Merge branch 'develop' into ximinez/fix/validator-cache

* XRPLF/develop:
  ci: Run full matrix only on `Ready to merge` or `Full CI build` labeled PRs (7689)
  fix: Strengthen Clawback invariant checks for MPT balances (7285)
  test: Add unit tests for IP address related functions (7744)
  ci: Add Rust to Nix docker image (7571)
  docs: Add more information about pre-commit hooks and how to set them up (7802)
  test: Add JSON array size tests (7592)
  chore: Enable most readability checks (7772)
  ci: Do not run conflict checker when label is applied (7774)
  chore: Run clang_tidy_check with `pass_filenames: false` from pre-commit (7800)
  feat: Add delegate filter param for account_tx RPC (6126)
  refactor: Move `jss.h` `include` out of `Indexes.h` (7799)
  test: Add tests for check doxygen style (7795)
  style: Add pre-commit hook to check doxygen style (7794)
  style: Unify style for all Doxygen comments (7776)
  fix: Improve Number addition/subtraction rounding (7369)
  feat: XLS-68: Sponsor, 5887 continuation  (7350)

.clang-tidy

@@ -75,8 +75,6 @@ Checks: "-*,
 # readability-static-accessed-through-instance,        # this check is probably unnecessary. It makes the code less readable
 # ---
 
-FormatStyle: file
-
 CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
@@ -85,8 +83,6 @@ CheckOptions:
 
   readability-braces-around-statements.ShortStatementLines: 2
   readability-identifier-naming.MacroDefinitionCase: UPPER_CASE
-  readability-identifier-naming.NamespaceCase: lower_case
-  readability-identifier-naming.InlineNamespaceCase: lower_case
   readability-identifier-naming.ClassCase: CamelCase
   readability-identifier-naming.StructCase: CamelCase
   readability-identifier-naming.UnionCase: CamelCase

.codecov.yml

@@ -1,32 +1,10 @@
 codecov:
   require_ci_to_pass: true
-  # The C++ and Rust uploads land minutes apart; without this gate Codecov
-  # publishes a near-zero total from whichever one arrives first.
-  notify:
-    after_n_builds: 2
-    wait_for_ci: true
 
 comment:
   behavior: default
   layout: reach,diff,flags,tree,reach
-  show_carryforward_flags: true
-  after_n_builds: 2
-
-# C++ and Rust coverage upload from independent workflows under the `cpp` and
-# `rust` flags; carryforward keeps one language's total when only the other reran.
-flag_management:
-  default_rules:
-    carryforward: true
-  individual_flags:
-    - name: cpp
-      carryforward: true
-      paths:
-        - include/
-        - src/
-    - name: rust
-      carryforward: true
-      paths:
-        - crates/
+  show_carryforward_flags: false
 
 coverage:
   range: "70..85"

.cspell.config.yaml

@@ -7,7 +7,6 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
-  - nix/check-tools/*.txt # generated, and full of Nix store hashes
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -31,9 +30,7 @@ ignoreRegExpList:
   - ABCDEFGHIJKLMNOPQRSTUVWXYZ
   - ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
 overrides:
-  - filename:
-      - "**/*_test.cpp" # legacy boost.test files
-      - "src/tests/**/*.cpp" # gtest test files
+  - filename: "**/*_test.cpp" # all test files
     ignoreRegExpList:
       - /"[^"]*"/g # double-quoted strings
       - /'[^']*'/g # single-quoted strings
@@ -68,9 +65,7 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - cdylib
   - canonicalised
-  - cctools
   - changespq
   - checkme
   - choco
@@ -106,14 +101,12 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
-  - desugars
   - desync
   - desynced
   - determ
   - disablerepo
   - distro
   - doxyfile
-  - dsymutil
   - dxrpl
   - elgamal
   - enabled
@@ -133,19 +126,15 @@ words:
   - gcov
   - gcovr
   - ghead
-  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
   - gpgkey
-  - Hinnant
   - hotwallet
   - hwaddress
   - hwrap
   - ifndef
-  - impls
   - inequation
-  - initialiser
   - insuf
   - insuff
   - invasively
@@ -174,8 +163,6 @@ words:
   - llection
   - LOCALGOOD
   - logwstream
-  - Lombrozo
-  - lresolv
   - lseq
   - lsmf
   - ltype
@@ -185,6 +172,7 @@ words:
   - MPTAMM
   - MPTDEX
   - Merkle
+  - Metafuncton
   - misprediction
   - missingok
   - mptbalance
@@ -212,7 +200,6 @@ words:
   - nftokens
   - nftpage
   - nikb
-  - Nikolaos
   - nixfmt
   - nixos
   - nixpkgs
@@ -229,8 +216,6 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
-  - otool
-  - oxalica
   - pargs
   - partitioner
   - paychan
@@ -255,20 +240,15 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
-  - qself
   - queuable
   - Raphson
   - rcflags
   - replayer
-  - repodata
-  - repomd
   - rerandomize
   - rerandomization
   - rerandomized
   - rerandomizes
   - rerere
-  - retargeted
-  - retargets
   - retriable
   - RIPD
   - ripdtop
@@ -282,8 +262,6 @@ words:
   - Rohrs
   - roundings
   - rustc
-  - rustfmt
-  - rustup
   - sahyadri
   - Satoshi
   - scons
@@ -304,7 +282,6 @@ words:
   - sles
   - soci
   - socidb
-  - Sonatype
   - sponsee
   - sponsees
   - SRPMS
@@ -313,7 +290,6 @@ words:
   - STATSDCOLLECTOR
   - stissue
   - stnum
-  - stnumber
   - stobj
   - stobject
   - stpath
@@ -325,12 +301,10 @@ words:
   - summands
   - superpeer
   - superpeers
-  - Swatinem
   - takergets
   - takerpays
   - ters
   - TMEndpointv2
-  - toolchain
   - tparam
   - trixie
   - tx
@@ -354,7 +328,6 @@ words:
   - unflatten
   - unfund
   - unimpair
-  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -364,7 +337,6 @@ words:
   - unsquelch
   - unsquelched
   - unsquelching
-  - unsuffixed
   - unvalidated
   - unveto
   - unvetoed
@@ -374,10 +346,7 @@ words:
   - venv
   - vfalco
   - vinnie
-  - vkeylet
   - wasmi
-  - wasmparser
-  - Werror
   - wextra
   - wptr
   - writeme
@@ -385,16 +354,12 @@ words:
   - wthread
   - xbridge
   - xchain
-  - xcrun
-  - xfloat
   - ximinez
   - XMACRO
-  - xored
   - xrpkuwait
   - xrpl
   - xrpld
   - xrplf
   - xxhash
   - xxhasher
-  - zstdio
   - CGNAT

.envrc

@@ -1,10 +1 @@
-watch_file nix/*.nix
-
-# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
-watch_file rust-toolchain.toml
-
-# The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
-# change in there has to invalidate direnv's cached environment.
-watch_dir conan
-
 use flake

.gersemi/definitions.cmake

@@ -11,9 +11,6 @@ endfunction()
 function(create_symbolic_link target link)
 endfunction()
 
-function(xrpl_add_benchmark name)
-endfunction()
-
 macro(exclude_from_default target_)
 endmacro()
 

.github/actions/cargo-cache/action.yml

@@ -1,39 +0,0 @@
-name: Use cargo artifacts cache
-description: >
-  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
-  when saving the cache, rust-cache deletes all binaries that were already
-  present there, which on persistent self-hosted runners wipes the tools
-  installed by prepare-runner. Harmless on ephemeral runners, but kept
-  consistent everywhere.
-
-inputs:
-  workspaces:
-    description: "Workspaces to cache, as 'workspace -> target' lines."
-    required: false
-    default: crates
-  key:
-    description: "Additional part of the cache key."
-    required: false
-    default: ""
-  cache-directories:
-    description: "Additional non-workspace directories to cache."
-    required: false
-    default: ""
-  save-if:
-    description: >
-      Condition for saving the cache after the job. Defaults to save only from develop branch
-    required: false
-    default: ${{ github.ref == 'refs/heads/develop' }}
-
-runs:
-  using: composite
-
-  steps:
-    - name: Use cargo artifacts cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      with:
-        cache-bin: "false"
-        cache-directories: ${{ inputs.cache-directories }}
-        key: ${{ inputs.key }}
-        save-if: ${{ inputs.save-if }}
-        workspaces: ${{ inputs.workspaces }}

.github/actions/generate-version/action.yml

@@ -0,0 +1,44 @@
+name: Generate build version number
+description: "Generate build version number."
+
+outputs:
+  version:
+    description: "The generated build version number."
+    value: ${{ steps.version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    # When a tag is pushed, the version is used as-is.
+    - name: Generate version for tag event
+      if: ${{ startsWith(github.ref, 'refs/tags/') }}
+      shell: bash
+      env:
+        VERSION: ${{ github.ref_name }}
+      run: echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
+
+    # When a tag is not pushed, then the version (e.g. 1.2.3-b0) is extracted
+    # from the BuildInfo.cpp file and the shortened commit hash appended to it.
+    # We use a plus sign instead of a hyphen because Conan recipe versions do
+    # not support two hyphens.
+    - name: Generate version for non-tag event
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      shell: bash
+      run: |
+        echo 'Extracting version from BuildInfo.cpp.'
+        VERSION="$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')"
+        if [[ -z "${VERSION}" ]]; then
+            echo 'Unable to extract version from BuildInfo.cpp.'
+            exit 1
+        fi
+
+        echo 'Appending shortened commit hash to version.'
+        SHA='${{ github.sha }}'
+        VERSION="${VERSION}+${SHA:0:7}"
+
+        echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
+
+    - name: Output version
+      id: version
+      shell: bash
+      run: echo "version=${VERSION}" >>"${GITHUB_OUTPUT}"

.github/actions/release-info/action.yml

@@ -1,90 +0,0 @@
-name: Release info
-description: "Derive the version, release channel and package release number for this build."
-
-outputs:
-  version:
-    description: "The build version number."
-    value: ${{ steps.version.outputs.version }}
-  channel:
-    description: "The release channel this build belongs to."
-    value: ${{ steps.channel.outputs.channel }}
-  pkg_release:
-    description: "The package release number: 1 for a tag, the run number otherwise."
-    value: ${{ steps.pkg_release.outputs.pkg_release }}
-
-runs:
-  using: composite
-  steps:
-    # A tag names its own version. Anything else takes it from BuildInfo.cpp and
-    # appends the commit hash as build metadata, joined with a plus sign because a
-    # Conan version cannot contain two hyphens.
-    - name: Determine version
-      id: version
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        REF_NAME: ${{ github.ref_name }}
-        SHA: ${{ github.sha }}
-      run: |
-        if [[ "${IS_TAG}" == "true" ]]; then
-            version="${REF_NAME}"
-        else
-            version="$(awk -F'"' '/versionString =/ { print $2 }' src/libxrpl/protocol/BuildInfo.cpp)"
-            if [[ -z "${version}" ]]; then
-                echo "Unable to read versionString from BuildInfo.cpp." >&2
-                exit 1
-            fi
-            version="${version}+${SHA:0:7}"
-        fi
-
-        echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
-
-    # Only a tag says how mature a build is: a push is a develop build whatever
-    # its version, and a non-public codebase keeps its packages to itself.
-    - name: Determine release channel
-      id: channel
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        REF_NAME: ${{ github.ref_name }}
-        VISIBILITY: ${{ github.event.repository.visibility }}
-      run: |
-        pre_release=""
-        if [[ "${REF_NAME}" == *-* ]]; then
-            pre_release="${REF_NAME#*-}"
-        fi
-
-        if [[ "${VISIBILITY}" != "public" ]]; then
-            channel=private
-        elif [[ "${IS_TAG}" != "true" ]]; then
-            channel=develop
-        elif [[ -z "${pre_release}" ]]; then
-            channel=stable
-        elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
-            channel=rc
-        elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
-            channel=beta
-        else
-            echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
-            exit 1
-        fi
-
-        echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
-
-    # A tag is packaged once, so its release number is fixed at 1. Develop builds
-    # repeat the same version, so the run number is what makes each push an
-    # upgrade rather than a reinstall.
-    - name: Determine package release
-      id: pkg_release
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        RUN_NUMBER: ${{ github.run_number }}
-      run: |
-        if [[ "${IS_TAG}" == "true" ]]; then
-            pkg_release=1
-        else
-            pkg_release="${RUN_NUMBER}"
-        fi
-
-        echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"

.github/actions/setup-nix-env/action.yml

@@ -1,69 +0,0 @@
-name: Setup Nix environment
-description: "Build the flake's CI environment and put its tools on PATH."
-
-# The environment from nix/ci-env.nix, the same one the Linux CI images bake in
-# (see nix/docker). Exported onto PATH rather than entered with `nix develop`:
-# the composite actions below run plain `bash` and would escape a dev shell.
-
-runs:
-  using: composite
-
-  steps:
-    - name: Build the CI environment
-      id: build
-      shell: bash
-      env:
-        # --out-link doubles as a GC root for the length of the job.
-        OUT_LINK: ${{ runner.temp }}/xrpld-ci-env
-      run: |
-        # --extra-experimental-features: flakes may not be on in the runner's nix.conf.
-        nix --extra-experimental-features "nix-command flakes" \
-            build .#default --out-link "${OUT_LINK}" --print-build-logs
-        echo "path=$(readlink -f "${OUT_LINK}")" >>"${GITHUB_OUTPUT}"
-
-    - name: Export the environment
-      shell: bash
-      env:
-        ENV_PATH: ${{ steps.build.outputs.path }}
-      run: |
-        echo "${ENV_PATH}/bin" >>"${GITHUB_PATH}"
-
-        # Already KEY=VALUE per line. See `darwinEnv` in nix/ci-env.nix.
-        ENV_FILE="${ENV_PATH}/share/xrpld-ci-env/env"
-        if [ -f "${ENV_FILE}" ]; then
-            cat "${ENV_FILE}" >>"${GITHUB_ENV}"
-        fi
-
-        # XrplSanity.cmake otherwise rejects a Nix compiler as one that leaked.
-        echo "XRPL_DEVSHELL=ci-env" >>"${GITHUB_ENV}"
-
-        # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
-        # own trust store, and pinning would break TLS to hosts relying on it.
-
-        # Workspace-local, so `cleanup-workspace` clears it, but not the
-        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
-        # different version, and the two would migrate each other's cache.
-        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
-
-    # Config, profiles and remote, exactly as the dev shell sets them up on
-    # entry; the `setup-conan` action is skipped for this toolchain.
-    - name: Setup Conan
-      shell: bash
-      run: ./conan/init.sh
-
-    # `Check tools` runs later but swallows failures; a bad export would just
-    # build with the system toolchain.
-    - name: Verify the toolchain resolves into the Nix store
-      shell: bash
-      run: |
-        for tool in clang clang++ cmake ninja conan; do
-            path="$(command -v "${tool}" || true)"
-            echo "${tool} -> ${path:-<not found>}"
-            case "${path}" in
-                /nix/store/*) ;;
-                *)
-                    echo "::error::${tool} does not resolve into the Nix store"
-                    exit 1
-                    ;;
-            esac
-        done

.github/dependabot.yml

@@ -4,8 +4,7 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/cargo-cache/
-      - .github/actions/release-info/
+      - .github/actions/generate-version/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/
     schedule:
@@ -16,23 +15,3 @@ updates:
     commit-message:
       prefix: "ci: [DEPENDABOT] "
     target-branch: develop
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: cargo
-    directory: /crates
-    schedule:
-      interval: weekly
-      day: monday
-      time: "04:00"
-      timezone: Etc/GMT
-    commit-message:
-      prefix: "chore: [DEPENDABOT] "
-    target-branch: develop
-    open-pull-requests-limit: 10
-    groups:
-      rust-dependencies:
-        patterns:
-          - "*"

.github/pull_request_template.md

@@ -1,10 +1,10 @@
 <!--
-This PR template helps you write a good pull request description.
+This PR template helps you to write a good pull request description.
 Please feel free to include additional useful information even beyond what is requested below.
 
 If your branch is on a personal fork and has a name that allows it to
 run CI build/test jobs (e.g. "ci/foo"), remember to rename it BEFORE
-opening the PR. This avoids redundant test runs. Renaming
+opening the PR.  This avoids unnecessary redundant test runs. Renaming
 the branch after opening the PR will close the PR.
 https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/renaming-a-branch
 -->
@@ -15,7 +15,7 @@ https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-
 Please include a summary of the changes.
 This may be a direct input to the release notes.
 If too broad, please consider splitting into multiple PRs.
-If there is a relevant task or issue, please link it here.
+If a relevant task or issue, please link it here.
 -->
 
 ### Context of Change
@@ -65,5 +65,5 @@ This section may not be needed if your change includes thoroughly commented unit
 
 <!--
 ## Future Tasks
-For future tasks related to this PR.
+For future tasks related to PR.
 -->

.github/scripts/levelization/README.md

@@ -40,18 +40,18 @@ listed later.
 | 04           | xrpl/protocol                       |
 | 05           | xrpl/core xrpl/resource xrpl/server |
 | 06           | xrpl/ledger xrpl/nodestore xrpl/net |
-| 07           | xrpl/shamap xrpl/consensus          |
+| 07           | xrpl/shamap                         |
 
 ## xrpld Modules (Application Implementation)
 
-| Level / Tier | Module(s)                   |
-| ------------ | --------------------------- |
-| 05           | xrpld/conditions            |
-| 06           | xrpld/core xrpld/peerfinder |
-| 07           | xrpld/shamap xrpld/overlay  |
-| 08           | xrpld/app                   |
-| 09           | xrpld/rpc                   |
-| 10           | xrpld/perflog               |
+| Level / Tier | Module(s)                        |
+| ------------ | -------------------------------- |
+| 05           | xrpld/conditions xrpld/consensus |
+| 06           | xrpld/core xrpld/peerfinder      |
+| 07           | xrpld/shamap xrpld/overlay       |
+| 08           | xrpld/app                        |
+| 09           | xrpld/rpc                        |
+| 10           | xrpld/perflog                    |
 
 ## Test Modules
 

.github/scripts/levelization/results/loops.txt

@@ -1,6 +1,9 @@
 Loop: xrpld.app xrpld.overlay
   xrpld.app > xrpld.overlay
 
+Loop: xrpld.app xrpld.peerfinder
+  xrpld.peerfinder ~= xrpld.app
+
 Loop: xrpld.app xrpld.rpc
   xrpld.rpc > xrpld.app
 

.github/scripts/levelization/results/ordering.txt

@@ -1,16 +1,8 @@
-benchmarks.libxrpl > xrpl.basics
-benchmarks.libxrpl > xrpl.config
-benchmarks.libxrpl > xrpl.nodestore
-benchmarks.libxrpl > xrpl.protocol
-benchmarks.libxrpl > xrpl.protocol_autogen
-benchmarks.libxrpl > xrpl.tx
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
 libxrpl.config > xrpl.basics
 libxrpl.config > xrpl.config
-libxrpl.consensus > xrpl.basics
-libxrpl.consensus > xrpl.consensus
 libxrpl.core > xrpl.basics
 libxrpl.core > xrpl.core
 libxrpl.core > xrpl.json
@@ -30,9 +22,6 @@ libxrpl.nodestore > xrpl.config
 libxrpl.nodestore > xrpl.json
 libxrpl.nodestore > xrpl.nodestore
 libxrpl.nodestore > xrpl.protocol
-libxrpl.peerfinder > xrpl.basics
-libxrpl.peerfinder > xrpl.peerfinder
-libxrpl.peerfinder > xrpl.protocol
 libxrpl.protocol > xrpl.basics
 libxrpl.protocol > xrpl.json
 libxrpl.protocol > xrpl.protocol
@@ -68,9 +57,9 @@ test.app > test.jtx
 test.app > test.unit_test
 test.app > xrpl.basics
 test.app > xrpl.config
-test.app > xrpl.consensus
 test.app > xrpl.core
 test.app > xrpld.app
+test.app > xrpld.consensus
 test.app > xrpld.core
 test.app > xrpld.overlay
 test.app > xrpld.rpc
@@ -91,9 +80,12 @@ test.basics > xrpl.protocol
 test.beast > xrpl.basics
 test.conditions > xrpl.basics
 test.conditions > xrpl.conditions
+test.consensus > test.csf
 test.consensus > test.jtx
+test.consensus > test.unit_test
 test.consensus > xrpl.basics
 test.consensus > xrpld.app
+test.consensus > xrpld.consensus
 test.consensus > xrpl.ledger
 test.consensus > xrpl.protocol
 test.consensus > xrpl.shamap
@@ -108,6 +100,10 @@ test.core > xrpl.json
 test.core > xrpl.protocol
 test.core > xrpl.rdb
 test.core > xrpl.server
+test.csf > xrpl.basics
+test.csf > xrpld.consensus
+test.csf > xrpl.json
+test.csf > xrpl.ledger
 test.json > test.jtx
 test.json > xrpl.json
 test.jtx > test.unit_test
@@ -133,9 +129,12 @@ test.ledger > xrpl.json
 test.ledger > xrpl.ledger
 test.ledger > xrpl.protocol
 test.nodestore > test.jtx
+test.nodestore > test.unit_test
 test.nodestore > xrpl.basics
+test.nodestore > xrpl.config
 test.nodestore > xrpld.core
 test.nodestore > xrpl.nodestore
+test.nodestore > xrpl.protocol
 test.nodestore > xrpl.rdb
 test.overlay > test.jtx
 test.overlay > test.unit_test
@@ -144,13 +143,19 @@ test.overlay > xrpl.config
 test.overlay > xrpld.app
 test.overlay > xrpld.core
 test.overlay > xrpld.overlay
+test.overlay > xrpld.peerfinder
 test.overlay > xrpl.json
 test.overlay > xrpl.nodestore
-test.overlay > xrpl.peerfinder
 test.overlay > xrpl.protocol
 test.overlay > xrpl.resource
 test.overlay > xrpl.server
 test.overlay > xrpl.shamap
+test.peerfinder > test.beast
+test.peerfinder > test.unit_test
+test.peerfinder > xrpl.basics
+test.peerfinder > xrpld.core
+test.peerfinder > xrpld.peerfinder
+test.peerfinder > xrpl.protocol
 test.protocol > test.jtx
 test.protocol > test.unit_test
 test.protocol > xrpl.basics
@@ -184,13 +189,11 @@ test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
 tests.libxrpl > xrpl.config
-tests.libxrpl > xrpl.consensus
 tests.libxrpl > xrpl.core
 tests.libxrpl > xrpl.json
 tests.libxrpl > xrpl.ledger
 tests.libxrpl > xrpl.net
 tests.libxrpl > xrpl.nodestore
-tests.libxrpl > xrpl.peerfinder
 tests.libxrpl > xrpl.protocol
 tests.libxrpl > xrpl.protocol_autogen
 tests.libxrpl > xrpl.resource
@@ -200,10 +203,6 @@ tests.libxrpl > xrpl.tx
 xrpl.conditions > xrpl.basics
 xrpl.conditions > xrpl.protocol
 xrpl.config > xrpl.basics
-xrpl.consensus > xrpl.basics
-xrpl.consensus > xrpl.json
-xrpl.consensus > xrpl.ledger
-xrpl.consensus > xrpl.protocol
 xrpl.core > xrpl.basics
 xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
@@ -218,8 +217,6 @@ xrpl.nodestore > xrpl.basics
 xrpl.nodestore > xrpl.config
 xrpl.nodestore > xrpl.json
 xrpl.nodestore > xrpl.protocol
-xrpl.peerfinder > xrpl.basics
-xrpl.peerfinder > xrpl.protocol
 xrpl.protocol > xrpl.basics
 xrpl.protocol > xrpl.json
 xrpl.protocol_autogen > xrpl.json
@@ -246,20 +243,23 @@ xrpl.tx > xrpl.protocol
 xrpld.app > test.unit_test
 xrpld.app > xrpl.basics
 xrpld.app > xrpl.config
-xrpld.app > xrpl.consensus
 xrpld.app > xrpl.core
+xrpld.app > xrpld.consensus
 xrpld.app > xrpld.core
 xrpld.app > xrpl.json
 xrpld.app > xrpl.ledger
 xrpld.app > xrpl.net
 xrpld.app > xrpl.nodestore
-xrpld.app > xrpl.peerfinder
 xrpld.app > xrpl.protocol
 xrpld.app > xrpl.rdb
 xrpld.app > xrpl.resource
 xrpld.app > xrpl.server
 xrpld.app > xrpl.shamap
 xrpld.app > xrpl.tx
+xrpld.consensus > xrpl.basics
+xrpld.consensus > xrpl.json
+xrpld.consensus > xrpl.ledger
+xrpld.consensus > xrpl.protocol
 xrpld.core > xrpl.basics
 xrpld.core > xrpl.config
 xrpld.core > xrpl.core
@@ -268,22 +268,21 @@ xrpld.core > xrpl.protocol
 xrpld.core > xrpl.rdb
 xrpld.overlay > xrpl.basics
 xrpld.overlay > xrpl.config
-xrpld.overlay > xrpl.consensus
 xrpld.overlay > xrpl.core
+xrpld.overlay > xrpld.consensus
 xrpld.overlay > xrpld.core
 xrpld.overlay > xrpld.peerfinder
 xrpld.overlay > xrpl.json
 xrpld.overlay > xrpl.ledger
-xrpld.overlay > xrpl.peerfinder
 xrpld.overlay > xrpl.protocol
 xrpld.overlay > xrpl.resource
 xrpld.overlay > xrpl.server
 xrpld.overlay > xrpl.shamap
 xrpld.overlay > xrpl.tx
 xrpld.peerfinder > xrpl.basics
-xrpld.peerfinder > xrpld.app
+xrpld.peerfinder > xrpl.config
 xrpld.peerfinder > xrpld.core
-xrpld.peerfinder > xrpl.peerfinder
+xrpld.peerfinder > xrpl.protocol
 xrpld.peerfinder > xrpl.rdb
 xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config

.github/scripts/rename/binary.sh

@@ -49,7 +49,7 @@ ${SED_COMMAND} -i -E 's@ripple/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@xrpld \(`xrpld`\)@xrpld@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' CONTRIBUTING.md
-${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/install.md
+${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/build/install.md
 
 popd
 echo "Processing complete."

