeCast rejects that narrowing, but every input bit is a Privilege bit by
+// construction, so the result is always representable.
+constexpr Privilege
+operator|(Privilege lhs, Privilege rhs)
+{
+    using Underlying = std::underlying_type_t<Privilege>;
+    return static_cast<Privilege>(
+        static_cast<Underlying>(safeCast<Underlying>(lhs) | safeCast<Underlying>(rhs)));
+}
+
+constexpr Privilege
+operator&(Privilege lhs, Privilege rhs)
+{
+    using Underlying = std::underlying_type_t<Privilege>;
+    return static_cast<Privilege>(
+        static_cast<Underlying>(safeCast<Underlying>(lhs) & safeCast<Underlying>(rhs)));
+}
+
+/**
+ * Per-transaction metadata declared in transactions.macro.
+ *
+ * Every member has a default, so a transaction only needs to name the settings
+ * that differ from the common case. See the documentation at the top of
+ * transactions.macro for the authoring syntax.
+ *
+ * This is deliberately not a constexpr-friendly type: amendment identifiers are
+ * runtime-initialized `extern uint256 const` globals (see Feature.h), so a
+ * TxSettings can only be built at runtime.
+ */
+struct TxSettings
+{
+    /**
+     * Whether an account may delegate this transaction to another account.
+     */
+    Delegation delegable{Delegation::NotDelegable};
+
+    /**
+     * The amendment gating this transaction, or uint256{} if always available.
+     */
+    // The `{}` looks redundant, because BaseUInt's default constructor already
+    // zeroes the value. It is not: without a default member initializer here,
+    // every partial designated initializer in transactions.macro trips the
+    // missing-designated-field-initializers warning, which the build treats as
+    // an error.
+    // NOLINTNEXTLINE(readability-redundant-member-init)
+    uint256 amendment{};
+
+    /**
+     * Operations this transaction is permitted to perform.
+     */
+    Privilege privileges{Privilege::NoPriv};
+};
+
+}  // namespace xrpl

include/xrpl/protocol_autogen/transactions/AMMBid.h

@@ -21,7 +21,7 @@ class AMMBidBuilder;
  * Type: ttAMM_BID (39)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMBidBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMClawback.h

@@ -21,7 +21,7 @@ class AMMClawbackBuilder;
  * Type: ttAMM_CLAWBACK (31)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMMClawback
- * Privileges: MayDeleteAcct | OverrideFreeze | MayAuthorizeMpt
+ * Privileges: Privilege::MayDeleteAcct | Privilege::OverrideFreeze | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMCreate.h

@@ -21,7 +21,7 @@ class AMMCreateBuilder;
  * Type: ttAMM_CREATE (35)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: CreatePseudoAcct | MayCreateMpt
+ * Privileges: Privilege::CreatePseudoAcct | Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMDelete.h

@@ -21,7 +21,7 @@ class AMMDeleteBuilder;
  * Type: ttAMM_DELETE (40)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: MustDeleteAcct | MayDeleteMpt
+ * Privileges: Privilege::MustDeleteAcct | Privilege::MayDeleteMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMDeposit.h

@@ -21,7 +21,7 @@ class AMMDepositBuilder;
  * Type: ttAMM_DEPOSIT (36)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMDepositBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMVote.h

@@ -21,7 +21,7 @@ class AMMVoteBuilder;
  * Type: ttAMM_VOTE (38)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMVoteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMWithdraw.h

@@ -21,7 +21,7 @@ class AMMWithdrawBuilder;
  * Type: ttAMM_WITHDRAW (37)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: MayDeleteAcct | MayAuthorizeMpt
+ * Privileges: Privilege::MayDeleteAcct | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMWithdrawBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AccountDelete.h

@@ -21,7 +21,7 @@ class AccountDeleteBuilder;
  * Type: ttACCOUNT_DELETE (21)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: MustDeleteAcct
+ * Privileges: Privilege::MustDeleteAcct
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AccountDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AccountSet.h

@@ -21,7 +21,7 @@ class AccountSetBuilder;
  * Type: ttACCOUNT_SET (3)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AccountSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/Batch.h

@@ -21,7 +21,7 @@ class BatchBuilder;
  * Type: ttBATCH (71)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureBatchV1_1
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use BatchBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCancel.h

