feat: Migrate coroutine tests from Boost.Coroutine to C++20 coroutines

Migrate Coroutine_test and JobQueue_test from Boost.Coroutine to
C++20 std::coroutine using CoroTask/CoroTaskRunner:

- Coroutine_test: Replace Coro-based coroutine tests with CoroTask
  equivalents using co_await runner->yieldAndPost().
- JobQueue_test: Replace Coro suspend/resume patterns with CoroTask
  equivalents, use pointer-by-value captures in coroutine lambdas
  to avoid dangling reference issues.

.clang-tidy

@@ -104,10 +104,13 @@ Checks: "-*,
   readability-const-return-type,
   readability-container-contains,
   readability-container-size-empty,
+  readability-convert-member-functions-to-static,
   readability-duplicate-include,
   readability-else-after-return,
   readability-enum-initial-value,
+  readability-implicit-bool-conversion,
   readability-make-member-function-const,
+  readability-math-missing-parentheses,
   readability-misleading-indentation,
   readability-non-const-parameter,
   readability-redundant-casting,
@@ -116,7 +119,9 @@ Checks: "-*,
   readability-redundant-member-init,
   readability-redundant-string-init,
   readability-reference-to-constructed-temporary,
+  readability-simplify-boolean-expr,
   readability-static-definition-in-anonymous-namespace,
+  readability-suspicious-call-argument,
   readability-use-std-min-max
   "
 # ---
@@ -127,14 +132,9 @@ Checks: "-*,
 # misc-include-cleaner,
 # misc-redundant-expression,
 #
-# readability-convert-member-functions-to-static,
-# readability-implicit-bool-conversion,
-# readability-inconsistent-declaration-parameter-name,
+# readability-inconsistent-declaration-parameter-name, # in this codebase this check will break a lot of arg names
+# readability-static-accessed-through-instance,        # this check is probably unnecessary. it makes the code less readable
 # readability-identifier-naming,
-# readability-math-missing-parentheses,
-# readability-simplify-boolean-expr,
-# readability-suspicious-call-argument,
-# readability-static-accessed-through-instance,
 #
 # modernize-concat-nested-namespaces,
 # modernize-pass-by-value,

.github/workflows/reusable-build-test-config.yml

@@ -298,7 +298,7 @@ jobs:
 
       - name: Upload coverage report
         if: ${{ github.repository == 'XRPLF/rippled' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           disable_search: true
           disable_telem: true

.github/workflows/reusable-clang-tidy.yml

@@ -51,5 +51,5 @@ jobs:
     if: ${{ always() && !cancelled() && (!inputs.check_only_changed || needs.determine-files.outputs.any_cpp_changed == 'true' || needs.determine-files.outputs.clang_tidy_config_changed == 'true') }}
     uses: ./.github/workflows/reusable-clang-tidy-files.yml
     with:
-      files: ${{ needs.determine-files.outputs.clang_tidy_config_changed == 'true' && '' || (inputs.check_only_changed && needs.determine-files.outputs.all_changed_files || '') }}
+      files: ${{ (needs.determine-files.outputs.clang_tidy_config_changed != 'true' && inputs.check_only_changed) && needs.determine-files.outputs.all_changed_files || '' }}
       create_issue_on_failure: ${{ inputs.create_issue_on_failure }}

BUILD.md

@@ -125,9 +125,9 @@ default profile.
 
 ### Patched recipes
 
-The recipes in Conan Center occasionally need to be patched for compatibility
-with the latest version of `xrpld`. We maintain a fork of the Conan Center
-[here](https://github.com/XRPLF/conan-center-index/) containing the patches.
+Occasionally, we need patched recipes or recipes not present in Conan Center.
+We maintain a fork of the Conan Center Index
+[here](https://github.com/XRPLF/conan-center-index/) containing the modified and newly added recipes.
 
 To ensure our patched recipes are used, you must add our Conan remote at a
 higher index than the default Conan Center remote, so it is consulted first. You
@@ -137,19 +137,11 @@ can do this by running:
 conan remote add --index 0 xrplf https://conan.ripplex.io
 ```
 
-Alternatively, you can pull the patched recipes into the repository and use them
-locally:
+Alternatively, you can pull our recipes from the repository and export them locally:
 
 ```bash
-# Extract the version number from the lockfile.
-function extract_version {
-  version=$(cat conan.lock | sed -nE "s@.+${1}/(.+)#.+@\1@p" | head -n1)
-  echo ${version}
-}
-
 # Define which recipes to export.
-recipes=('ed25519' 'grpc' 'nudb' 'openssl' 'secp256k1' 'snappy' 'soci')
-folders=('all'     'all'  'all'  '3.x.x'   'all'       'all'    'all')
+recipes=('abseil' 'ed25519' 'grpc' 'm4' 'mpt-crypto' 'nudb' 'openssl' 'secp256k1' 'snappy' 'soci' 'wasm-xrplf' 'wasmi')
 
 # Selectively check out the recipes from our CCI fork.
 cd external
@@ -158,29 +150,19 @@ cd conan-center-index
 git init
 git remote add origin git@github.com:XRPLF/conan-center-index.git
 git sparse-checkout init
-for ((index = 1; index <= ${#recipes[@]}; index++)); do
-  recipe=${recipes[index]}
-  folder=${folders[index]}
-  echo "Checking out recipe '${recipe}' from folder '${folder}'..."
-  git sparse-checkout add recipes/${recipe}/${folder}
+for recipe in "${recipes[@]}"; do
+  echo "Checking out recipe '${recipe}'..."
+  git sparse-checkout add recipes/${recipe}
 done
 git fetch origin master
 git checkout master
-cd ../..
 
-# Export the recipes into the local cache.
-for ((index = 1; index <= ${#recipes[@]}; index++)); do
-  recipe=${recipes[index]}
-  folder=${folders[index]}
-  version=$(extract_version ${recipe})
-  echo "Exporting '${recipe}/${version}' from '${recipe}/${folder}'..."
-  conan export --version $(extract_version ${recipe}) \
-    external/conan-center-index/recipes/${recipe}/${folder}
-done
+./export_all.sh
+cd ../../
 ```
 
 In the case we switch to a newer version of a dependency that still requires a
-patch, it will be necessary for you to pull in the changes and re-export the
+patch or add a new dependency, it will be necessary for you to pull in the changes and re-export the
 updated dependencies with the newer version. However, if we switch to a newer
 version that no longer requires a patch, no action is required on your part, as
 the new recipe will be automatically pulled from the official Conan Center.
@@ -189,6 +171,8 @@ the new recipe will be automatically pulled from the official Conan Center.
 > You might need to add `--lockfile=""` to your `conan install` command
 > to avoid automatic use of the existing `conan.lock` file when you run
 > `conan export` manually on your machine
+>
+> This is not recommended though, as you might end up using different revisions of recipes.
 
 ### Conan profile tweaks
 
@@ -204,39 +188,14 @@ Possible values are ['5.0', '5.1', '6.0', '6.1', '7.0', '7.3', '8.0', '8.1',
 Read "http://docs.conan.io/2/knowledge/faq.html#error-invalid-setting"
 ```
 
-you need to amend the list of compiler versions in
-`$(conan config home)/settings.yml`, by appending the required version number(s)
+you need to add your compiler to the list of compiler versions in
+`$(conan config home)/settings_user.yml`, by adding the required version number(s)
 to the `version` array specific for your compiler. For example:
 
 ```yaml
-apple-clang:
-  version:
-    [
-      "5.0",
-      "5.1",
-      "6.0",
-      "6.1",
-      "7.0",
-      "7.3",
-      "8.0",
-      "8.1",
-      "9.0",
-      "9.1",
-      "10.0",
-      "11.0",
-      "12.0",
-      "13",
-      "13.0",
-      "13.1",
-      "14",
-      "14.0",
-      "15",
-      "15.0",
-      "16",
-      "16.0",
-      "17",
-      "17.0",
-    ]
+compiler:
+  apple-clang:
+    version: ["17.0"]
 ```
 
 #### Multiple compilers

BoostToStdCoroutineTaskList.md

@@ -0,0 +1,142 @@
+# Boost.Coroutine to C++20 Migration — Task List
+
+> Parent document: [BoostToStdCoroutineSwitchPlan.md](BoostToStdCoroutineSwitchPlan.md)
+
+---
+
+## Milestone 1: New Coroutine Primitives
+
+- [ ] **1.1** Design `CoroTask<T>` class with `promise_type`
+  - Define `promise_type` with `initial_suspend`, `final_suspend`, `unhandled_exception`, `return_value`/`return_void`
+  - Implement `FinalAwaiter` for continuation support
+  - Implement move-only RAII handle wrapper
+  - Support both `CoroTask<T>` and `CoroTask<void>`
+
+- [ ] **1.2** Design and implement `JobQueueAwaiter`
+  - `await_suspend()` calls `jq_.addJob(type, name, [h]{ h.resume(); })`
+  - Handle `addJob()` failure (shutdown) — resume with error flag or throw
+  - Integrate `nSuspend_` counter increment/decrement
+
+- [ ] **1.3** Implement `LocalValues` swap in new coroutine resume path
+  - Before `handle.resume()`: save thread-local, install coroutine-local
+  - After `handle.resume()` returns: restore thread-local
+  - Ensure this works when coroutine migrates between threads
+
+- [ ] **1.4** Add `postCoroTask()` template to `JobQueue`
+  - Accept callable returning `CoroTask<void>`
+  - Schedule initial execution on JobQueue (mirror `postCoro()` behavior)
+  - Return a handle/shared_ptr for join/cancel
+
+- [ ] **1.5** Write unit tests (`src/test/core/CoroTask_test.cpp`)
+  - Test `CoroTask<void>` runs to completion
+  - Test `CoroTask<int>` returns value
+  - Test exception propagation across co_await
+  - Test coroutine destruction before completion
+  - Test `JobQueueAwaiter` schedules on correct thread
+  - Test `LocalValue` isolation across 4+ coroutines
+  - Test shutdown rejection (addJob returns false)
+  - Test `correct_order` equivalent (yield → join → post → complete)
+  - Test `incorrect_order` equivalent (post → yield → complete)
+  - Test multiple sequential co_await points
+
+- [ ] **1.6** Verify build on GCC 12+, Clang 16+
+- [ ] **1.7** Run ASAN + TSAN on new tests
+- [ ] **1.8** Run full `--unittest` suite (no regressions)
+- [ ] **1.9** Self-review and create PR #1
+
+---
+
+## Milestone 2: Entry Point Migration
+
+- [ ] **2.1** Migrate `ServerHandler::onRequest()` (`ServerHandler.cpp:287`)
+  - Replace `m_jobQueue.postCoro(jtCLIENT_RPC, ...)` with `postCoroTask()`
+  - Update lambda to return `CoroTask<void>` (add `co_return`)
+  - Update `processSession` to accept new coroutine type
+
+- [ ] **2.2** Migrate `ServerHandler::onWSMessage()` (`ServerHandler.cpp:325`)
+  - Replace `m_jobQueue.postCoro(jtCLIENT_WEBSOCKET, ...)` with `postCoroTask()`
+  - Update lambda signature
+
+- [ ] **2.3** Migrate `GRPCServer::CallData::process()` (`GRPCServer.cpp:102`)
+  - Replace `app_.getJobQueue().postCoro(JobType::jtRPC, ...)` with `postCoroTask()`
+  - Update `process(shared_ptr<Coro> coro)` overload signature
+
+- [ ] **2.4** Update `RPC::Context` (`Context.h:27`)
+  - Replace `std::shared_ptr<JobQueue::Coro> coro{}` with new coroutine wrapper type
+  - Ensure all code that accesses `context.coro` compiles
+
+- [ ] **2.5** Update `ServerHandler.h` signatures
+  - `processSession()` and `processRequest()` parameter types
+
+- [ ] **2.6** Update `GRPCServer.h` signatures
+  - `process()` method parameter types
+
+- [ ] **2.7** Run full `--unittest` suite
+- [ ] **2.8** Manual smoke test: HTTP + WS + gRPC RPC requests
+- [ ] **2.9** Run ASAN + TSAN
+- [ ] **2.10** Self-review and create PR #2
+
+---
+
+## Milestone 3: Handler Migration
+
+- [ ] **3.1** Migrate `doRipplePathFind()` (`RipplePathFind.cpp`)
+  - Replace `context.coro->yield()` with `co_await PathFindAwaiter{...}`
+  - Replace continuation lambda's `coro->post()` / `coro->resume()` with awaiter scheduling
+  - Handle shutdown case (post failure) in awaiter
+
+- [ ] **3.2** Create `PathFindAwaiter` (or use generic `JobQueueAwaiter`)
+  - Encapsulate the continuation + yield pattern from `RipplePathFind.cpp` lines 108-132
+
+- [ ] **3.3** Update `Path_test.cpp`
+  - Replace `postCoro` usage with `postCoroTask`
+  - Ensure `context.coro` usage matches new type
+
+- [ ] **3.4** Update `AMMTest.cpp`
+  - Replace `postCoro` usage with `postCoroTask`
+
+- [ ] **3.5** Rewrite `Coroutine_test.cpp` for new API
+  - `correct_order`: postCoroTask → co_await → join → resume → complete
+  - `incorrect_order`: post before yield equivalent
+  - `thread_specific_storage`: 4 coroutines with LocalValue isolation
+
+- [ ] **3.6** Update `JobQueue_test.cpp` `testPostCoro`
+  - Migrate to `postCoroTask` API
+
+- [ ] **3.7** Verify `ripple_path_find` works end-to-end with new coroutines
+- [ ] **3.8** Test shutdown-during-pathfind scenario
+- [ ] **3.9** Run full `--unittest` suite
+- [ ] **3.10** Run ASAN + TSAN
+- [ ] **3.11** Self-review and create PR #3
+
+---
+
+## Milestone 4: Cleanup & Validation
+
+- [ ] **4.1** Delete `include/xrpl/core/Coro.ipp`
+- [ ] **4.2** Remove from `JobQueue.h`:
+  - `#include <boost/coroutine2/all.hpp>`
+  - `struct Coro_create_t`
+  - `class Coro` (entire class)
+  - `postCoro()` template
+  - Comment block (lines 322-377) describing old race condition
+- [ ] **4.3** Update `cmake/deps/Boost.cmake`:
+  - Remove `coroutine` from `find_package(Boost REQUIRED COMPONENTS ...)`
+  - Remove `Boost::coroutine` from `target_link_libraries`
+- [ ] **4.4** Update `cmake/XrplInterface.cmake`:
+  - Remove `BOOST_COROUTINES2_NO_DEPRECATION_WARNING`
+- [ ] **4.5** Run memory benchmark
+  - Create N=1000 coroutines, compare RSS: before vs after
+  - Document results
+- [ ] **4.6** Run context switch benchmark
+  - 100K yield/resume cycles, compare latency: before vs after
+  - Document results
+- [ ] **4.7** Run RPC throughput benchmark
+  - Concurrent `ripple_path_find` requests, compare throughput
+  - Document results
+- [ ] **4.8** Run full `--unittest` suite
+- [ ] **4.9** Run ASAN, TSAN, UBSan
+  - Confirm `__asan_handle_no_return` warnings are gone
+- [ ] **4.10** Verify build on all supported compilers
+- [ ] **4.11** Self-review and create PR #4
+- [ ] **4.12** Document final benchmark results in PR description

CONTRIBUTING.md

@@ -259,6 +259,10 @@ There is a Continuous Integration job that runs clang-tidy on pull requests. The
 
 This ensures that configuration changes don't introduce new warnings across the codebase.
 
+### Installing clang-tidy
+
+See the [environment setup guide](./docs/build/environment.md#clang-tidy) for platform-specific installation instructions.
+
 ### Running clang-tidy locally
 
 Before running clang-tidy, you must build the project to generate required files (particularly protobuf headers). Refer to [`BUILD.md`](./BUILD.md) for build instructions.
@@ -266,10 +270,15 @@ Before running clang-tidy, you must build the project to generate required files
 Then run clang-tidy on your local changes:
 
 ```
-run-clang-tidy -p build src tests
+run-clang-tidy -p build src include tests
 ```
 
-This will check all source files in the `src` and `tests` directories using the compile commands from your `build` directory.
+This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
+If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix` to the above command:
+
+```
+run-clang-tidy -p build -fix src include tests
+```
 
 ## Contracts and instrumentation
 

LICENSE.md

@@ -1,7 +1,7 @@
 ISC License
 
 Copyright (c) 2011, Arthur Britto, David Schwartz, Jed McCaleb, Vinnie Falco, Bob Way, Eric Lombrozo, Nikolaos D. Bougalis, Howard Hinnant.
-Copyright (c) 2012-2025, the XRP Ledger developers.
+Copyright (c) 2012-present, the XRP Ledger developers.
 