.github/scripts/rename/docs.sh

@@ -77,8 +77,8 @@ ${SED_COMMAND} -i 's/Ripple integrators/XRPL developers/' README.md
 ${SED_COMMAND} -i 's/sanitizer-configuration-for-rippled/sanitizer-configuration-for-xrpld/' docs/build/sanitizers.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/levelization/README.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/strategy-matrix/generate.py
-${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/install.md
-${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/install.md
+${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/build/install.md
+${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/build/install.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' docs/Doxyfile
 ${SED_COMMAND} -i 's/ripple_basics/basics/' include/xrpl/basics/CountedObject.h
 ${SED_COMMAND} -i 's/<ripple/<xrpl/' include/xrpl/protocol/AccountID.h

.github/scripts/rename/namespace.sh

@@ -46,6 +46,9 @@ for DIRECTORY in "${DIRECTORIES[@]}"; do
     done
 done
 
+# Special case for NuDBFactory that has ripple twice in the test suite name.
+${SED_COMMAND} -i -E 's/(BEAST_DEFINE_TESTSUITE.+)ripple(.+)/\1xrpl\2/g' src/test/nodestore/NuDBFactory_test.cpp
+
 DIRECTORY=$1
 find "${DIRECTORY}" -type f -name "*.md" | while read -r FILE; do
     echo "Processing file: ${FILE}"

.github/scripts/strategy-matrix/generate.py

@@ -7,12 +7,7 @@ from pathlib import Path
 
 THIS_DIR = Path(__file__).parent.resolve()
 
-_BASE_CMAKE_ARGS = [
-    "-Dtests=ON",
-    "-Dwerr=ON",
-    "-Dxrpld=ON",
-    "-Dwextra=ON",
-]
+_BASE_CMAKE_ARGS = ["-Dtests=ON", "-Dwerr=ON", "-Dxrpld=ON", "-Dwextra=ON"]
 
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
@@ -22,19 +17,6 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
-def config_name(
-    distro: str,
-    compiler: str,
-    build_type: str,
-    arch: str,
-    suffix: str = "",
-    sanitizer: str = "",
-) -> str:
-    """Name a config. Its artifacts are named after it, so packaging reuses this."""
-    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
-    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
-
-
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -49,41 +31,22 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest.
-#
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
-# 'package' map to be packaged as well. Note that either applies to every entry
-# a config expands into, so only set them on configs that expand to a single
-# combination.
-
-
-@dataclasses.dataclass
-class PackageConfig:
-    """The 'package' map of a config whose binaries are also packaged."""
-
-    type: str  # "deb" or "rpm"; has to match what the image provides
-    # The packaging container image: a vanilla distro image, not the nix image
-    # the config itself builds in.
-    image: str
+# built for pull requests by default; the full matrix adds the rest. Packaging
+# configs declare it too, but packaging is gated in the workflow, not by it.
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in a linux.json 'configs' array."""
+    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
 
     compiler: list[str]
     build_type: list[str]
     arch: list[str]
     minimal: bool
-    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    package: PackageConfig | None = None  # set to also package this config
-
-    def __post_init__(self) -> None:
-        if isinstance(self.package, dict):
-            self.package = PackageConfig(**self.package)
+    image: str = ""  # only used by package_configs entries
 
 
 @dataclasses.dataclass
@@ -92,16 +55,22 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
+    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
+
+        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
+            return {
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in section.items()
+            }
+
         return cls(
             image_tag=data["image_tag"],
-            configs={
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in data["configs"].items()
-            },
+            configs=parse(data["configs"]),
+            package_configs=parse(data.get("package_configs", {})),
         )
 
 
@@ -112,11 +81,7 @@ class PlatformConfig:
     build_type: list[str]
     minimal: bool
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
-    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     extra_cmake_args: str = ""
-    # "" is the runner's system compiler, "nix" the flake's CI environment.
-    # macOS only: Linux always builds in a Nix image, Windows has no Nix.
-    toolchain: str = ""
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -160,23 +125,20 @@ class MatrixEntry:
     cmake_args: str
     cmake_target: str
     build_only: bool
-    benchmark: bool
     build_type: str
     architecture: Architecture
     sanitizers: str
     image: str = ""  # container image; empty for macOS/Windows (runs natively)
     compiler: str = ""  # compiler name ("gcc" or "clang"); empty for macOS/Windows
-    toolchain: str = ""  # "nix" for the flake's CI environment; see PlatformConfig
 
 
 @dataclasses.dataclass
 class PackagingEntry:
     """One entry in the generated packaging strategy matrix."""
 
-    xrpld_artifact_name: str
-    validator_keys_artifact_name: str
+    artifact_name: str
     image: str
-    package_type: str  # "deb" or "rpm"; drives the format-specific steps
+    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
 
 
 # ---------------------------------------------------------------------------
@@ -217,9 +179,13 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = config_name(
-                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
-                )
+                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
+                suffix_parts = [
+                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
+                ]
+                if suffix_parts:
+                    name += "-" + "-".join(suffix_parts)
+
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -227,7 +193,6 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                         cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                         cmake_target="all",
                         build_only=False,
-                        benchmark=cfg.benchmark,
                         build_type=build_type,
                         architecture=arch_info,
                         sanitizers=sanitizer,
@@ -239,33 +204,22 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from the configs that carry a 'package' map.
+    """Generate the packaging matrix from a LinuxFile's package_configs section.
 
-    Packaging consumes the binaries that config's build job uploaded, so the
-    artifact names come from the same config name, and a packaged config is one
-    that passes -Dvalidator_keys=ON.
-
-    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
-    instead of the nix-based build images, because deb/rpm tooling (debhelper,
-    rpm-build) is taken from the distro's archive rather than from nixpkgs.
+    Packaging uses vanilla distro images (debian:bookworm, ubi9, …) instead of
+    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
+    is taken from the distro's archive rather than from nixpkgs. Each config
+    entry carries its own 'image'.
     """
     entries = []
-    for distro, configs in linux.configs.items():
+    for distro, configs in linux.package_configs.items():
         for cfg in configs:
-            if cfg.package is None:
-                continue
-            for compiler, build_type, arch in itertools.product(
-                cfg.compiler, cfg.build_type, cfg.arch
-            ):
-                # The packaging workflow hardcodes an amd64 runner.
-                assert arch == "amd64", f"cannot package {distro} on {arch}"
-                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
+            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{name}",
-                        validator_keys_artifact_name=f"validator-keys-{name}",
-                        image=cfg.package.image,
-                        package_type=cfg.package.type,
+                        artifact_name=f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64",
+                        image=cfg.image,
+                        distro=distro,
                     )
                 )
 
@@ -285,20 +239,15 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
         if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
-            name = f"{platform_name}-{arch}-{build_type.lower()}"
-            if cfg.toolchain:
-                name += f"-{cfg.toolchain}"
             entries.append(
                 MatrixEntry(
-                    config_name=name,
+                    config_name=f"{platform_name}-{arch}-{build_type.lower()}",
                     cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                     cmake_target="install" if is_windows else "all",
                     build_only=cfg.build_only,
-                    benchmark=cfg.benchmark,
                     build_type=build_type,
                     architecture=Architecture(platform=pf.platform, runner=pf.runner),
                     sanitizers="",
-                    toolchain=cfg.toolchain,
                 )
             )
     return entries

.github/scripts/strategy-matrix/linux.json

@@ -1,23 +1,13 @@
 {
-  "image_tag": "sha-473fe44",
+  "image_tag": "sha-e29b523",
   "configs": {
     "ubuntu": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Debug"],
-        "arch": ["amd64"],
-        "minimal": true,
-        "suffix": "coverage",
-        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
-      },
       {
         "compiler": ["clang"],
         "build_type": ["Release"],
         "arch": ["amd64"],
-        "minimal": true,
-        "benchmark": true
+        "minimal": true
       },
-
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
@@ -39,6 +29,14 @@
         "sanitizers": ["address", "undefinedbehavior"]
       },
 
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Debug"],
+        "arch": ["amd64"],
+        "minimal": true,
+        "suffix": "coverage",
+        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
+      },
       {
         "compiler": ["clang"],
         "build_type": ["Debug"],
@@ -65,17 +63,32 @@
       }
     ],
 
+    "debian": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      }
+    ],
+
+    "rhel": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      }
+    ]
+  },
+  "package_configs": {
     "debian": [
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-45e4b88"
-        }
+        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
       }
     ],
 
@@ -85,11 +98,7 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-45e4b88"
-        }
+        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
       }
     ]
   }

.github/scripts/strategy-matrix/macos.json

@@ -12,19 +12,6 @@
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
       "minimal": false
-    },
-    {
-      "build_type": "Release",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
-      "toolchain": "nix",
-      "minimal": false
-    },
-    {
-      "build_type": "Debug",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
-      "toolchain": "nix",
-      "build_only": true,
-      "minimal": false
     }
   ]
 }

.github/workflows/build-nix-images.yml

@@ -1,4 +1,4 @@
-name: Build `nix` Docker images
+name: Build Nix Docker images
 
 on:
   push:
@@ -8,26 +8,20 @@ on:
       - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
-      - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
-      - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   workflow_dispatch:
 
@@ -42,7 +36,7 @@ defaults:
 
 jobs:
   build-merge:
-    name: Build and push `nix-${{ matrix.distro.name }}` image
+    name: Build and push nix-${{ matrix.distro.name }}
     permissions:
       contents: read
       packages: write
@@ -60,7 +54,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -1,4 +1,4 @@
-name: Build `packaging` Docker images
+name: Build packaging Docker images
 
 on:
   push:
@@ -26,22 +26,19 @@ defaults:
 
 jobs:
   build-merge:
-    name: Build and push `packaging-${{ matrix.distro.name }}` image
+    name: Build and push packaging-${{ matrix.distro.name }}
     permissions:
       contents: read
       packages: write
     strategy:
       fail-fast: false
       matrix:
-        # Newest of each distro: these images only wrap pre-built binaries, so
-        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:trixie
-          # AlmaLinux rather than UBI, which does not ship rpm-sign.
+            base_image: debian:bookworm
           - name: rhel
-            base_image: almalinux:10
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
+            base_image: registry.access.redhat.com/ubi9/ubi:latest
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/Dockerfile

.github/workflows/build-pre-commit-image.yml

@@ -1,38 +0,0 @@
-name: Build `pre-commit` Docker image
-
-on:
-  push:
-    branches:
-      - develop
-    paths:
-      - ".github/workflows/build-pre-commit-image.yml"
-      - "bin/pre-commit/Dockerfile"
-      - "rust-toolchain.toml"
-  pull_request:
-    paths:
-      - ".github/workflows/build-pre-commit-image.yml"
-      - "bin/pre-commit/Dockerfile"
-      - "rust-toolchain.toml"
-  workflow_dispatch:
-
-concurrency:
-  # Read `on-trigger.yml` for the rationale behind this concurrency group name.
-  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/develop' && github.sha || github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  build-merge:
-    name: Build and push `pre-commit` image
-    permissions:
-      contents: read
-      packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
-    with:
-      image_name: xrpld/pre-commit
-      dockerfile: bin/pre-commit/Dockerfile
-      base_image: ubuntu:26.04
-      push: ${{ github.event_name == 'push' }}

.github/workflows/cargo-audit.yml

@@ -1,80 +0,0 @@
-name: Cargo audit
-
-on:
-  schedule:
-    # 06:32 UTC every Monday.
-    - cron: "32 6 * * 1"
-  push:
-    branches:
-      - "develop"
-      - "release/*"
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  pull_request:
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    permissions:
-      contents: read
-      # Needed to open an issue on scheduled failures.
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run cargo audit
-        id: audit
-        continue-on-error: true
-        run: |
-          set -o pipefail
-          cargo audit | tee /tmp/cargo-audit.txt
-
-      - name: Prepare issue body
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        run: |
-          {
-              echo "## \`cargo audit\` found advisories"
-              echo
-              echo '```'
-              cat /tmp/cargo-audit.txt
-              echo '```'
-              echo
-              echo "---"
-              echo "*This issue was automatically created by the cargo-audit workflow.*"
-          } >/tmp/cargo-audit-issue.md
-
-      - name: Create issue
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
-        with:
-          title: "cargo audit found vulnerabilities"
-          body_file: /tmp/cargo-audit-issue.md
-          labels: "Bug,Security"
-
-      - name: Fail if advisories were found
-        if: ${{ steps.audit.outcome != 'success' }}
-        run: |
-          echo "cargo audit found advisories!"
-          cat /tmp/cargo-audit.txt
-          exit 1

.github/workflows/check-pr-description.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Write PR body to file
         env:

.github/workflows/check-pr-title.yml

@@ -20,4 +20,4 @@ on:
 jobs:
   check_title:
     if: ${{ github.event.pull_request.draft != true }}
-    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@d7c65e49225a38f6d8010eacf017bb5a98d7476c
+    uses: XRPLF/actions/.github/workflows/check-pr-title.yml@cba1f0891650baf1a9c88624dc2d72573be2eb81

.github/workflows/check-tools.yml

@@ -1,114 +0,0 @@
-# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
-# environment (see nix/check-tools/). If the environment changes — a new image
-# tag, an updated flake.lock, a different tool list — without the matching
-# snapshot being regenerated and committed, this workflow fails so the drift is
-# caught in review.
-#
-# To regenerate the snapshots, see nix/check-tools/README.md.
-name: Check tools
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/check-tools.yml"
-      - ".github/scripts/strategy-matrix/linux.json"
-      - "bin/check-tools.sh"
-      - "nix/**"
-      - "flake.nix"
-      - "flake.lock"
-      - "rust-toolchain.toml"
-  push:
-    branches:
-      - "develop"
-    paths:
-      - ".github/workflows/check-tools.yml"
-      - ".github/scripts/strategy-matrix/linux.json"
-      - "bin/check-tools.sh"
-      - "nix/**"
-      - "flake.nix"
-      - "flake.lock"
-      - "rust-toolchain.toml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
-  # so snapshots are checked against the exact image CI builds against.
-  linux-image-tag:
-    runs-on: ubuntu-latest
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Read nix image tag
-        id: tag
-        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
-
-  # One job for all environments; they differ only in whether the tools come
-  # from the nix-nixos container (Linux) or `nix develop` (macOS).
-  check-tools:
-    needs: linux-image-tag
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-latest
-            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
-            nix_develop: false
-          - runner: ubuntu-24.04-arm
-            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
-            nix_develop: false
-          - runner: macos-26-apple-clang-21
-            snapshot: nix/check-tools/macos.txt
-            nix_develop: true
-    runs-on: ${{ matrix.runner }}
-    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
-    # the flake's dev shell instead (see the run step below).
-    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
-        with:
-          enable_ccache: false
-
-      - name: Regenerate snapshot
-        env:
-          CHECK_TOOLS_SKIP_CLONE: "1"
-          # check-tools.sh skips some macOS tools when CI is set; the snapshots
-          # capture the full `nix develop` environment, so unset it here.
-          CI: ""
-        run: |
-          if [ "${{ matrix.nix_develop }}" = "true" ]; then
-              # `nix develop` prints the dev-shell greeting first; keep only the
-              # check-tools.sh output (from the "Detected OS:" line onward).
-              nix --extra-experimental-features "nix-command flakes" develop \
-                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
-          else
-              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
-          fi
-
-      - name: Verify snapshot is up to date
-        run: |
-          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
-              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
-              exit 1
-          fi
-
-      - name: Upload regenerated snapshot
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: check-tools-${{ runner.os }}-${{ runner.arch }}
-          path: ${{ matrix.snapshot }}

.github/workflows/on-pr.yml

@@ -25,11 +25,18 @@ on:
       - unlabeled
 
 concurrency:
-  # A single per-ref group with cancel-in-progress means any newer run (a push
-  # or a label change) supersedes the in-progress one for that ref. Keeping
-  # exactly one authoritative run per ref ensures a fast do-nothing run can never
-  # mask a real build's checks.
-  group: ${{ github.workflow }}-${{ github.ref }}
+  # Use a per-ref group so a newer run (a push, or a change to a label below)
+  # supersedes the in-progress one for that ref. Label events we don't act on get
+  # their own unique group (per run id) instead, keeping them out of the shared
+  # group so real builds keep running. Keep this list in sync with `should-run`.
+  group: >-
+    ${{ github.workflow }}-${{ github.ref }}${{
+      ((github.event.action == 'labeled' || github.event.action == 'unlabeled')
+      && github.event.label.name != 'Ready to merge'
+      && github.event.label.name != 'DraftRunCI'
+      && github.event.label.name != 'Full CI build')
+      && format('-{0}', github.run_id) || ''
+    }}
   cancel-in-progress: true
 
 defaults:
@@ -37,22 +44,26 @@ defaults:
     shell: bash
 
 jobs:
-  # This job determines whether the rest of the workflow should run at all,
-  # based on the current set of labels: it runs when the PR is not a draft
-  # (which should also cover merge-group) or has the 'DraftRunCI' or
-  # 'Full CI build' label. Whether a build then happens, and whether it is the
-  # minimal or full matrix, is decided further below and in the strategy matrix.
+  # This job determines whether the rest of the workflow should run. It runs
+  # when the PR is not a draft (which should also cover merge-group) or has the
+  # 'DraftRunCI' or 'Full CI build' label. For label events it only runs when the
+  # label added or removed is one we act on ('Ready to merge', 'DraftRunCI' or
+  # 'Full CI build'), so unrelated label changes do not trigger a redundant run.
   should-run:
     if: >-
       ${{
-        !github.event.pull_request.draft
-        || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
-        || contains(github.event.pull_request.labels.*.name, 'Full CI build')
+        ((github.event.action != 'labeled' && github.event.action != 'unlabeled')
+          || github.event.label.name == 'Ready to merge'
+          || github.event.label.name == 'DraftRunCI'
+          || github.event.label.name == 'Full CI build')
+        && (!github.event.pull_request.draft
+          || contains(github.event.pull_request.labels.*.name, 'DraftRunCI')
+          || contains(github.event.pull_request.labels.*.name, 'Full CI build'))
       }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine changed files
         # This step checks whether any files have changed that should
         # cause the next jobs to run. We do it this way rather than
@@ -77,28 +88,22 @@ jobs:
 
             # Keep the paths below in sync with those in `on-trigger.yml`.
             .github/actions/build-deps/**
-            .github/actions/release-info/**
+            .github/actions/generate-version/**
             .github/actions/setup-conan/**
-            .github/actions/setup-nix-env/**
             .github/scripts/strategy-matrix/**
             .github/workflows/reusable-build-test-config.yml
             .github/workflows/reusable-build-test.yml
-            .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
             .github/workflows/reusable-package.yml
-            .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
-            bin/check-nix-store-refs.sh
             bin/check-tools.sh
-            bin/default-loader-path.sh
             cfg/**
             cmake/**
             conan/**
-            crates/**
             external/**
             include/**
             src/**
@@ -106,9 +111,6 @@ jobs:
             CMakeLists.txt
             conanfile.py
             conan.lock
-            flake.lock
-            flake.nix
-            nix/**
             LICENSE.md
             package/**
             README.md
@@ -134,11 +136,6 @@ jobs:
     outputs:
       go: ${{ steps.go.outputs.go == 'true' }}
 
-  check-autogen:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-check-autogen.yml
-
   check-levelization:
     needs: should-run
     if: ${{ needs.should-run.outputs.go == 'true' }}
@@ -175,13 +172,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   package:
     needs: [should-run, build-test]
     # Packaging consumes the debian/rhel release binaries, which are only built
@@ -220,12 +210,10 @@ jobs:
   passed:
     if: failure() || cancelled()
     needs:
-      - check-autogen
       - check-levelization
       - check-rename
       - clang-tidy
       - build-test
-      - rust
       - package
       - upload-recipe
       - notify-clio

.github/workflows/on-tag.yml

@@ -1,9 +1,5 @@
-# When a versioned tag is pushed, this workflow:
-#
-#   - uploads the libxrpl recipe to the Conan remote
-#   - builds and tests the release binaries
-#   - builds the DEB and RPM packages
-#   - publishes those packages to the XRPLF package repositories
+# This workflow uploads the libxrpl recipe to the Conan remote and builds
+# release packages when a versioned tag is pushed.
 name: Tag
 
 on:
@@ -28,7 +24,7 @@ jobs:
       remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
-    if: ${{ github.repository_owner == 'XRPLF' }}
+    if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-build-test.yml
     strategy:
       fail-fast: true
@@ -41,12 +37,6 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   package:
-    if: ${{ github.repository_owner == 'XRPLF' }}
+    if: ${{ github.repository == 'XRPLF/rippled' }}
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
-    with:
-      publish: true
-    secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
-      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/on-trigger.yml

@@ -15,28 +15,22 @@ on:
 
       # Keep the paths below in sync with those in `on-pr.yml`.
       - ".github/actions/build-deps/**"
-      - ".github/actions/release-info/**"
+      - ".github/actions/generate-version/**"
       - ".github/actions/setup-conan/**"
-      - ".github/actions/setup-nix-env/**"
       - ".github/scripts/strategy-matrix/**"
       - ".github/workflows/reusable-build-test-config.yml"
       - ".github/workflows/reusable-build-test.yml"
-      - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
       - ".github/workflows/reusable-package.yml"
-      - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
-      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
-      - "crates/**"
       - "external/**"
       - "include/**"
       - "src/**"
@@ -44,9 +38,6 @@ on:
       - "CMakeLists.txt"
       - "conanfile.py"
       - "conan.lock"
-      - "flake.lock"
-      - "flake.nix"
-      - "nix/**"
       - "LICENSE.md"
       - "package/**"
       - "README.md"
@@ -75,9 +66,6 @@ defaults:
     shell: bash
 
 jobs:
-  check-autogen:
-    uses: ./.github/workflows/reusable-check-autogen.yml
-
   clang-tidy:
     uses: ./.github/workflows/reusable-clang-tidy.yml
     permissions:
@@ -103,11 +91,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   upload-recipe:
     needs: build-test
     # Only run when pushing to the develop branch.
@@ -120,11 +103,3 @@ jobs:
   package:
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
-    with:
-      # Packages are built on every trigger; only develop pushes in XRPLF/rippled
-      # publish them, matching upload-recipe above.
-      publish: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
-    secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
-      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'
+      container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -3,12 +3,6 @@ name: Build and test configuration
 on:
   workflow_call:
     inputs:
-      benchmark:
-        description: "Whether to smoke-run the benchmarks after testing."
-        required: false
-        type: boolean
-        default: false
-
       build_only:
         description: 'Whether to only build or to build and test the code ("true", "false").'
         required: true
@@ -69,12 +63,6 @@ on:
         type: string
         default: ""
 
-      toolchain:
-        description: 'Where the toolchain comes from ("nix" to build the flake CI environment on the runner, empty for the system one). macOS only: Linux always builds in a Nix image, and Nix has no Windows support.'
-        required: false
-        type: string
-        default: ""
-
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -112,32 +100,23 @@ jobs:
       # header files are copied into separate directories by CMake, which will
       # otherwise result in cache misses.
       CCACHE_SLOPPINESS: include_file_ctime,include_file_mtime
-      # Determine if coverage, voidstar and validator-keys should be enabled.
+      # Determine if coverage and voidstar should be enabled.
       COVERAGE_ENABLED: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
       VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
-      VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
       SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
-      # The binaries reusable-package.yml consumes. A private repository skips
-      # them except on a tag push, which is what produces its release packages.
-      PACKAGING_ARTIFACTS_ENABLED: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
-      # Before any step that uses a build tool, composite actions included.
-      - name: Setup Nix environment
-        if: ${{ inputs.toolchain == 'nix' }}
-        uses: ./.github/actions/setup-nix-env
-
       - name: Set ccache log file
         if: ${{ inputs.ccache_enabled && runner.debug == '1' }}
         run: echo "CCACHE_LOGFILE=${{ runner.temp }}/ccache.log" >>"${GITHUB_ENV}"
@@ -162,21 +141,7 @@ jobs:
         with:
           compiler: ${{ inputs.compiler }}
 
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-        with:
-          cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          key: ${{ inputs.config_name }}
-          # two workspaces here because build artifacts are located in 2 places:
-          # - crates/target when cargo is called directly
-          # - build/cargo when cargo is called by cmake
-          workspaces: |
-            crates
-            crates -> ${{ runner.os == 'Windows' && format('../{0}/x64/{1}/cargo', env.BUILD_DIR, inputs.build_type) || format('../{0}/cargo', env.BUILD_DIR) }}
-
-      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
-        if: ${{ inputs.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ inputs.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -205,9 +170,9 @@ jobs:
               ..
 