@@ -21,7 +21,7 @@ class CheckCancelBuilder;
  * Type: ttCHECK_CANCEL (18)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCancelBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCash.h

@@ -21,7 +21,7 @@ class CheckCashBuilder;
  * Type: ttCHECK_CASH (17)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: MayCreateMpt
+ * Privileges: Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCashBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCreate.h

@@ -21,7 +21,7 @@ class CheckCreateBuilder;
  * Type: ttCHECK_CREATE (16)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/Clawback.h

@@ -21,7 +21,7 @@ class ClawbackBuilder;
  * Type: ttCLAWBACK (30)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h

@@ -21,7 +21,7 @@ class ConfidentialMPTClawbackBuilder;
  * Type: ttCONFIDENTIAL_MPT_CLAWBACK (89)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h

@@ -21,7 +21,7 @@ class ConfidentialMPTConvertBuilder;
  * Type: ttCONFIDENTIAL_MPT_CONVERT (85)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTConvertBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h

@@ -21,7 +21,7 @@ class ConfidentialMPTConvertBackBuilder;
  * Type: ttCONFIDENTIAL_MPT_CONVERT_BACK (87)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTConvertBackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h

@@ -21,7 +21,7 @@ class ConfidentialMPTMergeInboxBuilder;
  * Type: ttCONFIDENTIAL_MPT_MERGE_INBOX (86)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTMergeInboxBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h

@@ -21,7 +21,7 @@ class ConfidentialMPTSendBuilder;
  * Type: ttCONFIDENTIAL_MPT_SEND (88)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTSendBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialAccept.h

@@ -21,7 +21,7 @@ class CredentialAcceptBuilder;
  * Type: ttCREDENTIAL_ACCEPT (59)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialAcceptBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialCreate.h

@@ -21,7 +21,7 @@ class CredentialCreateBuilder;
  * Type: ttCREDENTIAL_CREATE (58)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialDelete.h

@@ -21,7 +21,7 @@ class CredentialDeleteBuilder;
  * Type: ttCREDENTIAL_DELETE (60)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DIDDelete.h

@@ -21,7 +21,7 @@ class DIDDeleteBuilder;
  * Type: ttDID_DELETE (50)
  * Delegable: Delegation::Delegable
  * Amendment: featureDID
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DIDDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DIDSet.h

@@ -21,7 +21,7 @@ class DIDSetBuilder;
  * Type: ttDID_SET (49)
  * Delegable: Delegation::Delegable
  * Amendment: featureDID
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DIDSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DelegateSet.h

@@ -21,7 +21,7 @@ class DelegateSetBuilder;
  * Type: ttDELEGATE_SET (64)
  * Delegable: Delegation::NotDelegable
  * Amendment: featurePermissionDelegationV1_1
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DelegateSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DepositPreauth.h

@@ -21,7 +21,7 @@ class DepositPreauthBuilder;
  * Type: ttDEPOSIT_PREAUTH (19)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DepositPreauthBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EnableAmendment.h

@@ -21,7 +21,7 @@ class EnableAmendmentBuilder;
  * Type: ttAMENDMENT (100)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EnableAmendmentBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowCancel.h

@@ -21,7 +21,7 @@ class EscrowCancelBuilder;
  * Type: ttESCROW_CANCEL (4)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowCancelBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowCreate.h

@@ -21,7 +21,7 @@ class EscrowCreateBuilder;
  * Type: ttESCROW_CREATE (1)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowFinish.h

@@ -21,7 +21,7 @@ class EscrowFinishBuilder;
  * Type: ttESCROW_FINISH (2)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowFinishBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LedgerStateFix.h