 Permission to use, copy, modify, and distribute this software for any
 purpose with or without fee is hereby granted, provided that the above

conan.lock

@@ -1,16 +1,16 @@
 {
     "version": "0.5",
     "requires": [
-        "zlib/1.3.1#b8bc2603263cf7eccbd6e17e66b0ed76%1765850150.075",
+        "zlib/1.3.1#cac0f6daea041b0ccf42934163defb20%1765284699.337",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1765850149.987",
         "sqlite3/3.49.1#8631739a4c9b93bd3d6b753bac548a63%1765850149.926",
         "soci/4.0.3#a9f8d773cd33e356b5879a4b0564f287%1765850149.46",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1765850147.878",
-        "secp256k1/0.7.1#3a61e95e220062ef32c48d019e9c81f7%1770306721.686",
+        "secp256k1/0.7.1#481881709eb0bdd0185a12b912bbe8ad%1770910500.329",
         "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1765850186.86",
-        "re2/20230301#ca3b241baec15bd31ea9187150e0b333%1765850148.103",
-        "protobuf/6.32.1#f481fd276fc23a33b85a3ed1e898b693%1765850161.038",
-        "openssl/3.5.5#05a4ac5b7323f7a329b2db1391d9941f%1769599205.414",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1772560729.95",
+        "protobuf/6.32.1#b54f00da2e0f61d821330b5b638b0f80%1768401317.762",
+        "openssl/3.5.5#e6399de266349245a4542fc5f6c71552%1774367199.56",
         "nudb/2.0.9#0432758a24204da08fee953ec9ea03cb%1769436073.32",
         "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1765850143.914",
         "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1765842973.492",
@@ -18,27 +18,27 @@
         "libarchive/3.8.1#ffee18995c706e02bf96e7a2f7042e0d%1765850144.736",
         "jemalloc/5.3.0#e951da9cf599e956cebc117880d2d9f8%1729241615.244",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1768312129.152",
-        "grpc/1.72.0#f244a57bff01e708c55a1100b12e1589%1765850193.734",
+        "grpc/1.72.0#aaade9421980b2d926dbfb613d56c38a%1774376249.106",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1765850143.772",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1765850143.772",
-        "c-ares/1.34.5#5581c2b62a608b40bb85d965ab3ec7c8%1765850144.336",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1766500685.317",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1765850143.837",
         "boost/1.90.0#d5e8defe7355494953be18524a7f135b%1769454080.269",
-        "abseil/20250127.0#99262a368bd01c0ccca8790dfced9719%1766517936.993"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "build_requires": [
-        "zlib/1.3.1#b8bc2603263cf7eccbd6e17e66b0ed76%1765850150.075",
-        "strawberryperl/5.32.1.1#707032463aa0620fa17ec0d887f5fe41%1765850165.196",
-        "protobuf/6.32.1#f481fd276fc23a33b85a3ed1e898b693%1765850161.038",
+        "zlib/1.3.1#cac0f6daea041b0ccf42934163defb20%1765284699.337",
+        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1751971032.423",
+        "protobuf/6.32.1#b54f00da2e0f61d821330b5b638b0f80%1768401317.762",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1765850144.707",
-        "msys2/cci.latest#eea83308ad7e9023f7318c60d5a9e6cb%1770199879.083",
-        "m4/1.4.19#70dc8bbb33e981d119d2acc0175cf381%1763158052.846",
-        "cmake/4.2.0#ae0a44f44a1ef9ab68fd4b3e9a1f8671%1765850153.937",
-        "cmake/3.31.10#313d16a1aa16bbdb2ca0792467214b76%1765850153.479",
-        "b2/5.3.3#107c15377719889654eb9a162a673975%1765850144.355",
+        "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
+        "m4/1.4.19#5d7a4994e5875d76faf7acf3ed056036%1774365463.87",
+        "cmake/4.3.0#b939a42e98f593fb34d3a8c5cc860359%1773780142.26",
+        "cmake/3.31.11#f325c933f618a1fcebc1e1c0babfd1ba%1769622857.944",
+        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1766594659.866",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#99262a368bd01c0ccca8790dfced9719%1766517936.993"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "python_requires": [],
     "overrides": {
@@ -46,13 +46,13 @@
             null,
             "boost/1.90.0"
         ],
-        "protobuf/5.27.0": [
+        "protobuf/[>=5.27.0 <7]": [
             "protobuf/6.32.1"
         ],
         "lz4/1.9.4": [
             "lz4/1.10.0"
         ],
-        "sqlite3/3.44.2": [
+        "sqlite3/[>=3.44 <4]": [
             "sqlite3/3.49.1"
         ],
         "boost/1.83.0": [

conanfile.py

@@ -1,5 +1,5 @@
-import re
 import os
+import re
 
 from conan.tools.cmake import CMake, CMakeToolchain, cmake_layout
 

cspell.config.yaml

@@ -70,6 +70,7 @@ words:
   - coeffs
   - coldwallet
   - compr
+  - cppcoro
   - conanfile
   - conanrun
   - confs
@@ -105,6 +106,7 @@ words:
   - fmtdur
   - fsanitize
   - funclets
+  - gantt
   - gcov
   - gcovr
   - ghead
@@ -148,6 +150,7 @@ words:
   - ltype
   - mcmodel
   - MEMORYSTATUSEX
+  - Mankawde
   - Merkle
   - Metafuncton
   - misprediction
@@ -196,6 +199,7 @@ words:
   - permissioned
   - pointee
   - populator
+  - pratik
   - preauth
   - preauthorization
   - preauthorize
@@ -204,6 +208,7 @@ words:
   - protobuf
   - protos
   - ptrs
+  - Pratik
   - pushd
   - pyenv
   - pyparsing
@@ -211,6 +216,8 @@ words:
   - queuable
   - Raphson
   - replayer
+  - repost
+  - reposts
   - rerere
   - retriable
   - RIPD
@@ -242,6 +249,7 @@ words:
   - soci
   - socidb
   - sslws
+  - stackful
   - statsd
   - STATSDCOLLECTOR
   - stissue
@@ -297,6 +305,7 @@ words:
   - venv
   - vfalco
   - vinnie
+  - wasmi
   - wextra
   - wptr
   - writeme

docs/build/environment.md

@@ -109,3 +109,32 @@ Install CMake with Homebrew too:
 ```
 brew install cmake
 ```
+
+## Clang-tidy
+
+Clang-tidy is required to run static analysis checks locally (see [CONTRIBUTING.md](../../CONTRIBUTING.md)).
+It is not required to build the project. Currently this project uses clang-tidy version 21.
+
+### Linux
+
+LLVM 21 is not available in the default Debian 12 (Bookworm) repositories.
+Install it using the official LLVM apt installer:
+
+```
+wget https://apt.llvm.org/llvm.sh
+chmod +x llvm.sh
+sudo ./llvm.sh 21
+sudo apt install --yes clang-tidy-21
+```
+
+Then use `run-clang-tidy-21` when running clang-tidy locally.
+
+### macOS
+
+Install LLVM 21 via Homebrew:
+
+```
+brew install llvm@21
+```
+
+Then use `run-clang-tidy` from the LLVM 21 Homebrew prefix when running clang-tidy locally.

include/xrpl/beast/utility/instrumentation.h

@@ -15,7 +15,7 @@
 #define ALWAYS_OR_UNREACHABLE(cond, message) assert((message) && (cond))
 #define SOMETIMES(cond, message, ...)
 #define REACHABLE(message, ...)
-#define UNREACHABLE(message, ...) assert((message) && false)
+#define UNREACHABLE(message, ...) assert((message) && false)  // NOLINT(misc-static-assert)
 #endif
 
 #define XRPL_ASSERT ALWAYS_OR_UNREACHABLE

include/xrpl/core/CoroTask.h

@@ -0,0 +1,699 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+
+#include <coroutine>
+#include <exception>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace xrpl {
+
+template <typename T = void>
+class CoroTask;
+
+/**
+ * CoroTask<void> -- coroutine return type for void-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<void>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - exception_    : std::exception_ptr           |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_void()                                |
+ *   | + unhandled_exception()                        |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter
+ *   +-----------------------------------------------+
+ *   | await_suspend(h):                              |
+ *   |   if continuation_ set -> symmetric transfer   |
+ *   |   else                 -> noop_coroutine        |
+ *   +-----------------------------------------------+
+ *
+ * Design Notes
+ * ------------
+ * - Lazy start: initial_suspend returns suspend_always, so the coroutine
+ *   body does not execute until the handle is explicitly resumed.
+ * - Symmetric transfer: await_suspend returns a coroutine_handle instead
+ *   of void/bool, allowing the scheduler to jump directly to the next
+ *   coroutine without growing the call stack.
+ * - Continuation chaining: when one CoroTask is co_await-ed inside
+ *   another, the caller's handle is stored as continuation_ so
+ *   FinalAwaiter can resume it when this task finishes.
+ * - Move-only: the handle is exclusively owned; copy is deleted.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Basic void coroutine (the most common case in rippled):
+ *
+ *      CoroTask<void> doWork(std::shared_ptr<CoroTaskRunner> runner) {
+ *          // do something
+ *          co_await runner->suspend();   // yield control
+ *          // resumed later via runner->post() or runner->resume()
+ *          co_return;
+ *      }
+ *
+ * 2. co_await-ing one CoroTask<void> from another (chaining):
+ *
+ *      CoroTask<void> inner() {
+ *          // ...
+ *          co_return;
+ *      }
+ *      CoroTask<void> outer() {
+ *          co_await inner();   // continuation_ links outer -> inner
+ *          co_return;          // FinalAwaiter resumes outer
+ *      }
+ *
+ * 3. Exceptions propagate through co_await:
+ *
+ *      CoroTask<void> failing() {
+ *          throw std::runtime_error("oops");
+ *          co_return;
+ *      }
+ *      CoroTask<void> caller() {
+ *          try { co_await failing(); }
+ *          catch (std::runtime_error const&) { // caught here }
+ *      }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Dangling references in coroutine parameters.
+ *   Coroutine parameters are copied into the frame, but references
+ *   are NOT -- they are stored as-is. If the referent goes out of scope
+ *   before the coroutine finishes, you get use-after-free.
+ *
+ *      // BROKEN -- local dies before coroutine runs:
+ *      CoroTask<void> bad(int& ref) { co_return; }
+ *      void launch() {
+ *          int local = 42;
+ *          auto task = bad(local);  // frame stores &local
+ *      }  // local destroyed; frame holds dangling ref
+ *
+ *      // FIX -- pass by value, or ensure lifetime via shared_ptr.
+ *
+ * BUG-RISK: GCC 14 corrupts reference captures in coroutine lambdas.
+ *   When a lambda that returns CoroTask captures by reference ([&]),
+ *   GCC 14 may generate a corrupted coroutine frame. Always capture
+ *   by explicit pointer-to-value instead:
+ *
+ *      // BROKEN on GCC 14:
+ *      jq.postCoroTask(t, n, [&](auto) -> CoroTask<void> { ... });
+ *
+ *      // FIX -- capture pointers explicitly:
+ *      jq.postCoroTask(t, n, [ptr = &val](auto) -> CoroTask<void> { ... });
+ *
+ * BUG-RISK: Resuming a destroyed or completed CoroTask.
+ *   Calling handle().resume() after the coroutine has already run to
+ *   completion (done() == true) is undefined behavior. The CoroTaskRunner
+ *   guards against this with an XRPL_ASSERT, but standalone usage of
+ *   CoroTask must check done() before resuming.
+ *
+ * BUG-RISK: Moving a CoroTask that is being awaited.
+ *   If task A is co_await-ed by task B (so A.continuation_ == B), moving
+ *   or destroying A will invalidate the continuation link. Never move
+ *   or reassign a CoroTask while it is mid-execution or being awaited.
+ *
+ * LIMITATION: CoroTask is fire-and-forget for the top-level owner.
+ *   There is no built-in notification when the coroutine finishes.
+ *   The caller must use external synchronization (e.g. CoroTaskRunner::join
+ *   or a gate/condition_variable) to know when it is done.
+ *
+ * LIMITATION: No cancellation token.
+ *   There is no way to cancel a suspended CoroTask from outside. The
+ *   coroutine body must cooperatively check a flag (e.g. jq_.isStopping())
+ *   after each co_await and co_return early if needed.
+ *
+ * LIMITATION: Stackless -- cannot suspend from nested non-coroutine calls.
+ *   If a coroutine calls a regular function that wants to "yield", it
+ *   cannot. Only the immediate coroutine body can use co_await.
+ *   This is acceptable for rippled because all yield() sites are shallow.
+ */
+template <>
+class CoroTask<void>
+{
+public:
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise. Compiler uses this to manage coroutine state.
+     * Stores the exception (if any) and the continuation handle for
+     * symmetric transfer back to the awaiting coroutine.
+     */
+    struct promise_type
+    {
+        // Captured exception from the coroutine body, rethrown in
+        // await_resume() when this task is co_await-ed by a caller.
+        std::exception_ptr exception_;
+
+        // Handle to the coroutine that is co_await-ing this task.
+        // Set by await_suspend(). FinalAwaiter uses it for symmetric
+        // transfer back to the caller. Null if this is a top-level task.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. The coroutine body does not execute until the
+         * handle is explicitly resumed (e.g. by CoroTaskRunner::resume).
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Awaiter returned by final_suspend(). Uses symmetric transfer:
+         * if a continuation exists, transfers control directly to it
+         * (tail-call, no stack growth). Otherwise returns noop_coroutine
+         * so the coroutine frame stays alive for the owner to destroy.
+         */
+        struct FinalAwaiter
+        {
+            /**
+             * Always false. We need await_suspend to run for
+             * symmetric transfer.
+             */
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Symmetric transfer: returns the continuation handle so
+             * the compiler emits a tail-call instead of a nested resume.
+             * If no continuation is set, returns noop_coroutine to
+             * suspend at final_suspend without destroying the frame.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        /**
+         * Returns FinalAwaiter for symmetric transfer at coroutine end.
+         */
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return;` (void coroutine).
+         */
+        void
+        return_void()
+        {
+        }
+
+        /**
+         * Called by the compiler when an exception escapes the coroutine
+         * body. Captures it for later rethrowing in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            exception_ = std::current_exception();
+        }
+    };
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `co_await someCoroTask;` --
+
+    /**
+     * Always false. This task is lazy, so co_await always suspends
+     * the caller to set up the continuation link.
+     */
+    bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores the caller's handle as our continuation, then returns
+     * our handle for symmetric transfer (caller suspends, we resume).
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;  // Symmetric transfer
+    }
+
+    /**
+     * Called in the awaiting coroutine's context after this task
+     * completes. Rethrows any exception captured by
+     * unhandled_exception().
+     */
+    void
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_resume : handle is valid");
+        if (auto& ep = handle_.promise().exception_)
+            std::rethrow_exception(ep);
+    }
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+/**
+ * CoroTask<T> -- coroutine return type for value-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<T>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - result_       : variant<monostate, T,        |
+ *   |                           exception_ptr>       |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_value(T)     -> stores in result_[1]  |
+ *   | + unhandled_exception -> stores in result_[2]  |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter  (same symmetric-transfer pattern as CoroTask<void>)
+ *
+ * Value Extraction
+ * ----------------
+ * await_resume() inspects the variant:
+ *   - index 2 (exception_ptr) -> rethrow
+ *   - index 1 (T)             -> return value via move
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Simple value return:
+ *
+ *      CoroTask<int> computeAnswer() { co_return 42; }
+ *
+ *      CoroTask<void> caller() {
+ *          int v = co_await computeAnswer();  // v == 42
+ *      }
+ *
+ * 2. Chaining value-returning coroutines:
+ *
+ *      CoroTask<int> add(int a, int b) { co_return a + b; }
+ *      CoroTask<int> doubleSum(int a, int b) {
+ *          int s = co_await add(a, b);
+ *          co_return s * 2;
+ *      }
+ *
+ * 3. Exception propagation from inner to outer:
+ *
+ *      CoroTask<int> failing() {
+ *          throw std::runtime_error("bad");
+ *          co_return 0;  // never reached
+ *      }
+ *      CoroTask<void> caller() {
+ *          try {
+ *              int v = co_await failing();  // throws here
+ *          } catch (std::runtime_error const& e) {
+ *              // e.what() == "bad"
+ *          }
+ *      }
+ *
+ * Caveats / Pitfalls (in addition to CoroTask<void> caveats above)
+ * ================================================================
+ *
+ * BUG-RISK: await_resume() moves the value out of the variant.
+ *   Calling co_await on the same CoroTask<T> instance twice is undefined
+ *   behavior -- the second call will see a moved-from T. CoroTask is
+ *   single-shot: one co_return, one co_await.
+ *
+ * BUG-RISK: T must be move-constructible.
+ *   return_value(T) takes by value and moves into the variant.
+ *   Types that are not movable cannot be used as T.
+ *
+ * LIMITATION: No co_yield support.
+ *   CoroTask<T> only supports a single co_return. It does not implement
+ *   yield_value(), so using co_yield inside a CoroTask<T> coroutine is a
+ *   compile error. For streaming values, a different return type
+ *   (e.g. Generator<T>) would be needed.
+ *
+ * LIMITATION: Result is only accessible via co_await.
+ *   There is no .get() or .result() method. The value can only be
+ *   extracted by co_await-ing the CoroTask<T> from inside another
+ *   coroutine. For extracting results in non-coroutine code, pass a
+ *   pointer to the caller and write through it (as the tests do).
+ */
+template <typename T>
+class CoroTask
+{
+    static_assert(
+        std::is_move_constructible_v<T>,
+        "CoroTask<T> requires T to be move-constructible");
+
+public:
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise for value-returning coroutines.
+     * Stores the result as a variant: monostate (not yet set),
+     * T (co_return value), or exception_ptr (unhandled exception).
+     */
+    struct promise_type
+    {
+        // Tri-state result:
+        //   index 0 (monostate) -- coroutine has not yet completed
+        //   index 1 (T)         -- co_return value stored here
+        //   index 2 (exception) -- unhandled exception captured here
+        std::variant<std::monostate, T, std::exception_ptr> result_;
+
+        // Handle to the coroutine co_await-ing this task. Used by
+        // FinalAwaiter for symmetric transfer. Null for top-level tasks.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. Coroutine body does not run until explicitly resumed.
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Symmetric-transfer awaiter at coroutine completion.
+         * Same pattern as CoroTask<void>::FinalAwaiter.
+         */
+        struct FinalAwaiter
+        {
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Returns continuation for symmetric transfer, or
+             * noop_coroutine if this is a top-level task.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return value;`.
+         * Moves the value into result_ at index 1.
+         *
+         * @param value The value to store
+         */
+        void
+        return_value(T value)
+        {
+            result_.template emplace<1>(std::move(value));
+        }
+
+        /**
+         * Captures unhandled exceptions at index 2 of result_.
+         * Rethrown later in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            result_.template emplace<2>(std::current_exception());
+        }
+    };
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `T val = co_await someCoroTask;` --
+
+    /**
+     * Always false. co_await always suspends to set up continuation.
+     */
+    bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores caller as continuation, returns our handle for
+     * symmetric transfer.
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;
+    }
+
+    /**
+     * Extracts the result: rethrows if exception, otherwise moves
+     * the T value out of the variant. Single-shot: calling twice
+     * on the same task is undefined (moved-from T).
+     *
+     * @return The co_return-ed value
+     */
+    T
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_resume : handle is valid");
+        auto& result = handle_.promise().result_;
+        if (auto* ep = std::get_if<2>(&result))
+            std::rethrow_exception(*ep);
+        return std::get<1>(std::move(result));
+    }
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+}  // namespace xrpl