       # Export the sanitizer options before any instrumented binary runs. The
-      # build step below invokes instrumented dependency tools (protoc, grpc),
-      # so setting UBSAN_OPTIONS here lets the UBSan suppression list silence
-      # their diagnostics too, not just at test time.
+      # protocol code-gen and build steps below invoke instrumented dependency
+      # tools (protoc, grpc), so setting UBSAN_OPTIONS here lets the UBSan
+      # suppression list silence their diagnostics too, not just at test time.
       # GITHUB_WORKSPACE (not the github.workspace context) is used so the path
       # resolves correctly inside the container job.
       - name: Set sanitizer options
@@ -225,6 +190,32 @@ jobs:
           echo "UBSAN_OPTIONS=include=${SUPP}/runtime-ubsan-options.txt:suppressions=${SUPP}/ubsan.supp" >>${GITHUB_ENV}
           echo "LSAN_OPTIONS=include=${SUPP}/runtime-lsan-options.txt:suppressions=${SUPP}/lsan.supp" >>${GITHUB_ENV}
 
+      - name: Check protocol autogen files are up-to-date
+        working-directory: ${{ env.BUILD_DIR }}
+        env:
+          MESSAGE: |
+
+            The generated protocol wrapper classes are out of date.
+
+            This typically happens when the macro files or generator scripts
+            have changed but the generated files were not regenerated.
+
+            To fix this:
+              1. Run: cmake --build . --target setup_code_gen
+              2. Run: cmake --build . --target code_gen
+              3. Commit and push the regenerated files
+        run: |
+          set -e
+          cmake --build . --target setup_code_gen
+          cmake --build . --target code_gen
+          DIFF=$(git -C .. status --porcelain -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen)
+          if [ -n "${DIFF}" ]; then
+              echo "::error::Generated protocol files are out of date"
+              git -C .. diff -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen
+              echo "${MESSAGE}"
+              exit 1
+          fi
+
       - name: Build the binary
         working-directory: ${{ env.BUILD_DIR }}
         env:
@@ -232,31 +223,11 @@ jobs:
           BUILD_TYPE: ${{ inputs.build_type }}
           CMAKE_TARGET: ${{ inputs.cmake_target }}
         run: |
-          set -o pipefail
           cmake \
               --build . \
               --config "${BUILD_TYPE}" \
               --parallel "${BUILD_NPROC}" \
-              --target "${CMAKE_TARGET}" \
-              2>&1 | tee "${GITHUB_WORKSPACE}/build.log"
-
-      # Nothing may reference the store, so whole trees are checked - the Conan
-      # cache included, since what it holds is what gets uploaded and reused.
-      - name: Check the build output for Nix store references (Nix toolchain)
-        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
-
-      - name: Check the Conan cache for Nix store references (Nix toolchain)
-        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
-
-      # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
-      # images always references the store. Same condition it uses.
-      - name: Check for Nix store references (Linux)
-        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
-        run: |
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+              --target "${CMAKE_TARGET}"
 
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
@@ -268,7 +239,7 @@ jobs:
           fi
 
       - name: Upload the binary (Linux)
-        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
+        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpld-${{ inputs.config_name }}
@@ -276,22 +247,6 @@ jobs:
           retention-days: 3
           if-no-files-found: error
 
-      - name: Run the validator-keys tests
-        if: ${{ env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        working-directory: ${{ env.BUILD_DIR }}
-        run: ./validator-keys --unittest
-
-      - name: Upload the validator-keys binary
-        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: validator-keys-${{ inputs.config_name }}
-          path: |
-            ${{ env.BUILD_DIR }}/validator-keys
-            ${{ env.BUILD_DIR }}/validator-keys-LICENSE
-          retention-days: 3
-          if-no-files-found: error
-
       - name: Upload the test binary (Linux)
         if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -309,7 +264,7 @@ jobs:
           ./xrpld --definitions | python3 -m json.tool >server_definitions.json
 
       - name: Upload server definitions
-        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
+        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'debian-gcc-release-amd64' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: server-definitions
@@ -367,57 +322,27 @@ jobs:
               PRELOAD=""
           fi
 
-          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"
+          LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee unittest.log
 
-      - name: Run Rust tests
-        if: ${{ !inputs.build_only }}
-        working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
-
-      # Smoke-run every benchmark module with a single repetition to confirm the
-      # benchmarks still build and execute. This is a correctness check, not a
-      # performance measurement, so there is nothing to gain from repeating it
-      # across configurations: it is opted into by a single config in the
-      # strategy matrix (see the 'benchmark' flag in the JSON files), which
-      # keeps it off instrumented builds (sanitizers/coverage/voidstar), where
-      # it would be slow and meaningless, off Debug builds, where it is much
-      # slower, and off Windows, where the `install` target does not build them.
-      - name: Run the benchmarks
-        if: ${{ inputs.benchmark }}
-        working-directory: ${{ env.BUILD_DIR }}
+      - name: Show test failure summary
+        if: ${{ failure() && !inputs.build_only }}
+        env:
+          WORKING_DIR: ${{ runner.os == 'Windows' && format('{0}\{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
         run: |
-          rc=0
-          while IFS= read -r bench; do
-              echo "::group::${bench}"
-              "./${bench}" --benchmark_repetitions=1 || rc=1
-              echo "::endgroup::"
-          done < <(find src/benchmarks -type f -perm -u+x -name 'xrpl.bench.*')
-          exit "${rc}"
+          if [ ! -d "${WORKING_DIR}" ]; then
+              echo "Working directory '${WORKING_DIR}' does not exist."
+              exit 0
+          fi
 
-      - name: Show build/test failure summary
-        if: ${{ failure() }}
-        run: |
-          cd "${GITHUB_WORKSPACE}"
+          cd "${WORKING_DIR}"
 
-          if [ -f unittest.log ]; then
-              if ! grep -E "failed" unittest.log | grep -vE "^I[0-9]|^[0-9]+> (ERR:|FTL:)"; then
-                  echo "unittest.log present but no failure lines found."
-              fi
-          elif [ -f build.log ]; then
-              # GCC/Clang emit "error:" (covers "fatal error:"); MSVC emits
-              # "error C####:", "error LNK####:", and "fatal error LNK####:".
-              # -A6 prints the lines that follow each match (source line, caret,
-              # notes, and the "N errors generated" tally) to capture the whole
-              # diagnostic block.
-              if ! grep -E -A6 "error:|error C[0-9]{4}|error LNK[0-9]{4}|fatal error" build.log; then
-                  echo "build.log present but no compile errors found."
-              fi
-          else
-              echo "unittest.log/build.log not found; something went wrong."
-              exit 1
+          if [ ! -f unittest.log ]; then
+              echo "unittest.log not found; embedded tests may not have run."
+              exit 0
+          fi
+
+          if ! grep -E "failed" unittest.log; then
+              echo "Log present but no failure lines found in unittest.log."
           fi
       - name: Debug failure (Linux)
         if: ${{ failure() && runner.os == 'Linux' && !inputs.build_only }}
@@ -441,14 +366,13 @@ jobs:
               --target coverage
 
       - name: Upload coverage report
-        if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
+        if: ${{ github.repository == 'XRPLF/rippled' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           disable_search: true
           disable_telem: true
           fail_ci_if_error: true
           files: ${{ env.BUILD_DIR }}/coverage.xml
-          flags: cpp
           plugins: noop
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true

.github/workflows/reusable-build-test.yml

@@ -40,7 +40,6 @@ jobs:
       fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
     with:
-      benchmark: ${{ matrix.benchmark }}
       build_only: ${{ matrix.build_only }}
       build_type: ${{ matrix.build_type }}
       ccache_enabled: ${{ inputs.ccache_enabled }}
@@ -51,6 +50,5 @@ jobs:
       config_name: ${{ matrix.config_name }}
       sanitizers: ${{ matrix.sanitizers }}
       compiler: ${{ matrix.compiler || '' }}
-      toolchain: ${{ matrix.toolchain || '' }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/reusable-check-autogen.yml

@@ -1,76 +0,0 @@
-# This workflow checks that the generated protocol wrapper classes are
-# up-to-date with the macro files and generator scripts they are produced from,
-# see more info in include/xrpl/protocol_autogen/README.md.
-name: Check autogen
-
-# This workflow can only be triggered by other workflows.
-on: workflow_call
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-autogen
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  BUILD_DIR: build/codegen
-
-jobs:
-  autogen:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.13"
-
-      # Code generation is pure Python, so the standalone project below offers
-      # the same targets as the main build without needing its dependencies or
-      # a compiler, which keeps this job down to a few seconds.
-      - name: Configure CMake
-        run: cmake -S cmake/codegen -B "${BUILD_DIR}"
-
-      - name: Install code generation dependencies
-        run: cmake --build "${BUILD_DIR}" --target setup_code_gen
-
-      - name: Generate code
-        run: cmake --build "${BUILD_DIR}" --target code_gen
-
-      - name: Check for differences
-        env:
-          MESSAGE: |
-
-            The generated protocol wrapper classes are out of date.
-
-            This typically happens when the macro files or generator scripts
-            have changed but the generated files were not regenerated.
-
-            Run the following from the repository root, then commit and push
-            the regenerated files. This needs neither the dependencies nor a
-            compiler. See include/xrpl/protocol_autogen/README.md for more info.
-
-              cmake -S cmake/codegen -B build/codegen
-              cmake --build build/codegen --target setup_code_gen
-              cmake --build build/codegen --target code_gen
-
-            In an already configured build directory, the 'setup_code_gen' and
-            'code_gen' targets do the same thing.
-        run: |
-          # Record untracked files in the index without staging their contents,
-          # so that classes generated for a newly added transaction or ledger
-          # entry type show up in the diff below rather than silently as an
-          # empty one.
-          git add --intent-to-add .
-          DIFF=$(git status --porcelain)
-          if [ -n "${DIFF}" ]; then
-              # Print the differences to give the contributor a hint about what to
-              # expect when running code generation on their own machine.
-              git diff
-              echo "${MESSAGE}"
-              exit 1
-          fi

.github/workflows/reusable-check-levelization.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check levelization
         run: python .github/scripts/levelization/generate.py
       - name: Check for differences

.github/workflows/reusable-check-rename.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check definitions
         run: .github/scripts/rename/definitions.sh .
       - name: Check copyright notices

.github/workflows/reusable-clang-tidy.yml

@@ -27,23 +27,23 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-473fe44"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
     permissions:
       contents: read
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 
@@ -59,12 +59,6 @@ jobs:
         with:
           compiler: ${{ env.COMPILER }}
 
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-        with:
-          cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
-
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
 
@@ -88,10 +82,11 @@ jobs:
               -Dverify_headers=ON \
               ..
 
-      - name: Build clang-tidy prerequisites
+      # clang-tidy needs headers generated from proto files
+      - name: Build libxrpl.libpb
         working-directory: ${{ env.BUILD_DIR }}
         run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} tidy_prerequisites
+          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
 
       - name: Run clang tidy
         id: run_clang_tidy
@@ -100,7 +95,7 @@ jobs:
           TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'include src tests' }}
         run: |
           set -o pipefail
-          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -format -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
+          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
 
       - name: Print filtered clang-tidy errors
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}

.github/workflows/reusable-package.yml

@@ -1,37 +1,17 @@
-# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
-#
-#   - one job per config that carries a "package" map in linux.json
-#   - that map names the container image and the format it builds there
-#   - with 'publish: true' a job also uploads what it built
-#     (see package/publish_pkg.py)
-#
-# Only linux/amd64 is supported; the runner is hardcoded in the job below.
+# Build Linux packages (DEB and RPM) from pre-built binary artifacts.
+# Discovers which configurations to package from linux.json (configs in
+# "package_configs") and fans out one job per distro. Only linux/amd64 is
+# supported; the runner is hardcoded in the job below.
 name: Package
 
 on:
   workflow_call:
     inputs:
-      publish:
-        description: "Whether to publish the packages after building them."
-        required: false
-        type: boolean
-        default: false
-      nexus_url:
-        description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
+      pkg_release:
+        description: "Package release number. Increment when repackaging the same executable."
         required: false
         type: string
-        default: https://packages.xrplf.org
-
-    secrets:
-      remote_username:
-        description: "The username of a Nexus account with write access to the repositories."
-        required: false
-      remote_password:
-        description: "The password or token for that Nexus account."
-        required: false
-      signing_key:
-        description: "Armoured PGP private key used to sign the RPMs. Required when publishing."
-        required: false
+        default: "1"
 
 defaults:
   run:
@@ -47,10 +27,10 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
 
@@ -61,11 +41,11 @@ jobs:
 
   package:
     needs: [generate-matrix]
-    if: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ github.event.repository.visibility == 'public' }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "${{ matrix.xrpld_artifact_name }}"
+    name: "${{ matrix.artifact_name }}"
     permissions:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
@@ -74,66 +54,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Download pre-built xrpld binary
+      - name: Download pre-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: ${{ matrix.xrpld_artifact_name }}
+          name: ${{ matrix.artifact_name }}
           path: ${{ env.BUILD_DIR }}
 
-      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ matrix.validator_keys_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
-
-      - name: Make binaries executable
-        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
-
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
+      - name: Make binary executable
+        run: chmod +x "${BUILD_DIR}/xrpld"
 
       - name: Build package
         env:
-          PACKAGE_TYPE: ${{ matrix.package_type }}
-          PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
-          CHANNEL: ${{ steps.release_info.outputs.channel }}
-        run: |
-          ./package/build_pkg.py \
-              --package-type "${PACKAGE_TYPE}" \
-              --build-dir "${BUILD_DIR}" \
-              --pkg-release "${PKG_RELEASE}" \
-              --channel "${CHANNEL}"
-
-      # Before the upload, so the artifact and the published package are the
-      # same bytes. DEBs are not signed, so the key is never set on that job.
-      - name: Sign RPM
-        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
-        env:
-          PKG_SIGNING_KEY: ${{ secrets.signing_key }}
-        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
+          PKG_RELEASE: ${{ inputs.pkg_release }}
+        run: ./package/build_pkg.sh
 
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg
+          name: ${{ matrix.artifact_name }}-pkg
           path: |
             ${{ env.BUILD_DIR }}/debbuild/*.deb
             ${{ env.BUILD_DIR }}/debbuild/*.ddeb
             ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
           if-no-files-found: error
-
-      - name: Publish package
-        if: ${{ inputs.publish }}
-        env:
-          CHANNEL: ${{ steps.release_info.outputs.channel }}
-          NEXUS_URL: ${{ inputs.nexus_url }}
-          NEXUS_USERNAME: ${{ secrets.remote_username }}
-          NEXUS_PASSWORD: ${{ secrets.remote_password }}
-        run: |
-          ./package/publish_pkg.py \
-              --channel "${CHANNEL}" \
-              --package-dir "${BUILD_DIR}" \
-              --nexus-url "${NEXUS_URL}"

.github/workflows/reusable-rust.yml

@@ -1,80 +0,0 @@
-# Clippy, coverage and documentation for the Rust crates in crates/. Each runs
-# as an independent job on a GitHub-hosted runner, but inside the same container
-# image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints, coverage instrumentation and the cargo cache) matches
-# what production builds use.
-#
-# Rust unit tests are deliberately NOT run here. They run as part of the C++
-# build (reusable-build-test-config.yml), which already compiles the crates on a
-# self-hosted runner, so there is no need to provision a toolchain again.
-name: Rust
-
-on:
-  workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        description: "The Codecov token to use for uploading coverage reports."
-        required: true
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  clippy:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Run clippy
-        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
-
-  coverage:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Generate coverage report
-        run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
-
-      - name: Upload coverage report
-        if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          disable_search: true
-          disable_telem: true
-          fail_ci_if_error: true
-          files: crates/lcov.info
-          flags: rust
-          plugins: noop
-          token: ${{ secrets.CODECOV_TOKEN }}
-          verbose: true
-
-  doc:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Build documentation
-        env:
-          RUSTDOCFLAGS: "-D warnings"
-        run: cargo doc --workspace --no-deps --all-features --locked

.github/workflows/reusable-strategy-matrix.yml

@@ -23,10 +23,10 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
 

.github/workflows/reusable-upload-recipe.yml

@@ -40,18 +40,18 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
       CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
+      - name: Generate build version number
+        id: version
+        uses: ./.github/actions/generate-version
 
       - name: Set up Conan
         uses: ./.github/actions/setup-conan
@@ -64,8 +64,8 @@ jobs:
 
       - name: Upload Conan recipe (version)
         run: |
-          conan export . --version=${{ steps.release_info.outputs.version }}
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.release_info.outputs.version }}
+          conan export . --version=${{ steps.version.outputs.version }}
+          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
 
       # When this workflow is triggered by a push event, it will always be when merging into the
       # 'develop' branch, see on-trigger.yml.
@@ -92,4 +92,4 @@ jobs:
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
 
     outputs:
-      ref: xrpl/${{ steps.release_info.outputs.version }}
+      ref: xrpl/${{ steps.version.outputs.version }}

.github/workflows/upload-conan-deps.yml

@@ -65,18 +65,13 @@ jobs:
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
         with:
           enable_ccache: false
 
-      # Before any step that uses a build tool, composite actions included.
-      - name: Setup Nix environment
-        if: ${{ matrix.toolchain == 'nix' }}
-        uses: ./.github/actions/setup-nix-env
-
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
 
@@ -92,9 +87,7 @@ jobs:
         with:
           compiler: ${{ matrix.compiler }}
 
-      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
-        if: ${{ matrix.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ matrix.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -113,10 +106,6 @@ jobs:
           log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
-      - name: Check the Conan cache for Nix store references (Nix toolchain)
-        if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
-
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"

.gitignore

@@ -81,14 +81,8 @@ DerivedData
 # Python
 __pycache__
 
-# Rust build artifacts.
-target/
-
 # Direnv's directory
 /.direnv
 
 # clangd cache
 /.cache
-
-# Rust build directory
-crates/target

.pre-commit-config.yaml

@@ -55,54 +55,29 @@ repos:
         types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: f4d7745e17a28aad7eed2f4874ca8d1568c11c4c # frozen: v22.1.8
+    rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
     hooks:
       - id: clang-format
         args: [--style=file]
         types_or: [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
-  - repo: local
-    hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo fmt --manifest-path crates/Cargo.toml --all
-        language: system
-        types: [rust]
-        pass_filenames: false # rustfmt formats the whole workspace
-
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
     hooks:
       - id: gersemi
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 9337a74165b178ae2c766f60bee7252a0f06f3e8 # frozen: v3.9.5
+    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
     hooks:
       - id: prettier
         args: [--end-of-line=auto]
 
-  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
-  # so widening these is its own change.
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 7c55798a78262d14b2074abf623d8a992ebb70d4 # frozen: v0.16.2
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
-  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
-    hooks:
-      - id: mypy
-        args: [--strict]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
     hooks:

API-CHANGELOG.md

@@ -42,7 +42,6 @@ This section contains changes targeting a future version.
 
 ### Bugfixes
 
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -54,11 +53,6 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
-- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 
 ## XRP Ledger server version 3.1.0
 

BUILD.md

@@ -1,17 +1,37 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
-For the hardware needed to run a node, see
-[System Requirements](https://xrpl.org/system-requirements.html).
+See [System Requirements](https://xrpl.org/system-requirements.html).
 
-For the software needed to build xrpld, see the
-[environment setup guide](./docs/build/environment.md).
+Building xrpld generally requires Git, Python, Conan, CMake, and a C++
+compiler.
+
+- [Python](https://www.python.org/downloads/)
+- [Conan](https://conan.io/downloads.html)
+- [CMake](https://cmake.org/download/)
+
+You can verify that the required tools are installed and runnable with:
+
+```bash
+./bin/check-tools.sh
+```
+
+`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
+
+| Compiler    | Version         |
+| ----------- | --------------- |
+| GCC         | 15.2            |
+| Clang       | 22              |
+| Apple Clang | 21              |
+| MSVC        | 19.44[^windows] |
 
 ## Operating Systems
 
+Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
+
 ### Linux
 
 The Ubuntu Linux distribution has received the highest level of quality
@@ -22,13 +42,12 @@ Our Linux CI tooling is distro-independent and uses a Nix-based environment, so
 ### macOS
 
 Many `xrpld` engineers use macOS for development.
-The minimum supported version is macOS 15 (Sequoia).
-CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
 
 ### Windows
 
-Windows is used by some engineers for development only, and is not recommended
-for production use.
+Windows is used by some engineers for development only.
+
+[^windows]: Windows is not recommended for production use.
 
 ## Steps
 
@@ -53,25 +72,37 @@ releases](https://github.com/XRPLF/rippled/releases).
 
 ### Set Up Conan
 
-Once your [development environment](./docs/build/environment.md) is ready, set
-Conan up for this repository:
+After you have a [C++ development environment](./docs/build/environment.md) ready with Git, Python,
+Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
+
+These instructions assume a basic familiarity with Conan and CMake. If you are
+unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
+[Getting Started][conan-getting-started] walkthrough.
+
+#### Profiles
+
+We recommend that you install our Conan profiles:
 
 ```bash
-./conan/init.sh
+conan config install conan/profiles/ -tf $(conan config home)/profiles/
 ```
 
-That installs our [`global.conf`](./conan/global.conf), our Conan
-[profiles](./conan/profiles), and the `xrplf` remote that hosts some of our
-dependencies. It honours `CONAN_HOME` and never deletes an existing Conan home,
-so it is safe to re-run — it only overwrites the files it manages.
+You can check your Conan profile by running:
 
-> [!TIP]
-> In the [Nix development shell](./docs/build/nix.md#conan-configuration) this is
-> already done for you: the script runs on entry.
+```bash
+conan profile show
+```
 
-You can inspect the resulting profile with `conan profile show`. If it is not
-suitable for your environment, create a custom profile and pass it to Conan — see
-[Advanced Conan configuration](./docs/build/advanced_conan.md).
+If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
+More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
+
+#### Add xrplf remote
+
+Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
+
+```bash
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
+```
 
 ### Set Up Ccache
 
@@ -214,17 +245,7 @@ cmake --build . --target setup_code_gen  # create venv and install dependencies
 cmake --build . --target code_gen        # regenerate code
 ```
 
-The same targets are also available as a standalone project, which does not
-need the dependencies to be configured first:
-
-```
-cmake -S cmake/codegen -B build/codegen
-cmake --build build/codegen --target setup_code_gen
-cmake --build build/codegen --target code_gen
-```
-
-The regenerated files should be committed alongside your changes. CI verifies
-that they are up-to-date.
+The regenerated files should be committed alongside your changes.
 
 ## Coverage report
 
@@ -236,14 +257,10 @@ which is only enabled when the `coverage` option is set, e.g. with
 Prerequisites for the coverage report:
 
 - [gcovr tool][gcovr] (can be installed e.g. with [pip][python-pip])
-- `gcov` for GCC or `llvm-cov` for Clang, usually installed with the compiler
+- `gcov` for GCC (installed with the compiler by default) or
+- `llvm-cov` for Clang (installed with the compiler by default)
 - `Debug` build type
 
-> [!NOTE]
-> Clang coverage is not available in the [Nix development shell](./docs/build/nix.md#building-xrpld-in-the-nix-shell):
-> its `clang` shells do not ship `llvm-cov`. Use a `gcc` shell instead (`.#gcc`,
-> or `.#gcc-plain` on Linux), which provides a `gcov` matching its compiler.
-
 A coverage report is created when the following steps are completed, in order:
 
 1. `xrpld` binary built with instrumentation data, enabled by the `coverage`
@@ -316,22 +333,6 @@ memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
-### Rust crates
-
-The build compiles the Rust workspace in `crates/` and generates the cxxbridge
-bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
-at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
-[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
-as described in [Rust](./docs/build/environment.md#rust).
-
-The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake (CI runs them with
-`cargo nextest`):
-
-```bash
-cargo test --manifest-path crates/Cargo.toml --workspace
-```
-
 ### Verifying headers
 
 The regular build only compiles `.cpp` files, so a header is only ever checked
@@ -376,14 +377,10 @@ After any updates or changes to dependencies, you may need to do the following:
 4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
-If you are using the Nix development shell, whether prebuilt Conan binaries apply
-depends on your platform — see
-[Prebuilt packages](./docs/build/nix.md#prebuilt-packages).
-
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [set Conan up](#set-up-conan) so the `xrplf` remote is configured, or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -403,6 +400,7 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
+[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
 [unity-build]: https://en.wikipedia.org/wiki/Unity_build
 [gcovr]: https://gcovr.com/en/stable/getting-started.html

CMakeLists.txt

@@ -13,23 +13,6 @@ if(DEFINED CMAKE_MODULE_PATH)
 endif()
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
 
-# Must be set before project() because project() consumes it when configuring the compiler and SDK.
-# A user-provided -DCMAKE_OSX_DEPLOYMENT_TARGET still takes precedence.
-#
-# CMAKE_SYSTEM_NAME can't be used before project(), so CMAKE_HOST_SYSTEM_NAME is used instead.
-#
-# When CMAKE_OSX_DEPLOYMENT_TARGET is bumped to >=26.0, FastFloat dependency won't be needed anymore
-if(
-    CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin"
-    AND NOT DEFINED CMAKE_OSX_DEPLOYMENT_TARGET
-)
-    set(CMAKE_OSX_DEPLOYMENT_TARGET
-        "15.0"
-        CACHE STRING
-        "Minimum macOS deployment version"
-    )
-endif()
-
 project(xrpl)
 set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_CXX_STANDARD 23)
@@ -104,7 +87,6 @@ include(deps/Boost)
 add_subdirectory(external/antithesis-sdk)
 find_package(date REQUIRED)
 find_package(ed25519 REQUIRED)
-find_package(FastFloat REQUIRED)
 find_package(gRPC REQUIRED)
 find_package(LibArchive REQUIRED)
 find_package(lz4 REQUIRED)
@@ -120,7 +102,6 @@ target_link_libraries(
     xrpl_libs
     INTERFACE
         ed25519::ed25519
-        FastFloat::fast_float
         lz4::lz4
         mpt-crypto::mpt-crypto
         OpenSSL::Crypto
@@ -150,30 +131,17 @@ else()
 endif()
 target_link_libraries(xrpl_libs INTERFACE ${nudb})
 
-if(benchmark)
-    find_package(benchmark REQUIRED)
-endif()
-
 if(coverage)
     include(XrplCov)
 endif()
 
-add_custom_target(tidy_prerequisites)
-
-add_subdirectory(crates)
 include(XrplCore)
 include(XrplProtocolAutogen)
 include(XrplInstall)
-include(XrplValidatorKeys)
-# Must come after XrplValidatorKeys: the 'package' target depends on the
-# validator-keys target existing.
 include(XrplPackaging)
+include(XrplValidatorKeys)
 
 if(tests)
     include(CTest)
     add_subdirectory(src/tests/libxrpl)
 endif()
-
-if(benchmark)
-    add_subdirectory(src/benchmarks/libxrpl)
-endif()

CODEOWNERS

@@ -1,4 +0,0 @@
-# By default, anyone can review changes.
-
-# The CI tooling team should review changes to the CI configuration.
-/.github/ @XRPLF/ci-tooling

CONTRIBUTING.md

@@ -83,7 +83,6 @@ If you create new source files, they must be organized as follows:
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
 - All test source files must go under `src/test`.
-- All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest
 way to satisfy this is to install the [`pre-commit`](#pre-commit-hooks) hooks,
@@ -225,9 +224,8 @@ environment, so you don't need to install most of the individual tools
 yourself. The version of each hook sourced from an external repository
 (`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
 locally uses exactly the same versions as CI. A few `local` hooks — most notably
-`clang-tidy` and `cargo fmt` — run tools from your own environment; see
-[Installing clang-tidy](#installing-clang-tidy) and
-[Rust](./docs/build/environment.md#rust) for how to get those.
+`clang-tidy` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) for how to get those.
 
 To get started, install `pre-commit` and enable the git hook scripts:
 
@@ -256,7 +254,6 @@ The hooks configured in this repository include, among others:
 - `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
 - `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
 - `gersemi` — CMake formatting
-- `cargo fmt` — Rust formatting for the crates in `crates/`
 - `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
 - `cspell` — spell checking
 
@@ -321,11 +318,7 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
-
-```bash
-cmake --build build --target tidy_prerequisites
-```
+Before running clang-tidy, you must build the project to generate required files (particularly protobuf headers). Refer to [`BUILD.md`](./BUILD.md) for build instructions.
 
 #### Via pre-commit (recommended)
 
@@ -354,14 +347,12 @@ run-clang-tidy -p build -allow-no-checks src tests
 ```
 