@@ -21,7 +21,7 @@ class LedgerStateFixBuilder;
  * Type: ttLEDGER_STATE_FIX (53)
  * Delegable: Delegation::Delegable
  * Amendment: fixNFTokenPageLinks
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LedgerStateFixBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverClawbackBuilder;
  * Type: ttLOAN_BROKER_COVER_CLAWBACK (78)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverDepositBuilder;
  * Type: ttLOAN_BROKER_COVER_DEPOSIT (76)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverDepositBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverWithdrawBuilder;
  * Type: ttLOAN_BROKER_COVER_WITHDRAW (77)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MayAuthorizeMpt
+ * Privileges: Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverWithdrawBuilder to construct new transactions.
@@ -121,6 +121,32 @@ public:
     {
         return this->tx_->isFieldPresent(sfDestinationTag);
     }
+
+    /**
+     * @brief Get sfCredentialIDs (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VECTOR256::type::value_type>
+    getCredentialIDs() const
+    {
+        if (hasCredentialIDs())
+        {
+            return this->tx_->at(sfCredentialIDs);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfCredentialIDs is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasCredentialIDs() const
+    {
+        return this->tx_->isFieldPresent(sfCredentialIDs);
+    }
 };
 
 /**
@@ -214,6 +240,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfCredentialIDs (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    LoanBrokerCoverWithdrawBuilder&
+    setCredentialIDs(std::decay_t<typename SF_VECTOR256::type::value_type> const& value)
+    {
+        object_[sfCredentialIDs] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the LoanBrokerCoverWithdraw wrapper.
      * @param publicKey The public key for signing.

include/xrpl/protocol_autogen/transactions/LoanBrokerDelete.h

@@ -21,7 +21,7 @@ class LoanBrokerDeleteBuilder;
  * Type: ttLOAN_BROKER_DELETE (75)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MustDeleteAcct | MayAuthorizeMpt
+ * Privileges: Privilege::MustDeleteAcct | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerSet.h

@@ -21,7 +21,7 @@ class LoanBrokerSetBuilder;
  * Type: ttLOAN_BROKER_SET (74)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: CreatePseudoAcct | MayAuthorizeMpt
+ * Privileges: Privilege::CreatePseudoAcct | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanDelete.h

@@ -21,7 +21,7 @@ class LoanDeleteBuilder;
  * Type: ttLOAN_DELETE (81)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanManage.h

@@ -21,7 +21,7 @@ class LoanManageBuilder;
  * Type: ttLOAN_MANAGE (82)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MayModifyVault
+ * Privileges: Privilege::MayModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanManageBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanPay.h

@@ -21,7 +21,7 @@ class LoanPayBuilder;
  * Type: ttLOAN_PAY (84)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MayAuthorizeMpt | MustModifyVault
+ * Privileges: Privilege::MayAuthorizeMpt | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanPayBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanSet.h

@@ -21,7 +21,7 @@ class LoanSetBuilder;
  * Type: ttLOAN_SET (80)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MayAuthorizeMpt | MustModifyVault
+ * Privileges: Privilege::MayAuthorizeMpt | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/MPTokenAuthorize.h

@@ -21,7 +21,7 @@ class MPTokenAuthorizeBuilder;
  * Type: ttMPTOKEN_AUTHORIZE (57)
  * Delegable: Delegation::Delegable
  * Amendment: featureMPTokensV1
- * Privileges: MustAuthorizeMpt
+ * Privileges: Privilege::MustAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use MPTokenAuthorizeBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/MPTokenIssuanceCreate.h

@@ -21,7 +21,7 @@ class MPTokenIssuanceCreateBuilder;
  * Type: ttMPTOKEN_ISSUANCE_CREATE (54)
  * Delegable: Delegation::Delegable
  * Amendment: featureMPTokensV1
- * Privileges: CreateMptIssuance
+ * Privileges: Privilege::CreateMptIssuance
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use MPTokenIssuanceCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/MPTokenIssuanceDestroy.h

@@ -21,7 +21,7 @@ class MPTokenIssuanceDestroyBuilder;
  * Type: ttMPTOKEN_ISSUANCE_DESTROY (55)
  * Delegable: Delegation::Delegable
  * Amendment: featureMPTokensV1
- * Privileges: DestroyMptIssuance
+ * Privileges: Privilege::DestroyMptIssuance
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use MPTokenIssuanceDestroyBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/MPTokenIssuanceSet.h

@@ -21,7 +21,7 @@ class MPTokenIssuanceSetBuilder;
  * Type: ttMPTOKEN_ISSUANCE_SET (56)
  * Delegable: Delegation::Delegable
  * Amendment: featureMPTokensV1
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use MPTokenIssuanceSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenAcceptOffer.h