include/xrpl/core/CoroTaskRunner.ipp

@@ -0,0 +1,374 @@
+#pragma once
+
+/**
+ * @file CoroTaskRunner.ipp
+ *
+ * CoroTaskRunner inline implementation.
+ *
+ * This file contains the business logic for managing C++20 coroutines
+ * on the JobQueue. It is included at the bottom of JobQueue.h.
+ *
+ * Data Flow: suspend / post / resume cycle
+ * =========================================
+ *
+ *         coroutine body                 CoroTaskRunner              JobQueue
+ *         --------------                 --------------              --------
+ *              |
+ *    co_await runner->suspend()
+ *              |
+ *              +--- await_suspend ------> onSuspend()
+ *              |                            ++nSuspend_ ------------> nSuspend_
+ *              |                          [coroutine is now suspended]
+ *              |
+ *              .    (externally or by yieldAndPost())
+ *              .
+ *              +--- (caller calls) -----> post()
+ *              |                            ++runCount_
+ *              |                            addJob(resume) ----------> job enqueued
+ *              |                                                        |
+ *              |                                                      [worker picks up]
+ *              |                                                        |
+ *              +--- <----- resume() <-----------------------------------+
+ *              |             --nSuspend_ ------> nSuspend_
+ *              |             swap in LocalValues (lvs_)
+ *              |             task_.handle().resume()
+ *              |                |
+ *              |    [coroutine body continues here]
+ *              |                |
+ *              |             swap out LocalValues
+ *              |             --runCount_
+ *              |             cv_.notify_all()
+ *              v
+ *
+ * Thread Safety
+ * =============
+ * - mutex_     : guards task_.handle().resume() so that post()-before-suspend
+ *                races cannot resume the coroutine while it is still running.
+ *                (See the race condition discussion in JobQueue.h)
+ * - mutex_run_ : guards runCount_ counter; used by join() to wait until
+ *                all in-flight resume operations complete.
+ * - jq_.m_mutex: guards nSuspend_ increments/decrements.
+ *
+ * Common Mistakes When Modifying This File
+ * =========================================
+ *
+ * 1. Changing lock ordering.
+ *    resume() acquires locks sequentially (never held simultaneously):
+ *    jq_.m_mutex (released immediately), then mutex_ (held across resume),
+ *    then mutex_run_ (released after decrement). post() acquires only
+ *    mutex_run_. Any new code path must follow the same order.
+ *
+ * 2. Removing the shared_from_this() capture in post().
+ *    The lambda passed to addJob captures [this, sp = shared_from_this()].
+ *    If you remove sp, 'this' can be destroyed before the job runs,
+ *    causing use-after-free. The sp capture is load-bearing.
+ *
+ * 3. Forgetting to decrement nSuspend_ on a new code path.
+ *    Every ++nSuspend_ must have a matching --nSuspend_. If you add a new
+ *    suspension path (e.g. a new awaiter) and forget to decrement on resume
+ *    or on failure, JobQueue::stop() will hang.
+ *
+ * 4. Calling task_.handle().resume() without holding mutex_.
+ *    This allows a race where the coroutine runs on two threads
+ *    simultaneously. Always hold mutex_ around resume().
+ *
+ * 5. Swapping LocalValues outside of the mutex_ critical section.
+ *    The swap-in and swap-out of LocalValues must bracket the resume()
+ *    call. If you move the swap-out before the lock_guard(mutex_) is
+ *    released, you break LocalValue isolation for any code that runs
+ *    after the coroutine suspends but before the lock is dropped.
+ */
+
+namespace xrpl {
+
+/**
+ * Construct a CoroTaskRunner. Sets runCount_ to 0; does not
+ * create the coroutine. Call init() afterwards.
+ *
+ * @param jq   The JobQueue this coroutine will run on
+ * @param type Job type for scheduling priority
+ * @param name Human-readable name for logging
+ */
+inline JobQueue::CoroTaskRunner::CoroTaskRunner(
+    create_t,
+    JobQueue& jq,
+    JobType type,
+    std::string const& name)
+    : jq_(jq), type_(type), name_(name), runCount_(0)
+{
+}
+
+/**
+ * Initialize with a coroutine-returning callable.
+ * Stores the callable on the heap (FuncStore) so it outlives the
+ * coroutine frame. Coroutine frames store a reference to the
+ * callable's implicit object parameter (the lambda). If the callable
+ * is a temporary, that reference dangles after the caller returns.
+ * Keeping the callable alive here ensures the coroutine's captures
+ * remain valid.
+ *
+ * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+ */
+template <class F>
+void
+JobQueue::CoroTaskRunner::init(F&& f)
+{
+    using Fn = std::decay_t<F>;
+    auto store = std::make_unique<FuncStore<Fn>>(std::forward<F>(f));
+    task_ = store->func(shared_from_this());
+    storedFunc_ = std::move(store);
+}
+
+/**
+ * Destructor. Waits for any in-flight resume() to complete, then
+ * asserts (debug) that the coroutine has finished or
+ * expectEarlyExit() was called.
+ *
+ * The join() call is necessary because with async dispatch the
+ * coroutine runs on a worker thread. The gate signal (which wakes
+ * the test thread) can arrive before resume() has set finished_.
+ * join() synchronizes via mutex_run_, establishing a happens-before
+ * edge: finished_ = true -> unlock(mutex_run_) in resume() ->
+ * lock(mutex_run_) in join() -> read finished_.
+ */
+inline JobQueue::CoroTaskRunner::~CoroTaskRunner()
+{
+#ifndef NDEBUG
+    join();
+    XRPL_ASSERT(finished_, "xrpl::JobQueue::CoroTaskRunner::~CoroTaskRunner : is finished");
+#endif
+}
+
+/**
+ * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+ */
+inline void
+JobQueue::CoroTaskRunner::onSuspend()
+{
+    std::lock_guard lock(jq_.m_mutex);
+    ++jq_.nSuspend_;
+}
+
+/**
+ * Decrement nSuspend_ without resuming.
+ */
+inline void
+JobQueue::CoroTaskRunner::onUndoSuspend()
+{
+    std::lock_guard lock(jq_.m_mutex);
+    --jq_.nSuspend_;
+}
+
+/**
+ * Return a SuspendAwaiter whose await_suspend() increments nSuspend_
+ * before the coroutine actually suspends. The caller must later call
+ * post() or resume() to continue execution.
+ *
+ * @return Awaiter for use with `co_await runner->suspend()`
+ */
+inline auto
+JobQueue::CoroTaskRunner::suspend()
+{
+    /**
+     * Custom awaiter for suspend(). Always suspends (await_ready
+     * returns false) and increments nSuspend_ in await_suspend().
+     */
+    struct SuspendAwaiter
+    {
+        CoroTaskRunner& runner_;  // The runner that owns this coroutine.
+
+        /**
+         * Always returns false so the coroutine suspends.
+         */
+        bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        /**
+         * Called when the coroutine suspends. Increments nSuspend_
+         * so the JobQueue knows a coroutine is waiting.
+         */
+        void
+        await_suspend(std::coroutine_handle<>) const
+        {
+            runner_.onSuspend();
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    return SuspendAwaiter{*this};
+}
+
+/**
+ * Suspend and immediately repost on the JobQueue. Equivalent to
+ * `co_await JobQueueAwaiter{runner}` but uses an inline struct
+ * to work around a GCC-12 codegen bug (see declaration in JobQueue.h).
+ *
+ * If the JobQueue is stopping (post fails), the suspend count is
+ * undone and the coroutine is resumed immediately via h.resume().
+ *
+ * @return An inline YieldPostAwaiter
+ */
+inline auto
+JobQueue::CoroTaskRunner::yieldAndPost()
+{
+    struct YieldPostAwaiter
+    {
+        CoroTaskRunner& runner_;
+
+        bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        void
+        await_suspend(std::coroutine_handle<> h)
+        {
+            runner_.onSuspend();
+            if (!runner_.post())
+            {
+                runner_.onUndoSuspend();
+                h.resume();
+            }
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    return YieldPostAwaiter{*this};
+}
+
+/**
+ * Schedule coroutine resumption as a job on the JobQueue.
+ * A shared_ptr capture (sp) prevents this CoroTaskRunner from being
+ * destroyed while the job is queued but not yet executed.
+ *
+ * @return false if the JobQueue rejected the job (shutting down)
+ */
+inline bool
+JobQueue::CoroTaskRunner::post()
+{
+    {
+        std::lock_guard lk(mutex_run_);
+        ++runCount_;
+    }
+
+    // sp prevents 'this' from being destroyed while the job is pending
+    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()]() { resume(); }))
+    {
+        return true;
+    }
+
+    // The coroutine will not run. Undo the runCount_ increment.
+    std::lock_guard lk(mutex_run_);
+    --runCount_;
+    cv_.notify_all();
+    return false;
+}
+
+/**
+ * Resume the coroutine on the current thread.
+ *
+ * Steps:
+ *   1. Decrement nSuspend_ (under jq_.m_mutex)
+ *   2. Swap in this coroutine's LocalValues for thread-local isolation
+ *   3. Resume the coroutine handle (under mutex_)
+ *   4. Swap out LocalValues, restoring the thread's previous state
+ *   5. Decrement runCount_ and notify join() waiters
+ *
+ * @pre post() must have been called before resume(). Direct calls
+ *      without a prior post() will corrupt runCount_ and break join().
+ * Note: runCount_ is NOT incremented here — post() already did that.
+ * This ensures join() stays blocked for the entire post->resume lifetime.
+ */
+inline void
+JobQueue::CoroTaskRunner::resume()
+{
+    {
+        std::lock_guard lock(jq_.m_mutex);
+        --jq_.nSuspend_;
+    }
+    auto saved = detail::getLocalValues().release();
+    detail::getLocalValues().reset(&lvs_);
+    std::lock_guard lock(mutex_);
+    XRPL_ASSERT(
+        task_.handle() && !task_.done(),
+        "xrpl::JobQueue::CoroTaskRunner::resume : task handle is valid and not done");
+    task_.handle().resume();
+    detail::getLocalValues().release();
+    detail::getLocalValues().reset(saved);
+    if (task_.done())
+    {
+        finished_ = true;
+        // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+        // Use std::move (not task_ = {}) so task_.handle_ is null BEFORE the
+        // frame is destroyed. operator= would destroy the frame while handle_
+        // still holds the old value -- a re-entrancy hazard on GCC-12 if
+        // frame destruction triggers runner cleanup.
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    std::lock_guard lk(mutex_run_);
+    --runCount_;
+    cv_.notify_all();
+}
+
+/**
+ * @return true if the coroutine has not yet run to completion
+ */
+inline bool
+JobQueue::CoroTaskRunner::runnable() const
+{
+    // After normal completion, task_ is reset to break the shared_ptr cycle
+    // (handle_ becomes null). A null handle means the coroutine is done.
+    return task_.handle() && !task_.done();
+}
+
+/**
+ * Handle early termination when the coroutine never ran (e.g. JobQueue
+ * is stopping). Decrements nSuspend_ and destroys the coroutine frame
+ * to break the shared_ptr cycle: frame -> lambda -> runner -> frame.
+ */
+inline void
+JobQueue::CoroTaskRunner::expectEarlyExit()
+{
+    if (!finished_)
+    {
+        std::lock_guard lock(jq_.m_mutex);
+        --jq_.nSuspend_;
+        finished_ = true;
+    }
+    // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+    // The coroutine is at initial_suspend and never ran user code, so
+    // destroying it is safe. Use std::move (not task_ = {}) so
+    // task_.handle_ is null before the frame is destroyed.
+    {
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    storedFunc_.reset();
+}
+
+/**
+ * Block until all pending/active resume operations complete.
+ * Uses cv_ + mutex_run_ to wait until runCount_ reaches 0 or
+ * finished_ becomes true. The finished_ check handles the case
+ * where resume() is called directly (without post()), which
+ * decrements runCount_ below zero. In that scenario runCount_
+ * never returns to 0, but finished_ becoming true guarantees
+ * the coroutine is done and no more resumes will occur.
+ */
+inline void
+JobQueue::CoroTaskRunner::join()
+{
+    std::unique_lock<std::mutex> lk(mutex_run_);
+    cv_.wait(lk, [this]() { return runCount_ == 0 || finished_; });
+}
+
+}  // namespace xrpl

include/xrpl/core/JobQueue.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/LocalValue.h>
 #include <xrpl/core/ClosureCounter.h>
+#include <xrpl/core/CoroTask.h>
 #include <xrpl/core/JobTypeData.h>
 #include <xrpl/core/JobTypes.h>
 #include <xrpl/core/detail/Workers.h>
@@ -10,6 +11,7 @@
 #include <boost/context/protected_fixedsize_stack.hpp>
 #include <boost/coroutine2/all.hpp>
 
+#include <coroutine>
 #include <set>
 
 namespace xrpl {
@@ -120,6 +122,419 @@ public:
         join();
     };
 