 This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
-If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix -format` to the above command:
+If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix` to the above command:
 
 ```
-run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
+run-clang-tidy -p build -quiet -fix -allow-no-checks src tests
 ```
 
-`-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
-
 ## Contracts and instrumentation
 
 We are using [Antithesis](https://antithesis.com/) for continuous fuzzing,

README.md

@@ -54,7 +54,6 @@ Here are some good places to start learning the source code:
 | `./docs`   | Source documentation files and doxygen config. |
 | `./cfg`    | Example configuration files.                   |
 | `./src`    | Source code.                                   |
-| `./crates` | Rust source code.                              |
 
 Some of the directories under `src` are external repositories included using
 git-subtree. See those directories' README files for more details.

bin/check-nix-store-refs.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary under <path> records a /nix/store path it resolves at run
-# time. See docs/build/nix.md#prebuilt-packages for why that matters.
-#
-# <path> is a file or a directory. macOS: nothing may reference the store, so
-# point it at whole trees. Linux: the toolchain always writes the store into
-# PT_INTERP and RUNPATH, so only at what cmake/PatchNixBinary.cmake retargets.
-#
-# Only Mach-O / ELF is inspected. Static archives hold store paths in debug info
-# alone; the scripts in a Conan cache are all git hook samples and autotools
-# scratch, 36 false positives to 0 real.
-#
-# Usage: bin/check-nix-store-refs.sh <path>
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <path>" >&2
-    exit 2
-fi
-
-if [ ! -e "$1" ]; then
-    echo "$0: no such path: $1" >&2
-    exit 2
-fi
-
-case "$(uname -s)" in
-    Darwin)
-        format=Mach-O
-        recorded_paths=macho_recorded_paths
-        tool=otool
-        ;;
-    Linux)
-        format=ELF
-        recorded_paths=elf_recorded_paths
-        tool=readelf
-        ;;
-    *)
-        echo "Unsupported OS - skipping the Nix store reference check."
-        exit 0
-        ;;
-esac
-
-# `pipefail` would catch this too, but only as a bare nonzero exit.
-if ! command -v "${tool}" >/dev/null; then
-    echo "$0: ${tool} not found; cannot inspect binaries" >&2
-    exit 2
-fi
-
-# Both list what the file records. `ldd` would answer what this machine resolves
-# now, which is wrong both ways: store paths for a correctly patched binary,
-# silence for a store RUNPATH that resolves nowhere.
-
-# `name` covers LC_ID_DYLIB and LC_LOAD*_DYLIB, `path` covers LC_RPATH.
-macho_recorded_paths() {
-    otool -l "$1" | sed -nE 's#^ *(name|path) ([^ ]*).*#\2#p'
-}
-
-# RPATH and RUNPATH are colon-separated.
-elf_recorded_paths() {
-    readelf -ldW "$1" |
-        sed -nE \
-            -e 's#.*program interpreter: ([^]]*)\].*#\1#p' \
-            -e 's#.*\((RPATH|RUNPATH|NEEDED)\).*\[([^]]*)\].*#\2#p' |
-        tr ':' '\n'
-}
-
-checked=0
-skipped=0
-leaked=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}" 2>/dev/null)" in
-        *"${format}"*) ;;
-        *)
-            skipped=$((skipped + 1))
-            continue
-            ;;
-    esac
-    checked=$((checked + 1))
-
-    # Filter after extracting, or a search path starting elsewhere ($ORIGIN)
-    # hides the rest. `sed` not `grep`: grep calls "no matches" a failure, and
-    # the `|| true` that would need masks a broken pipeline too.
-    refs="$("${recorded_paths}" "${file}" | sed -n '\#^/nix/store/#p' | sort -u)"
-    if [ -n "${refs}" ]; then
-        leaked=$((leaked + 1))
-        echo "::error file=${file}::references the Nix store at run time"
-        echo "${file}"
-        echo "${refs}" | sed 's/^/    /'
-    fi
-done < <(find "$1" -type f \( -perm -u+x -o -name '*.dylib' -o -name '*.so*' \))
-
-echo "$1: checked ${checked}, skipped ${skipped}, ${leaked} with Nix store references."
-
-if [ "${leaked}" -ne 0 ]; then
-    cat >&2 <<'EOF'
-
-Fixes, in order of preference:
-  - A Conan package built before this check existed: drop it
-    (`conan remove '<name>/*'`) and rebuild.
-  - A binary that should have been retargeted to the system loader: check that
-    cmake/PatchNixBinary.cmake ran for it.
-  - Link the macOS system library instead of the Nix one - see
-    libresolvSystemStub in nix/darwin.nix.
-  - No system library exists (libstdc++): link it statically.
-  - None of the above: pin the toolchain into the package ID, following
-    `user.package:libc_version` in conan/profiles/ci.
-EOF
-    exit 1
-fi

bin/check-tools.sh

@@ -15,14 +15,10 @@
 #   - Windows: the core build tools only (CMake, Conan, Git, Python).
 #              MSVC is expected to be provided separately and is not checked here.
 #
-# Some tools (clang-format, clang-tidy, doxygen, gcovr, gh, git-cliff, gpg,
-# pre-commit, run-clang-tidy) are present in our Linux CI images and in local
-# development setups, but not in the macOS CI environment. They are checked
-# everywhere except when running in CI on macOS.
-#
-# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
-# `g++-15`, ...) are probed under both names: a suffixed name can break while
-# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
+# Some tools (clang-format, doxygen, gcovr, gh, git-cliff, gpg, pre-commit,
+# run-clang-tidy) are present in our Linux CI images and in local development
+# setups, but not in the macOS CI environment. They are checked everywhere
+# except when running in CI on macOS.
 #
 # Environment variables:
 #   CI                      if set, skip the tools above when on macOS.
@@ -30,27 +26,12 @@
 
 set -uo pipefail
 
-# Version suffixes of the Nix tool links, tracking nix/packages.nix.
-gcc_version=15
-llvm_version=22
-
 missing=()
 checked=0
 
-# tool_path <name>
-# Fully resolved path of a tool, so the snapshots record which derivation
-# provides it. Prints nothing when it isn't on PATH.
-tool_path() {
-    local path
-    path="$(command -v "$1" 2>/dev/null)" || return 0
-    readlink -f "${path}" 2>/dev/null || printf '%s' "${path}"
-}
-
 # check <name> [probe-command...]
-# Runs the probe (default: "<name> --version"), capturing both stdout and
-# stderr, and prints three lines: the status and name, the first non-blank line
-# of the probe output (its version, or the error when it failed), and the tool's
-# resolved path. Records <name> as missing if it is not found or exits non-zero.
+# Runs the probe (default: "<name> --version") quietly. Records <name> as
+# missing if the command is not found or exits non-zero.
 check() {
     local name="$1"
     shift
@@ -59,18 +40,14 @@ check() {
         probe=("${name}" --version)
     fi
 
+    echo "Checking ${name}..."
     checked=$((checked + 1))
-    local output version path
-    path="$(tool_path "${name}")"
-    if output="$("${probe[@]}" 2>&1)"; then
-        printf '  ✅ %s\n' "${name}"
+    if "${probe[@]}" | head -n 1; then
+        printf '  [ ok ] %s\n' "${name}"
     else
-        printf '  ❌ %s\n' "${name}"
+        printf '  [MISS] %s\n' "${name}"
         missing+=("${name}")
     fi
-    version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
-    printf '     %s\n' "${version:-(no output)}"
-    printf '     %s\n' "${path:-(not found)}"
 }
 
 case "$(uname -s)" in
@@ -102,35 +79,24 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     echo "Development tooling:"
     check ccache
     check clang
-    check "clang-${llvm_version}"
     check clang++
-    check "clang++-${llvm_version}"
     check ClangBuildAnalyzer
     check curl
     check file
     check less
     check make
-    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
-    # version flag, so fall back to a presence marker there.
-    check netstat sh -c 'command -v netstat >/dev/null && { netstat --version 2>&1 | grep -m1 -oE "net-tools [0-9.]+" || echo present; }'
+    check netstat which netstat
     check ninja
-    check perl perl -e 'print "$^V\n"'
+    check perl
     check pkg-config
     check vim
-    check zip bash -c 'zip --version 2>&1 | grep -m1 -oE "Zip [0-9.]+"'
+    check zip
 
     # These tools are present in our Linux CI images and in local development
     # setups, but not in the macOS CI environment. So check them everywhere
     # except when running in CI on macOS.
     if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
-        check clang-apply-replacements
-        check "clang-apply-replacements-${llvm_version}"
         check clang-format
-        check "clang-format-${llvm_version}"
-        # clang-tidy leads --version with the LLVM banner, not the version.
-        tidy_probe="--version | grep -m1 -oE 'LLVM version [0-9.]+'"
-        check clang-tidy sh -c "clang-tidy ${tidy_probe}"
-        check "clang-tidy-${llvm_version}" sh -c "clang-tidy-${llvm_version} ${tidy_probe}"
         check dot
         check doxygen
         check gcovr
@@ -141,7 +107,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
         # pre-commit, or its alternative implementation prek
         check pre-commit sh -c 'pre-commit --version || prek --version'
         check run-clang-tidy run-clang-tidy --help
-        check "run-clang-tidy-${llvm_version}" "run-clang-tidy-${llvm_version}" --help
     fi
 fi
 
@@ -156,7 +121,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-audit cargo audit --version
     check cargo-llvm-cov cargo llvm-cov --version
     check cargo-nextest cargo nextest --version
-    check clippy-driver
+    check clippy clippy-driver --version
     check rust-analyzer
     check rustc
     check rustfmt
@@ -168,11 +133,7 @@ if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
     check gcc
-    check "gcc-${gcc_version}"
     check g++
-    check "g++-${gcc_version}"
-    check cpp
-    check "cpp-${gcc_version}"
     check gcov
 
     echo
@@ -197,9 +158,9 @@ else
     checked=$((checked + 1))
     tmp_clone="$(mktemp -d)"
     if git clone --depth 1 https://github.com/XRPLF/actions.git "${tmp_clone}/actions" >/dev/null 2>&1; then
-        printf '  ✅ git clone over HTTPS\n'
+        printf '  [ ok ] git clone over HTTPS\n'
     else
-        printf '  ❌ git clone over HTTPS\n'
+        printf '  [MISS] git clone over HTTPS\n'
         missing+=("git-https-clone")
     fi
     rm -rf "${tmp_clone}"
@@ -207,9 +168,9 @@ fi
 
 echo
 if [ "${#missing[@]}" -eq 0 ]; then
-    echo "✅ All ${checked} checked tools are present and runnable."
+    echo "All ${checked} checked tools are present and runnable."
 else
-    echo "❌ Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
+    echo "Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
     for tool in "${missing[@]}"; do
         echo "  - ${tool}" >&2
     done

bin/pre-commit/Dockerfile

@@ -1,55 +0,0 @@
-ARG BASE_IMAGE=ubuntu:26.04
-
-FROM ${BASE_IMAGE}
-
-SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
-ENTRYPOINT ["/bin/bash"]
-
-ARG DEBIAN_FRONTEND=noninteractive
-
-RUN <<EOF
-pkgs=()
-pkgs+=(curl)         # Required to install nix.
-pkgs+=(doxygen)      # Needed for Clio's check-doxygen-docs.sh.
-pkgs+=(git)          # Required for prepare-runner.
-pkgs+=(libatomic1)   # Required to run pre-commit provided `node`.
-pkgs+=(python3)      # Python 3 interpreter.
-pkgs+=(python3-pip)  # Package manager for Python applications.
-pkgs+=(xz-utils)     # Required to install nix
-
-apt-get update
-apt-get install -y --no-install-recommends "${pkgs[@]}"
-apt-get clean
-rm -rf /var/lib/apt/lists/*
-EOF
-
-ARG PRE_COMMIT_VERSION=4.6.0
-RUN pip install --no-cache --break-system-packages \
-    pre-commit==${PRE_COMMIT_VERSION}
-
-RUN sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon --yes
-
-# Add nix to PATH and set NIX environment variables,
-# so nix is available in all shells including non-interactive shells (e.g., GitHub Actions).
-ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
-ENV NIX_PROFILES="/nix/var/nix/profiles/default"
-ENV NIX_SSL_CERT_FILE="/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
-
-# Verify nix installation
-RUN nix --version
-
-ENV RUSTUP_HOME="/opt/rust/rustup"
-ENV CARGO_HOME="/opt/rust/cargo"
-ENV PATH="/opt/rust/cargo/bin:${PATH}"
-
-WORKDIR /tmp
-COPY rust-toolchain.toml /tmp/rust-toolchain.toml
-RUN <<EOF
-curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-    | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
-rustup toolchain install
-rustup show
-cargo fmt --version
-EOF
-
-WORKDIR /

bin/pre-commit/clang_tidy_check.py

@@ -144,11 +144,7 @@ def main():
             + files
         )
         canonicalize_fix_paths(Path(fixes_dir))
-        # `FormatStyle` in .clang-tidy does not reach this path,
-        # so ask for the repository style here.
-        applied = subprocess.run(
-            [clang_apply_replacements, "--format", "--style=file", fixes_dir]
-        )
+        applied = subprocess.run([clang_apply_replacements, fixes_dir])
 
     return result.returncode or applied.returncode
 

cfg/xrpld-example.cfg

@@ -488,17 +488,6 @@
 #   Must be a number between 100 and 1000, defaults to 250
 #
 #
-# [max_subscriptions_per_connection]
-#
-#   Maximum number of account, real-time account, and account-history
-#   subscriptions a single client connection may hold at once. Bounds the
-#   per-connection state torn down when the connection disconnects. Book
-#   subscriptions are tracked separately and are not counted here.
-#
-#   Defaults to 100000 if not set; large enough for legitimate power users
-#   such as block explorers.
-#
-#
 # [overlay]
 #
 #   Controls settings related to the peer to peer overlay.
@@ -549,45 +538,6 @@
 #       only be used for local testing and debugging. Do not disable
 #       on mainnet.
 #
-#   max_untrusted_count = <number>
-#
-#       The number of manifests the server keeps for validators it does not
-#       list, and the number it sends and processes in a single peer protocol
-#       message. Once the server holds this many, a manifest for a new
-#       unlisted validator is rejected, so peer gossip cannot grow the cache
-#       without end.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#   max_trusted_count = <number>
-#
-#       The number of manifests for listed validators to allow for when
-#       sizing peer protocol messages. Manifests for listed validators are
-#       never dropped, whether sending or receiving, because doing so would
-#       delay a validator key change reaching this server. Set this above the
-#       number of validators the server lists.
-#
-#       Together the two counts above set the largest manifest message the
-#       server accepts: bigger messages are discarded without reading them,
-#       and without penalising the sender. Raising either means the server
-#       accepts and sends bigger messages than a peer using the defaults, and
-#       those peers will discard what this server sends. Lowering either below
-#       what peers send makes this server discard their manifest messages,
-#       which it does without recording anything.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#       NOTE: These two options (max_untrusted_count and max_trusted_count)
-#       are transitional. They exist to bound manifest-message size and cache
-#       growth during the network upgrade. They may be removed in a future
-#       release once the fleet has upgraded, and should not be relied upon as
-#       stable configuration.
 #
 # [transaction_queue] EXPERIMENTAL
 #
@@ -1094,8 +1044,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between online_delete
-#                           SQL deletion batches to allow other functions
+#                           Number of milliseconds to wait between
+#                           online_delete batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,22 +1059,10 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old, and that all
-#                           recent ledgers are available. If not, then continue
+#                           'age_threshold_seconds' old. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 2.
-#
-#       max_waiting_ledgers
-#                           The maximum number of ledgers that may be validated
-#                           while online deletion is waiting for the node to get
-#                           fully synced with the rest of the network. If more than
-#                           this number of ledgers are validated while waiting, then
-#                           online deletion gives up on the current ledger and tries
-#                           again later. Note this only affects situations that cause
-#                           rotation to wait, such as going out of sync, or missing
-#                           ledgers. Forward progress is not penalized. Minimum is 64.
-#                           Default is the online_delete value.
+#                           Default is 5.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.

cmake/CompilationEnv.cmake

@@ -29,27 +29,6 @@ if(CMAKE_GENERATOR STREQUAL "Xcode")
     set(is_xcode TRUE)
 endif()
 
-# --------------------------------------------------------------------
-# Nix toolchain detection
-# --------------------------------------------------------------------
-# True when the C++ compiler resolves into the Nix store. CMAKE_CXX_COMPILER may
-# be referenced through a symlink outside the store (a Nix profile, a /usr/bin
-# alternative, ...), so resolve the real path before matching.
-set(is_nix_compiler FALSE)
-get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
-if(_cxx_real MATCHES "^/nix/store/")
-    set(is_nix_compiler TRUE)
-endif()
-unset(_cxx_real)
-
-# True inside the Nix CI Docker image, identified by the /nix/ci-env tree it
-# ships (see nix/docker/Dockerfile). The dev shell and bare systems don't have
-# it, so it distinguishes the CI image from other Nix-compiler environments.
-set(is_ci_image FALSE)
-if(EXISTS "/nix/ci-env/bin")
-    set(is_ci_image TRUE)
-endif()
-
 # --------------------------------------------------------------------
 # Operating system detection
 # --------------------------------------------------------------------

cmake/PatchNixBinary.cmake

@@ -1,38 +1,26 @@
 #[===================================================================[
    Patch executables to run in non-Nix environments.
 
-   The Nix toolchain links binaries against an ELF interpreter (loader)
+   The Nix-based CI image links binaries against an ELF interpreter (loader)
    that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` resets
-   the interpreter to the system default loader and drops the rpath, once the
-   binary has been linked.
+   (including once installed from the .deb package). `patch_nix_binary` adds a
+   POST_BUILD step that resets the interpreter to the system default loader and
+   drops the rpath.
 
-   This runs by default for Nix-toolchain builds (determined by whether the compiler resolves under /nix/store/).
-   Those builds are where binaries get a Nix-store loader.
-   It is opted out of by setting the XRPLD_NO_PATCH_NIX_BINARY environment variable —
-   the plain Nix dev shells set it, since their binaries link a newer glibc
-   and must not be retargeted to the system loader.
-
-   Non-Nix builds (a system compiler, already using the system loader) and sanitizer builds
-   (runtime libraries resolved through the rpath) are skipped too.
-   Everywhere else `patch_nix_binary` is a no-op.
-
-   The default loader is resolved by bin/default-loader-path.sh.
+   This is only active inside the Nix-based image, detected by the presence of
+   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
+   is skipped for sanitizer builds, whose runtime libraries are resolved through
+   the rpath. Everywhere else `patch_nix_binary` is a no-op.
 #]===================================================================]
 
 include_guard(GLOBAL)
 
 include(CompilationEnv)
 
-# Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
+# Provided by the Nix-based CI image; prints the system default ELF loader path.
+set(_loader_path_script "/tmp/loader-path.sh")
 
-if(
-    is_linux
-    AND NOT SANITIZERS_ENABLED
-    AND is_nix_compiler
-    AND NOT DEFINED ENV{XRPLD_NO_PATCH_NIX_BINARY}
-)
+if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
     execute_process(
         COMMAND "${_loader_path_script}"
         OUTPUT_VARIABLE DEFAULT_LOADER_PATH
@@ -53,38 +41,13 @@ function(patch_nix_binary target)
     if(NOT PATCH_NIX_BINARIES)
         return()
     endif()
-
-    set(patch_command
-        "${PATCHELF_COMMAND}"
-        --set-interpreter
-        "${DEFAULT_LOADER_PATH}"
-        --remove-rpath
-        "$<TARGET_FILE:${target}>"
+    add_custom_command(
+        TARGET ${target}
+        POST_BUILD
+        COMMAND
+            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
+            --remove-rpath "$<TARGET_FILE:${target}>"
+        COMMENT "Patching ${target}: set default loader, remove rpath"
+        VERBATIM
     )
-    set(comment "Patching ${target}: set default loader, remove rpath")
-
-    # POST_BUILD is the cheap way to do this: it runs only when the binary is
-    # relinked. It is also only available in the directory that defined the
-    # target, so for a target from elsewhere (e.g. a FetchContent subproject)
-    # fall back to a custom target that runs after the binary is linked. That
-    # one runs on every build, which is harmless because patchelf is idempotent.
-    get_target_property(target_source_dir ${target} SOURCE_DIR)
-    if("${target_source_dir}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
-        add_custom_command(
-            TARGET ${target}
-            POST_BUILD
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-    else()
-        add_custom_target(
-            ${target}-patch-nix
-            ALL
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-        add_dependencies(${target}-patch-nix ${target})
-    endif()
 endfunction()

cmake/XrplAddBenchmark.cmake

@@ -1,46 +0,0 @@
-include_guard()
-
-include(isolate_headers)
-
-# Define a benchmark executable for the module `name`.
-#
-# This follows the same general pattern as other build helpers in this repo
-# (e.g. `add_module`): create a target and isolate headers, but here the target
-# is a benchmark executable and no `add_test(...)` is registered.
-#
-# `isolate_headers` exposes only `${CMAKE_CURRENT_SOURCE_DIR}/${name}` on the
-# include path, rooted at `src`, so a benchmark's own headers are reached as
-# `<benchmarks/.../${name}/...>` and nothing else in the tree leaks in.
-function(xrpl_add_benchmark name)
-    set(target ${PROJECT_NAME}.bench.${name})
-
-    file(
-        GLOB_RECURSE sources
-        CONFIGURE_DEPENDS
-        "${CMAKE_CURRENT_SOURCE_DIR}/${name}/*.cpp"
-        "${CMAKE_CURRENT_SOURCE_DIR}/${name}.cpp"
-    )
-    add_executable(${target} ${ARGN} ${sources})
-
-    # Benchmark sources register cases through Google Benchmark's static
-    # registrars (anonymous-namespace lambdas). Merging several such files into
-    # one unity translation unit collides those internal-linkage entities, so
-    # keep benchmarks out of the unity build - mirroring xrpl.libpb in
-    # XrplCore.cmake. Each file compiles fine on its own.
-    set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
-
-    # Land next to `xrpl_tests` in the build root rather than buried under
-    # `src/benchmarks/libxrpl/`. A benchmark is something a person runs by hand,
-    # repeatedly, and comparing two of them should not mean typing two long paths.
-    set_target_properties(
-        ${target}
-        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-    )
-
-    isolate_headers(
-        ${target}
-        "${CMAKE_SOURCE_DIR}/src"
-        "${CMAKE_CURRENT_SOURCE_DIR}/${name}"
-        PRIVATE
-    )
-endfunction()

cmake/XrplCompiler.cmake

@@ -120,10 +120,7 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(
-        common
-        INTERFACE -errorreport:none -machine:X64 -ignore:4099
-    )
+    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
 else()
     target_compile_options(
         common
@@ -174,8 +171,9 @@ else()
     # Clang wrapper supplies those paths itself (via -nostdinc++), so at compile time the
     # flag is unused -> Clang errors under our -Werror. At link time the flag IS consumed
     # (it selects the C++ runtime), so we move it there instead of dropping it entirely.
+    get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
     if(
-        is_nix_compiler
+        _cxx_real MATCHES "^/nix/store/"
         AND is_linux
         AND is_clang
         AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
@@ -269,50 +267,10 @@ elseif(use_lld)
     )
     if("${LD_VERSION}" MATCHES "LLD")
         target_link_libraries(common INTERFACE -fuse-ld=lld)
-        # remembered for the linker flag probe below
-        set(fuse_ld_flag "-fuse-ld=lld")
     endif()
     unset(LD_VERSION)
 endif()
 