@@ -21,7 +21,7 @@ class NFTokenAcceptOfferBuilder;
  * Type: ttNFTOKEN_ACCEPT_OFFER (29)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenAcceptOfferBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenBurn.h

@@ -21,7 +21,7 @@ class NFTokenBurnBuilder;
  * Type: ttNFTOKEN_BURN (26)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: ChangeNftCounts
+ * Privileges: Privilege::ChangeNftCounts
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenBurnBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenCancelOffer.h

@@ -21,7 +21,7 @@ class NFTokenCancelOfferBuilder;
  * Type: ttNFTOKEN_CANCEL_OFFER (28)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenCancelOfferBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenCreateOffer.h

@@ -21,7 +21,7 @@ class NFTokenCreateOfferBuilder;
  * Type: ttNFTOKEN_CREATE_OFFER (27)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenCreateOfferBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenMint.h

@@ -21,7 +21,7 @@ class NFTokenMintBuilder;
  * Type: ttNFTOKEN_MINT (25)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: ChangeNftCounts
+ * Privileges: Privilege::ChangeNftCounts
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenMintBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/NFTokenModify.h

@@ -21,7 +21,7 @@ class NFTokenModifyBuilder;
  * Type: ttNFTOKEN_MODIFY (61)
  * Delegable: Delegation::Delegable
  * Amendment: featureDynamicNFT
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use NFTokenModifyBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/OfferCancel.h

@@ -21,7 +21,7 @@ class OfferCancelBuilder;
  * Type: ttOFFER_CANCEL (8)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use OfferCancelBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/OfferCreate.h

@@ -21,7 +21,7 @@ class OfferCreateBuilder;
  * Type: ttOFFER_CREATE (7)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: MayCreateMpt
+ * Privileges: Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use OfferCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/OracleDelete.h

@@ -21,7 +21,7 @@ class OracleDeleteBuilder;
  * Type: ttORACLE_DELETE (52)
  * Delegable: Delegation::Delegable
  * Amendment: featurePriceOracle
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use OracleDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/OracleSet.h

@@ -21,7 +21,7 @@ class OracleSetBuilder;
  * Type: ttORACLE_SET (51)
  * Delegable: Delegation::Delegable
  * Amendment: featurePriceOracle
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use OracleSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/Payment.h

@@ -21,7 +21,7 @@ class PaymentBuilder;
  * Type: ttPAYMENT (0)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: CreateAcct | MayCreateMpt
+ * Privileges: Privilege::CreateAcct | Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PaymentBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/PaymentChannelClaim.h

@@ -21,7 +21,7 @@ class PaymentChannelClaimBuilder;
  * Type: ttPAYCHAN_CLAIM (15)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PaymentChannelClaimBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/PaymentChannelCreate.h

@@ -21,7 +21,7 @@ class PaymentChannelCreateBuilder;
  * Type: ttPAYCHAN_CREATE (13)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PaymentChannelCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/PaymentChannelFund.h

@@ -21,7 +21,7 @@ class PaymentChannelFundBuilder;
  * Type: ttPAYCHAN_FUND (14)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PaymentChannelFundBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/PermissionedDomainDelete.h

@@ -21,7 +21,7 @@ class PermissionedDomainDeleteBuilder;
  * Type: ttPERMISSIONED_DOMAIN_DELETE (63)
  * Delegable: Delegation::Delegable
  * Amendment: featurePermissionedDomains
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PermissionedDomainDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/PermissionedDomainSet.h

@@ -21,7 +21,7 @@ class PermissionedDomainSetBuilder;
  * Type: ttPERMISSIONED_DOMAIN_SET (62)
  * Delegable: Delegation::Delegable
  * Amendment: featurePermissionedDomains
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use PermissionedDomainSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/SetFee.h

@@ -21,7 +21,7 @@ class SetFeeBuilder;
  * Type: ttFEE (101)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use SetFeeBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/SetRegularKey.h

@@ -21,7 +21,7 @@ class SetRegularKeyBuilder;
  * Type: ttREGULAR_KEY_SET (5)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use SetRegularKeyBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/SignerListSet.h