+    /** C++20 coroutine lifecycle manager. Replaces Coro for new code.
+     *
+     *  Class / Inheritance / Dependency Diagram
+     *  =========================================
+     *
+     *  std::enable_shared_from_this<CoroTaskRunner>
+     *            ^
+     *            | (public inheritance)
+     *            |
+     *  CoroTaskRunner
+     *  +---------------------------------------------------+
+     *  | - lvs_         : detail::LocalValues               |
+     *  | - jq_          : JobQueue&                         |
+     *  | - type_        : JobType                           |
+     *  | - name_        : std::string                       |
+     *  | - runCount_    : int         (in-flight resumes)    |
+     *  | - mutex_       : std::mutex      (coroutine guard) |
+     *  | - mutex_run_   : std::mutex      (join guard)      |
+     *  | - cv_          : condition_variable                 |
+     *  | - task_        : CoroTask<void>                    |
+     *  | - storedFunc_  : unique_ptr<FuncBase> (type-erased)|
+     *  +---------------------------------------------------+
+     *  | + init(F&&)         : set up coroutine callable    |
+     *  | + onSuspend()       : ++jq_.nSuspend_              |
+     *  | + onUndoSuspend()   : --jq_.nSuspend_              |
+     *  | + suspend()         : returns SuspendAwaiter       |
+     *  | + post()            : schedule resume on JobQueue  |
+     *  | + resume()          : resume coroutine on caller   |
+     *  | + runnable()        : !task_.done()                |
+     *  | + expectEarlyExit() : teardown for failed post     |
+     *  | + join()            : block until not running       |
+     *  +---------------------------------------------------+
+     *          |                          |
+     *          | owns                     | references
+     *          v                          v
+     *    CoroTask<void>             JobQueue
+     *    (coroutine frame)          (thread pool + nSuspend_)
+     *
+     *    FuncBase / FuncStore<F>    (type-erased heap storage
+     *                                for the coroutine lambda)
+     *
+     *  Coroutine Lifecycle (Control Flow)
+     *  ===================================
+     *
+     *  Caller thread              JobQueue worker thread
+     *  -------------              ----------------------
+     *  postCoroTask(f)
+     *    |
+     *    +-- check stopping_ (reject if JQ shutting down)
+     *    +-- ++nSuspend_  (lazy start counts as suspended)
+     *    +-- make_shared<CoroTaskRunner>
+     *    +-- init(f)
+     *    |     +-- store lambda on heap (FuncStore)
+     *    |     +-- task_ = f(shared_from_this())
+     *    |           [coroutine created, suspended at initial_suspend]
+     *    +-- post()
+     *    |     +-- ++runCount_
+     *    |     +-- addJob(type_, [resume]{})
+     *    |                                    resume()
+     *    |                                      |
+     *    |                                      +-- --nSuspend_
+     *    |                                      +-- swap in LocalValues
+     *    |                                      +-- task_.handle().resume()
+     *    |                                      |     [coroutine body runs]
+     *    |                                      |     ...
+     *    |                                      |     co_await suspend()
+     *    |                                      |       +-- ++nSuspend_
+     *    |                                      |       [coroutine suspends]
+     *    |                                      +-- swap out LocalValues
+     *    |                                      +-- --runCount_
+     *    |                                      +-- cv_.notify_all()
+     *    |
+     *  post()  <-- called externally or by yieldAndPost()
+     *    +-- ++runCount_
+     *    +-- addJob(type_, [resume]{})
+     *                                         resume()
+     *                                           |
+     *                                           +-- [coroutine body continues]
+     *                                           +-- co_return
+     *                                           +-- --runCount_
+     *                                           +-- cv_.notify_all()
+     *  join()
+     *    +-- cv_.wait([]{runCount_ == 0})
+     *    +-- [done]
+     *
+     *  Usage Examples
+     *  ==============
+     *
+     *  1. Fire-and-forget coroutine (most common pattern):
+     *
+     *      jq.postCoroTask(jtCLIENT, "MyWork",
+     *          [](auto runner) -> CoroTask<void> {
+     *              doSomeWork();
+     *              co_await runner->suspend();  // yield to other jobs
+     *              doMoreWork();
+     *              co_return;
+     *          });
+     *
+     *  2. Manually controlling suspend / resume (external trigger):
+     *
+     *      auto runner = jq.postCoroTask(jtCLIENT, "ExtTrigger",
+     *          [&result](auto runner) -> CoroTask<void> {
+     *              startAsyncOperation(callback);
+     *              co_await runner->suspend();
+     *              // callback called runner->post() to get here
+     *              result = collectResult();
+     *              co_return;
+     *          });
+     *      // ... later, from the callback:
+     *      runner->post();   // reschedule the coroutine on the JobQueue
+     *
+     *  3. Using yieldAndPost() for automatic suspend + repost:
+     *
+     *      jq.postCoroTask(jtCLIENT, "AutoRepost",
+     *          [](auto runner) -> CoroTask<void> {
+     *              step1();
+     *              co_await runner->yieldAndPost();  // yield + auto-repost
+     *              step2();
+     *              co_await runner->yieldAndPost();
+     *              step3();
+     *              co_return;
+     *          });
+     *
+     *  4. Checking shutdown after co_await (cooperative cancellation):
+     *
+     *      jq.postCoroTask(jtCLIENT, "Cancellable",
+     *          [&jq](auto runner) -> CoroTask<void> {
+     *              while (moreWork()) {
+     *                  co_await runner->yieldAndPost();
+     *                  if (jq.isStopping())
+     *                      co_return;  // bail out cleanly
+     *                  processNextItem();
+     *              }
+     *              co_return;
+     *          });
+     *
+     *  Caveats / Pitfalls
+     *  ==================
+     *
+     *  BUG-RISK: Calling suspend() without a matching post()/resume().
+     *    After co_await runner->suspend(), the coroutine is parked and
+     *    nSuspend_ is incremented.  If nothing ever calls post() or
+     *    resume(), the coroutine is leaked and JobQueue::stop() will
+     *    hang forever waiting for nSuspend_ to reach zero.
+     *
+     *  BUG-RISK: Calling post() on an already-running coroutine.
+     *    post() schedules a resume() job.  If the coroutine has not
+     *    actually suspended yet (no co_await executed), the resume job
+     *    will try to call handle().resume() while the coroutine is still
+     *    running on another thread.  This is UB.  The mutex_ prevents
+     *    data corruption but the logic is wrong — always co_await
+     *    suspend() before calling post().  (The test incorrect_order()
+     *    shows this works only because mutex_ serializes the calls.)
+     *
+     *  BUG-RISK: Dropping the shared_ptr<CoroTaskRunner> before join().
+     *    The CoroTaskRunner destructor asserts that finished_ is true
+     *    (the coroutine completed). If you let the last shared_ptr die
+     *    while the coroutine is still running or suspended, you get an
+     *    assertion failure in debug and UB in release.  Always call
+     *    join() or expectEarlyExit() first.
+     *
+     *  BUG-RISK: Lambda captures outliving the coroutine frame.
+     *    The lambda passed to postCoroTask is heap-allocated (FuncStore)
+     *    to prevent dangling.  But objects captured by pointer still need
+     *    their own lifetime management.  If you capture a raw pointer to
+     *    a stack variable, and the stack frame exits before the coroutine
+     *    finishes, the pointer dangles.  Use shared_ptr or ensure the
+     *    pointed-to object outlives the coroutine.
+     *
+     *  BUG-RISK: Forgetting co_return in a void coroutine.
+     *    If the coroutine body falls off the end without co_return,
+     *    the compiler may silently treat it as co_return (per standard),
+     *    but some compilers warn.  Always write explicit co_return.
+     *
+     *  LIMITATION: CoroTaskRunner only supports CoroTask<void>.
+     *    The task_ member is CoroTask<void>.  To return values from
+     *    the top-level coroutine, write through a captured pointer
+     *    (as the tests demonstrate), or co_await inner CoroTask<T>
+     *    coroutines that return values.
+     *
+     *  LIMITATION: One coroutine per CoroTaskRunner.
+     *    init() must be called exactly once.  You cannot reuse a
+     *    CoroTaskRunner to run a second coroutine.  Create a new one
+     *    via postCoroTask() instead.
+     *
+     *  LIMITATION: No timeout on join().
+     *    join() blocks indefinitely.  If the coroutine is suspended
+     *    and never posted, join() will deadlock.  Use timed waits
+     *    on the gate pattern (condition_variable + wait_for) in tests.
+     */
+    class CoroTaskRunner : public std::enable_shared_from_this<CoroTaskRunner>
+    {
+    private:
+        // Per-coroutine thread-local storage. Swapped in before resume()
+        // and swapped out after, so each coroutine sees its own LocalValue
+        // state regardless of which worker thread executes it.
+        detail::LocalValues lvs_;
+
+        // Back-reference to the owning JobQueue. Used to post jobs,
+        // increment/decrement nSuspend_, and acquire jq_.m_mutex.
+        JobQueue& jq_;
+
+        // Job type passed to addJob() when posting this coroutine.
+        JobType type_;
+
+        // Human-readable name for this coroutine job (for logging).
+        std::string name_;
+
+        // Number of in-flight resume operations (pending + active).
+        // Incremented by post(), decremented when resume() finishes.
+        // Guarded by mutex_run_. join() blocks until this reaches 0.
+        //
+        // A counter (not a bool) is needed because post() can be called
+        // from within the coroutine body (e.g. via yieldAndPost()),
+        // enqueuing a second resume while the first is still running.
+        // A bool would be clobbered: R2.post() sets true, then R1's
+        // cleanup sets false — losing the fact that R2 is still pending.
+        int runCount_;
+
+        // Serializes all coroutine resume() calls, preventing concurrent
+        // execution of the coroutine body on multiple threads. Handles the
+        // race where post() enqueues a resume before the coroutine has
+        // actually suspended (post-before-suspend pattern).
+        std::mutex mutex_;
+
+        // Guards runCount_. Used with cv_ for join() to wait
+        // until all pending/active resume operations complete.
+        std::mutex mutex_run_;
+
+        // Notified when runCount_ reaches zero, allowing
+        // join() waiters to wake up.
+        std::condition_variable cv_;
+
+        // The coroutine handle wrapper. Owns the coroutine frame.
+        // Set by init(). Reset to empty in resume() upon coroutine
+        // completion (to break the shared_ptr cycle) or in
+        // expectEarlyExit() on early termination.
+        CoroTask<void> task_;
+
+        /**
+         * Type-erased base for heap-stored callables.
+         * Prevents the coroutine lambda from being destroyed before
+         * the coroutine frame is done with it.
+         *
+         * @see FuncStore
+         */
+        struct FuncBase
+        {
+            virtual ~FuncBase() = default;
+        };
+
+        /**
+         * Concrete type-erased storage for a callable of type F.
+         * The coroutine frame stores a reference to the lambda's implicit
+         * object parameter. If the lambda is a temporary, that reference
+         * dangles after the call returns. FuncStore keeps it alive on
+         * the heap for the lifetime of the CoroTaskRunner.
+         */
+        template <class F>
+        struct FuncStore : FuncBase
+        {
+            F func;  // The stored callable (coroutine lambda).
+            explicit FuncStore(F&& f) : func(std::move(f))
+            {
+            }
+        };
+
+        // Heap-allocated callable storage. Set by init(), ensures the
+        // lambda outlives the coroutine frame that references it.
+        std::unique_ptr<FuncBase> storedFunc_;
+
+        // True once the coroutine has completed or expectEarlyExit() was
+        // called. Asserted in the destructor (debug) to catch leaked
+        // runners. Available in all builds to guard expectEarlyExit()
+        // against double-decrementing nSuspend_.
+        bool finished_ = false;
+
+    public:
+        /**
+         * Tag type for private construction. Prevents external code
+         * from constructing CoroTaskRunner directly. Use postCoroTask().
+         */
+        struct create_t
+        {
+            explicit create_t() = default;
+        };
+
+        /**
+         * Construct a CoroTaskRunner. Private by convention (create_t tag).
+         *
+         * @param jq   The JobQueue this coroutine will run on
+         * @param type Job type for scheduling priority
+         * @param name Human-readable name for logging
+         */
+        CoroTaskRunner(create_t, JobQueue&, JobType, std::string const&);
+
+        CoroTaskRunner(CoroTaskRunner const&) = delete;
+        CoroTaskRunner&
+        operator=(CoroTaskRunner const&) = delete;
+
+        /**
+         * Destructor. Asserts (debug) that the coroutine has finished
+         * or expectEarlyExit() was called.
+         */
+        ~CoroTaskRunner();
+
+        /**
+         * Initialize with a coroutine-returning callable.
+         * Must be called exactly once, after the object is managed by
+         * shared_ptr (because init uses shared_from_this internally).
+         * This is handled automatically by postCoroTask().
+         *
+         * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+         */
+        template <class F>
+        void
+        init(F&& f);
+
+        /**
+         * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+         * Called when the coroutine is about to suspend. Every call
+         * must be balanced by a corresponding decrement (via resume()
+         * or onUndoSuspend()), or JobQueue::stop() will hang.
+         */
+        void
+        onSuspend();
+
+        /**
+         * Decrement nSuspend_ without resuming.
+         * Used to undo onSuspend() when a scheduled post() fails
+         * (e.g. JobQueue is stopping).
+         */
+        void
+        onUndoSuspend();
+
+        /**
+         * Suspend the coroutine.
+         * The awaiter's await_suspend() increments nSuspend_ before the
+         * coroutine actually suspends. The caller must later call post()
+         * or resume() to continue execution.
+         *
+         * @return An awaiter for use with `co_await runner->suspend()`
+         */
+        auto
+        suspend();
+
+        /**
+         * Suspend the coroutine and immediately repost it on the
+         * JobQueue. Combines suspend() + post() atomically inside
+         * await_suspend, so there is no window where an external
+         * event could race between the two.
+         *
+         * Equivalent to JobQueueAwaiter but defined as an inline
+         * awaiter returned from a member function. This avoids a
+         * GCC-12 coroutine codegen bug where an external awaiter
+         * struct (JobQueueAwaiter) used at multiple co_await points
+         * corrupts the coroutine state machine's resume index,
+         * causing the coroutine to hang on the third resumption.
+         *
+         * @return An awaiter for use with `co_await runner->yieldAndPost()`
+         */
+        auto
+        yieldAndPost();
+
+        /**
+         * Schedule coroutine resumption as a job on the JobQueue.
+         * Captures shared_from_this() to prevent this runner from being
+         * destroyed while the job is queued.
+         *
+         * @return true if the job was accepted; false if the JobQueue
+         *         is stopping (caller must handle cleanup)
+         */
+        bool
+        post();
+
+        /**
+         * Resume the coroutine on the current thread.
+         * Decrements nSuspend_, swaps in LocalValues, resumes the
+         * coroutine handle, swaps out LocalValues, and notifies join()
+         * waiters. Lock ordering (sequential, non-overlapping):
+         * jq_.m_mutex -> mutex_ -> mutex_run_.
+         *
+         * @pre post() must have been called before resume(). Direct
+         *      calls without a prior post() will corrupt runCount_
+         *      and break join().
+         */
+        void
+        resume();
+
+        /**
+         * @return true if the coroutine has not yet run to completion
+         */
+        bool
+        runnable() const;
+
+        /**
+         * Handle early termination when the coroutine never ran.
+         * Decrements nSuspend_ and destroys the coroutine frame to
+         * break the shared_ptr cycle (frame -> lambda -> runner -> frame).
+         * Called by postCoroTask() when post() fails.
+         */
+        void
+        expectEarlyExit();
+
+        /**
+         * Block until all pending/active resume operations complete.
+         * Uses cv_ + mutex_run_ to wait until runCount_ reaches 0.
+         * Warning: deadlocks if the coroutine is suspended and never posted.
+         */
+        void
+        join();
+    };
+
     using JobFunction = std::function<void()>;
 
     JobQueue(
@@ -166,6 +581,19 @@ public:
     std::shared_ptr<Coro>
     postCoro(JobType t, std::string const& name, F&& f);
 
+    /** Creates a C++20 coroutine and adds a job to the queue to run it.
+
+        @param t The type of job.
+        @param name Name of the job.
+        @param f Callable with signature
+            CoroTask<void>(std::shared_ptr<CoroTaskRunner>).
+
+        @return shared_ptr to posted CoroTaskRunner. nullptr if not successful.
+    */
+    template <class F>
+    std::shared_ptr<CoroTaskRunner>
+    postCoroTask(JobType t, std::string const& name, F&& f);
+
     /** Jobs waiting at this priority.
      */
     int
@@ -316,7 +744,7 @@ private:
     // Returns the limit of running jobs for the given job type.
     // For jobs with no limit, we return the largest int. Hopefully that
     // will be enough.
-    int
+    static int
     getJobLimit(JobType type);
 };
 
@@ -380,6 +808,7 @@ private:
 }  // namespace xrpl
 
 #include <xrpl/core/Coro.ipp>
+#include <xrpl/core/CoroTaskRunner.ipp>
 
 namespace xrpl {
 
@@ -402,4 +831,69 @@ JobQueue::postCoro(JobType t, std::string const& name, F&& f)
     return coro;
 }
 
+// postCoroTask — entry point for launching a C++20 coroutine on the JobQueue.
+//
+// Control Flow
+// ============
+//
+//   postCoroTask(t, name, f)
+//     |
+//     +-- 1. Check stopping_ — reject if JQ shutting down
+//     |
+//     +-- 2. ++nSuspend_   (mirrors Boost Coro ctor's implicit yield)
+//     |        The coroutine is "suspended" from the JobQueue's perspective
+//     |        even though it hasn't run yet — this keeps the JQ shutdown
+//     |        logic correct (it waits for nSuspend_ to reach 0).
+//     |
+//     +-- 3. Create CoroTaskRunner (shared_ptr, ref-counted)
+//     |
+//     +-- 4. runner->init(f)
+//     |        +-- Heap-allocate the lambda (FuncStore) to prevent
+//     |        |   dangling captures in the coroutine frame
+//     |        +-- task_ = f(shared_from_this())
+//     |              [coroutine created but NOT started — lazy initial_suspend]
+//     |
+//     +-- 5. runner->post()
+//     |        +-- addJob(type_, [resume]{})   → resume on worker thread
+//     |        +-- failure (JQ stopping):
+//     |              +-- runner->expectEarlyExit()
+//     |              |     --nSuspend_, destroy coroutine frame
+//     |              +-- return nullptr
+//
+// Why async post() instead of synchronous resume()?
+// ==================================================
+// The initial dispatch MUST use async post() so the coroutine body runs on
+// a JobQueue worker thread, not the caller's thread.  resume() swaps the
+// caller's thread-local LocalValues with the coroutine's private copy.
+// If the coroutine mutates LocalValues (e.g. thread_specific_storage test),
+// those mutations bleed back into the caller's thread-local state after the
+// swap-out, corrupting subsequent tests that share the same thread pool.
+// Async post() avoids this by running the coroutine on a worker thread whose
+// LocalValues are managed by the thread pool, not by the caller.
+//
+template <class F>
+std::shared_ptr<JobQueue::CoroTaskRunner>
+JobQueue::postCoroTask(JobType t, std::string const& name, F&& f)
+{
+    // Reject if the JQ is shutting down — matches addJob()'s stopping_ check.
+    // Must check before incrementing nSuspend_ to avoid leaving an orphan
+    // count that would cause stop() to hang.
+    if (stopping_)
+        return nullptr;
+
+    {
+        std::lock_guard lock(m_mutex);
+        ++nSuspend_;
+    }
+
+    auto runner = std::make_shared<CoroTaskRunner>(CoroTaskRunner::create_t{}, *this, t, name);
+    runner->init(std::forward<F>(f));
+    if (!runner->post())
+    {
+        runner->expectEarlyExit();
+        runner.reset();
+    }
+    return runner;
+}
+
 }  // namespace xrpl

include/xrpl/core/JobQueueAwaiter.h

@@ -0,0 +1,206 @@
+#pragma once
+
+#include <xrpl/core/JobQueue.h>
+
+#include <coroutine>
+#include <memory>
+
+namespace xrpl {
+
+/**
+ * Awaiter that suspends and immediately reschedules on the JobQueue.
+ * Equivalent to calling yield() followed by post() in the old Coro API.
+ *
+ * Usage:
+ *     co_await JobQueueAwaiter{runner};
+ *
+ * What it waits for: The coroutine is re-queued as a job and resumes
+ * when a worker thread picks it up.
+ *
+ * Which thread resumes: A JobQueue worker thread.
+ *
+ * What await_resume() returns: void.
+ *
+ * Dependency Diagram
+ * ==================
+ *
+ *   JobQueueAwaiter
+ *   +----------------------------------------------+
+ *   | + runner : shared_ptr<CoroTaskRunner>         |
+ *   +----------------------------------------------+
+ *   | + await_ready()   -> false (always suspend)   |
+ *   | + await_suspend() -> bool (suspend or cancel) |
+ *   | + await_resume()  -> void                     |
+ *   +----------------------------------------------+
+ *          |                         |
+ *          | uses                    | uses
+ *          v                         v
+ *   CoroTaskRunner              JobQueue
+ *   .onSuspend()                (via runner->post() -> addJob)
+ *   .onUndoSuspend()
+ *   .post()
+ *
+ * Control Flow (await_suspend)
+ * ============================
+ *
+ *   co_await JobQueueAwaiter{runner}
+ *     |
+ *     +-- await_ready() -> false
+ *     +-- await_suspend(handle)
+ *           |
+ *           +-- runner->onSuspend()     // ++nSuspend_
+ *           +-- runner->post()          // addJob to JobQueue
+ *           |     |
+ *           |     +-- success? return noop_coroutine()
+ *           |     |     // coroutine stays suspended;
+ *           |     |     // worker thread will call resume()
+ *           |     +-- failure? (JQ stopping)
+ *           |           +-- runner->onUndoSuspend()  // --nSuspend_
+ *           |           +-- return handle  // symmetric transfer back
+ *           |                              // coroutine continues immediately
+ *           |                              // so it can clean up and co_return
+ *
+ * DEPRECATED — prefer `co_await runner->yieldAndPost()`
+ * =====================================================
+ *
+ * GCC-12 has a coroutine codegen bug where using this external awaiter
+ * struct at multiple co_await points in the same coroutine corrupts the
+ * state machine's resume index. After the second co_await, the third
+ * resumption enters handle().resume() but never reaches await_resume()
+ * or any subsequent user code — the coroutine hangs indefinitely.
+ *
+ * The fix is `co_await runner->yieldAndPost()`, which defines the
+ * awaiter as an inline struct inside a CoroTaskRunner member function.
+ * GCC-12 handles inline awaiters correctly at multiple co_await points.
+ *
+ * This struct is retained for single-use scenarios and documentation
+ * purposes. For any code that may use co_await in a loop or at
+ * multiple points, always use `runner->yieldAndPost()`.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Yield and auto-repost (preferred — works on all compilers):
+ *
+ *     CoroTask<void> handler(auto runner) {
+ *         doPartA();
+ *         co_await runner->yieldAndPost();   // yield + repost
+ *         doPartB();                         // runs on a worker thread
+ *         co_return;
+ *     }
+ *
+ * 2. Multiple yield points in a loop:
+ *
+ *     CoroTask<void> batchProcessor(auto runner) {
+ *         for (auto& item : items) {
+ *             process(item);
+ *             co_await runner->yieldAndPost();  // let other jobs run
+ *         }
+ *         co_return;
+ *     }
+ *
+ * 3. Graceful shutdown — checking after resume:
+ *
+ *     CoroTask<void> longTask(auto runner, JobQueue& jq) {
+ *         while (hasWork()) {
+ *             co_await runner->yieldAndPost();
+ *             // If JQ is stopping, await_suspend resumes the coroutine
+ *             // immediately without re-queuing. Always check
+ *             // isStopping() to decide whether to proceed:
+ *             if (jq.isStopping())
+ *                 co_return;
+ *             doNextChunk();
+ *         }
+ *         co_return;
+ *     }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Using a stale or null runner.
+ *   The runner shared_ptr must be valid and point to the CoroTaskRunner
+ *   that owns the coroutine currently executing. Passing a runner from
+ *   a different coroutine, or a default-constructed shared_ptr, is UB.
+ *
+ * BUG-RISK: Assuming resume happens on the same thread.
+ *   After co_await, the coroutine resumes on whatever worker thread
+ *   picks up the job. Do not rely on thread-local state unless it is
+ *   managed through LocalValue (which CoroTaskRunner automatically
+ *   swaps in/out).
+ *
+ * BUG-RISK: Ignoring the shutdown path.
+ *   When the JobQueue is stopping, post() fails and await_suspend()
+ *   resumes the coroutine immediately (symmetric transfer back to h).
+ *   The coroutine body continues on the same thread. If your code
+ *   after co_await assumes it was re-queued and is running on a worker
+ *   thread, that assumption breaks during shutdown. Always handle the
+ *   "JQ is stopping" case, either by checking jq.isStopping() or by
+ *   letting the coroutine fall through to co_return naturally.
+ *
+ * DIFFERENCE from runner->suspend() + runner->post():
+ *   Both JobQueueAwaiter and yieldAndPost() combine suspend + post
+ *   in one atomic operation. With the manual suspend()/post() pattern,
+ *   there is a window between the two calls where an external event
+ *   could race. The atomic awaiters remove that window — onSuspend()
+ *   and post() happen within the same await_suspend() call while the
+ *   coroutine is guaranteed to be suspended. Use yieldAndPost() unless
+ *   you need an external party to decide *when* to call post().
+ */
+struct JobQueueAwaiter
+{
+    // The CoroTaskRunner that owns the currently executing coroutine.
+    std::shared_ptr<JobQueue::CoroTaskRunner> runner;
+
+    /**
+     * Always returns false so the coroutine suspends.
+     */
+    bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Increment nSuspend (equivalent to yield()) and schedule resume
+     * on the JobQueue (equivalent to post()). If the JobQueue is
+     * stopping, undoes the suspend count and transfers back to the
+     * coroutine so it can clean up and co_return.
+     *
+     * Returns a coroutine_handle<> (symmetric transfer) instead of
+     * bool to work around a GCC-12 codegen bug where bool-returning
+     * await_suspend leaves the coroutine in an invalid state —
+     * neither properly suspended nor resumed — causing a hang.
+     *
+     * WARNING: GCC-12 has an additional codegen bug where using this
+     * external awaiter struct at multiple co_await points in the same
+     * coroutine corrupts the state machine's resume index, causing the
+     * coroutine to hang on the third resumption. Prefer
+     * `co_await runner->yieldAndPost()` which uses an inline awaiter
+     * that GCC-12 handles correctly.
+     *
+     * @return noop_coroutine() to stay suspended (job posted);
+     *         the caller's handle to resume immediately (JQ stopping)
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> h)
+    {
+        XRPL_ASSERT(runner, "xrpl::JobQueueAwaiter::await_suspend : runner is valid");
+        runner->onSuspend();
+        if (!runner->post())
+        {
+            // JobQueue is stopping. Undo the suspend count and
+            // transfer back to the coroutine so it can clean up
+            // and co_return.
+            runner->onUndoSuspend();
+            return h;
+        }
+        return std::noop_coroutine();
+    }
+
+    void
+    await_resume() const noexcept
+    {
+    }
+};
+
+}  // namespace xrpl