-# Linker warnings are errors where we control the toolchain and the dependencies: CI and the Nix dev shell.
-# On non-Nix macOS we suppress the deployment target warning: an old Conan profile may not pin os.version.
-# Only the new Apple linker understands the flag, so probe the actual linker (lld may be selected above).
-if(is_macos OR is_linux)
-    if(is_ci OR is_nix_compiler)
-        if(is_macos)
-            set(fatal_warnings_flag "-Wl,-fatal_warnings")
-        else()
-            set(fatal_warnings_flag "-Wl,--fatal-warnings")
-        endif()
-        message(
-            STATUS
-            "Treating all linker warnings as errors (${fatal_warnings_flag})"
-        )
-        target_link_options(common INTERFACE "${fatal_warnings_flag}")
-        unset(fatal_warnings_flag)
-    elseif(is_macos)
-        set(silence_flag "-Wl,-deployment_target_mismatches,suppress")
-        set(probe_flags ${fuse_ld_flag} "${silence_flag}")
-        include(CheckLinkerFlag)
-        check_linker_flag(
-            CXX
-            "${probe_flags}"
-            have_deployment_target_mismatches
-        )
-        if(have_deployment_target_mismatches)
-            message(
-                STATUS
-                "Silencing macOS deployment target mismatch warnings (${silence_flag})"
-            )
-            target_link_options(common INTERFACE "${silence_flag}")
-        endif()
-        unset(probe_flags)
-        unset(silence_flag)
-    endif()
-endif()
-unset(fuse_ld_flag)
-
 if(assert)
     foreach(var_ CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_RELEASE)
         string(REGEX REPLACE "[-/]DNDEBUG" "" ${var_} "${${var_}}")

cmake/XrplCore.cmake

@@ -51,8 +51,6 @@ target_compile_options(
 
 target_link_libraries(xrpl.libpb PUBLIC protobuf::libprotobuf gRPC::grpc++)
 
-add_dependencies(tidy_prerequisites xrpl.libpb)
-
 # TODO: Clean up the number of library targets later.
 add_library(xrpl.imports.main INTERFACE)
 
@@ -135,12 +133,6 @@ target_link_libraries(
 add_module(xrpl resource)
 target_link_libraries(xrpl.libxrpl.resource PUBLIC xrpl.libxrpl.protocol)
 
-add_module(xrpl peerfinder)
-target_link_libraries(
-    xrpl.libxrpl.peerfinder
-    PUBLIC xrpl.libxrpl.basics xrpl.libxrpl.protocol
-)
-
 # Level 08
 add_module(xrpl net)
 target_link_libraries(
@@ -207,21 +199,7 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
-
-add_module(xrpl consensus)
-target_link_libraries(
-    xrpl.libxrpl.consensus
-    PUBLIC
-        xrpl.libxrpl.basics
-        xrpl.libxrpl.json
-        xrpl.libxrpl.protocol
-        xrpl.libxrpl.ledger
-)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_library(xrpl.libxrpl)
 set_target_properties(xrpl.libxrpl PROPERTIES OUTPUT_NAME xrpl)
@@ -242,7 +220,6 @@ target_link_modules(
     beast
     conditions
     config
-    consensus
     core
     crypto
     git
@@ -250,7 +227,6 @@ target_link_modules(
     ledger
     net
     nodestore
-    peerfinder
     protocol
     protocol_autogen
     rdb

cmake/XrplCov.cmake

@@ -44,7 +44,6 @@ setup_target_for_coverage_gcovr(
     EXCLUDE
         "src/test"
         "src/tests"
-        "src/benchmarks"
         "include/xrpl/beast/test"
         "include/xrpl/beast/unit_test"
         "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.py) installs to FHS-standard
+   The packaging script (package/build_pkg.sh) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -25,33 +25,19 @@ if(NOT (RPMBUILD_EXECUTABLE OR DPKG_BUILDPACKAGE_EXECUTABLE))
     return()
 endif()
 
-if(NOT TARGET xrpld)
-    message(STATUS "xrpld=ON is required; 'package' target not available")
-    return()
-endif()
-
-if(NOT TARGET validator-keys)
-    message(
-        STATUS
-        "validator_keys=ON is required; 'package' target not available"
-    )
-    return()
-endif()
-
-if(DPKG_BUILDPACKAGE_EXECUTABLE)
-    set(pkg_type deb)
-else()
-    set(pkg_type rpm)
-endif()
+set(package_env
+    SRC_DIR=${CMAKE_SOURCE_DIR}
+    BUILD_DIR=${CMAKE_BINARY_DIR}
+    PKG_RELEASE=${pkg_release}
+)
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
-        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
-        --channel=UNRELEASED
+        ${CMAKE_COMMAND} -E env ${package_env}
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-    DEPENDS xrpld validator-keys
-    COMMENT "Building Linux ${pkg_type} package"
+    DEPENDS xrpld
+    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
     VERBATIM
 )

cmake/XrplProtocolAutogen.cmake

@@ -2,22 +2,21 @@
    Protocol Autogen - Code generation for protocol wrapper classes
 #]===================================================================]
 
-# The repository root, derived from the location of this file rather than from
-# the including project, so that the targets below can also be offered on their
-# own by cmake/codegen/CMakeLists.txt.
-get_filename_component(XRPL_ROOT "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
-
 set(CODEGEN_VENV_DIR
-    "${XRPL_ROOT}/.venv"
+    "${CMAKE_CURRENT_SOURCE_DIR}/.venv"
     CACHE PATH
     "Path to a Python virtual environment for code generation. A venv will be created here by setup_code_gen and used to run generation scripts."
 )
 
 # Directory paths
-set(MACRO_DIR "${XRPL_ROOT}/include/xrpl/protocol/detail")
-set(AUTOGEN_HEADER_DIR "${XRPL_ROOT}/include/xrpl/protocol_autogen")
-set(AUTOGEN_TEST_DIR "${XRPL_ROOT}/src/tests/libxrpl/protocol_autogen")
-set(SCRIPTS_DIR "${XRPL_ROOT}/cmake/scripts/codegen")
+set(MACRO_DIR "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol/detail")
+set(AUTOGEN_HEADER_DIR
+    "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol_autogen"
+)
+set(AUTOGEN_TEST_DIR
+    "${CMAKE_CURRENT_SOURCE_DIR}/src/tests/libxrpl/protocol_autogen"
+)
+set(SCRIPTS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/scripts/codegen")
 
 # Input macro files
 set(TRANSACTIONS_MACRO "${MACRO_DIR}/transactions.macro")
@@ -115,14 +114,14 @@ if(CODEGEN_VENV_DIR)
         setup_code_gen
         COMMAND ${Python3_EXECUTABLE} -m venv "${CODEGEN_VENV_DIR}"
         COMMAND ${CODEGEN_PYTHON} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${XRPL_ROOT}"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
         COMMENT "Creating venv and installing code generation dependencies..."
     )
 else()
     add_custom_target(
         setup_code_gen
         COMMAND ${Python3_EXECUTABLE} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${XRPL_ROOT}"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
         COMMENT "Installing code generation dependencies..."
     )
 endif()
@@ -140,8 +139,8 @@ add_custom_target(
         -DSFIELDS_MACRO=${SFIELDS_MACRO}
         -DAUTOGEN_HEADER_DIR=${AUTOGEN_HEADER_DIR}
         -DAUTOGEN_TEST_DIR=${AUTOGEN_TEST_DIR} -P
-        "${CMAKE_CURRENT_LIST_DIR}/XrplProtocolAutogenRun.cmake"
-    WORKING_DIRECTORY "${XRPL_ROOT}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/XrplProtocolAutogenRun.cmake"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
     COMMENT "Running protocol code generation..."
     SOURCES ${ALL_INPUT_FILES}
 )

cmake/XrplSanity.cmake

@@ -36,19 +36,6 @@ elseif(is_gcc)
     endif()
 endif()
 
-# A Nix compiler is only meant to be used from a managed environment: the xrpld
-# dev shell (which exports XRPL_DEVSHELL) or the CI image. Using one from a bare
-# shell usually means a leaked toolchain (picked up via PATH or a Conan profile)
-# and leads to confusing breakage, so fail early with guidance.
-if(is_nix_compiler AND NOT is_ci_image AND NOT DEFINED ENV{XRPL_DEVSHELL})
-    message(
-        FATAL_ERROR
-        "A Nix compiler (${CMAKE_CXX_COMPILER}) is being used outside the xrpld "
-        "dev shell. Enter it with `nix develop` (see docs/build/nix.md) before "
-        "configuring the build."
-    )
-endif()
-
 # check for in-source build and fail
 if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
     message(

cmake/XrplSettings.cmake

@@ -30,8 +30,6 @@ if(tests)
     endif()
 endif()
 
-option(benchmark "Build benchmarks" ON)
-
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are

cmake/XrplValidatorKeys.cmake

@@ -5,39 +5,22 @@ option(
 )
 
 if(validator_keys)
-    # Own the install destination below rather than relying on another module
-    # having pulled this in first.
-    include(GNUInstallDirs)
-
-    # Pinned to an exact commit, not a branch: the tool ships inside our
-    # packages, so the same xrpld version must always package the same
-    # validator-keys. Bump this deliberately.
-    set(validator_keys_commit "4c0fb75eec9601c711645998c904507e87e910ae")
-    message(STATUS "Using ValidatorKeys commit: ${validator_keys_commit}")
+    git_branch(current_branch)
+    # default to tracking VK master branch unless we are on release
+    if(NOT (current_branch STREQUAL "release"))
+        set(current_branch "master")
+    endif()
+    message(STATUS "Tracking ValidatorKeys branch: ${current_branch}")
 
     FetchContent_Declare(
         validator_keys
         GIT_REPOSITORY https://github.com/ripple/validator-keys-tool.git
-        GIT_TAG "${validator_keys_commit}"
+        GIT_TAG "${current_branch}"
     )
     FetchContent_MakeAvailable(validator_keys)
-    # The tool's own CMakeLists excludes the target from 'all' when it is built
-    # as a subproject. Undo that, so validator_keys=ON really does build it.
     set_target_properties(
         validator-keys
-        PROPERTIES
-            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-            EXCLUDE_FROM_ALL OFF
-            EXCLUDE_FROM_DEFAULT_BUILD OFF
-    )
-    # We ship this binary, so like xrpld it must not keep the Nix store's ELF
-    # loader, or it cannot run on the target distro at all.
-    patch_nix_binary(validator-keys)
-
-    configure_file(
-        "${validator_keys_SOURCE_DIR}/LICENSE"
-        "${CMAKE_BINARY_DIR}/validator-keys-LICENSE"
-        COPYONLY
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
     )
     install(TARGETS validator-keys RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()

cmake/codegen/CMakeLists.txt

@@ -1,21 +0,0 @@
-#[===================================================================[
-   Protocol Autogen - Standalone project
-
-   Exposes the 'setup_code_gen' and 'code_gen' targets on their own, without
-   configuring the rest of xrpl. Code generation is pure Python, so this needs
-   neither the dependencies nor a compiler, which makes it usable in CI and by
-   contributors who only want to regenerate the protocol wrapper classes:
-
-     cmake -S cmake/codegen -B build/codegen
-     cmake --build build/codegen --target setup_code_gen
-     cmake --build build/codegen --target code_gen
-
-   The targets are identical to the ones offered by the top-level build, since
-   both come from cmake/XrplProtocolAutogen.cmake.
-#]===================================================================]
-
-cmake_minimum_required(VERSION 3.16)
-
-project(xrpl_codegen LANGUAGES NONE)
-
-include("${CMAKE_CURRENT_LIST_DIR}/../XrplProtocolAutogen.cmake")

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,7 +8,6 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
-import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -54,89 +53,28 @@ def create_transaction_parser():
     return macro_parser
 
 
-# Defaults for xrpl::TxSettings members, mirroring
-# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
-# the members that differ from these.
-SETTING_DEFAULTS = {
-    "delegable": "Delegation::NotDelegable",
-    "amendment": "uint256{}",
-    "privileges": "Privilege::NoPriv",
-}
-
-
-def parse_settings(settings_str):
-    """Parse a TxSettings blob into a dict, filling in defaults.
-
-    Args:
-        settings_str: A string like '({.delegable = Delegation::NotDelegable,
-                      .privileges = Privilege::CreateAcct})', or '({})'.
-
-    Returns:
-        A dict with a value for every key in SETTING_DEFAULTS.
-    """
-    body = settings_str.strip()
-    if not (body.startswith("(") and body.endswith(")")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1].strip()
-    if not (body.startswith("{") and body.endswith("}")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1]
-
-    # Strip comments, which may be interleaved with the designated initializers.
-    body = re.sub(r"//[^\n]*", "", body)
-
-    settings = dict(SETTING_DEFAULTS)
-    seen = set()
-    # Each entry runs from '.key =' up to the next '.key =' or the end.
-    for key, value in re.findall(
-        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
-    ):
-        if key not in SETTING_DEFAULTS:
-            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
-        settings[key] = " ".join(value.split()).rstrip(",")
-        seen.add(key)
-
-    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
-    # Every '.member' in the blob must have been consumed above.
-    if len(re.findall(r"\.\w+", body)) != len(seen):
-        raise ValueError(f"Could not parse every setting in {settings_str!r}")
-
-    # A blob with content but no designated initializer is positional, which
-    # would otherwise be read as "all defaults" and silently generate the
-    # wrong output.
-    if body.strip() and not seen:
-        raise ValueError(
-            "TxSettings requires designated initializers (.member = value), "
-            f"got {settings_str!r}"
-        )
-
-    return settings
-
-
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment',
-                    '({.privileges = Privilege::CreateAcct})', '({...})']
+                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
+                    'uint256{}', 'createAcct', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 5:
+    if len(args_list) < 7:
         raise ValueError(
-            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    settings = parse_settings(args_list[3])
+    delegable = args_list[3]
+    amendments = args_list[4]
+    privileges = args_list[5]
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -146,9 +84,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": settings["delegable"],
-        "amendments": settings["amendment"],
-        "privileges": settings["privileges"],
+        "delegable": delegable,
+        "amendments": amendments,
+        "privileges": privileges,
         "fields": fields,
     }
 

conan.lock

@@ -10,25 +10,22 @@
         "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
         "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
+        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
         "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/1.0.2#b313cef0c1a493eb970ad185b2e9bab7%1784285108.866483",
+        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
         "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
-        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1782494504.298",
+        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
-        "corrosion/0.6.1#bfa292df0a957bc70a450ff316cd9435%1786119416.131296",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
-        "benchmark/1.9.5#b885dc73ad67b40a55d45684d1c88ad1%1782736613.864841",
-        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
@@ -36,12 +33,12 @@
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
+        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#9ef01c1451a8340f9022e46238c0fbb6%1783945159.651047"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
     ],
     "python_requires": [],
     "overrides": {

conan/init.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
-# Safe to re-run; never deletes the Conan home.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-CONAN_DIR="$(conan config home)"
-
-echo "Installing Conan configuration into ${CONAN_DIR}"
-conan config install "${SCRIPT_DIR}/global.conf"
-conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
-# This script manages these files, so make them read-only - Conan does not
-# preserve the source mode. Only the files: the directories must stay writable
-# for `conan config install` to replace them.
-chmod a-w "${CONAN_DIR}/global.conf"
-find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
-
-echo "Adding the xrplf Conan remote"
-# --index 0: our patched recipes must win over Conan Center.
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/

conan/profiles/default

@@ -1,13 +1,9 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
+{% set compiler_version = version %}
+{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
-{% if os == "Macos" %}
-{# Minimum macOS the dependencies target. #}
-{# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
-{# dependency objects target a newer macOS than the binary and the linker warns. #}
-{# Keep at or below CMAKE_OSX_DEPLOYMENT_TARGET in CMakeLists.txt. #}
-{% set min_macos_version = "15.0" %}
 {% endif %}
 
 [settings]
@@ -22,39 +18,10 @@ compiler.runtime=static
 {% else %}
 compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
-{% if os == "Macos" %}
-os.version={{ min_macos_version }}
-{% endif %}
 
 [conf]
-{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
-{# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
-{# so on a host that also has a system `g++-15` the probe escapes Nix #}
-{# and picks the system compiler, which is mismatched with the Nix libraries #}
-{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
-{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
-{# resolve the same compiler. #}
-{# Not part of the package ID, so binaries stay shareable. #}
-{% if os != "Windows" %}
-{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
-{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
-tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
-{% endif %}
-
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
-
-{% if os == "Macos" %}
-[buildenv]
-{# os.version adds -mmacosx-version-min to compiler command lines, #}
-{# but Boost.Context's b2 assembly (.S) rule ignores it, #}
-{# so those objects keep the host SDK version and still warn at link time. #}
-{# clang's assembler honors this env var regardless, pinning them. #}
-{# Scoped to boost/* since it is the only gap. #}
-boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
-{% endif %}

conanfile.py

@@ -15,7 +15,6 @@ class Xrpl(ConanFile):
     settings = "os", "compiler", "build_type", "arch"
     options = {
         "assertions": [True, False],
-        "benchmark": [True, False],
         "coverage": [True, False],
         "fPIC": [True, False],
         "jemalloc": [True, False],
@@ -28,9 +27,7 @@ class Xrpl(ConanFile):
     }
 
     requires = [
-        "corrosion/0.6.1",
         "ed25519/2015.03",
-        "fast_float/8.2.10",
         "grpc/1.81.1",
         "libarchive/3.8.7",
         "nudb/2.0.9",
@@ -49,7 +46,6 @@ class Xrpl(ConanFile):
 
     default_options = {
         "assertions": False,
-        "benchmark": True,
         "coverage": False,
         "fPIC": True,
         "jemalloc": False,
@@ -133,14 +129,12 @@ class Xrpl(ConanFile):
             self.options["boost"].without_cobalt = True
 
     def requirements(self):
-        if self.options.benchmark:
-            self.requires("benchmark/1.9.5")
         self.requires("boost/1.91.0", force=True, transitive_headers=True)
         self.requires("date/3.0.4", transitive_headers=True)
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
         self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/1.0.2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
         self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")
@@ -152,12 +146,8 @@ class Xrpl(ConanFile):
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
-        "crates/*",
-        "crates/.cargo/*",
-        "!crates/target/*",
         "external/*",
         "include/*",
-        "rust-toolchain.toml",
         "src/*",
     )
 
@@ -172,7 +162,6 @@ class Xrpl(ConanFile):
     def generate(self):
         tc = CMakeToolchain(self)
         tc.variables["tests"] = self.options.tests
-        tc.variables["benchmark"] = self.options.benchmark
         tc.variables["assert"] = self.options.assertions
         tc.variables["coverage"] = self.options.coverage
         tc.variables["jemalloc"] = self.options.jemalloc
@@ -217,7 +206,6 @@ class Xrpl(ConanFile):
             "boost::thread",
             "date::date",
             "ed25519::ed25519",
-            "fast_float::fast_float",
             "grpc::grpc++",
             "libarchive::libarchive",
             "lz4::lz4",

crates/.cargo/config.toml

@@ -1,17 +0,0 @@
-# The Rust static libraries are linked into C++ targets, so the runtime linkage
-# here has to match what the C++ build uses (see cmake/XrplCompiler.cmake).
-#
-# macOS needs nothing: AppleClang cannot link libgcc/libc++ statically, so the
-# C++ build skips those flags on Apple as well.
-
-# Both amd64 and arm64 Linux builds link libgcc statically. This only affects
-# links that rustc itself drives (`cargo test` binaries and the like) — the
-# `staticlib` crates consumed by CMake are archived, not linked, so rustc
-# silently ignores link args for them. Keeping libgcc_s.so.1 off the xrpld link
-# line is handled in crates/CMakeLists.txt instead.
-[target.'cfg(target_os = "linux")']
-rustflags = ["-C", "link-args=-static-libgcc"]
-
-# Windows builds use the static MSVC runtime.
-[target.'cfg(windows)']
-rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -1,111 +0,0 @@
-find_package(Corrosion REQUIRED)
-
-corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
-
-# The generated C++ lands in the build tree, so put a .clang-tidy next to it to
-# keep clang-tidy from analyzing code we don't own.
-configure_file(
-    generated.clang-tidy
-    "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
-    COPYONLY
-)
-
-add_custom_target(xrpl_crates)
-add_dependencies(tidy_prerequisites xrpl_crates)
-
-# On macOS, ld warns `ignoring duplicate libraries` when linking a crate.
-# Corrosion is the source of both duplicates it names:
-#
-# * The crate archive and its cxxbridge archive, because
-#   `corrosion_add_cxxbridge` makes the two depend on each other, and CMake
-#   repeats a static library cycle on the link line so single-pass linkers can
-#   resolve it. (LINK_INTERFACE_MULTIPLICITY can only raise that count.)
-# * `-lSystem`, which Corrosion copies from rustc's `native-static-libs` even
-#   though the compiler driver always links libSystem.
-#
-# ld needs neither: it resolves the cycle from one copy of each archive and
-# links libSystem once. So silence the warning rather than rewrite Corrosion's
-# link interface, which the cycle is also part of. The option itself is old —
-# Xcode 15 is only where the warning became the default — and the check below
-# leaves it out on a linker that does not know it.
-if(is_macos)
-    include(CheckLinkerFlag)
-    check_linker_flag(
-        CXX
-        -Wl,-no_warn_duplicate_libraries
-        have_no_warn_duplicate_libraries
-    )
-endif()
-
-function(_unlink_libgcc_s crate)
-    if(NOT (is_linux AND static))
-        return()
-    endif()
-
-    # Corrosion exposes a crate's staticlib as an imported `<crate>-static`
-    # target and puts the native libs in its INTERFACE_LINK_LIBRARIES. If either
-    # of those changes, warn instead of silently letting libgcc_s.so.1 return.
-    set(imported "${crate}-static")
-    if(NOT TARGET ${imported})
-        message(
-            FATAL_ERROR
-            "Corrosion did not create the imported target '${imported}', so "
-            "libgcc_s cannot be removed from the link interface of '${crate}'. "
-            "xrpld will link libgcc_s.so.1 dynamically. Check where Corrosion "
-            "${CORROSION_VERSION} now records `native-static-libs`."
-        )
-        return()
-    endif()
-
-    get_target_property(libs ${imported} INTERFACE_LINK_LIBRARIES)
-    if(NOT "gcc_s" IN_LIST libs)
-        message(
-            WARNING
-            "'gcc_s' was not in the link interface of '${imported}' as "
-            "expected. If the Rust toolchain stopped reporting it this "
-            "workaround is obsolete and can be deleted; otherwise xrpld may "
-            "link libgcc_s.so.1 dynamically. Verify with: "
-            "objdump -p xrpld | grep NEEDED"
-        )
-        return()
-    endif()
-
-    list(REMOVE_ITEM libs gcc_s)
-    set_property(TARGET ${imported} PROPERTY INTERFACE_LINK_LIBRARIES ${libs})
-endfunction()
-
-function(add_xrpl_crate name)
-    cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
-    _unlink_libgcc_s(${ARG_CRATE})
-    # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
-    # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
-    if(is_msvc)
-        corrosion_set_env_vars(
-            ${ARG_CRATE}
-            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
-        )
-    endif()
-    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
-                            ${ARG_FILES}
-    )
-    # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
-    # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
-    # existence check — build-time ordering is enforced by the custom commands.
-    set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
-    if(have_no_warn_duplicate_libraries)
-        target_link_options(
-            ${name}_cxxbridge
-            INTERFACE -Wl,-no_warn_duplicate_libraries
-        )
-    endif()
-    add_dependencies(xrpl_crates ${name}_cxxbridge)
-endfunction()
-
-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)