@@ -21,7 +21,7 @@ class SignerListSetBuilder;
  * Type: ttSIGNER_LIST_SET (12)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use SignerListSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/SponsorshipSet.h

@@ -21,7 +21,7 @@ class SponsorshipSetBuilder;
  * Type: ttSPONSORSHIP_SET (91)
  * Delegable: Delegation::Delegable
  * Amendment: featureSponsor
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use SponsorshipSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/SponsorshipTransfer.h

@@ -21,7 +21,7 @@ class SponsorshipTransferBuilder;
  * Type: ttSPONSORSHIP_TRANSFER (90)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSponsor
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use SponsorshipTransferBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/TicketCreate.h

@@ -21,7 +21,7 @@ class TicketCreateBuilder;
  * Type: ttTICKET_CREATE (10)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use TicketCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/TrustSet.h

@@ -21,7 +21,7 @@ class TrustSetBuilder;
  * Type: ttTRUST_SET (20)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use TrustSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/UNLModify.h

@@ -21,7 +21,7 @@ class UNLModifyBuilder;
  * Type: ttUNL_MODIFY (102)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use UNLModifyBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultClawback.h

@@ -21,7 +21,7 @@ class VaultClawbackBuilder;
  * Type: ttVAULT_CLAWBACK (70)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: MayDeleteMpt | MustModifyVault
+ * Privileges: Privilege::MayDeleteMpt | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultCreate.h

@@ -21,7 +21,7 @@ class VaultCreateBuilder;
  * Type: ttVAULT_CREATE (65)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: CreatePseudoAcct | CreateMptIssuance | MustModifyVault
+ * Privileges: Privilege::CreatePseudoAcct | Privilege::CreateMptIssuance | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultDelete.h

@@ -21,7 +21,7 @@ class VaultDeleteBuilder;
  * Type: ttVAULT_DELETE (67)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: MustDeleteAcct | DestroyMptIssuance | MustModifyVault
+ * Privileges: Privilege::MustDeleteAcct | Privilege::DestroyMptIssuance | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultDeposit.h

@@ -21,7 +21,7 @@ class VaultDepositBuilder;
  * Type: ttVAULT_DEPOSIT (68)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: MayAuthorizeMpt | MustModifyVault
+ * Privileges: Privilege::MayAuthorizeMpt | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultDepositBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultSet.h

@@ -21,7 +21,7 @@ class VaultSetBuilder;
  * Type: ttVAULT_SET (66)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: MustModifyVault
+ * Privileges: Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/VaultWithdraw.h

@@ -21,7 +21,7 @@ class VaultWithdrawBuilder;
  * Type: ttVAULT_WITHDRAW (69)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureSingleAssetVault
- * Privileges: MayDeleteMpt | MayAuthorizeMpt | MustModifyVault
+ * Privileges: Privilege::MayDeleteMpt | Privilege::MayAuthorizeMpt | Privilege::MustModifyVault
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use VaultWithdrawBuilder to construct new transactions.
@@ -121,6 +121,32 @@ public:
     {
         return this->tx_->isFieldPresent(sfDestinationTag);
     }
+
+    /**
+     * @brief Get sfCredentialIDs (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VECTOR256::type::value_type>
+    getCredentialIDs() const
+    {
+        if (hasCredentialIDs())
+        {
+            return this->tx_->at(sfCredentialIDs);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfCredentialIDs is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasCredentialIDs() const
+    {
+        return this->tx_->isFieldPresent(sfCredentialIDs);
+    }
 };
 
 /**
@@ -214,6 +240,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfCredentialIDs (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    VaultWithdrawBuilder&
+    setCredentialIDs(std::decay_t<typename SF_VECTOR256::type::value_type> const& value)
+    {
+        object_[sfCredentialIDs] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the VaultWithdraw wrapper.
      * @param publicKey The public key for signing.

include/xrpl/protocol_autogen/transactions/XChainAccountCreateCommit.h

@@ -21,7 +21,7 @@ class XChainAccountCreateCommitBuilder;
  * Type: ttXCHAIN_ACCOUNT_CREATE_COMMIT (44)
  * Delegable: Delegation::Delegable
  * Amendment: featureXChainBridge
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use XChainAccountCreateCommitBuilder to construct new transactions.