include/xrpl/ledger/Credit.h

@@ -1,43 +0,0 @@
-#pragma once
-
-#include <xrpl/ledger/View.h>
-#include <xrpl/protocol/IOUAmount.h>
-#include <xrpl/protocol/STAmount.h>
-
-namespace xrpl {
-
-/** Calculate the maximum amount of IOUs that an account can hold
-    @param ledger the ledger to check against.
-    @param account the account of interest.
-    @param issuer the issuer of the IOU.
-    @param currency the IOU to check.
-    @return The maximum amount that can be held.
-*/
-/** @{ */
-STAmount
-creditLimit(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& issuer,
-    Currency const& currency);
-
-IOUAmount
-creditLimit2(ReadView const& v, AccountID const& acc, AccountID const& iss, Currency const& cur);
-/** @} */
-
-/** Returns the amount of IOUs issued by issuer that are held by an account
-    @param ledger the ledger to check against.
-    @param account the account of interest.
-    @param issuer the issuer of the IOU.
-    @param currency the IOU to check.
-*/
-/** @{ */
-STAmount
-creditBalance(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& issuer,
-    Currency const& currency);
-/** @} */
-
-}  // namespace xrpl

include/xrpl/ledger/View.h

@@ -2,26 +2,23 @@
 
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/OpenView.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/Asset.h>
-#include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/MPTIssue.h>
 #include <xrpl/protocol/Protocol.h>
-#include <xrpl/protocol/Rate.h>
 #include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STObject.h>
-#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
 
+#include <cstdint>
 #include <functional>
-#include <initializer_list>
 #include <map>
+#include <memory>
+#include <optional>
+#include <set>
 #include <utility>
 
 namespace xrpl {
 
-enum class WaiveTransferFee : bool { No = false, Yes };
 enum class SkipEntry : bool { No = false, Yes };
 
 //------------------------------------------------------------------------------
@@ -54,24 +51,6 @@ enum class SkipEntry : bool { No = false, Yes };
 [[nodiscard]] bool
 hasExpired(ReadView const& view, std::optional<std::uint32_t> const& exp);
 
-/** Controls the treatment of frozen account balances */
-enum FreezeHandling { fhIGNORE_FREEZE, fhZERO_IF_FROZEN };
-
-/** Controls the treatment of unauthorized MPT balances */
-enum AuthHandling { ahIGNORE_AUTH, ahZERO_IF_UNAUTHORIZED };
-
-/** Controls whether to include the account's full spendable balance */
-enum SpendableHandling { shSIMPLE_BALANCE, shFULL_BALANCE };
-
-[[nodiscard]] bool
-isGlobalFrozen(ReadView const& view, AccountID const& issuer);
-
-[[nodiscard]] bool
-isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue);
-
-[[nodiscard]] bool
-isGlobalFrozen(ReadView const& view, Asset const& asset);
-
 // Note, depth parameter is used to limit the recursion depth
 [[nodiscard]] bool
 isVaultPseudoAccountFrozen(
@@ -80,175 +59,6 @@ isVaultPseudoAccountFrozen(
     MPTIssue const& mptShare,
     int depth);
 
-[[nodiscard]] bool
-isIndividualFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    Currency const& currency,
-    AccountID const& issuer);
-
-[[nodiscard]] inline bool
-isIndividualFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
-{
-    return isIndividualFrozen(view, account, issue.currency, issue.account);
-}
-
-[[nodiscard]] bool
-isIndividualFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
-
-[[nodiscard]] inline bool
-isIndividualFrozen(ReadView const& view, AccountID const& account, Asset const& asset)
-{
-    return std::visit(
-        [&](auto const& issue) { return isIndividualFrozen(view, account, issue); }, asset.value());
-}
-
-[[nodiscard]] bool
-isFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    Currency const& currency,
-    AccountID const& issuer);
-
-[[nodiscard]] inline bool
-isFrozen(ReadView const& view, AccountID const& account, Issue const& issue, int = 0 /*ignored*/)
-{
-    return isFrozen(view, account, issue.currency, issue.account);
-}
-
-[[nodiscard]] bool
-isFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue, int depth = 0);
-
-/**
- *   isFrozen check is recursive for MPT shares in a vault, descending to
- *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
- *   purely defensive, as we currently do not allow such vaults to be created.
- */
-[[nodiscard]] inline bool
-isFrozen(ReadView const& view, AccountID const& account, Asset const& asset, int depth = 0)
-{
-    return std::visit(
-        [&](auto const& issue) { return isFrozen(view, account, issue, depth); }, asset.value());
-}
-
-[[nodiscard]] inline TER
-checkFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
-{
-    return isFrozen(view, account, issue) ? (TER)tecFROZEN : (TER)tesSUCCESS;
-}
-
-[[nodiscard]] inline TER
-checkFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue)
-{
-    return isFrozen(view, account, mptIssue) ? (TER)tecLOCKED : (TER)tesSUCCESS;
-}
-
-[[nodiscard]] inline TER
-checkFrozen(ReadView const& view, AccountID const& account, Asset const& asset)
-{
-    return std::visit(
-        [&](auto const& issue) { return checkFrozen(view, account, issue); }, asset.value());
-}
-
-[[nodiscard]] bool
-isAnyFrozen(
-    ReadView const& view,
-    std::initializer_list<AccountID> const& accounts,
-    MPTIssue const& mptIssue,
-    int depth = 0);
-
-[[nodiscard]] inline bool
-isAnyFrozen(
-    ReadView const& view,
-    std::initializer_list<AccountID> const& accounts,
-    Issue const& issue)
-{
-    for (auto const& account : accounts)
-    {
-        if (isFrozen(view, account, issue.currency, issue.account))
-            return true;
-    }
-    return false;
-}
-
-[[nodiscard]] inline bool
-isAnyFrozen(
-    ReadView const& view,
-    std::initializer_list<AccountID> const& accounts,
-    Asset const& asset,
-    int depth = 0)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue) {
-            if constexpr (std::is_same_v<TIss, Issue>)
-                return isAnyFrozen(view, accounts, issue);
-            else
-                return isAnyFrozen(view, accounts, issue, depth);
-        },
-        asset.value());
-}
-
-[[nodiscard]] bool
-isDeepFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    Currency const& currency,
-    AccountID const& issuer);
-
-[[nodiscard]] inline bool
-isDeepFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    Issue const& issue,
-    int = 0 /*ignored*/)
-{
-    return isDeepFrozen(view, account, issue.currency, issue.account);
-}
-
-[[nodiscard]] inline bool
-isDeepFrozen(
-    ReadView const& view,
-    AccountID const& account,
-    MPTIssue const& mptIssue,
-    int depth = 0)
-{
-    // Unlike IOUs, frozen / locked MPTs are not allowed to send or receive
-    // funds, so checking "deep frozen" is the same as checking "frozen".
-    return isFrozen(view, account, mptIssue, depth);
-}
-
-/**
- *   isFrozen check is recursive for MPT shares in a vault, descending to
- *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
- *   purely defensive, as we currently do not allow such vaults to be created.
- */
-[[nodiscard]] inline bool
-isDeepFrozen(ReadView const& view, AccountID const& account, Asset const& asset, int depth = 0)
-{
-    return std::visit(
-        [&](auto const& issue) { return isDeepFrozen(view, account, issue, depth); },
-        asset.value());
-}
-
-[[nodiscard]] inline TER
-checkDeepFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
-{
-    return isDeepFrozen(view, account, issue) ? (TER)tecFROZEN : (TER)tesSUCCESS;
-}
-
-[[nodiscard]] inline TER
-checkDeepFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue)
-{
-    return isDeepFrozen(view, account, mptIssue) ? (TER)tecLOCKED : (TER)tesSUCCESS;
-}
-
-[[nodiscard]] inline TER
-checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& asset)
-{
-    return std::visit(
-        [&](auto const& issue) { return checkDeepFrozen(view, account, issue); }, asset.value());
-}
-
 [[nodiscard]] bool
 isLPTokenFrozen(
     ReadView const& view,
@@ -256,159 +66,6 @@ isLPTokenFrozen(
     Issue const& asset,
     Issue const& asset2);
 
-// Returns the amount an account can spend.
-//
-// If shSIMPLE_BALANCE is specified, this is the amount the account can spend
-// without going into debt.
-//
-// If shFULL_BALANCE is specified, this is the amount the account can spend
-// total. Specifically:
-// * The account can go into debt if using a trust line, and the other side has
-// a non-zero limit.
-// * If the account is the asset issuer the limit is defined by the asset /
-//   issuance.
-//
-// <-- saAmount: amount of currency held by account. May be negative.
-[[nodiscard]] STAmount
-accountHolds(
-    ReadView const& view,
-    AccountID const& account,
-    Currency const& currency,
-    AccountID const& issuer,
-    FreezeHandling zeroIfFrozen,
-    beast::Journal j,
-    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
-
-[[nodiscard]] STAmount
-accountHolds(
-    ReadView const& view,
-    AccountID const& account,
-    Issue const& issue,
-    FreezeHandling zeroIfFrozen,
-    beast::Journal j,
-    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
-
-[[nodiscard]] STAmount
-accountHolds(
-    ReadView const& view,
-    AccountID const& account,
-    MPTIssue const& mptIssue,
-    FreezeHandling zeroIfFrozen,
-    AuthHandling zeroIfUnauthorized,
-    beast::Journal j,
-    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
-
-[[nodiscard]] STAmount
-accountHolds(
-    ReadView const& view,
-    AccountID const& account,
-    Asset const& asset,
-    FreezeHandling zeroIfFrozen,
-    AuthHandling zeroIfUnauthorized,
-    beast::Journal j,
-    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
-
-// Returns the amount an account can spend of the currency type saDefault, or
-// returns saDefault if this account is the issuer of the currency in
-// question. Should be used in favor of accountHolds when questioning how much
-// an account can spend while also allowing currency issuers to spend
-// unlimited amounts of their own currency (since they can always issue more).
-[[nodiscard]] STAmount
-accountFunds(
-    ReadView const& view,
-    AccountID const& id,
-    STAmount const& saDefault,
-    FreezeHandling freezeHandling,
-    beast::Journal j);
-
-// Return the account's liquid (not reserved) XRP.  Generally prefer
-// calling accountHolds() over this interface.  However, this interface
-// allows the caller to temporarily adjust the owner count should that be
-// necessary.
-//
-// @param ownerCountAdj positive to add to count, negative to reduce count.
-[[nodiscard]] XRPAmount
-xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj, beast::Journal j);
-
-/** Iterate all items in the given directory. */
-void
-forEachItem(
-    ReadView const& view,
-    Keylet const& root,
-    std::function<void(std::shared_ptr<SLE const> const&)> const& f);
-
-/** Iterate all items after an item in the given directory.
-    @param after The key of the item to start after
-    @param hint The directory page containing `after`
-    @param limit The maximum number of items to return
-    @return `false` if the iteration failed
-*/
-bool
-forEachItemAfter(
-    ReadView const& view,
-    Keylet const& root,
-    uint256 const& after,
-    std::uint64_t const hint,
-    unsigned int limit,
-    std::function<bool(std::shared_ptr<SLE const> const&)> const& f);
-
-/** Iterate all items in an account's owner directory. */
-inline void
-forEachItem(
-    ReadView const& view,
-    AccountID const& id,
-    std::function<void(std::shared_ptr<SLE const> const&)> const& f)
-{
-    return forEachItem(view, keylet::ownerDir(id), f);
-}
-
-/** Iterate all items after an item in an owner directory.
-    @param after The key of the item to start after
-    @param hint The directory page containing `after`
-    @param limit The maximum number of items to return
-    @return `false` if the iteration failed
-*/
-inline bool
-forEachItemAfter(
-    ReadView const& view,
-    AccountID const& id,
-    uint256 const& after,
-    std::uint64_t const hint,
-    unsigned int limit,
-    std::function<bool(std::shared_ptr<SLE const> const&)> const& f)
-{
-    return forEachItemAfter(view, keylet::ownerDir(id), after, hint, limit, f);
-}
-
-/** Returns IOU issuer transfer fee as Rate. Rate specifies
- * the fee as fractions of 1 billion. For example, 1% transfer rate
- * is represented as 1,010,000,000.
- * @param issuer The IOU issuer
- */
-[[nodiscard]] Rate
-transferRate(ReadView const& view, AccountID const& issuer);
-
-/** Returns MPT transfer fee as Rate. Rate specifies
- * the fee as fractions of 1 billion. For example, 1% transfer rate
- * is represented as 1,010,000,000.
- * @param issuanceID MPTokenIssuanceID of MPTTokenIssuance object
- */
-[[nodiscard]] Rate
-transferRate(ReadView const& view, MPTID const& issuanceID);
-
-/** Returns the transfer fee as Rate based on the type of token
- * @param view The ledger view
- * @param amount The amount to transfer
- */
-[[nodiscard]] Rate
-transferRate(ReadView const& view, STAmount const& amount);
-
-/** Returns `true` if the directory is empty
-    @param key The key of the directory
-*/
-[[nodiscard]] bool
-dirIsEmpty(ReadView const& view, Keylet const& k);
-
 // Return the list of enabled amendments
 [[nodiscard]] std::set<uint256>
 getEnabledAmendments(ReadView const& view);
@@ -474,81 +131,6 @@ areCompatible(
 //
 //------------------------------------------------------------------------------
 
-/** Adjust the owner count up or down. */
-void
-adjustOwnerCount(
-    ApplyView& view,
-    std::shared_ptr<SLE> const& sle,
-    std::int32_t amount,
-    beast::Journal j);
-
-/** @{ */
-/** Returns the first entry in the directory, advancing the index
-
-    @deprecated These are legacy function that are considered deprecated
-                and will soon be replaced with an iterator-based model
-                that is easier to use. You should not use them in new code.
-
-    @param view The view against which to operate
-    @param root The root (i.e. first page) of the directory to iterate
-    @param page The current page
-    @param index The index inside the current page
-    @param entry The entry at the current index
-
-    @return true if the directory isn't empty; false otherwise
- */
-bool
-cdirFirst(
-    ReadView const& view,
-    uint256 const& root,
-    std::shared_ptr<SLE const>& page,
-    unsigned int& index,
-    uint256& entry);
-
-bool
-dirFirst(
-    ApplyView& view,
-    uint256 const& root,
-    std::shared_ptr<SLE>& page,
-    unsigned int& index,
-    uint256& entry);
-/** @} */
-
-/** @{ */
-/** Returns the next entry in the directory, advancing the index
-
-    @deprecated These are legacy function that are considered deprecated
-                and will soon be replaced with an iterator-based model
-                that is easier to use. You should not use them in new code.
-
-    @param view The view against which to operate
-    @param root The root (i.e. first page) of the directory to iterate
-    @param page The current page
-    @param index The index inside the current page
-    @param entry The entry at the current index
-
-    @return true if the directory isn't empty; false otherwise
- */
-bool
-cdirNext(
-    ReadView const& view,
-    uint256 const& root,
-    std::shared_ptr<SLE const>& page,
-    unsigned int& index,
-    uint256& entry);
-
-bool
-dirNext(
-    ApplyView& view,
-    uint256 const& root,
-    std::shared_ptr<SLE>& page,
-    unsigned int& index,
-    uint256& entry);
-/** @} */
-
-[[nodiscard]] std::function<void(SLE::ref)>
-describeOwnerDir(AccountID const& account);
-
 [[nodiscard]] TER
 dirLink(
     ApplyView& view,
@@ -556,63 +138,6 @@ dirLink(
     std::shared_ptr<SLE>& object,
     SF_UINT64 const& node = sfOwnerNode);
 
-AccountID
-pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
-
-/**
- *
- * Create pseudo-account, storing pseudoOwnerKey into ownerField.
- *
- * The list of valid ownerField is maintained in View.cpp and the caller to
- * this function must perform necessary amendment check(s) before using a
- * field. The amendment check is **not** performed in createPseudoAccount.
- */
-[[nodiscard]] Expected<std::shared_ptr<SLE>, TER>
-createPseudoAccount(ApplyView& view, uint256 const& pseudoOwnerKey, SField const& ownerField);
-
-// Returns true if and only if sleAcct is a pseudo-account or specific
-// pseudo-accounts in pseudoFieldFilter.
-//
-// Returns false if sleAcct is
-// * NOT a pseudo-account OR
-// * NOT a ltACCOUNT_ROOT OR
-// * null pointer
-[[nodiscard]] bool
-isPseudoAccount(
-    std::shared_ptr<SLE const> sleAcct,
-    std::set<SField const*> const& pseudoFieldFilter = {});
-
-// Returns the list of fields that define an ACCOUNT_ROOT as a pseudo-account if
-// set
-// Pseudo-account designator fields MUST be maintained by including the
-// SField::sMD_PseudoAccount flag in the SField definition. (Don't forget to
-// "| SField::sMD_Default"!) The fields do NOT need to be amendment-gated,
-// since a non-active amendment will not set any field, by definition.
-// Specific properties of a pseudo-account are NOT checked here, that's what
-// InvariantCheck is for.
-[[nodiscard]] std::vector<SField const*> const&
-getPseudoAccountFields();
-
-[[nodiscard]] inline bool
-isPseudoAccount(
-    ReadView const& view,
-    AccountID const& accountId,
-    std::set<SField const*> const& pseudoFieldFilter = {})
-{
-    return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
-}
-
-[[nodiscard]] TER
-canAddHolding(ReadView const& view, Asset const& asset);
-
-/** Validates that the destination SLE and tag are valid
-
-   - Checks that the SLE is not null.
-   - If the SLE requires a destination tag, checks that there is a tag.
-*/
-[[nodiscard]] TER
-checkDestinationAndTag(SLE::const_ref toSle, bool hasDestinationTag);
-
 /** Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
@@ -686,351 +211,6 @@ doWithdraw(
     STAmount const& amount,
     beast::Journal j);
 