crates/Cargo.lock

@@ -1,498 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
-[[package]]
-name = "cc"
-version = "1.2.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "codespan-reporting"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
-dependencies = [
- "serde",
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "cxx"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
-dependencies = [
- "cc",
- "cxx-build",
- "cxxbridge-cmd",
- "cxxbridge-flags",
- "cxxbridge-macro",
- "foldhash 0.2.0",
- "link-cplusplus",
-]
-
-[[package]]
-name = "cxx-build"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
-dependencies = [
- "cc",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "scratch",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-cmd"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
-dependencies = [
- "clap",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-flags"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
-
-[[package]]
-name = "cxxbridge-macro"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
-dependencies = [
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown 0.17.0",
-]
-
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
-[[package]]
-name = "link-cplusplus"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f78c730aaa7d0b9336a299029ea49f9ee53b0ed06e9202e8cb7db9bae7b8c82"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "scratch"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
-
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78693fcdd618e0fc34af59c6b8efa9ac5d58c68df940beff4bedddb6acfe7c27"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.228.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a8be2aa467cf2d29e96ff759472c36eeb44a3c81c67fc9cb76c9a24c519c557"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69372d5fda3ea3d1e0aa6603c7888110e0187e88ea17cd8fc2e2df0a0e1f37fa"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f17b774caa13c618c7244f1ee51fe23c5e7b8538a471fa46d9949779758aed6"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.228.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]

crates/Cargo.toml

@@ -1,21 +0,0 @@
-[workspace]
-members = [
-    "xrpl-wasm-vm-ffi",
-    "xrpl-wasm-vm",
-    "xrpl-wasm-testkit",
-    "xrpl-host-functions",
-    "xrpl-host-functions-macros",
-]
-resolver = "3"
-
-[workspace.dependencies]
-cxx = { version = "1.0.199", features = ["c++20"] }
-
-[workspace.package]
-edition = "2024"
-
-[profile.release]
-opt-level = 3
-overflow-checks = true
-lto = true
-debug = true

crates/generated.clang-tidy

@@ -1,10 +0,0 @@
----
-# Neutralizes clang-tidy for the corrosion/cxxbridge-generated C++. Copied into
-# the crates build directory by crates/CMakeLists.txt, next to the generated
-# sources, so clang-tidy picks it up instead of the top-level configuration.
-#
-# One check is kept enabled to avoid clang-tidy's "no checks enabled" error.
-Checks: "-*,google-readability-todo"
-WarningsAsErrors: ""
-HeaderFilterRegex: ""
-InheritParentConfig: false

crates/xrpl-host-functions-macros/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The doctest declares host functions returning `HostResult`, which the facade
-# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
-# the library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"

crates/xrpl-host-functions-macros/src/errors.rs

@@ -1,33 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}
-
-/// `value`, or the folded diagnostics if any were recorded.
-pub(crate) fn into_result<T>(value: T, errors: Vec<syn::Error>) -> syn::Result<T> {
-    match combine(errors) {
-        Some(error) => Err(error),
-        None => Ok(value),
-    }
-}
-
-/// `result`'s value, or `None` with its error filed in `errors` — so a check that
-/// yields a value can be reported like one that yields nothing, and the caller
-/// keeps going.
-pub(crate) fn record<T>(result: syn::Result<T>, errors: &mut Vec<syn::Error>) -> Option<T> {
-    match result {
-        Ok(value) => Some(value),
-        Err(error) => {
-            errors.push(error);
-            None
-        }
-    }
-}

crates/xrpl-host-functions-macros/src/glue.rs

@@ -1,471 +0,0 @@
-//! The wasmi registration, generated from the declarations the ABI table is
-//! generated from — so the closure a guest links against cannot disagree with the
-//! signature preflight screens it by.
-//!
-//! Emitted as a `macro_rules!` rather than as the registration itself, because the
-//! crate the expansion lands in is `no_std`, zero-dependency and links into the
-//! guest, and a `macro_rules!` body is inert tokens until someone expands it.
-//!
-//! The body therefore resolves in two crates at once and names nothing free:
-//! `$crate` is the ABI crate, `$env` the module the caller passes in, and every
-//! other path starts at `::wasmi` or `::core`. `$env` is matched as an `ident`
-//! because `$env:path` used as `$env::Foo` is `error: missing angle brackets in
-//! associated item path`.
-//!
-//! The one file that knows an engine's calling convention: how a region arrives as
-//! two wasm parameters, where the gas charge goes, and which helper a result-less
-//! function takes. A second engine would be a second file like it.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, quote};
-
-use crate::lowering::{ResultType, WasmValType};
-use crate::parsed_host_function::{Param, ParsedHostFunction};
-
-/// The `wasmi_glue!` macro: the trait a VM implements one body per host function
-/// in, and the registration that hands each of them to a `Linker`.
-pub(crate) fn wasmi_glue(functions: &[ParsedHostFunction]) -> TokenStream {
-    let bodies = functions.iter().map(body_declaration);
-    let registrations = functions.iter().map(registration);
-    let assertions = charging_assertions();
-    let env = env();
-
-    quote! {
-        /// Expands to the wasmi glue for this ABI: the `HostFunctionBodies` trait
-        /// and `register_host_functions`, at the scope it is called in. A
-        /// declaration added to the ABI is then a missing trait item rather than a
-        /// forgotten registration.
-        ///
-        /// `$env` names a module holding everything the expansion reaches for on
-        /// the engine's side, since this crate can name none of it: the store type
-        /// `VmState`, the charging helpers `charged` and `charged_unreported` with
-        /// their `CallResult`, and the argument types `InBytes`, `InStr`, `InU32`,
-        /// `OutBytes` and `TraceCode`.
-        ///
-        /// ```ignore
-        /// mod glue_env {
-        ///     pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-        ///     pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-        ///     pub(crate) use crate::vm::VmState;
-        /// }
-        ///
-        /// xrpl_host_functions::wasmi_glue!(glue_env);
-        /// ```
-        ///
-        /// The module supplies the spellings; the shapes are pinned by the
-        /// expansion. Each argument type implements [`FromWasmRegion`] or
-        /// [`FromWasmScalar`] — which one is the ABI's decision, so a declared
-        /// `u32` is a region — and each charging helper's signature is asserted
-        /// against a `const _`.
-        #[cfg(feature = "wasmi_glue")]
-        #[macro_export]
-        macro_rules! wasmi_glue {
-            ($env:ident) => {
-                /// One body per host function: what the engine runs once the call's
-                /// gas is charged and its arguments are off the wire.
-                ///
-                /// The methods take no receiver, so a registered closure captures
-                /// nothing — which is what satisfies wasmi's
-                /// `Fn + Send + Sync + 'static` bound, and why the implementor
-                /// itself need not be `'static`. A body does not charge gas; the
-                /// generated closure does, so it cannot be forgotten or charged
-                /// twice.
-                pub(crate) trait HostFunctionBodies {
-                    #(#bodies)*
-                }
-
-                /// Register every host function on `linker`, one `func_wrap` per
-                /// declaration, at the ABI's derived wasm signature — so an import
-                /// that passes [`crate::check`] links here by construction.
-                pub(crate) fn register_host_functions<B: HostFunctionBodies>(
-                    linker: &mut ::wasmi::Linker<#env::VmState<'_>>,
-                ) -> ::core::result::Result<(), ::wasmi::errors::LinkerError> {
-                    #(#registrations)*
-                    Ok(())
-                }
-
-                #assertions
-            };
-        }
-    }
-}
-
-/// The macro argument every engine-side path is qualified by.
-fn env() -> TokenStream {
-    quote!($env)
-}
-
-/// The signature of each charging helper, pinned as a `const _` the expansion
-/// carries: the one part of the contract neither `$env` nor the argument traits
-/// state.
-///
-/// Its value is the diagnostic. A changed helper is already a type error at the
-/// call, but there it is failed inference inside a generated closure and here it
-/// is one line stating the signature that was expected.
-fn charging_assertions() -> TokenStream {
-    let env = env();
-    let assertion = |helper: TokenStream, answer: TokenStream| {
-        quote! {
-            const _: fn(
-                &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-                $crate::HostFunctionSpec,
-                fn(&mut ::wasmi::Caller<'_, #env::VmState<'_>>) -> #env::CallResult<#answer>,
-            ) -> ::core::result::Result<#answer, ::wasmi::Error> = #env::#helper;
-        }
-    };
-
-    let reported = assertion(quote!(charged), quote!(i32));
-    let unreported = assertion(quote!(charged_unreported), quote!(()));
-
-    quote! {
-        #reported
-        #unreported
-    }
-}
-
-/// `fn check_keylet(caller: &mut Caller<'_, $env::VmState<'_>>, account:
-/// $env::InBytes, seq: $env::InU32, out: $env::OutBytes) ->
-/// $env::CallResult<i32>;`
-fn body_declaration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let name = &function.signature.ident;
-    let params = function.params().iter().map(|param| {
-        let name = &param.name;
-        let ty = param.ty.argument_type(&env);
-        quote! { #name: #ty }
-    });
-    let answer = answer_type(function.result());
-
-    quote! {
-        fn #name(
-            caller: &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-            #(#params),*
-        ) -> #answer;
-    }
-}
-
-/// One `linker.func_wrap(…)?;`: the wasm signature as the closure's parameters,
-/// the gas charge around the call, and the body between them.
-fn registration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let body = &function.signature.ident;
-    let spec = spec_path(function);
-    let params = function.params().iter().flat_map(closure_params);
-    let arguments = function.params().iter().map(lift);
-    let (answer, charge) = match function.result() {
-        ResultType::BufferLength | ResultType::Value => (quote!(i32), quote!(#env::charged)),
-        ResultType::Nothing => (quote!(()), quote!(#env::charged_unreported)),
-    };
-
-    quote! {
-        linker.func_wrap(
-            $crate::HOST_MODULE,
-            #spec.wasm_name(),
-            |mut caller: ::wasmi::Caller<'_, #env::VmState<'_>>, #(#params),*|
-             -> ::core::result::Result<#answer, ::wasmi::Error> {
-                #charge(&mut caller, #spec, |caller| {
-                    B::#body(caller, #(#arguments),*)
-                })
-            },
-        )?;
-    }
-}
-
-/// `$crate::HostFunctionSpec::CheckKeylet` — the one name the expansion reaches
-/// back into the ABI crate for.
-fn spec_path(function: &ParsedHostFunction) -> TokenStream {
-    let variant = &function.variant;
-    quote! { $crate::HostFunctionSpec::#variant }
-}
-
-/// One declared parameter as the closure declares it: `account_ptr: i32,
-/// account_len: i32`, or `field: i32`.
-///
-/// Names and types both come from the lowering, so the arity a closure is
-/// registered at *is* the derived arity.
-fn closure_params(param: &Param) -> Vec<TokenStream> {
-    param
-        .ty
-        .wasm_names(&param.name)
-        .into_iter()
-        .zip(param.ty.as_wasm_params())
-        .map(|(name, val_type)| {
-            let ty = rust_type(*val_type);
-            quote! { #name: #ty }
-        })
-        .collect()
-}
-
-/// The argument a body is handed, built from the wasm parameters it arrived as:
-/// `<$env::InBytes as $crate::FromWasmRegion>::from_wasm(account_ptr,
-/// account_len)`, or the scalar itself.
-///
-/// Qualified rather than an inherent call, so the arity comes from the trait the
-/// lowering chose: an argument type implementing the other one is an unsatisfied
-/// bound named at the type, where `Ty::from_wasm(a, b)` would be an unrelated
-/// arity error named here.
-fn lift(param: &Param) -> TokenStream {
-    let Some(argument_trait) = param.ty.argument_trait() else {
-        return param.name.to_token_stream();
-    };
-    let ty = param.ty.argument_type(&env());
-    let names = param.ty.wasm_names(&param.name);
-
-    quote! { <#ty as $crate::#argument_trait>::from_wasm(#(#names),*) }
-}
-
-/// What a body answers: the value the guest is told, or nothing at all for the
-/// function whose whole effect is on the host.
-fn answer_type(result: ResultType) -> TokenStream {
-    let env = env();
-    match result {
-        ResultType::BufferLength | ResultType::Value => quote!(#env::CallResult<i32>),
-        ResultType::Nothing => quote!(#env::CallResult<()>),
-    }
-}
-
-/// A wasm value type as a closure parameter spells it — a Rust type, not
-/// [`WasmValType`]'s own `ToTokens`, which spells the ABI crate's variant.
-fn rust_type(val_type: WasmValType) -> TokenStream {
-    match val_type {
-        WasmValType::I32 => quote!(i32),
-        WasmValType::I64 => quote!(i64),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use proc_macro2::{Delimiter, Group, TokenTree};
-    use syn::parse_quote;
-
-    fn parsed(function: syn::TraitItemFn) -> ParsedHostFunction {
-        ParsedHostFunction::parse(function).expect("the declaration should parse")
-    }
-
-    /// The declaration whose declared and wasm parameter lists differ most:
-    /// `account`, `out` and `seq` are a `(ptr, len)` pair each, so three arguments
-    /// to the body and six on the wire.
-    #[test]
-    fn lowers_a_declaration_to_a_body_and_a_registration() {
-        let keylet = parsed(parse_quote! {
-            #[gas = 350]
-            #[wasm_name = "check_id"]
-            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&keylet).to_string(),
-            "fn check_keylet (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account : $ env :: InBytes , seq : $ env :: InU32 , out : $ env :: OutBytes) \
-             -> $ env :: CallResult < i32 > ;"
-        );
-
-        assert_eq!(
-            registration(&keylet).to_string(),
-            "linker . func_wrap ($ crate :: HOST_MODULE , \
-             $ crate :: HostFunctionSpec :: CheckKeylet . wasm_name () , \
-             | mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account_ptr : i32 , account_len : i32 , seq_ptr : i32 , seq_len : i32 , \
-             out_ptr : i32 , out_len : i32 | \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > \
-             { $ env :: charged (& mut caller , \
-             $ crate :: HostFunctionSpec :: CheckKeylet , | caller | \
-             { B :: check_keylet (caller , \
-             < $ env :: InBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (account_ptr , account_len) , \
-             < $ env :: InU32 as $ crate :: FromWasmRegion > :: from_wasm (seq_ptr , seq_len) , \
-             < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (out_ptr , out_len)) }) } ,) ? ;"
-        );
-    }
-
-    /// A wasm scalar is passed through as itself, in declaration order: no pair,
-    /// no argument type, and an `i64` that stays one.
-    #[test]
-    fn passes_the_wasm_scalars_through_untouched() {
-        let from_int = parsed(parse_quote! {
-            #[gas = 100]
-            #[wasm_name = "float_from_int"]
-            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&from_int).to_string(),
-            "fn float_from_int (caller : & mut :: wasmi :: Caller < '_ , \
-             $ env :: VmState < '_ >> , \
-             x : i64 , out : $ env :: OutBytes , mode : i32) -> $ env :: CallResult < i32 > ;"
-        );
-
-        let registration = registration(&from_int).to_string();
-        assert!(
-            registration.contains(
-                "| mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-                 x : i64 , out_ptr : i32 , out_len : i32 , mode : i32 |"
-            ),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: float_from_int (caller , x , \
-                 < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (out_ptr , out_len) , mode)"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The function that answers nothing takes the other charging helper, derived
-    /// from its declared `HostResult<()>` rather than named as a special case.
-    /// Its `TraceCode` is also the only place `FromWasmScalar` is reached for.
-    #[test]
-    fn a_declaration_that_answers_nothing_takes_the_other_charge() {
-        let trace = parsed(trace_declaration());
-
-        assert_eq!(
-            body_declaration(&trace).to_string(),
-            "fn trace (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             msg : $ env :: InStr , data_type : $ env :: TraceCode , data : $ env :: InBytes) \
-             -> $ env :: CallResult < () > ;"
-        );
-
-        let registration = registration(&trace).to_string();
-        assert!(
-            registration.contains(":: core :: result :: Result < () , :: wasmi :: Error >"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains("$ env :: charged_unreported (& mut caller"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: trace (caller , \
-                 < $ env :: InStr as $ crate :: FromWasmRegion > :: from_wasm (msg_ptr , msg_len) , \
-                 < $ env :: TraceCode as $ crate :: FromWasmScalar > :: from_wasm (data_type) , \
-                 < $ env :: InBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (data_ptr , data_len))"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The two worlds the macro body resolves in: the ABI crate through `$crate`,
-    /// and one engine by name. `names_no_crate_of_its_own` holds the ABI half of
-    /// the expansion to naming neither.
-    #[test]
-    fn reaches_the_abi_crate_through_dollar_crate_and_the_engine_by_name() {
-        let glue = code(wasmi_glue(&[parsed(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        })]));
-
-        assert!(
-            glue.contains("$ crate :: HostFunctionSpec :: GetLedgerSqn"),
-            "{glue}"
-        );
-        assert!(glue.contains("$ crate :: HOST_MODULE"), "{glue}");
-        assert!(glue.contains(":: wasmi :: Linker"), "{glue}");
-        assert!(!glue.contains("xrpl_host_functions"), "{glue}");
-    }
-
-    /// Every engine-side item is reached through the module the macro is handed: a
-    /// bare name would resolve against whatever the call site has in scope.
-    ///
-    /// `charged` covers `charged_unreported`, being its prefix.
-    #[test]
-    fn names_the_engine_s_own_items_only_through_the_module_it_is_handed() {
-        let glue = code(wasmi_glue(&[
-            parsed(trace_declaration()),
-            parsed(parse_quote! {
-                #[gas = 350]
-                #[wasm_name = "check_id"]
-                fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8])
-                    -> HostResult<usize>;
-            }),
-        ]));
-
-        for item in [
-            "VmState",
-            "CallResult",
-            "charged",
-            "InBytes",
-            "InStr",
-            "InU32",
-            "OutBytes",
-            "TraceCode",
-        ] {
-            for (index, _) in glue.match_indices(item) {
-                assert!(
-                    glue[..index].ends_with("$ env :: "),
-                    "`{item}` named outside `$env`: {glue}"
-                );
-            }
-        }
-    }
-
-    /// The charging helpers' signatures, which nothing else in the contract
-    /// states.
-    #[test]
-    fn pins_both_charging_helpers_signatures() {
-        assert_eq!(
-            charging_assertions().to_string(),
-            "const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < i32 > ,) \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > = $ env :: charged ; \
-             const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < () > ,) \
-             -> :: core :: result :: Result < () , :: wasmi :: Error > \
-             = $ env :: charged_unreported ;"
-        );
-    }
-
-    fn trace_declaration() -> syn::TraitItemFn {
-        parse_quote! {
-            #[gas = 30]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-        }
-    }
-
-    /// The expansion's code alone. `to_string` renders a doc comment as a
-    /// `#[doc = "…"]` literal, and the macro's own documentation names the very
-    /// items the scans above look for.
-    fn code(tokens: TokenStream) -> String {
-        fn is_doc(tree: Option<&TokenTree>) -> bool {
-            let Some(TokenTree::Group(group)) = tree else {
-                return false;
-            };
-            group.delimiter() == Delimiter::Bracket
-                && matches!(group.stream().into_iter().next(),
-                            Some(TokenTree::Ident(ident)) if ident == "doc")
-        }
-
-        fn strip(tokens: TokenStream) -> TokenStream {
-            let mut trees = tokens.into_iter().peekable();
-            let mut kept = Vec::new();
-            while let Some(tree) = trees.next() {
-                match tree {
-                    TokenTree::Punct(ref punct)
-                        if punct.as_char() == '#' && is_doc(trees.peek()) =>
-                    {
-                        trees.next();
-                    }
-                    TokenTree::Group(group) => kept.push(TokenTree::Group(Group::new(
-                        group.delimiter(),
-                        strip(group.stream()),
-                    ))),
-                    other => kept.push(other),
-                }
-            }
-            kept.into_iter().collect()
-        }
-
-        strip(tokens).to_string()
-    }
-}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,493 +0,0 @@
-mod errors;
-mod glue;
-mod lowering;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the declarations refer to and holds the one declaration
-/// block.
-///
-/// # What it generates
-///
-/// Four items, in the scope the block is written in:
-///
-/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
-///   receiver, parameters, return type and doc comment exactly as written. An
-///   execution environment implements it; the rest of the expansion does not
-///   mention it.
-/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
-///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
-///   carrying that declaration's doc comment. Its `const fn wasm_name`, `gas`,
-///   `wasm_params` and `wasm_result` are the ABI metadata, and `ALL` is every
-///   variant in declaration order — what a wasm engine iterates to build its
-///   import table.
-/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
-///   so those accessors read from a single `match` over the declarations, and
-///   never appears in a signature a caller can name.
-/// - `macro_rules! wasmi_glue`: the registration for a wasmi engine, emitted as a
-///   macro rather than as code because it names an engine this crate must not
-///   depend on. Inert until expanded — see its own documentation.
-///
-/// The wasm signature is derived from the declared types rather than stated a
-/// second time: `i32` and `i64` are the wasm scalars spelled as themselves, every
-/// other parameter type is marshalled through a `(ptr, len)` pair or an `i32`
-/// code, and the result comes from the `HostResult<T>` success type. The glue is
-/// generated from that same derivation, so the closure a guest links against and
-/// the signature it is screened by are one statement.
-///
-/// Outside the glue's body the expansion builds only `Self::Variant` and
-/// `WasmValType` paths, so the block compiles wherever the types it names —
-/// `HostResult` and `WasmValType` — resolve.
-///
-/// ```
-/// use xrpl_host_functions::{HostResult, WasmValType};
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // The trait's methods are the declarations, down to the `&self` receiver the
-/// // VM calls the host through.
-/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
-///     host.get_ledger_sqn(out)
-/// }
-///
-/// // The metadata is a `const` table, so gas and import names are available at
-/// // compile time rather than looked up at run time.
-/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
-/// assert_eq!(TRACE_GAS, 500);
-///
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
-/// assert_eq!(
-///     HostFunctionSpec::ALL,
-///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
-/// );
-///
-/// // So is the wasm signature: `out: &mut [u8]` is the pair `(ptr, len)`, and
-/// // `HostResult<usize>` answers the length written to it.
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32],
-/// );
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_result(),
-///     Some(WasmValType::I32),
-/// );
-///
-/// // `trace_num` answers nothing at all, so its import has no result.
-/// assert_eq!(
-///     HostFunctionSpec::TraceNum.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32, WasmValType::I64],
-/// );
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_result(), None);
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self`, with no body and no
-/// generics: it maps to exactly one wasm import signature. Its parameters must be
-/// `i32`, `i64`, `u32`, `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`, and it
-/// must return `HostResult<usize>` if it writes an output region,
-/// `HostResult<i32>` if it answers a value directly, or `HostResult<()>` if it
-/// answers nothing. Two declarations may not share a `wasm_name`, nor collapse to
-/// the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let functions = parse_block(input)?;
-    let abi = abi_items(&functions);
-    let glue = glue::wasmi_glue(&functions);
-
-    Ok(quote! {
-        #abi
-        #glue
-    })
-}
-
-/// Every declaration in the block, parsed and checked against each other, or
-/// every mistake in it.
-fn parse_block(input: TokenStream) -> syn::Result<Vec<ParsedHostFunction>> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(parsed)
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-/// The ABI itself: the trait a host implements and the table everything else
-/// reads. `glue::wasmi_glue` is the other half of the expansion.
-fn abi_items(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec`]'s accessors
-        /// read from.
-        ///
-        /// Private, and the only reason it exists is to keep all of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-            wasm_params: &'static [WasmValType],
-            wasm_result: Option<WasmValType>,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-
-            /// The wasm parameters this function is imported with, in wire
-            /// order — the list a guest's import must match, which the
-            /// declaration's own parameter list is not: a declared parameter
-            /// marshalled through a `(ptr, len)` region is two of these.
-            ///
-            /// Usable in `const` context, so import lists can be built at
-            /// compile time.
-            pub const fn wasm_params(self) -> &'static [WasmValType] {
-                self.spec().wasm_params
-            }
-
-            /// The wasm result this function answers with, or `None` for the
-            /// one whose whole effect is on the host. An `i32` where there is
-            /// one, whether the host answered a value or the length of what it
-            /// wrote — the wire does not distinguish those.
-            pub const fn wasm_result(self) -> Option<WasmValType> {
-                self.spec().wasm_result
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    /// The ABI half of the expansion alone: the glue's body is written against
-    /// another crate entirely, so the tests below about what the expansion may
-    /// name are not about it.
-    fn abi_expansion(input: TokenStream) -> String {
-        abi_items(&parse_block(input).expect("the block should parse")).to_string()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self , out : & mut [u8]) -> HostResult < usize > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , \
-             wasm_params : & 'static [WasmValType] , wasm_result : Option < WasmValType > , }",
-            "const fn spec (self) -> HostFnSpec",
-            // Two wasm parameters for the one declared region, and a result for
-            // the length written to it.
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
-             wasm_result : Some (WasmValType :: I32) , }",
-            "Self :: TraceNum => HostFnSpec { name : \"trace_num\" , gas : 500u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32 , WasmValType :: I64] , \
-             wasm_result : None , }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-            "pub const fn wasm_params (self) -> & 'static [WasmValType]",
-            "pub const fn wasm_result (self) -> Option < WasmValType >",
-            // The fourth item; its contents are `glue`'s own tests.
-            "macro_rules ! wasmi_glue",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The ABI reaches for nothing outside the crate it lands in, which is what
-    /// lets that crate stay zero-dependency and link into the guest. The glue is
-    /// not held to this — its body names one engine throughout, and `glue`'s own
-    /// tests pin that instead.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // Two roots and no others: `Self::Variant` and `WasmValType::I32`.
-        // Doc comments spell paths without spaces (`Self::ALL`), so they do not
-        // match.
-        for (index, _) in generated.match_indices(" :: ") {
-            let prefix = &generated[..index];
-            assert!(
-                prefix.ends_with("Self") || prefix.ends_with("WasmValType"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<i32>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<i32>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions-macros/src/lowering.rs