-/// Any transactors that call addEmptyHolding() in doApply must call
-/// canAddHolding() in preflight with the same View and Asset
-[[nodiscard]] TER
-addEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    XRPAmount priorBalance,
-    Issue const& issue,
-    beast::Journal journal);
-
-[[nodiscard]] TER
-addEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    XRPAmount priorBalance,
-    MPTIssue const& mptIssue,
-    beast::Journal journal);
-
-[[nodiscard]] inline TER
-addEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    XRPAmount priorBalance,
-    Asset const& asset,
-    beast::Journal journal)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
-            return addEmptyHolding(view, accountID, priorBalance, issue, journal);
-        },
-        asset.value());
-}
-
-[[nodiscard]] TER
-authorizeMPToken(
-    ApplyView& view,
-    XRPAmount const& priorBalance,
-    MPTID const& mptIssuanceID,
-    AccountID const& account,
-    beast::Journal journal,
-    std::uint32_t flags = 0,
-    std::optional<AccountID> holderID = std::nullopt);
-
-// VFALCO NOTE Both STAmount parameters should just
-//             be "Amount", a unit-less number.
-//
-/** Create a trust line
-
-    This can set an initial balance.
-*/
-[[nodiscard]] TER
-trustCreate(
-    ApplyView& view,
-    bool const bSrcHigh,
-    AccountID const& uSrcAccountID,
-    AccountID const& uDstAccountID,
-    uint256 const& uIndex,      // --> ripple state entry
-    SLE::ref sleAccount,        // --> the account being set.
-    bool const bAuth,           // --> authorize account.
-    bool const bNoRipple,       // --> others cannot ripple through
-    bool const bFreeze,         // --> funds cannot leave
-    bool bDeepFreeze,           // --> can neither receive nor send funds
-    STAmount const& saBalance,  // --> balance of account being set.
-                                // Issuer should be noAccount()
-    STAmount const& saLimit,    // --> limit for account being set.
-                                // Issuer should be the account being set.
-    std::uint32_t uSrcQualityIn,
-    std::uint32_t uSrcQualityOut,
-    beast::Journal j);
-
-[[nodiscard]] TER
-removeEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    Issue const& issue,
-    beast::Journal journal);
-
-[[nodiscard]] TER
-removeEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    MPTIssue const& mptIssue,
-    beast::Journal journal);
-
-[[nodiscard]] inline TER
-removeEmptyHolding(
-    ApplyView& view,
-    AccountID const& accountID,
-    Asset const& asset,
-    beast::Journal journal)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
-            return removeEmptyHolding(view, accountID, issue, journal);
-        },
-        asset.value());
-}
-
-[[nodiscard]] TER
-trustDelete(
-    ApplyView& view,
-    std::shared_ptr<SLE> const& sleRippleState,
-    AccountID const& uLowAccountID,
-    AccountID const& uHighAccountID,
-    beast::Journal j);
-
-/** Delete an offer.
-
-    Requirements:
-        The passed `sle` be obtained from a prior
-        call to view.peek()
-*/
-// [[nodiscard]] // nodiscard commented out so Flow, BookTip and others compile.
-TER
-offerDelete(ApplyView& view, std::shared_ptr<SLE> const& sle, beast::Journal j);
-
-//------------------------------------------------------------------------------
-
-//
-// Money Transfers
-//
-
-// Direct send w/o fees:
-// - Redeeming IOUs and/or sending sender's own IOUs.
-// - Create trust line of needed.
-// --> bCheckIssuer : normally require issuer to be involved.
-// [[nodiscard]] // nodiscard commented out so DirectStep.cpp compiles.
-
-/** Calls static rippleCreditIOU if saAmount represents Issue.
- * Calls static rippleCreditMPT if saAmount represents MPTIssue.
- */
-TER
-rippleCredit(
-    ApplyView& view,
-    AccountID const& uSenderID,
-    AccountID const& uReceiverID,
-    STAmount const& saAmount,
-    bool bCheckIssuer,
-    beast::Journal j);
-
-TER
-rippleLockEscrowMPT(
-    ApplyView& view,
-    AccountID const& uGrantorID,
-    STAmount const& saAmount,
-    beast::Journal j);
-
-TER
-rippleUnlockEscrowMPT(
-    ApplyView& view,
-    AccountID const& uGrantorID,
-    AccountID const& uGranteeID,
-    STAmount const& netAmount,
-    STAmount const& grossAmount,
-    beast::Journal j);
-
-/** Calls static accountSendIOU if saAmount represents Issue.
- * Calls static accountSendMPT if saAmount represents MPTIssue.
- */
-[[nodiscard]] TER
-accountSend(
-    ApplyView& view,
-    AccountID const& from,
-    AccountID const& to,
-    STAmount const& saAmount,
-    beast::Journal j,
-    WaiveTransferFee waiveFee = WaiveTransferFee::No);
-
-using MultiplePaymentDestinations = std::vector<std::pair<AccountID, Number>>;
-/** Like accountSend, except one account is sending multiple payments (with the
- *  same asset!) simultaneously
- *
- * Calls static accountSendMultiIOU if saAmount represents Issue.
- * Calls static accountSendMultiMPT if saAmount represents MPTIssue.
- */
-[[nodiscard]] TER
-accountSendMulti(
-    ApplyView& view,
-    AccountID const& senderID,
-    Asset const& asset,
-    MultiplePaymentDestinations const& receivers,
-    beast::Journal j,
-    WaiveTransferFee waiveFee = WaiveTransferFee::No);
-
-[[nodiscard]] TER
-issueIOU(
-    ApplyView& view,
-    AccountID const& account,
-    STAmount const& amount,
-    Issue const& issue,
-    beast::Journal j);
-
-[[nodiscard]] TER
-redeemIOU(
-    ApplyView& view,
-    AccountID const& account,
-    STAmount const& amount,
-    Issue const& issue,
-    beast::Journal j);
-
-[[nodiscard]] TER
-transferXRP(
-    ApplyView& view,
-    AccountID const& from,
-    AccountID const& to,
-    STAmount const& amount,
-    beast::Journal j);
-
-/* Check if MPToken (for MPT) or trust line (for IOU) exists:
- * - StrongAuth - before checking if authorization is required
- * - WeakAuth
- *    for MPT - after checking lsfMPTRequireAuth flag
- *    for IOU - do not check if trust line exists
- * - Legacy
- *    for MPT - before checking lsfMPTRequireAuth flag i.e. same as StrongAuth
- *    for IOU - do not check if trust line exists i.e. same as WeakAuth
- */
-enum class AuthType { StrongAuth, WeakAuth, Legacy };
-
-/** Check if the account lacks required authorization.
- *
- * Return tecNO_AUTH or tecNO_LINE if it does
- * and tesSUCCESS otherwise.
- *
- * If StrongAuth then return tecNO_LINE if the RippleState doesn't exist. Return
- * tecNO_AUTH if lsfRequireAuth is set on the issuer's AccountRoot, and the
- * RippleState does exist, and the RippleState is not authorized.
- *
- * If WeakAuth then return tecNO_AUTH if lsfRequireAuth is set, and the
- * RippleState exists, and is not authorized. Return tecNO_LINE if
- * lsfRequireAuth is set and the RippleState doesn't exist. Consequently, if
- * WeakAuth and lsfRequireAuth is *not* set, this function will return
- * tesSUCCESS even if RippleState does *not* exist.
- *
- * The default "Legacy" auth type is equivalent to WeakAuth.
- */
-[[nodiscard]] TER
-requireAuth(
-    ReadView const& view,
-    Issue const& issue,
-    AccountID const& account,
-    AuthType authType = AuthType::Legacy);
-
-/** Check if the account lacks required authorization.
- *
- * This will also check for expired credentials. If it is called directly
- * from preclaim, the user should convert result tecEXPIRED to tesSUCCESS and
- * proceed to also check permissions with enforceMPTokenAuthorization inside
- * doApply. This will ensure that any expired credentials are deleted.
- *
- * requireAuth check is recursive for MPT shares in a vault, descending to
- * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
- * purely defensive, as we currently do not allow such vaults to be created.
- *
- * If StrongAuth then return tecNO_AUTH if MPToken doesn't exist or
- * lsfMPTRequireAuth is set and MPToken is not authorized. Vault and LoanBroker
- * pseudo-accounts are implicitly authorized.
- *
- * If WeakAuth then return tecNO_AUTH if lsfMPTRequireAuth is set and MPToken
- * doesn't exist or is not authorized (explicitly or via credentials, if
- * DomainID is set in MPTokenIssuance). Consequently, if WeakAuth and
- * lsfMPTRequireAuth is *not* set, this function will return true even if
- * MPToken does *not* exist.
- *
- * The default "Legacy" auth type is equivalent to StrongAuth.
- */
-[[nodiscard]] TER
-requireAuth(
-    ReadView const& view,
-    MPTIssue const& mptIssue,
-    AccountID const& account,
-    AuthType authType = AuthType::Legacy,
-    int depth = 0);
-
-[[nodiscard]] TER inline requireAuth(
-    ReadView const& view,
-    Asset const& asset,
-    AccountID const& account,
-    AuthType authType = AuthType::Legacy)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue_) {
-            return requireAuth(view, issue_, account, authType);
-        },
-        asset.value());
-}
-
-/** Enforce account has MPToken to match its authorization.
- *
- *   Called from doApply - it will check for expired (and delete if found any)
- *   credentials matching DomainID set in MPTokenIssuance. Must be called if
- *   requireAuth(...MPTIssue...) returned tesSUCCESS or tecEXPIRED in preclaim,
- *   which implies that preclaim should replace `tecEXPIRED` with `tesSUCCESS`
- *   in order for the transactor to proceed to doApply.
- *
- *   This function will create MPToken (if needed) on the basis of any
- *   non-expired credentials and will delete any expired credentials, indirectly
- *   via verifyValidDomain, as per DomainID (if set in MPTokenIssuance).
- *
- *   The caller does NOT need to ensure that DomainID is actually set - this
- *   function handles gracefully both cases when DomainID is set and when not.
- *
- *   The caller does NOT need to look for existing MPToken to match
- *   mptIssue/account - this function checks lsfMPTAuthorized of an existing
- *   MPToken iff DomainID is not set.
- *
- *   Do not use for accounts which hold implied permission e.g. object owners or
- *   if MPTokenIssuance does not require authorization. In both cases use
- *   MPTokenAuthorize::authorize if MPToken does not yet exist.
- */
-[[nodiscard]] TER
-enforceMPTokenAuthorization(
-    ApplyView& view,
-    MPTID const& mptIssuanceID,
-    AccountID const& account,
-    XRPAmount const& priorBalance,
-    beast::Journal j);
-
-/** Check if the destination account is allowed
- *  to receive MPT. Return tecNO_AUTH if it doesn't
- *  and tesSUCCESS otherwise.
- */
-[[nodiscard]] TER
-canTransfer(
-    ReadView const& view,
-    MPTIssue const& mptIssue,
-    AccountID const& from,
-    AccountID const& to);
-
-[[nodiscard]] TER
-canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, AccountID const& to);
-
-[[nodiscard]] TER inline canTransfer(
-    ReadView const& view,
-    Asset const& asset,
-    AccountID const& from,
-    AccountID const& to)
-{
-    return std::visit(
-        [&]<ValidIssueType TIss>(TIss const& issue) -> TER {
-            return canTransfer(view, issue, from, to);
-        },
-        asset.value());
-}
-
 /** Deleter function prototype. Returns the status of the entry deletion
  * (if should not be skipped) and if the entry should be skipped. The status
  * is always tesSUCCESS if the entry should be skipped.
@@ -1052,57 +232,6 @@ cleanupOnAccountDelete(
     beast::Journal j,
     std::optional<std::uint16_t> maxNodesToDelete = std::nullopt);
 
-/** Delete trustline to AMM. The passed `sle` must be obtained from a prior
- * call to view.peek(). Fail if neither side of the trustline is AMM or
- * if ammAccountID is seated and is not one of the trustline's side.
- */
-[[nodiscard]] TER
-deleteAMMTrustLine(
-    ApplyView& view,
-    std::shared_ptr<SLE> sleState,
-    std::optional<AccountID> const& ammAccountID,
-    beast::Journal j);
-
-// From the perspective of a vault, return the number of shares to give the
-// depositor when they deposit a fixed amount of assets. Since shares are MPT
-// this number is integral and always truncated in this calculation.
-[[nodiscard]] std::optional<STAmount>
-assetsToSharesDeposit(
-    std::shared_ptr<SLE const> const& vault,
-    std::shared_ptr<SLE const> const& issuance,
-    STAmount const& assets);
-
-// From the perspective of a vault, return the number of assets to take from
-// depositor when they receive a fixed amount of shares. Note, since shares are
-// MPT, they are always an integral number.
-[[nodiscard]] std::optional<STAmount>
-sharesToAssetsDeposit(
-    std::shared_ptr<SLE const> const& vault,
-    std::shared_ptr<SLE const> const& issuance,
-    STAmount const& shares);
-
-enum class TruncateShares : bool { no = false, yes = true };
-
-// From the perspective of a vault, return the number of shares to demand from
-// the depositor when they ask to withdraw a fixed amount of assets. Since
-// shares are MPT this number is integral, and it will be rounded to nearest
-// unless explicitly requested to be truncated instead.
-[[nodiscard]] std::optional<STAmount>
-assetsToSharesWithdraw(
-    std::shared_ptr<SLE const> const& vault,
-    std::shared_ptr<SLE const> const& issuance,
-    STAmount const& assets,
-    TruncateShares truncate = TruncateShares::no);
-
-// From the perspective of a vault, return the number of assets to give the
-// depositor when they redeem a fixed amount of shares. Note, since shares are
-// MPT, they are always an integral number.
-[[nodiscard]] std::optional<STAmount>
-sharesToAssetsWithdraw(
-    std::shared_ptr<SLE const> const& vault,
-    std::shared_ptr<SLE const> const& issuance,
-    STAmount const& shares);
-
 /** Has the specified time passed?
 
     @param now  the current time

include/xrpl/ledger/helpers/AccountRootHelpers.h

@@ -0,0 +1,112 @@
+#pragma once
+
+#include <xrpl/basics/Expected.h>
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+
+#include <memory>
+#include <set>
+#include <vector>
+
+namespace xrpl {
+
+/** Check if the issuer has the global freeze flag set.
+    @param issuer The account to check
+    @return true if the account has global freeze set
+*/
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, AccountID const& issuer);
+
+// Calculate liquid XRP balance for an account.
+// This function may be used to calculate the amount of XRP that
+// the holder is able to freely spend. It subtracts reserve requirements.
+//
+// ownerCountAdj adjusts the owner count in case the caller calculates
+// before ledger entries are added or removed. Positive to add, negative
+// to subtract.
+//
+// @param ownerCountAdj positive to add to count, negative to reduce count.
+[[nodiscard]] XRPAmount
+xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj, beast::Journal j);
+
+/** Adjust the owner count up or down. */
+void
+adjustOwnerCount(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sle,
+    std::int32_t amount,
+    beast::Journal j);
+
+/** Returns IOU issuer transfer fee as Rate. Rate specifies
+ * the fee as fractions of 1 billion. For example, 1% transfer rate
+ * is represented as 1,010,000,000.
+ * @param issuer The IOU issuer
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, AccountID const& issuer);
+
+/** Generate a pseudo-account address from a pseudo owner key.
+    @param pseudoOwnerKey The key to generate the address from
+    @return The generated account ID
+*/
+AccountID
+pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
+
+/** Returns the list of fields that define an ACCOUNT_ROOT as a pseudo-account
+    if set.
+
+    The list is constructed during initialization and is const after that.
+    Pseudo-account designator fields MUST be maintained by including the
+    SField::sMD_PseudoAccount flag in the SField definition.
+*/
+[[nodiscard]] std::vector<SField const*> const&
+getPseudoAccountFields();
+
+/** Returns true if and only if sleAcct is a pseudo-account or specific
+    pseudo-accounts in pseudoFieldFilter.
+
+    Returns false if sleAcct is:
+    - NOT a pseudo-account OR
+    - NOT a ltACCOUNT_ROOT OR
+    - null pointer
+*/
+[[nodiscard]] bool
+isPseudoAccount(
+    std::shared_ptr<SLE const> sleAcct,
+    std::set<SField const*> const& pseudoFieldFilter = {});
+
+/** Convenience overload that reads the account from the view. */
+[[nodiscard]] inline bool
+isPseudoAccount(
+    ReadView const& view,
+    AccountID const& accountId,
+    std::set<SField const*> const& pseudoFieldFilter = {})
+{
+    return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
+}
+
+/**
+ * Create pseudo-account, storing pseudoOwnerKey into ownerField.
+ *
+ * The list of valid ownerField is maintained in AccountRootHelpers.cpp and
+ * the caller to this function must perform necessary amendment check(s)
+ * before using a field. The amendment check is **not** performed in
+ * createPseudoAccount.
+ */
+[[nodiscard]] Expected<std::shared_ptr<SLE>, TER>
+createPseudoAccount(ApplyView& view, uint256 const& pseudoOwnerKey, SField const& ownerField);
+
+/** Checks the destination and tag.
+
+   - Checks that the SLE is not null.
+   - If the SLE requires a destination tag, checks that there is a tag.
+*/
+[[nodiscard]] TER
+checkDestinationAndTag(SLE::const_ref toSle, bool hasDestinationTag);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/DirectoryHelpers.h