@@ -1,487 +0,0 @@
-//! The wire shape of a declaration: everything a declared Rust type decides — the
-//! wasm value types it lowers to, the names those wasm parameters take, the type a
-//! generated body is handed for it, and which of the ABI's two argument traits
-//! builds that type. Kept as one set of `match` arms because the four must agree.
-//!
-//! The whole mapping, and the only place it is written down: a type no arm here
-//! names is a type the ABI does not have, not one that falls back to something.
-//!
-//! Two rows are worth knowing before reading a declaration:
-//!
-//! - **`u32` is not a scalar.** It is a `(ptr, len)` region holding four
-//!   little-endian bytes, which is how the guest SDK passes a sequence number.
-//! - **`usize` and `i32` results are the same on the wire and not
-//!   interchangeable**: the first is the length of what was written to an output
-//!   region, the second the answer itself.
-//!
-//! Matching is on types as they are spelled — a proc macro resolves nothing, so
-//! `type Bytes = u32; … x: Bytes` is unrecognizable — but on a path's last
-//! segment, so any of these types may be spelled qualified.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, format_ident, quote};
-use syn::{Ident, PathArguments, Type, TypePath, TypeReference};
-
-/// What a host function may be handed, and what each costs on the wire.
-///
-/// Declaration order is wasm parameter order, so a reader of a declaration is
-/// reading the import the guest links against.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ParamType {
-    /// `i32`, passed through as itself. Also the spelling for a raw scalar
-    /// whose signedness the ABI does not fix.
-    I32,
-    /// `i64`, passed through as itself.
-    I64,
-    /// `TraceDataType`: an `i32` code the engine resolves to the enum before a
-    /// host sees it.
-    TraceDataType,
-    /// `&[u8]`: a borrowed input region.
-    InBytes,
-    /// `&str`: an input region whose read is also the UTF-8 check.
-    InStr,
-    /// `u32`: an input region holding four little-endian bytes.
-    InU32,
-    /// `&mut [u8]`: the writable output region.
-    OutBytes,
-}
-
-/// The success type of the `HostResult<T>` every declaration returns. These three
-/// are what the ABI has; any other `T` is an error.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ResultType {
-    /// `usize`: the true length of a value written to an output region, which
-    /// the engine turns into the wire's `i32` or into `BufferTooSmall` /
-    /// `DataFieldTooLarge`. Never itself the wire type.
-    BufferLength,
-    /// `i32`: the answer, from a function that writes no region.
-    Value,
-    /// `()`: no wasm result at all — the call's whole effect is on the host, and
-    /// an `Err` reaches the guest in no form.
-    Nothing,
-}
-
-/// The wasm value types this ABI uses, mirroring `xrpl_host_functions::WasmValType`.
-///
-/// Mirrored rather than shared because the dependency runs the other way: the ABI
-/// crate depends on this one, so nothing here can name its types. The [`ToTokens`]
-/// impl below is the whole of the crossing, and emits references to that enum's
-/// variants — so falling out of sync with it is a compile error at the
-/// `host_functions!` call site rather than drift.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum WasmValType {
-    I32,
-    I64,
-}
-
-impl ParamType {
-    /// Recognizes the declared type, or refuses it against its own span.
-    pub(crate) fn parse(ty: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function's parameter must be `i32`, `i64`, `u32`, \
-                               `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`";
-
-        let recognized = match ty {
-            // A lifetime on the reference changes nothing on the wire.
-            Type::Reference(TypeReference {
-                mutability, elem, ..
-            }) => match (mutability, &**elem) {
-                (None, Type::Slice(slice)) if is_named(&slice.elem, "u8") => Some(Self::InBytes),
-                (Some(_), Type::Slice(slice)) if is_named(&slice.elem, "u8") => {
-                    Some(Self::OutBytes)
-                }
-                (None, elem) if is_named(elem, "str") => Some(Self::InStr),
-                _ => None,
-            },
-            _ => match last_path_segment(ty) {
-                Some(name) if name == "i32" => Some(Self::I32),
-                Some(name) if name == "i64" => Some(Self::I64),
-                Some(name) if name == "u32" => Some(Self::InU32),
-                Some(name) if name == "TraceDataType" => Some(Self::TraceDataType),
-                _ => None,
-            },
-        };
-
-        recognized.ok_or_else(|| syn::Error::new_spanned(ty, ALLOWED))
-    }
-
-    /// The wasm parameters this declared type lowers to, in order. `InBytes` and
-    /// `OutBytes` lower alike, so a region's direction survives only in the
-    /// variant.
-    pub(crate) fn as_wasm_params(self) -> &'static [WasmValType] {
-        match self {
-            Self::I32 | Self::TraceDataType => &[WasmValType::I32],
-            Self::I64 => &[WasmValType::I64],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                &[WasmValType::I32, WasmValType::I32]
-            }
-        }
-    }
-
-    /// What a declaration calls each of those wasm parameters: the declared name
-    /// for a scalar, and `{name}_ptr`/`{name}_len` for the pair a region lowers
-    /// to.
-    ///
-    /// **It must answer as many names as [`Self::as_wasm_params`] answers types**,
-    /// since the generated closure declares them one against the other — hence the
-    /// matching arms, and `lowers_every_declared_parameter_type`'s row-by-row
-    /// length check.
-    pub(crate) fn wasm_names(self, name: &Ident) -> Vec<Ident> {
-        match self {
-            Self::I32 | Self::I64 | Self::TraceDataType => vec![name.clone()],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                vec![format_ident!("{name}_ptr"), format_ident!("{name}_len")]
-            }
-        }
-    }
-
-    /// The type a generated body takes this parameter as: a wasm scalar spelled as
-    /// itself, everything else the argument type carrying its shape and direction —
-    /// which is what makes an input region used as an output one a compile error
-    /// naming both.
-    ///
-    /// The argument types are the engine's, so `vm` is the path they are reached
-    /// under; which types need it is decided here, a wasm scalar being `i32` under
-    /// every engine.
-    pub(crate) fn argument_type(self, vm: &TokenStream) -> TokenStream {
-        match self {
-            Self::I32 => quote!(i32),
-            Self::I64 => quote!(i64),
-            Self::TraceDataType => quote!(#vm::TraceCode),
-            Self::InBytes => quote!(#vm::InBytes),
-            Self::InStr => quote!(#vm::InStr),
-            Self::InU32 => quote!(#vm::InU32),
-            Self::OutBytes => quote!(#vm::OutBytes),
-        }
-    }
-
-    /// Which of the ABI's two argument traits builds this parameter's argument
-    /// type, or `None` for a wasm scalar, which reaches a body as itself.
-    ///
-    /// The arity is the whole of the distinction — `FromWasmRegion` takes the two
-    /// of a `(ptr, len)` pair, `FromWasmScalar` the one of a code — so this answers
-    /// alongside [`Self::as_wasm_params`] rather than from a predicate elsewhere.
-    pub(crate) fn argument_trait(self) -> Option<TokenStream> {
-        match self {
-            Self::I32 | Self::I64 => None,
-            Self::TraceDataType => Some(quote!(FromWasmScalar)),
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                Some(quote!(FromWasmRegion))
-            }
-        }
-    }
-
-    /// Whether this parameter is a region the host writes to — what
-    /// [`ResultType::BufferLength`] is the length *of*.
-    pub(crate) fn is_out_region(self) -> bool {
-        matches!(self, Self::OutBytes)
-    }
-}
-
-impl ResultType {
-    /// Recognizes the success type of a declaration's `HostResult<T>`, or
-    /// refuses it against its own span.
-    pub(crate) fn parse(success: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function must return `HostResult<usize>` for a value it \
-                               writes to an output region, `HostResult<i32>` for one it answers \
-                               directly, or `HostResult<()>` for none at all";
-
-        if let Type::Tuple(tuple) = success
-            && tuple.elems.is_empty()
-        {
-            return Ok(Self::Nothing);
-        }
-
-        match last_path_segment(success) {
-            Some(name) if name == "usize" => Ok(Self::BufferLength),
-            Some(name) if name == "i32" => Ok(Self::Value),
-            _ => Err(syn::Error::new_spanned(success, ALLOWED)),
-        }
-    }
-
-    /// The generated table's `wasm_result` field: `Some(WasmValType::I32)`, or
-    /// `None` for the function that answers nothing.
-    ///
-    /// Spelled out here rather than left to `quote`'s `Option` impl, which emits
-    /// nothing at all for `None`.
-    pub(crate) fn wasm_result_tokens(self) -> TokenStream {
-        match self.as_wasm_result() {
-            Some(val_type) => quote! { Some(#val_type) },
-            None => quote! { None },
-        }
-    }
-
-    /// Whether the value reaches the guest as the length of what was written to
-    /// an output region.
-    pub(crate) fn is_buffer_length(self) -> bool {
-        matches!(self, Self::BufferLength)
-    }
-
-    /// The wasm result, which does not distinguish a length from a value.
-    fn as_wasm_result(self) -> Option<WasmValType> {
-        match self {
-            Self::BufferLength | Self::Value => Some(WasmValType::I32),
-            Self::Nothing => None,
-        }
-    }
-}
-
-/// `WasmValType::I32` — the ABI crate's variant, named but never defined here.
-impl ToTokens for WasmValType {
-    fn to_tokens(&self, tokens: &mut TokenStream) {
-        tokens.extend(match self {
-            Self::I32 => quote! { WasmValType::I32 },
-            Self::I64 => quote! { WasmValType::I64 },
-        });
-    }
-}
-
-/// The last segment of a plain path type, when it carries no generic arguments:
-/// `i32`, `core::primitive::i32` and `TraceDataType` all answer their own name,
-/// `Vec<u8>` and `[u8; 4]` nothing.
-fn last_path_segment(ty: &Type) -> Option<&Ident> {
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = ty
-    else {
-        return None;
-    };
-    let last = path.segments.last()?;
-    matches!(last.arguments, PathArguments::None).then_some(&last.ident)
-}
-
-/// Whether `ty` is the named primitive, however it is spelled.
-fn is_named(ty: &Type, name: &str) -> bool {
-    last_path_segment(ty).is_some_and(|segment| segment == name)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use syn::parse_quote;
-
-    use WasmValType::{I32, I64};
-
-    /// Every declared parameter type and everything it decides: what it costs on
-    /// the wire, what a body is handed for it, and which trait builds that.
-    ///
-    /// The names are asserted by length rather than spelling, since a type
-    /// answering fewer names than value types is the one way these answers can
-    /// contradict each other.
-    #[test]
-    fn lowers_every_declared_parameter_type() {
-        let mapping: [(Type, &[WasmValType], &str, Option<&str>); 7] = [
-            (parse_quote!(i32), &[I32], "i32", None),
-            (parse_quote!(i64), &[I64], "i64", None),
-            (
-                parse_quote!(TraceDataType),
-                &[I32],
-                "vm :: TraceCode",
-                Some("FromWasmScalar"),
-            ),
-            (
-                parse_quote!(&[u8]),
-                &[I32, I32],
-                "vm :: InBytes",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&str),
-                &[I32, I32],
-                "vm :: InStr",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(u32),
-                &[I32, I32],
-                "vm :: InU32",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&mut [u8]),
-                &[I32, I32],
-                "vm :: OutBytes",
-                Some("FromWasmRegion"),
-            ),
-        ];
-        let declared_name = format_ident!("seq");
-        let vm = quote!(vm);
-
-        for (declared, wasm, argument, argument_trait) in mapping {
-            let param = ParamType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a parameter type", quoted(&declared)));
-
-            assert_eq!(param.as_wasm_params(), wasm, "`{}`", quoted(&declared));
-            assert_eq!(
-                param.argument_type(&vm).to_string(),
-                argument,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param
-                    .argument_trait()
-                    .map(|name| name.to_string())
-                    .as_deref(),
-                argument_trait,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param.wasm_names(&declared_name).len(),
-                wasm.len(),
-                "one name per wasm parameter: `{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A region's two wasm parameters are named off the declaration, so the
-    /// generated closure reads as the declaration does.
-    #[test]
-    fn names_a_region_s_pair_after_the_declared_parameter() {
-        let seq = format_ident!("seq");
-
-        let names = |declared: Type| {
-            ParamType::parse(&declared)
-                .expect("a parameter type")
-                .wasm_names(&seq)
-                .iter()
-                .map(Ident::to_string)
-                .collect::<Vec<_>>()
-        };
-
-        assert_eq!(names(parse_quote!(u32)), ["seq_ptr", "seq_len"]);
-        assert_eq!(names(parse_quote!(i32)), ["seq"]);
-    }
-
-    /// The two `(ptr, len)` pairs lower alike but are told apart, since only the
-    /// direction says who may write to the region.
-    #[test]
-    fn keeps_the_regions_apart() {
-        let input: Type = parse_quote!(&[u8]);
-        let output: Type = parse_quote!(&mut [u8]);
-
-        assert!(!ParamType::parse(&input).unwrap().is_out_region());
-        assert!(ParamType::parse(&output).unwrap().is_out_region());
-    }
-
-    /// A type outside the mapping is refused rather than lowered to a guess.
-    #[test]
-    fn refuses_parameter_types_outside_the_mapping() {
-        let outside: [Type; 11] = [
-            parse_quote!(u64),
-            parse_quote!(u8),
-            parse_quote!(usize),
-            parse_quote!(bool),
-            parse_quote!(Vec<u8>),
-            parse_quote!([u8; 4]),
-            parse_quote!(&mut str),
-            parse_quote!(&i32),
-            parse_quote!(&[i32]),
-            parse_quote!(&Foo),
-            parse_quote!(()),
-        ];
-
-        for declared in outside {
-            let Err(error) = ParamType::parse(&declared) else {
-                panic!("`{}` should not be a parameter type", quoted(&declared));
-            };
-            assert!(
-                error.to_string().contains("must be `i32`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The three success types, and the wasm result each becomes. `usize` and
-    /// `i32` agree on the wire and are separate rows.
-    #[test]
-    fn lowers_every_success_type() {
-        let mapping: [(Type, ResultType, Option<WasmValType>); 3] = [
-            (parse_quote!(usize), ResultType::BufferLength, Some(I32)),
-            (parse_quote!(i32), ResultType::Value, Some(I32)),
-            (parse_quote!(()), ResultType::Nothing, None),
-        ];
-
-        for (declared, expected, wasm_result) in mapping {
-            let result = ResultType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a success type", quoted(&declared)));
-
-            assert_eq!(result, expected, "`{}`", quoted(&declared));
-            assert_eq!(
-                result.as_wasm_result(),
-                wasm_result,
-                "`{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The distinction the wasm result loses: which of the two `i32` results was
-    /// declared decides how the value reaches the guest.
-    #[test]
-    fn tells_a_length_from_a_value() {
-        assert!(ResultType::BufferLength.is_buffer_length());
-        assert!(!ResultType::Value.is_buffer_length());
-        assert!(!ResultType::Nothing.is_buffer_length());
-    }
-
-    #[test]
-    fn refuses_success_types_outside_the_mapping() {
-        let outside: [Type; 6] = [
-            parse_quote!(u32),
-            parse_quote!(i64),
-            parse_quote!(bool),
-            parse_quote!([u8; 32]),
-            parse_quote!(Vec<u8>),
-            parse_quote!((usize, i32)),
-        ];
-
-        for declared in outside {
-            let Err(error) = ResultType::parse(&declared) else {
-                panic!("`{}` should not be a success type", quoted(&declared));
-            };
-            assert!(
-                error
-                    .to_string()
-                    .contains("must return `HostResult<usize>`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A qualified spelling is the same type, matching how the return type finds
-    /// `HostResult`.
-    #[test]
-    fn accepts_qualified_spellings() {
-        let qualified: Type = parse_quote!(core::primitive::i32);
-        assert_eq!(ParamType::parse(&qualified).unwrap(), ParamType::I32);
-
-        let qualified: Type = parse_quote!(xrpl_host_functions::TraceDataType);
-        assert_eq!(
-            ParamType::parse(&qualified).unwrap(),
-            ParamType::TraceDataType
-        );
-    }
-
-    /// The emitted tokens name the ABI crate's variants, which is the whole of
-    /// what crosses out of this crate. Pinned here so a break in the mirror is a
-    /// failure with a span rather than a rustc error at the call site.
-    #[test]
-    fn emits_references_to_the_hand_written_variants() {
-        assert_eq!(I32.to_token_stream().to_string(), "WasmValType :: I32");
-        assert_eq!(I64.to_token_stream().to_string(), "WasmValType :: I64");
-
-        assert_eq!(
-            ResultType::BufferLength.wasm_result_tokens().to_string(),
-            "Some (WasmValType :: I32)"
-        );
-        assert_eq!(ResultType::Nothing.wasm_result_tokens().to_string(), "None");
-    }
-
-    fn quoted(ty: &Type) -> String {
-        ty.to_token_stream().to_string()
-    }
-}

crates/xrpl-host-functions/Cargo.toml

@@ -1,20 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
-
-# `wasmi_glue!` and the two argument traits it marshals through are a host's
-# business, and this crate is what a contract links against — so the feature is
-# what keeps `cargo doc` here showing a contract developer only the ABI. It costs
-# nothing either way: a `macro_rules!` is inert and a trait with no impls emits
-# nothing.
-#
-# `xrpl-wasm-vm` enables it and features unify across the graph, so the off
-# configuration is only ever checked by `cargo check -p xrpl-host-functions`,
-# which is in the loop in `tmp/notes/wasm-vm/testing.md` for that reason.
-[features]
-default = []
-wasmi_glue = []

crates/xrpl-host-functions/src/lib.rs

@@ -1,543 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`HostResult`], [`HASH_LEN`] — and everything
-//! derived from the declarations is generated. The expansion names nothing this file
-//! does not, so the two sides meet only in the block below.
-//!
-//! Three items cross that split the other way, named by the expansion but by no
-//! declaration: [`WasmValType`], which the derived wasm signatures are spelled in,
-//! and `FromWasmRegion`/`FromWasmScalar`, which `wasmi_glue!` builds a marshalled
-//! argument through.
-//!
-//! So this file is lists — error codes, trace data types, functions. The `macro_rules!`
-//! that expand the first two into enums live in `macros.rs`.
-
-#![no_std]
-
-#[macro_use]
-mod macros;
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::host_functions;
-
-host_errors! {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-trace_data_types! {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-/// The wasm module name a guest imports these functions under:
-/// `(import "host_lib" "ldgr_index" …)`.
-pub const HOST_MODULE: &str = "host_lib";
-
-/// A wasm value type, as many of them as this ABI uses — the vocabulary the
-/// generated wasm signatures are spelled in, which an engine maps to its own value
-/// types once.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WasmValType {
-    I32,
-    I64,
-}
-
-/// Builds the argument an engine marshals a `(ptr, len)` region into: a declared
-/// `&[u8]`, `&str`, `u32` or `&mut [u8]`. Nothing is checked here — the pair
-/// arrives as the guest sent it, and refusing a malformed region is the engine's
-/// business.
-///
-/// **Kept apart from [`FromWasmScalar`]** rather than folded into one trait with
-/// an associated wasm type, for the diagnostic: the mistake worth catching is an
-/// arity one — a declared `u32` is a region, not a code — and as two traits that
-/// lands as an unsatisfied bound at the offending argument type rather than an
-/// `i32`-against-`(i32, i32)` mismatch at the macro call.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmRegion {
-    fn from_wasm(ptr: i32, len: i32) -> Self;
-}
-
-/// Builds the argument an engine marshals a single `i32` code into: the declared
-/// `TraceDataType`. [`FromWasmRegion`] says why the two are separate traits.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmScalar {
-    fn from_wasm(code: i32) -> Self;
-}
-
-// Two rules hold over every declaration below, and neither is visible at any one of
-// them. They are what lets the wasm signature be read off the declaration.
-//
-// **Declaration order is wasm parameter order.** So `mode` comes after `out` in the
-// float functions, and `data_type` between `trace`'s two regions: the wire's order,
-// not the one a Rust signature would choose.
-//
-// **`i32` and `i64` are the wasm scalars, spelled as themselves; every other type is
-// marshalled.** `&[u8]`/`&str` and `&mut [u8]` are `(ptr, len)` pairs, `TraceDataType`
-// is an `i32` code the engine names before a host sees it, and **`u32` is four
-// little-endian bytes in a region**, not a scalar, which is how the guest SDK passes a
-// sequence number.
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
-    /// the answer is `1` if enabled and `0` if not.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Answers the slot used.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
-    /// multiple of 4).
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
-    /// is valid, `0` if not, or a negative error.
-    #[gas = 300]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
-    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
-    /// issuer).
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
-    /// the account it authorizes.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
-    /// its ticket sequence number.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
-    /// host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
-    /// bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
-    /// little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
-    /// little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
-    /// (four little-endian bytes), each written to its own output region.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        out: &mut [u8],
-        mode: i32,
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, returning a negative, zero, or positive scalar as
-    /// `x` is less than, equal to, or greater than `y`.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32>;
-
-    /// The float sum `x + y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, out: &mut [u8], mode: i32) -> HostResult<usize>;
-}

crates/xrpl-host-functions/src/macros.rs

@@ -1,102 +0,0 @@
-//! The `macro_rules!` behind the two hand-listed enums, [`crate::HostError`] and
-//! [`crate::TraceDataType`].
-//!
-//! Each takes one list of `Variant = code,` and expands the enum together with the
-//! `ALL`/`code`/`from_code` set that must not fall behind it. The lists themselves stay
-//! in `lib.rs`, beside the `host_functions!` block.
-
-/// Declares [`crate::HostError`] from one list: the variants, `HostError::ALL` and
-/// `HostError::from_code`'s table all expand from the codes given.
-///
-/// One list is what makes `ALL` complete. Rust cannot enumerate an enum's
-/// variants — an exhaustive `match` forces an arm per variant but gives nothing to
-/// iterate — so a hand-written `ALL` beside a hand-written enum could only be kept
-/// in step by review, and `ALL`'s whole purpose is to be the set a test can trust.
-/// A code added to the list gains its `ALL` entry and its `from_code` arm by
-/// construction. `HostFunctionSpec::ALL` is complete the same way, from the
-/// `host_functions!` block.
-macro_rules! host_errors {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// Error codes a host function may return.
-        ///
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum HostError {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl HostError {
-            /// Every error a host function may return, in code order.
-            ///
-            /// The complete set, and complete by construction: a wasm engine's
-            /// split between the codes it hands the guest and the conditions it
-            /// traps on is a decision per variant, so the test that checks the
-            /// split iterates this and a code added to the ABI cannot slip past it.
-            pub const ALL: &'static [HostError] = &[$(HostError::$variant,)+];
-
-            /// The negative wire value a failed call returns. Every code but
-            /// `InternalFatal` is one a guest reads off that value.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// Reconstruct a `HostError` from its wire code.
-            ///
-            /// A code this ABI does not define is `InternalFatal`: an answer the
-            /// caller cannot act on is the call not having been served, and that is
-            /// the variant which says so. Positive values are not errors at all and go
-            /// the same way, since this is reached only once a negative return has
-            /// been read as a failure.
-            pub const fn from_code(code: i32) -> HostError {
-                match code {
-                    $($code => HostError::$variant,)+
-                    _ => HostError::InternalFatal,
-                }
-            }
-        }
-    };
-}
-
-/// Declares [`crate::TraceDataType`] from one list, so `TraceDataType::ALL`,
-/// `TraceDataType::code` and `TraceDataType::from_code` cannot fall behind the
-/// variants — the reason `host_errors!` above is written this way.
-macro_rules! trace_data_types {
-    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
-        /// How [`HostFunctions::trace`] is to read its data buffer.
-        ///
-        /// The discriminants are wire values shared with the guest stdlib: append only,
-        /// never renumber. They start at 1, so a zeroed argument names no type rather
-        /// than the first one.
-        ///
-        /// This is the declaration a guest and a host both compile against. The host
-        /// side needs a second one — `cxx` cannot be a dependency here, since this
-        /// crate also links into the guest — so `xrpl-wasm-vm-ffi` declares a shared
-        /// enum for C++ and converts, exhaustively, from this.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        pub enum TraceDataType {
-            $($(#[$doc])* $variant = $code,)+
-        }
-
-        impl TraceDataType {
-            /// Every data type a guest may name, in code order.
-            pub const ALL: &'static [TraceDataType] = &[$(TraceDataType::$variant,)+];
-
-            /// The wire value a guest passes to name this type.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The type `code` names, or `None`: the engine drops a call it cannot
-            /// read rather than guessing at a rendering the guest did not ask for.
-            pub const fn from_code(code: i32) -> Option<TraceDataType> {
-                match code {
-                    $($code => Some(TraceDataType::$variant),)+
-                    _ => None,
-                }
-            }
-        }
-    };
-}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -1,41 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are `WasmValType` and the ones the declarations
-//! themselves spell.
-//!
-//! That this crate compiles is also what shows the emitted `wasmi_glue!` costs
-//! nothing to carry: its body names an engine throughout, there is no engine
-//! here, and nobody here expands it.
-
-use xrpl_host_functions::{HostResult, WasmValType};
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-    assert_eq!(HostFunctionSpec::Ping.wasm_params(), &[WasmValType::I32]);
-    assert_eq!(HostFunctionSpec::Ping.wasm_result(), Some(WasmValType::I32));
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -1,102 +0,0 @@
-//! Exercises what `host_errors!` generates: the wire codes, the set
-//! [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), error, "{error:?}");
-    }
-}
-
-/// A code from outside the set is `InternalFatal`: a host answering something this ABI
-/// does not define has not served the call, whatever it meant by it, and success is not
-/// an error at all.
-///
-/// `-21` is the code xrpld would append next, so it is the one that decides whether a
-/// list this crate has not caught up with reaches a guest or stops the run. `i32::MIN +
-/// 1` is next to the sentinel and unassigned, which is what makes the sentinel a value
-/// rather than a range.
-#[test]
-fn a_code_outside_the_set_is_internal_fatal() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(
-            HostError::from_code(code),
-            HostError::InternalFatal,
-            "{code}"
-        );
-    }
-}

crates/xrpl-wasm-testkit/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-wat = "1"
-xrpl-host-functions = { path = "../xrpl-host-functions" }

crates/xrpl-wasm-testkit/src/lib.rs

@@ -1,107 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
-//! into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-
-        /// The gas a host function is charged before it runs, by its guest import name.
-        ///
-        /// For the C++ gas benchmarks, which measure what a host call actually costs and
-        /// report it against what the table says it costs. Reading the declaration through
-        /// here rather than copying the numbers into C++ is the point: 61 transcribed
-        /// constants would drift from `lib.rs` the first time a price changed, and drift
-        /// silently, because a benchmark has nothing to fail.
-        ///
-        /// Throws `rust::Error` on an unknown name — a typo should fail loudly rather than
-        /// quietly compare against zero.
-        fn host_function_gas(wasm_name: &str) -> Result<u64>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-fn host_function_gas(wasm_name: &str) -> Result<u64, UnknownHostFunction> {
-    xrpl_host_functions::HostFunctionSpec::ALL
-        .iter()
-        .find(|op| op.wasm_name() == wasm_name)
-        .map(|op| op.gas())
-        .ok_or_else(|| UnknownHostFunction(wasm_name.to_owned()))
-}
-
-#[derive(Debug)]
-struct UnknownHostFunction(String);
-
-impl std::fmt::Display for UnknownHostFunction {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "no host function is imported as `{}`", self.0)
-    }
-}
-
-impl std::error::Error for UnknownHostFunction {}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_host_function_reports_the_gas_its_declaration_gives_it() {
-        // `trace` is the cheapest declaration in the table; the point is not the number but
-        // that the lookup reaches the same constant the engine charges from.
-        assert_eq!(
-            host_function_gas("trace").expect("trace is a host function"),
-            xrpl_host_functions::HostFunctionSpec::Trace.gas()
-        );
-    }
-
-    #[test]
-    fn every_host_function_is_reachable_by_its_import_name() {
-        for op in xrpl_host_functions::HostFunctionSpec::ALL {
-            assert_eq!(
-                host_function_gas(op.wasm_name()).expect("declared"),
-                op.gas(),
-                "{} must be reachable by name",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_an_error_rather_than_zero_gas() {
-        host_function_gas("not_a_host_function").expect_err("must not resolve");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }

crates/xrpl-wasm-vm/Cargo.toml

@@ -1,11 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "2.0.0", default-features = false, features = ["std", "validate", "portable-dispatch"] }
-xrpl-host-functions = { path = "../xrpl-host-functions", features = ["wasmi_glue"] }
-
-[dev-dependencies]
-wat = "1"

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,813 +0,0 @@
-use crate::args::OutBytes;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use core::ops::Range;
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// The guest's memory, for a call that reads its inputs and writes nothing back.
-/// An argument read out of the slice is borrowed rather than copied.
-///
-/// A call that also writes takes both borrows at once, so [`write_buffered`] and
-/// [`write_mant_exp`] hand over the same slice themselves.
-pub(crate) fn guest_memory<'a>(caller: &'a Caller<'_, VmState<'_>>) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(mem.data(caller))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region, the
-/// cap, nor the budget, and all three checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can read any number of input
-/// arguments out of it — which a `&mut` view of that memory would forbid. That is
-/// why the answer goes through a buffer instead of straight into the guest as
-/// [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
-    let region = data
-        .get(range.clone())
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if region.len() < width {
-        return Err(HostError::BufferTooSmall);
-    }
-    Ok(())
-}
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: OutBytes,
-    exponent_out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    let mant_range = mantissa_out.range()?;
-    check_fits(data, &mant_range, MANTISSA_BYTES)?;
-    let exp_range = exponent_out.range()?;
-    check_fits(data, &exp_range, EXPONENT_BYTES)?;
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::TraceDataType;
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data_type: TraceDataType, _data: &[u8]) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/args.rs

@@ -1,243 +0,0 @@
-//! A host call's arguments as they arrive: one type per declared parameter the
-//! ABI marshals, built by `register.rs`'s generated closures and read by its
-//! bodies. A wasm scalar (`i32`, `i64`) is passed through as itself and has no
-//! type here.
-//!
-//! What the types buy is that **a body cannot mistake one argument for another**:
-//! an input region offered where an output one belongs is a compile error naming
-//! both, where two loose `i32`s would let a rounding mode be read as a buffer
-//! length. A derived signature cannot catch that, every one of these being
-//! `i32, i32` on the wire.
-//!
-//! The arguments arrive unchecked and are judged where they are read — `InU32`'s
-//! region must hold exactly four bytes, `InStr`'s must be UTF-8, a [`TraceCode`]
-//! must name a rendering — so they are refused in the order the body reads them.
-//!
-//! **The `from_wasm` impls below are half of `wasmi_glue!`'s contract** and the
-//! only construction these types have; `register.rs`'s `glue_env` is where the
-//! macro is told which type marshals which declared one. Which of the two traits
-//! a type takes is the ABI's decision, so `InU32` is a region rather than the
-//! scalar its declared `u32` reads like.
-
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{FromWasmRegion, FromWasmScalar, HostError, HostResult, TraceDataType};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// The shared half of the four region types below, which differ in what reading
-/// one means. The fields being out of reach makes [`range`](Region::range) the
-/// only way to indices, so the check can be deferred but not skipped — and
-/// construction is infallible so that a malformed region is refused in the order
-/// the call's own helper chooses.
-#[derive(Copy, Clone)]
-struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check, and the
-    /// checked addition guards a 32-bit `usize`, where two `i32`s can sum past the
-    /// end.
-    fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. The slice aliases `data`.
-    fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}
-
-/// A declared `&[u8]`: an input region the host borrows.
-#[derive(Copy, Clone)]
-pub(crate) struct InBytes(Region);
-
-impl FromWasmRegion for InBytes {
-    fn from_wasm(ptr: i32, len: i32) -> InBytes {
-        InBytes(Region::new(ptr, len))
-    }
-}
-
-impl InBytes {
-    /// The region's bytes, aliasing the guest's memory rather than copied out of it.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        self.0.read(data)
-    }
-}
-
-/// A declared `&str`: an input region whose bytes are text.
-#[derive(Copy, Clone)]
-pub(crate) struct InStr(Region);
-
-impl FromWasmRegion for InStr {
-    fn from_wasm(ptr: i32, len: i32) -> InStr {
-        InStr(Region::new(ptr, len))
-    }
-}
-
-impl InStr {
-    /// The region's bytes as text. The read is also the UTF-8 check, so a host is
-    /// never the one to validate them.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&str> {
-        core::str::from_utf8(self.0.read(data)?).map_err(|_| HostError::InvalidParams)
-    }
-}
-
-/// A declared `u32`: an input region holding the number as four little-endian
-/// bytes, which is how the guest SDK passes a sequence number.
-#[derive(Copy, Clone)]
-pub(crate) struct InU32(Region);
-
-impl FromWasmRegion for InU32 {
-    fn from_wasm(ptr: i32, len: i32) -> InU32 {
-        InU32(Region::new(ptr, len))
-    }
-}
-
-impl InU32 {
-    /// The number the region holds. The width is the ABI's, so any length but four
-    /// is `InvalidParams`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<u32> {
-        let bytes: [u8; 4] = self
-            .0
-            .read(data)?
-            .try_into()
-            .map_err(|_| HostError::InvalidParams)?;
-        Ok(u32::from_le_bytes(bytes))
-    }
-}
-
-/// A declared `&mut [u8]`: the region the host's answer is written to.
-///
-/// It has no `read`: what a call may put here is decided by the `abi.rs` helper
-/// serving it, against the value's length and the run's budget, and the host is
-/// never handed the guest's capacity.
-#[derive(Copy, Clone)]
-pub(crate) struct OutBytes(Region);
-
-impl FromWasmRegion for OutBytes {
-    fn from_wasm(ptr: i32, len: i32) -> OutBytes {
-        OutBytes(Region::new(ptr, len))
-    }
-}
-
-impl OutBytes {
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        self.0.range()
-    }
-}
-
-/// A declared `TraceDataType`: the `i32` code naming how `trace` is to render its
-/// data. The one marshalled argument that is not a region, so reading it needs no
-/// guest memory.
-#[derive(Copy, Clone)]
-pub(crate) struct TraceCode(i32);
-
-impl FromWasmScalar for TraceCode {
-    fn from_wasm(code: i32) -> TraceCode {
-        TraceCode(code)
-    }
-}
-
-impl TraceCode {
-    /// The type the code names, or `InvalidParams`: a rendering the guest did not
-    /// ask for is not one to guess at.
-    pub(crate) fn read(self) -> HostResult<TraceDataType> {
-        TraceDataType::from_code(self.0).ok_or(HostError::InvalidParams)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The guest memory these tests read out of: sixteen bytes at index 0.
-    const MEMORY: [u8; 16] = [
-        0x78, 0x56, 0x34, 0x12, b'h', b'i', 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-    ];
-
-    #[test]
-    fn a_u32_argument_is_four_little_endian_bytes() {
-        assert_eq!(InU32::from_wasm(0, 4).read(&MEMORY), Ok(0x1234_5678));
-    }
-
-    /// A longer region is refused too, rather than its first four bytes read as
-    /// the answer.
-    #[test]
-    fn a_u32_argument_of_any_other_width_is_refused() {
-        for len in [0, 1, 3, 5, 8] {
-            assert_eq!(
-                InU32::from_wasm(0, len).read(&MEMORY),
-                Err(HostError::InvalidParams),
-                "{len} bytes"
-            );
-        }
-    }
-
-    /// The read is the UTF-8 check, so a host implementing `trace` has nothing
-    /// left to validate.
-    #[test]
-    fn a_str_argument_is_checked_where_it_is_read() {
-        assert_eq!(InStr::from_wasm(4, 2).read(&MEMORY), Ok("hi"));
-        assert_eq!(
-            InStr::from_wasm(6, 1).read(&MEMORY),
-            Err(HostError::InvalidParams),
-            "0xff is not UTF-8"
-        );
-    }
-
-    /// A region past the end of guest memory is refused rather than clamped, and
-    /// one past the field cap is refused before the memory is consulted at all.
-    #[test]
-    fn a_region_is_held_to_the_memory_and_to_the_field_cap() {
-        assert_eq!(
-            InBytes::from_wasm(8, 16).read(&MEMORY),
-            Err(HostError::PointerOutOfBounds)
-        );
-
-        let past_the_cap = i32::try_from(MAX_FIELD_BYTES).expect("the cap is a small constant") + 1;
-        assert_eq!(
-            InBytes::from_wasm(0, past_the_cap).read(&MEMORY),
-            Err(HostError::DataFieldTooLarge)
-        );
-
-        assert_eq!(
-            InBytes::from_wasm(-1, 4).read(&MEMORY),
-            Err(HostError::InvalidParams)
-        );
-    }
-
-    /// Every code the ABI has, and nothing else: an unknown one is refused rather
-    /// than rendered some other way.
-    #[test]
-    fn a_trace_code_names_a_rendering_or_none() {
-        for &data_type in TraceDataType::ALL {
-            assert_eq!(TraceCode::from_wasm(data_type.code()).read(), Ok(data_type));
-        }
-
-        for code in [0, -1, i32::MAX] {
-            assert_eq!(
-                TraceCode::from_wasm(code).read(),
-                Err(HostError::InvalidParams),
-                "{code}"
-            );
-        }
-    }
-}

crates/xrpl-wasm-vm/src/lib.rs

@@ -1,28 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-
-mod abi;
-mod args;
-mod preflight;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check};
-pub use vm::{
-    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError, RunFailure,
-    RunOutcome, TRANSFER_LIMIT_BYTES, run,
-};

crates/xrpl-wasm-vm/src/preflight/mod.rs

@@ -1,478 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the three stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two things it deliberately does not screen. A module exporting **no** linear
-//! memory passes: a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section
-//! passes: it is guest code, and executing it is the one thing a check must not do
-//! — a trap in one is charged to the contract like any other trap.
-//!
-//! Two things it screens that a run can only discover: an exported memory, or an
-//! exported table, larger than the engine grants. Both read the same export list, so
-//! [`check_exported_resources`] is one pass — see it for what stays invisible, and
-//! why the table case leaves much more of it there.
-//!
-//! Every rule is here but one: [`signature`] holds the comparison of an import's
-//! type against the ABI's, which needs machinery the rest of the stage does not.
-
-mod signature;
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::{HOST_MODULE, HostFunctionSpec};
-
-use crate::vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, compile};
-use signature::check_signature;
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// An import of a host function typed as something other than what the engine
-    /// registers it as. Apart from [`CheckError::Import`] because the ABI does
-    /// have the function the guest asked for.
-    Signature(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-    /// The module asks for a larger table than the engine grants.
-    Table(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            CheckError::Signature(detail) => write!(f, "signature: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-            CheckError::Table(detail) => write!(f, "table: {detail}"),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
-/// have.
-///
-/// The stages are ordered by how much of the module each explains. An import fault
-/// is reported before a missing entry point because the imports are what the rest of
-/// the module is built on; the resource caps come last, being a request rather than a
-/// mistake about the ABI.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let module = compile(wasm).map_err(CheckError::Compile)?;
-    check_imports(&module)?;
-    check_entry_point(&module, function_name)?;
-    check_exported_resources(&module)
-}
-
-/// Every import must be one the linker defines, with the type it defines it as. The
-/// first that is not ends the check, so a module with several faults reports the
-/// earliest.
-fn check_imports(module: &Module) -> Result<(), CheckError> {
-    for import in module.imports() {
-        check_import(import.module(), import.name(), import.ty())?;
-    }
-    Ok(())
-}
-
-/// Whether the engine defines this one import, as the guest declares it.
-///
-/// Names and signatures both come from the declarations
-/// [`crate::register::register_host_functions`] registers from, so a check and a
-/// run cannot disagree about which imports exist or what they look like.
-///
-/// The rules are ordered, each presuming the ones before it held: a guest
-/// importing `env::malloc` is told about the namespace, which explains every other
-/// import it has too, and only an import that names a real host function as a
-/// function has a signature worth comparing.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), CheckError> {
-    let function = host_function(module, name).map_err(CheckError::Import)?;
-    let imported = imported_function(name, ty).map_err(CheckError::Import)?;
-    check_signature(function, imported).map_err(CheckError::Signature)
-}
-
-/// Which host function this import names: its namespace must be the engine's, and
-/// its name one the ABI declares.
-fn host_function(module: &str, name: &str) -> Result<HostFunctionSpec, String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    HostFunctionSpec::ALL
-        .iter()
-        .find(|function| function.wasm_name() == name)
-        .copied()
-        .ok_or_else(|| format!("no host function '{name}'"))
-}
-
-/// The function type the guest declared. The engine defines these names as
-/// functions and as nothing else, so an import of any other kind does not link.
-fn imported_function<'ty>(name: &str, ty: &'ty ExternType) -> Result<&'ty FuncType, String> {
-    match ty {
-        ExternType::Func(ty) => Ok(ty),
-        _ => Err(format!("'{HOST_MODULE}::{name}' is not a function")),
-    }
-}
-
-fn check_entry_point(module: &Module, name: &str) -> Result<(), CheckError> {
-    match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => Ok(()),
-        found => Err(CheckError::EntryPoint(entry_point_fault(found, name))),
-    }
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may declare no more linear memory, and no larger a table, than the
-/// engine grants. One pass over the exports, since both rules read the same list and
-/// the export table is the only place either is visible.
-///
-/// **A memory or table the module keeps to itself is therefore not screened**: it is
-/// absent from the exports, and the store's limiter is what refuses it, at
-/// instantiation. That gap is wide for tables — Rust exports
-/// `__indirect_function_table` only under `--export-table`, so unexported is the
-/// normal shape — and narrow for memories, since a contract needs an exported one to
-/// make any host call at all.
-///
-/// A module faulting on both is reported by whichever it declares first. Neither
-/// fault explains the other, so there is no precedence to preserve — only the need
-/// for every node to reach the same verdict, which export order already gives.
-fn check_exported_resources(module: &Module) -> Result<(), CheckError> {
-    for export in module.exports() {
-        match export.ty() {
-            ExternType::Memory(ty) => {
-                check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
-            }
-            ExternType::Table(ty) => {
-                check_initial_elements(ty.minimum()).map_err(CheckError::Table)?;
-            }
-            _ => {}
-        }
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a table of this declared initial size.
-///
-/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
-/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
-/// than it was declared and a declared maximum past the cap is simply unreachable.
-fn check_initial_elements(elements: u64) -> Result<(), String> {
-    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
-    if elements > cap {
-        return Err(format!(
-            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`]; what is here is
-/// what a module cannot state precisely — which rule fires, in which order, and in
-/// what words the caller logs it. The signature rule's derivation is tested beside
-/// it, in [`signature`].
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-mod tests {
-    use super::signature::registered_type;
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// The type an import of `function` must declare.
-    fn registered(function: HostFunctionSpec) -> ExternType {
-        ExternType::Func(registered_type(function))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served, at the signature derived from its
-    /// declaration. Derived from `ALL` rather than listed, so a host function added
-    /// to the ABI is covered the day it lands.
-    ///
-    /// Both sides come from the table, so this pins that no declaration is refused,
-    /// not that the table is right. `tests/preflight.rs`'s
-    /// `every_declared_host_function_may_be_imported` and
-    /// `the_derived_signatures_are_what_the_linker_registers` are what compare it
-    /// against hand-written imports and against the real linker.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for &function in HostFunctionSpec::ALL {
-            let name = function.wasm_name();
-            if let Err(refusal) = check_import(HOST_MODULE, name, &registered(function)) {
-                panic!("'{name}' is declared but not served: {refusal}");
-            }
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = host_function(namespace, a_host_function_name()).expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal = host_function(HOST_MODULE, "no_such_function").expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = imported_function(name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = host_function("env", "no_such_function")
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// The signature is the last rule, so an import wrong about the namespace, the
-    /// name or the kind is not told about a signature instead, and the two kinds of
-    /// fault reach the caller as different stages.
-    #[test]
-    fn the_signature_is_the_last_rule() {
-        let name = a_host_function_name();
-        let mistyped = ExternType::Func(FuncType::new([ValType::F32], []));
-        let not_a_function = ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const));
-
-        for (rule, refusal) in [
-            ("the namespace", check_import("env", name, &mistyped)),
-            (
-                "the name",
-                check_import(HOST_MODULE, "no_such_function", &mistyped),
-            ),
-            ("the kind", check_import(HOST_MODULE, name, &not_a_function)),
-        ] {
-            assert!(
-                matches!(refusal, Err(CheckError::Import(_))),
-                "{rule} explains this import, not its signature: {refusal:?}"
-            );
-        }
-
-        assert!(
-            matches!(
-                check_import(HOST_MODULE, name, &mistyped),
-                Err(CheckError::Signature(_))
-            ),
-            "an import that breaks nothing but the signature is a signature fault"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Func(FuncType::new(
-                    [ValType::I32],
-                    [ValType::I32]
-                ))),
-                "finish"
-            ),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The cap itself is granted; one element past it is not. The boundary is the
-    /// whole rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
-        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
-        assert_eq!(check_initial_elements(0), Ok(()));
-        assert_eq!(check_initial_elements(cap), Ok(()));
-
-        let past = cap + 1;
-        let refusal = check_initial_elements(past).expect_err("one element past the cap");
-        assert_eq!(
-            refusal,
-            format!(
-                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-            )
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
-            "table: initial table of 1025 elements"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The stage is the prefix, so the detail must not say "signature" again.
-        assert_eq!(
-            CheckError::Signature(
-                "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'".to_string()
-            )
-            .to_string(),
-            "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/preflight/signature.rs

@@ -1,153 +0,0 @@
-//! The last rule on an import: an import that names a host function must also
-//! declare the type the engine registers it as.
-//!
-//! A file of its own because it is the one import rule with machinery to carry:
-//! the ABI's derived signature, its map into wasmi's value types, and a rendering
-//! of a function type for the refusal.
-//!
-//! **Arity and value types are the whole of it** — an `i64` in an `i32`'s place, or
-//! a `u32` parameter read as one wasm parameter rather than two. **Parameter order
-//! is invisible**: nearly everything lowers to `i32`, so two swapped parameters of
-//! the same type leave the function type identical.
-
-use wasmi::{FuncType, ValType};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-
-/// Whether this import declares the type the engine registers — one that does not
-/// is what a module parts from the linker over at instantiation.
-pub(super) fn check_signature(
-    function: HostFunctionSpec,
-    imported: &FuncType,
-) -> Result<(), String> {
-    let registered = registered_type(function);
-    if *imported == registered {
-        return Ok(());
-    }
-    Err(format!(
-        "'{}' expected '{}', found '{}'",
-        function.wasm_name(),
-        signature(&registered),
-        signature(imported)
-    ))
-}
-
-/// The type the engine registers `function` as: the wasm signature derived from its
-/// declaration, in wasmi's own vocabulary.
-///
-/// Building one to compare against costs nothing — `FuncType` holds up to 21 value
-/// types inline on a 64-bit target and the ABI's widest signature is nine, so this
-/// is a stack value and the comparison above is one `==`.
-pub(super) fn registered_type(function: HostFunctionSpec) -> FuncType {
-    FuncType::new(
-        function.wasm_params().iter().copied().map(val_type),
-        function.wasm_result().map(val_type),
-    )
-}
-
-/// The one place the ABI's value types become the engine's.
-fn val_type(declared: WasmValType) -> ValType {
-    match declared {
-        WasmValType::I32 => ValType::I32,
-        WasmValType::I64 => ValType::I64,
-    }
-}
-
-/// A function type as `(i32, i32) -> i32`, and as `(i32, i32)` for a function
-/// answering nothing — the spelling [`super::entry_point_fault`] uses, so the two
-/// stages describe a signature the same way.
-fn signature(ty: &FuncType) -> String {
-    let params = to_string(ty.params());
-    match ty.results() {
-        [] => format!("({params})"),
-        results => format!("({params}) -> {}", to_string(results)),
-    }
-}
-
-/// The types of one position, as a signature lists them.
-fn to_string(types: &[ValType]) -> String {
-    types
-        .iter()
-        .copied()
-        .map(as_str)
-        .collect::<Vec<_>>()
-        .join(", ")
-}
-
-/// A wasm value type as the text format spells it. Total over [`ValType`] because a
-/// refusal renders the found side too, which is whatever the module declared.
-fn as_str(val_type: ValType) -> &'static str {
-    match val_type {
-        ValType::I32 => "i32",
-        ValType::I64 => "i64",
-        ValType::F32 => "f32",
-        ValType::F64 => "f64",
-        ValType::V128 => "v128",
-        ValType::FuncRef => "funcref",
-        ValType::ExternRef => "externref",
-    }
-}
-
-/// The rule and the derivation under it, on function types built directly. Which
-/// `CheckError` a refusal becomes and where this rule sits among the other three
-/// are the parent's tests.
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The three ways an import's type can differ from the one registered, each
-    /// against a real declaration: a wrong value type, a wrong arity, and a result
-    /// where the ABI answers nothing.
-    ///
-    /// The arity case is the one that matters in practice — a guest that reads
-    /// `check_keylet`'s `seq: u32` as a scalar writes exactly that signature.
-    #[test]
-    fn an_import_of_the_wrong_type_is_refused() {
-        let refusal = check_signature(
-            HostFunctionSpec::GetLedgerSqn,
-            &FuncType::new([ValType::I64, ValType::I64], [ValType::I32]),
-        )
-        .expect_err("i64 where i32 belongs");
-        assert_eq!(
-            refusal,
-            "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::CheckKeylet,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a u32 read as one parameter rather than two");
-        assert_eq!(
-            refusal,
-            "'check_id' expected '(i32, i32, i32, i32, i32, i32) -> i32', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::Trace,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a result from the one function that answers nothing");
-        assert_eq!(
-            refusal,
-            "'trace' expected '(i32, i32, i32, i32, i32)', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-    }
-
-    /// Both of the ABI's value types survive the map to the engine's vocabulary:
-    /// an `i64` collapsed to an `i32` would make the check accept what the linker
-    /// refuses, and a result invented for `trace` would make it refuse what the
-    /// linker accepts.
-    #[test]
-    fn the_derived_type_keeps_i64_and_the_absent_result() {
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::FloatFromInt)),
-            "(i64, i32, i32, i32) -> i32"
-        );
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::Trace)),
-            "(i32, i32, i32, i32, i32)"
-        );
-    }
-}