@@ -0,0 +1,223 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+
+#include <functional>
+#include <memory>
+#include <type_traits>
+
+namespace xrpl {
+
+namespace detail {
+
+template <
+    class V,
+    class N,
+    class = std::enable_if_t<
+        std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>>>
+bool
+internalDirNext(
+    V& view,
+    uint256 const& root,
+    std::shared_ptr<N>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    auto const& svIndexes = page->getFieldV256(sfIndexes);
+    XRPL_ASSERT(index <= svIndexes.size(), "xrpl::detail::internalDirNext : index inside range");
+
+    if (index >= svIndexes.size())
+    {
+        auto const next = page->getFieldU64(sfIndexNext);
+
+        if (!next)
+        {
+            entry.zero();
+            return false;
+        }
+
+        if constexpr (std::is_const_v<N>)
+        {
+            page = view.read(keylet::page(root, next));
+        }
+        else
+        {
+            page = view.peek(keylet::page(root, next));
+        }
+
+        XRPL_ASSERT(page, "xrpl::detail::internalDirNext : non-null root");
+
+        if (!page)
+            return false;
+
+        index = 0;
+
+        return internalDirNext(view, root, page, index, entry);
+    }
+
+    entry = svIndexes[index++];
+    return true;
+}
+
+template <
+    class V,
+    class N,
+    class = std::enable_if_t<
+        std::is_same_v<std::remove_cv_t<N>, SLE> && std::is_base_of_v<ReadView, V>>>
+bool
+internalDirFirst(
+    V& view,
+    uint256 const& root,
+    std::shared_ptr<N>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    if constexpr (std::is_const_v<N>)
+    {
+        page = view.read(keylet::page(root));
+    }
+    else
+    {
+        page = view.peek(keylet::page(root));
+    }
+
+    if (!page)
+        return false;
+
+    index = 0;
+
+    return internalDirNext(view, root, page, index, entry);
+}
+
+}  // namespace detail
+
+/** @{ */
+/** Returns the first entry in the directory, advancing the index
+
+    @deprecated These are legacy function that are considered deprecated
+                and will soon be replaced with an iterator-based model
+                that is easier to use. You should not use them in new code.
+
+    @param view The view against which to operate
+    @param root The root (i.e. first page) of the directory to iterate
+    @param page The current page
+    @param index The index inside the current page
+    @param entry The entry at the current index
+
+    @return true if the directory isn't empty; false otherwise
+ */
+bool
+cdirFirst(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry);
+
+bool
+dirFirst(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry);
+/** @} */
+
+/** @{ */
+/** Returns the next entry in the directory, advancing the index
+
+    @deprecated These are legacy function that are considered deprecated
+                and will soon be replaced with an iterator-based model
+                that is easier to use. You should not use them in new code.
+
+    @param view The view against which to operate
+    @param root The root (i.e. first page) of the directory to iterate
+    @param page The current page
+    @param index The index inside the current page
+    @param entry The entry at the current index
+
+    @return true if the directory isn't empty; false otherwise
+ */
+bool
+cdirNext(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry);
+
+bool
+dirNext(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry);
+/** @} */
+
+/** Iterate all items in the given directory. */
+void
+forEachItem(
+    ReadView const& view,
+    Keylet const& root,
+    std::function<void(std::shared_ptr<SLE const> const&)> const& f);
+
+/** Iterate all items after an item in the given directory.
+    @param after The key of the item to start after
+    @param hint The directory page containing `after`
+    @param limit The maximum number of items to return
+    @return `false` if the iteration failed
+*/
+bool
+forEachItemAfter(
+    ReadView const& view,
+    Keylet const& root,
+    uint256 const& after,
+    std::uint64_t const hint,
+    unsigned int limit,
+    std::function<bool(std::shared_ptr<SLE const> const&)> const& f);
+
+/** Iterate all items in an account's owner directory. */
+inline void
+forEachItem(
+    ReadView const& view,
+    AccountID const& id,
+    std::function<void(std::shared_ptr<SLE const> const&)> const& f)
+{
+    return forEachItem(view, keylet::ownerDir(id), f);
+}
+
+/** Iterate all items after an item in an owner directory.
+    @param after The key of the item to start after
+    @param hint The directory page containing `after`
+    @param limit The maximum number of items to return
+    @return `false` if the iteration failed
+*/
+inline bool
+forEachItemAfter(
+    ReadView const& view,
+    AccountID const& id,
+    uint256 const& after,
+    std::uint64_t const hint,
+    unsigned int limit,
+    std::function<bool(std::shared_ptr<SLE const> const&)> const& f)
+{
+    return forEachItemAfter(view, keylet::ownerDir(id), after, hint, limit, f);
+}
+
+/** Returns `true` if the directory is empty
+    @param key The key of the directory
+*/
+[[nodiscard]] bool
+dirIsEmpty(ReadView const& view, Keylet const& k);
+
+/** Returns a function that sets the owner on a directory SLE */
+[[nodiscard]] std::function<void(SLE::ref)>
+describeOwnerDir(AccountID const& account);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/MPTokenHelpers.h

@@ -0,0 +1,160 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
+
+#include <initializer_list>
+#include <optional>
+
+namespace xrpl {
+
+//------------------------------------------------------------------------------
+//
+// Freeze checking (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue);
+
+[[nodiscard]] bool
+isIndividualFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
+
+[[nodiscard]] bool
+isFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue, int depth = 0);
+
+[[nodiscard]] bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    MPTIssue const& mptIssue,
+    int depth = 0);
+
+//------------------------------------------------------------------------------
+//
+// Transfer rate (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+/** Returns MPT transfer fee as Rate. Rate specifies
+ * the fee as fractions of 1 billion. For example, 1% transfer rate
+ * is represented as 1,010,000,000.
+ * @param issuanceID MPTokenIssuanceID of MPTTokenIssuance object
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, MPTID const& issuanceID);
+
+//------------------------------------------------------------------------------
+//
+// Holding checks (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+canAddHolding(ReadView const& view, MPTIssue const& mptIssue);
+
+//------------------------------------------------------------------------------
+//
+// Authorization (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+authorizeMPToken(
+    ApplyView& view,
+    XRPAmount const& priorBalance,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    beast::Journal journal,
+    std::uint32_t flags = 0,
+    std::optional<AccountID> holderID = std::nullopt);
+
+/** Check if the account lacks required authorization for MPT.
+ *
+ * requireAuth check is recursive for MPT shares in a vault, descending to
+ * assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ * purely defensive, as we currently do not allow such vaults to be created.
+ */
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy,
+    int depth = 0);
+
+/** Enforce account has MPToken to match its authorization.
+ *
+ *   Called from doApply - it will check for expired (and delete if found any)
+ *   credentials matching DomainID set in MPTokenIssuance. Must be called if
+ *   requireAuth(...MPTIssue...) returned tesSUCCESS or tecEXPIRED in preclaim.
+ */
+[[nodiscard]] TER
+enforceMPTokenAuthorization(
+    ApplyView& view,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    XRPAmount const& priorBalance,
+    beast::Journal j);
+
+/** Check if the destination account is allowed
+ *  to receive MPT. Return tecNO_AUTH if it doesn't
+ *  and tesSUCCESS otherwise.
+ */
+[[nodiscard]] TER
+canTransfer(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& from,
+    AccountID const& to);
+
+//------------------------------------------------------------------------------
+//
+// Empty holding operations (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    MPTIssue const& mptIssue,
+    beast::Journal journal);
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    MPTIssue const& mptIssue,
+    beast::Journal journal);
+
+//------------------------------------------------------------------------------
+//
+// Escrow operations (MPT-specific)
+//
+//------------------------------------------------------------------------------
+
+TER
+rippleLockEscrowMPT(
+    ApplyView& view,
+    AccountID const& uGrantorID,
+    STAmount const& saAmount,
+    beast::Journal j);
+
+TER
+rippleUnlockEscrowMPT(
+    ApplyView& view,
+    AccountID const& uGrantorID,
+    AccountID const& uGranteeID,
+    STAmount const& netAmount,
+    STAmount const& grossAmount,
+    beast::Journal j);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/OfferHelpers.h

@@ -0,0 +1,28 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+
+#include <memory>
+
+namespace xrpl {
+
+/** Delete an offer.
+
+    Requirements:
+        The offer must exist.
+        The caller must have already checked permissions.
+
+    @param view The ApplyView to modify.
+    @param sle The offer to delete.
+    @param j Journal for logging.
+
+    @return tesSUCCESS on success, otherwise an error code.
+*/
+// [[nodiscard]] // nodiscard commented out so Flow, BookTip and others compile.
+TER
+offerDelete(ApplyView& view, std::shared_ptr<SLE> const& sle, beast::Journal j);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/RippleStateHelpers.h

@@ -0,0 +1,255 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/TokenHelpers.h>
+#include <xrpl/protocol/IOUAmount.h>
+#include <xrpl/protocol/Issue.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
+
+//------------------------------------------------------------------------------
+//
+// RippleState (Trustline) helpers
+//
+//------------------------------------------------------------------------------
+
+namespace xrpl {
+
+//------------------------------------------------------------------------------
+//
+// Credit functions (from Credit.h)
+//
+//------------------------------------------------------------------------------
+
+/** Calculate the maximum amount of IOUs that an account can hold
+    @param view the ledger to check against.
+    @param account the account of interest.
+    @param issuer the issuer of the IOU.
+    @param currency the IOU to check.
+    @return The maximum amount that can be held.
+*/
+/** @{ */
+STAmount
+creditLimit(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& issuer,
+    Currency const& currency);
+
+IOUAmount
+creditLimit2(ReadView const& v, AccountID const& acc, AccountID const& iss, Currency const& cur);
+/** @} */
+
+/** Returns the amount of IOUs issued by issuer that are held by an account
+    @param view the ledger to check against.
+    @param account the account of interest.
+    @param issuer the issuer of the IOU.
+    @param currency the IOU to check.
+*/
+/** @{ */
+STAmount
+creditBalance(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& issuer,
+    Currency const& currency);
+/** @} */
+
+//------------------------------------------------------------------------------
+//
+// Freeze checking (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] inline bool
+isIndividualFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
+{
+    return isIndividualFrozen(view, account, issue.currency, issue.account);
+}
+
+[[nodiscard]] bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] inline bool
+isFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
+{
+    return isFrozen(view, account, issue.currency, issue.account);
+}
+
+// Overload with depth parameter for uniformity with MPTIssue version.
+// The depth parameter is ignored for IOUs since they don't have vault recursion.
+[[nodiscard]] inline bool
+isFrozen(ReadView const& view, AccountID const& account, Issue const& issue, int /*depth*/)
+{
+    return isFrozen(view, account, issue);
+}
+
+[[nodiscard]] bool
+isDeepFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer);
+
+[[nodiscard]] inline bool
+isDeepFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& issue,
+    int = 0 /*ignored*/)
+{
+    return isDeepFrozen(view, account, issue.currency, issue.account);
+}
+
+[[nodiscard]] inline TER
+checkDeepFrozen(ReadView const& view, AccountID const& account, Issue const& issue)
+{
+    return isDeepFrozen(view, account, issue) ? (TER)tecFROZEN : (TER)tesSUCCESS;
+}
+
+//------------------------------------------------------------------------------
+//
+// Trust line operations
+//
+//------------------------------------------------------------------------------
+
+/** Create a trust line
+
+    This can set an initial balance.
+*/
+[[nodiscard]] TER
+trustCreate(
+    ApplyView& view,
+    bool const bSrcHigh,
+    AccountID const& uSrcAccountID,
+    AccountID const& uDstAccountID,
+    uint256 const& uIndex,      // --> ripple state entry
+    SLE::ref sleAccount,        // --> the account being set.
+    bool const bAuth,           // --> authorize account.
+    bool const bNoRipple,       // --> others cannot ripple through
+    bool const bFreeze,         // --> funds cannot leave
+    bool bDeepFreeze,           // --> can neither receive nor send funds
+    STAmount const& saBalance,  // --> balance of account being set.
+                                // Issuer should be noAccount()
+    STAmount const& saLimit,    // --> limit for account being set.
+                                // Issuer should be the account being set.
+    std::uint32_t uQualityIn,
+    std::uint32_t uQualityOut,
+    beast::Journal j);
+
+[[nodiscard]] TER
+trustDelete(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sleRippleState,
+    AccountID const& uLowAccountID,
+    AccountID const& uHighAccountID,
+    beast::Journal j);
+
+//------------------------------------------------------------------------------
+//
+// IOU issuance/redemption
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+issueIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j);
+
+[[nodiscard]] TER
+redeemIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j);
+
+//------------------------------------------------------------------------------
+//
+// Authorization and transfer checks (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+/** Check if the account lacks required authorization.
+ *
+ * Return tecNO_AUTH or tecNO_LINE if it does
+ * and tesSUCCESS otherwise.
+ *
+ * If StrongAuth then return tecNO_LINE if the RippleState doesn't exist. Return
+ * tecNO_AUTH if lsfRequireAuth is set on the issuer's AccountRoot, and the
+ * RippleState does exist, and the RippleState is not authorized.
+ *
+ * If WeakAuth then return tecNO_AUTH if lsfRequireAuth is set, and the
+ * RippleState exists, and is not authorized. Return tecNO_LINE if
+ * lsfRequireAuth is set and the RippleState doesn't exist. Consequently, if
+ * WeakAuth and lsfRequireAuth is *not* set, this function will return
+ * tesSUCCESS even if RippleState does *not* exist.
+ *
+ * The default "Legacy" auth type is equivalent to WeakAuth.
+ */
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    Issue const& issue,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy);
+
+/** Check if the destination account is allowed
+ *  to receive IOU. Return terNO_RIPPLE if rippling is
+ *  disabled on both sides and tesSUCCESS otherwise.
+ */
+[[nodiscard]] TER
+canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, AccountID const& to);
+
+//------------------------------------------------------------------------------
+//
+// Empty holding operations (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+/// Any transactors that call addEmptyHolding() in doApply must call
+/// canAddHolding() in preflight with the same View and Asset
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    Issue const& issue,
+    beast::Journal journal);
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    Issue const& issue,
+    beast::Journal journal);
+
+/** Delete trustline to AMM. The passed `sle` must be obtained from a prior
+ * call to view.peek(). Fail if neither side of the trustline is AMM or
+ * if ammAccountID is seated and is not one of the trustline's side.
+ */
+[[nodiscard]] TER
+deleteAMMTrustLine(
+    ApplyView& view,
+    std::shared_ptr<SLE> sleState,
+    std::optional<AccountID> const& ammAccountID,
+    beast::Journal j);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/TokenHelpers.h

@@ -0,0 +1,286 @@
+#pragma once
+
+#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/protocol/Asset.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/TER.h>
+
+#include <initializer_list>
+#include <vector>
+
+namespace xrpl {
+
+//------------------------------------------------------------------------------
+//
+// Enums for token handling
+//
+//------------------------------------------------------------------------------
+
+/** Controls the treatment of frozen account balances */
+enum FreezeHandling { fhIGNORE_FREEZE, fhZERO_IF_FROZEN };
+
+/** Controls the treatment of unauthorized MPT balances */
+enum AuthHandling { ahIGNORE_AUTH, ahZERO_IF_UNAUTHORIZED };
+
+/** Controls whether to include the account's full spendable balance */
+enum SpendableHandling { shSIMPLE_BALANCE, shFULL_BALANCE };
+
+enum class WaiveTransferFee : bool { No = false, Yes };
+
+/* Check if MPToken (for MPT) or trust line (for IOU) exists:
+ * - StrongAuth - before checking if authorization is required
+ * - WeakAuth
+ *    for MPT - after checking lsfMPTRequireAuth flag
+ *    for IOU - do not check if trust line exists
+ * - Legacy
+ *    for MPT - before checking lsfMPTRequireAuth flag i.e. same as StrongAuth
+ *    for IOU - do not check if trust line exists i.e. same as WeakAuth
+ */
+enum class AuthType { StrongAuth, WeakAuth, Legacy };
+
+//------------------------------------------------------------------------------
+//
+// Freeze checking (Asset-based dispatchers)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] bool
+isGlobalFrozen(ReadView const& view, Asset const& asset);
+
+[[nodiscard]] bool
+isIndividualFrozen(ReadView const& view, AccountID const& account, Asset const& asset);
+
+/**
+ *   isFrozen check is recursive for MPT shares in a vault, descending to
+ *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ *   purely defensive, as we currently do not allow such vaults to be created.
+ */
+[[nodiscard]] bool
+isFrozen(ReadView const& view, AccountID const& account, Asset const& asset, int depth = 0);
+
+[[nodiscard]] TER
+checkFrozen(ReadView const& view, AccountID const& account, Issue const& issue);
+
+[[nodiscard]] TER
+checkFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
+
+[[nodiscard]] TER
+checkFrozen(ReadView const& view, AccountID const& account, Asset const& asset);
+
+[[nodiscard]] bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    Issue const& issue);
+
+[[nodiscard]] bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    Asset const& asset,
+    int depth = 0);
+
+[[nodiscard]] bool
+isDeepFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue,
+    int depth = 0);
+
+/**
+ *   isFrozen check is recursive for MPT shares in a vault, descending to
+ *   assets in the vault, up to maxAssetCheckDepth recursion depth. This is
+ *   purely defensive, as we currently do not allow such vaults to be created.
+ */
+[[nodiscard]] bool
+isDeepFrozen(ReadView const& view, AccountID const& account, Asset const& asset, int depth = 0);
+
+[[nodiscard]] TER
+checkDeepFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue);
+
+[[nodiscard]] TER
+checkDeepFrozen(ReadView const& view, AccountID const& account, Asset const& asset);
+
+//------------------------------------------------------------------------------
+//
+// Account balance functions (Asset-based dispatchers)
+//
+//------------------------------------------------------------------------------
+
+// Returns the amount an account can spend.
+//
+// If shSIMPLE_BALANCE is specified, this is the amount the account can spend
+// without going into debt.
+//
+// If shFULL_BALANCE is specified, this is the amount the account can spend
+// total. Specifically:
+// * The account can go into debt if using a trust line, and the other side has
+// a non-zero limit.
+// * If the account is the asset issuer the limit is defined by the asset /
+//   issuance.
+//
+// <-- saAmount: amount of currency held by account. May be negative.
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer,
+    FreezeHandling zeroIfFrozen,
+    beast::Journal j,
+    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Issue const& issue,
+    FreezeHandling zeroIfFrozen,
+    beast::Journal j,
+    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    MPTIssue const& mptIssue,
+    FreezeHandling zeroIfFrozen,
+    AuthHandling zeroIfUnauthorized,
+    beast::Journal j,
+    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
+
+[[nodiscard]] STAmount
+accountHolds(
+    ReadView const& view,
+    AccountID const& account,
+    Asset const& asset,
+    FreezeHandling zeroIfFrozen,
+    AuthHandling zeroIfUnauthorized,
+    beast::Journal j,
+    SpendableHandling includeFullBalance = shSIMPLE_BALANCE);
+
+// Returns the amount an account can spend of the currency type saDefault, or
+// returns saDefault if this account is the issuer of the currency in
+// question. Should be used in favor of accountHolds when questioning how much
+// an account can spend while also allowing currency issuers to spend
+// unlimited amounts of their own currency (since they can always issue more).
+[[nodiscard]] STAmount
+accountFunds(
+    ReadView const& view,
+    AccountID const& id,
+    STAmount const& saDefault,
+    FreezeHandling freezeHandling,
+    beast::Journal j);
+
+/** Returns the transfer fee as Rate based on the type of token
+ * @param view The ledger view
+ * @param amount The amount to transfer
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, STAmount const& amount);
+
+//------------------------------------------------------------------------------
+//
+// Holding operations (Asset-based dispatchers)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+canAddHolding(ReadView const& view, Asset const& asset);
+
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    Asset const& asset,
+    beast::Journal journal);
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    Asset const& asset,
+    beast::Journal journal);
+
+//------------------------------------------------------------------------------
+//
+// Authorization and transfer checks (Asset-based dispatchers)
+//
+//------------------------------------------------------------------------------
+
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    Asset const& asset,
+    AccountID const& account,
+    AuthType authType = AuthType::Legacy);
+
+[[nodiscard]] TER
+canTransfer(ReadView const& view, Asset const& asset, AccountID const& from, AccountID const& to);
+
+//------------------------------------------------------------------------------
+//
+// Money Transfers (Asset-based dispatchers)
+//
+//------------------------------------------------------------------------------
+
+// Direct send w/o fees:
+// - Redeeming IOUs and/or sending sender's own IOUs.
+// - Create trust line of needed.
+// --> bCheckIssuer : normally require issuer to be involved.
+// [[nodiscard]] // nodiscard commented out so DirectStep.cpp compiles.
+
+/** Calls static rippleCreditIOU if saAmount represents Issue.
+ * Calls static rippleCreditMPT if saAmount represents MPTIssue.
+ */
+TER
+rippleCredit(
+    ApplyView& view,
+    AccountID const& uSenderID,
+    AccountID const& uReceiverID,
+    STAmount const& saAmount,
+    bool bCheckIssuer,
+    beast::Journal j);
+
+/** Calls static accountSendIOU if saAmount represents Issue.
+ * Calls static accountSendMPT if saAmount represents MPTIssue.
+ */
+[[nodiscard]] TER
+accountSend(
+    ApplyView& view,
+    AccountID const& from,
+    AccountID const& to,
+    STAmount const& saAmount,
+    beast::Journal j,
+    WaiveTransferFee waiveFee = WaiveTransferFee::No);
+
+using MultiplePaymentDestinations = std::vector<std::pair<AccountID, Number>>;
+/** Like accountSend, except one account is sending multiple payments (with the
+ *  same asset!) simultaneously
+ *
+ * Calls static accountSendMultiIOU if saAmount represents Issue.
+ * Calls static accountSendMultiMPT if saAmount represents MPTIssue.
+ */
+[[nodiscard]] TER
+accountSendMulti(
+    ApplyView& view,
+    AccountID const& senderID,
+    Asset const& asset,
+    MultiplePaymentDestinations const& receivers,
+    beast::Journal j,
+    WaiveTransferFee waiveFee = WaiveTransferFee::No);
+
+[[nodiscard]] TER
+transferXRP(
+    ApplyView& view,
+    AccountID const& from,
+    AccountID const& to,
+    STAmount const& amount,
+    beast::Journal j);
+
+}  // namespace xrpl

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -0,0 +1,81 @@
+#pragma once
+
+#include <xrpl/protocol/STAmount.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+
+#include <memory>
+#include <optional>
+
+namespace xrpl {
+
+/** From the perspective of a vault, return the number of shares to give
+    depositor when they offer a fixed amount of assets. Note, since shares are
+    MPT, this number is integral and always truncated in this calculation.
+
+    @param vault The vault SLE.
+    @param issuance The MPTokenIssuance SLE for the vault's shares.
+    @param assets The amount of assets to convert.
+
+    @return The number of shares, or nullopt on error.
+*/
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets);
+
+/** From the perspective of a vault, return the number of assets to take from
+    depositor when they receive a fixed amount of shares. Note, since shares are
+    MPT, they are always an integral number.
+
+    @param vault The vault SLE.
+    @param issuance The MPTokenIssuance SLE for the vault's shares.
+    @param shares The amount of shares to convert.
+
+    @return The number of assets, or nullopt on error.
+*/
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares);
+
+/** Controls whether to truncate shares instead of rounding. */
+enum class TruncateShares : bool { no = false, yes = true };
+
+/** From the perspective of a vault, return the number of shares to demand from
+    the depositor when they ask to withdraw a fixed amount of assets. Since
+    shares are MPT this number is integral, and it will be rounded to nearest
+    unless explicitly requested to be truncated instead.
+
+    @param vault The vault SLE.
+    @param issuance The MPTokenIssuance SLE for the vault's shares.
+    @param assets The amount of assets to convert.
+    @param truncate Whether to truncate instead of rounding.
+
+    @return The number of shares, or nullopt on error.
+*/
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets,
+    TruncateShares truncate = TruncateShares::no);
+
+/** From the perspective of a vault, return the number of assets to give the
+    depositor when they redeem a fixed amount of shares. Note, since shares are
+    MPT, they are always an integral number.
+
+    @param vault The vault SLE.
+    @param issuance The MPTokenIssuance SLE for the vault's shares.
+    @param shares The amount of shares to convert.
+
+    @return The number of assets, or nullopt on error.
+*/
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares);
+
+}  // namespace xrpl

include/xrpl/protocol/Permissions.h

@@ -72,12 +72,12 @@ public:
     isDelegable(std::uint32_t const& permissionValue, Rules const& rules) const;
 
     // for tx level permission, permission value is equal to tx type plus one
-    uint32_t
-    txToPermissionType(TxType const& type) const;
+    static uint32_t
+    txToPermissionType(TxType const& type);
 
     // tx type value is permission value minus one
-    TxType
-    permissionToTxType(uint32_t const& value) const;
+    static TxType
+    permissionToTxType(uint32_t const& value);
 };
 
 }  // namespace xrpl

include/xrpl/protocol/Serializer.h

@@ -336,7 +336,7 @@ public:
         static_assert(N > 0, "");
     }
 
-    std::size_t
+    [[nodiscard]] bool
     empty() const noexcept
     {
         return remain_ == 0;

include/xrpl/shamap/SHAMap.h

@@ -520,7 +520,7 @@ private:
     // getMissingNodes helper functions
     void
     gmn_ProcessNodes(MissingNodes&, MissingNodes::StackEntry& node);
-    void
+    static void
     gmn_ProcessDeferredReads(MissingNodes&);
 
     // fetch from DB helper function

include/xrpl/tx/ApplyContext.h

@@ -111,7 +111,7 @@ public:
     checkInvariants(TER const result, XRPAmount const fee);
 
 private:
-    TER
+    static TER
     failInvariantCheck(TER const result);
 
     template <std::size_t... Is>

include/xrpl/tx/invariants/FreezeInvariant.h

@@ -48,7 +48,7 @@ private:
     bool
     isValidEntry(std::shared_ptr<SLE const> const& before, std::shared_ptr<SLE const> const& after);
 
-    STAmount
+    static STAmount
     calculateBalanceChange(
         std::shared_ptr<SLE const> const& before,
         std::shared_ptr<SLE const> const& after,
@@ -63,7 +63,7 @@ private:
     std::shared_ptr<SLE const>
     findIssuer(AccountID const& issuerID, ReadView const& view);
 
-    bool
+    static bool
     validateIssuerChanges(
         std::shared_ptr<SLE const> const& issuer,
         IssuerChanges const& changes,
@@ -71,7 +71,7 @@ private:
         beast::Journal const& j,
         bool enforce);
 
-    bool
+    static bool
     validateFrozenState(
         BalanceChange const& change,
         bool high,

include/xrpl/tx/invariants/InvariantCheck.h

@@ -111,7 +111,7 @@ public:
     void
     visitEntry(bool, std::shared_ptr<SLE const> const&, std::shared_ptr<SLE const> const&);
 
-    bool
+    static bool
     finalize(STTx const&, TER const, XRPAmount const, ReadView const&, beast::Journal const&);
 };
 

include/xrpl/tx/invariants/LoanInvariant.h

@@ -41,8 +41,8 @@ class ValidLoanBroker
     // for LoanBroker pseudo-accounts.
     std::vector<SLE::const_pointer> mpts_;
 
-    bool
-    goodZeroDirectory(ReadView const& view, SLE::const_ref dir, beast::Journal const& j) const;
+    static bool
+    goodZeroDirectory(ReadView const& view, SLE::const_ref dir, beast::Journal const& j);
 
 public:
     void

include/xrpl/tx/paths/detail/StrandFlow.h

@@ -1,7 +1,9 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/ledger/Credit.h>
+#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/OfferHelpers.h>
+#include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/protocol/Feature.h>
 #include <xrpl/protocol/IOUAmount.h>
 #include <xrpl/protocol/XRPAmount.h>

include/xrpl/tx/transactors/dex/AMMUtils.h

@@ -3,6 +3,7 @@
 #include <xrpl/basics/Expected.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/TER.h>

include/xrpl/tx/transactors/dex/AMMWithdraw.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/tx/Transactor.h>
 
 namespace xrpl {

src/libxrpl/basics/Number.cpp

@@ -981,7 +981,7 @@ root(Number f, unsigned d)
     auto ex = [e = e, di = di]()  // Euclidean remainder of e/d
     {
         int k = (e >= 0 ? e : e - (di - 1)) / di;
-        int k2 = e - k * di;
+        int k2 = e - (k * di);
         if (k2 == 0)
             return 0;
         return di - k2;
@@ -998,7 +998,7 @@ root(Number f, unsigned d)
     }
 
     // Quadratic least squares curve fit of f^(1/d) in the range [0, 1]
-    auto const D = ((6 * di + 11) * di + 6) * di + 1;
+    auto const D = (((6 * di + 11) * di + 6) * di) + 1;
     auto const a0 = 3 * di * ((2 * di - 3) * di + 1);
     auto const a1 = 24 * di * (2 * di - 1);
     auto const a2 = -30 * (di - 1) * di;

src/libxrpl/basics/ResolverAsio.cpp

@@ -169,7 +169,7 @@ public:
         XRPL_ASSERT(m_stopped == true, "xrpl::ResolverAsioImpl::start : stopped");
         XRPL_ASSERT(m_stop_called == false, "xrpl::ResolverAsioImpl::start : not stopping");
 
-        if (m_stopped.exchange(false) == true)
+        if (m_stopped.exchange(false))
         {
             {
                 std::lock_guard lk{m_mut};
@@ -182,7 +182,7 @@ public:
     void
     stop_async() override
     {
-        if (m_stop_called.exchange(true) == false)
+        if (!m_stop_called.exchange(true))
         {
             boost::asio::dispatch(
                 m_io_context,
@@ -229,7 +229,7 @@ public:
     {
         XRPL_ASSERT(m_stop_called == true, "xrpl::ResolverAsioImpl::do_stop : stopping");
 
-        if (m_stopped.exchange(true) == false)
+        if (!m_stopped.exchange(true))
         {
             m_work.clear();
             m_resolver.cancel();
@@ -271,7 +271,7 @@ public:
                 m_strand, std::bind(&ResolverAsioImpl::do_work, this, CompletionCounter(this))));
     }
 
-    HostAndPort
+    static HostAndPort
     parseName(std::string const& str)
     {
         // first attempt to parse as an endpoint (IP addr + port).
@@ -319,7 +319,7 @@ public:
     void
     do_work(CompletionCounter)
     {
-        if (m_stop_called == true)
+        if (m_stop_called)
             return;
 
         // We don't have any work to do at this time
@@ -367,7 +367,7 @@ public:
     {
         XRPL_ASSERT(!names.empty(), "xrpl::ResolverAsioImpl::do_resolve : names non-empty");
 
-        if (m_stop_called == false)
+        if (!m_stop_called)
         {
             m_work.emplace_back(names, handler);
 

src/libxrpl/basics/StringUtilities.cpp

@@ -24,7 +24,7 @@ sqlBlobLiteral(Blob const& blob)
 {
     std::string j;
 
-    j.reserve(blob.size() * 2 + 3);
+    j.reserve((blob.size() * 2) + 3);
     j.push_back('X');
     j.push_back('\'');
     boost::algorithm::hex(blob.begin(), blob.end(), std::back_inserter(j));

src/libxrpl/basics/base64.cpp

@@ -107,7 +107,7 @@ encode(void* dest, void const* src, std::size_t len)
     char const* in = static_cast<char const*>(src);
     auto const tab = base64::get_alphabet();
 
-    for (auto n = len / 3; n--;)
+    for (auto n = len / 3; n != 0u; --n)
     {
         *out++ = tab[(in[0] & 0xfc) >> 2];
         *out++ = tab[((in[0] & 0x03) << 4) + ((in[1] & 0xf0) >> 4)];
@@ -162,7 +162,7 @@ decode(void* dest, char const* src, std::size_t len)
 
     auto const inverse = base64::get_inverse();
 
-    while (len-- && *in != '=')
+    while (((len--) != 0u) && *in != '=')
     {
         auto const v = inverse[*in];
         if (v == -1)
@@ -181,7 +181,7 @@ decode(void* dest, char const* src, std::size_t len)
         }
     }
 
-    if (i)
+    if (i != 0)
     {
         c3[0] = (c4[0] << 2) + ((c4[1] & 0x30) >> 4);
         c3[1] = ((c4[1] & 0xf) << 4) + ((c4[2] & 0x3c) >> 2);

src/libxrpl/basics/make_SSLContext.cpp

@@ -253,7 +253,7 @@ initAuthenticated(
         // VFALCO Replace fopen() with RAII
         FILE* f = fopen(chain_file.c_str(), "r");
 
-        if (!f)
+        if (f == nullptr)
         {
             LogicError(
                 "Problem opening SSL chain file" +

src/libxrpl/beast/insight/StatsDCollector.cpp

@@ -352,7 +352,7 @@ public:
         }
     }
 
-    void
+    static void
     log(std::vector<boost::asio::const_buffer> const& buffers)
     {
         (void)buffers;

src/libxrpl/beast/net/IPAddressV6.cpp

@@ -10,7 +10,7 @@ bool
 is_private(AddressV6 const& addr)
 {
     return (
-        (addr.to_bytes()[0] & 0xfd) ||  // TODO  fc00::/8 too ?
+        ((addr.to_bytes()[0] & 0xfd) != 0) ||  // TODO  fc00::/8 too ?
         (addr.is_v4_mapped() &&
          is_private(boost::asio::ip::make_address_v4(boost::asio::ip::v4_mapped, addr))));
 }

src/libxrpl/beast/net/IPEndpoint.cpp

@@ -57,7 +57,7 @@ Endpoint::to_string() const
     if (port() != 0 && address().is_v6())
         s += '[';
     s += address().to_string();
-    if (port())
+    if (port() != 0u)
     {
         if (address().is_v6())
             s += ']';
@@ -111,7 +111,7 @@ operator>>(std::istream& is, Endpoint& endpoint)
         // so we continue to honor that here by assuming we are at the end
         // of the address portion if we hit a space (or the separator
         // we were expecting to see)
-        if (isspace(static_cast<unsigned char>(i)) || (readTo && i == readTo))
+        if ((isspace(static_cast<unsigned char>(i)) != 0) || ((readTo != 0) && i == readTo))
             break;
 
         if ((i == '.') || (i >= '0' && i <= ':') || (i >= 'a' && i <= 'f') ||
@@ -121,13 +121,13 @@ operator>>(std::istream& is, Endpoint& endpoint)
 
             // don't exceed a reasonable length...
             if (addrStr.size() == INET6_ADDRSTRLEN ||
-                (readTo && readTo == ':' && addrStr.size() > 15))
+                ((readTo != 0) && readTo == ':' && addrStr.size() > 15))
             {
                 is.setstate(std::ios_base::failbit);
                 return is;
             }
 
-            if (!readTo && (i == '.' || i == ':'))
+            if ((readTo == 0) && (i == '.' || i == ':'))
             {
                 // if we see a dot first, must be IPv4
                 // otherwise must be non-bracketed IPv6
@@ -145,7 +145,7 @@ operator>>(std::istream& is, Endpoint& endpoint)
     if (readTo == ']' && is.rdbuf()->in_avail() > 0)
     {
         is.get(i);
-        if (!(isspace(static_cast<unsigned char>(i)) || i == ':'))
+        if ((isspace(static_cast<unsigned char>(i)) == 0) && i != ':')
         {
             is.unget();
             is.setstate(std::ios_base::failbit);

src/libxrpl/core/detail/JobQueue.cpp

@@ -84,8 +84,7 @@ JobQueue::addRefCountedJob(JobType type, std::string const& name, JobFunction co
 
         JobType const type(job.getType());
         XRPL_ASSERT(type != jtINVALID, "xrpl::JobQueue::addRefCountedJob : has valid job type");
-        XRPL_ASSERT(
-            m_jobSet.find(job) != m_jobSet.end(), "xrpl::JobQueue::addRefCountedJob : job found");
+        XRPL_ASSERT(m_jobSet.contains(job), "xrpl::JobQueue::addRefCountedJob : job found");
         perfLog_.jobQueue(type);
 
         JobTypeData& data(getJobTypeData(type));

src/libxrpl/core/detail/LoadMonitor.cpp

@@ -141,7 +141,7 @@ LoadMonitor::isOver()
     update();
 
     if (mLatencyEvents == 0)
-        return 0;
+        return false;
 
     return isOverTarget(
         mLatencyMSAvg / (mLatencyEvents * 4), mLatencyMSPeak / (mLatencyEvents * 4));

src/libxrpl/core/detail/Workers.cpp

@@ -47,7 +47,7 @@ Workers::setNumberOfThreads(int numberOfThreads)
     if (m_numberOfThreads == numberOfThreads)
         return;
 
-    if (perfLog_)
+    if (perfLog_ != nullptr)
         perfLog_->resizeJobs(numberOfThreads);
 
     if (numberOfThreads > m_numberOfThreads)

src/libxrpl/crypto/RFC1751.cpp

@@ -210,8 +210,8 @@ RFC1751::extract(char const* s, int start, int length)
 
     int const shiftR = 24 - (length + (start % 8));
     cl = s[start / 8];  // get components
-    cc = (shiftR < 16) ? s[start / 8 + 1] : 0;
-    cr = (shiftR < 8) ? s[start / 8 + 2] : 0;
+    cc = (shiftR < 16) ? s[(start / 8) + 1] : 0;
+    cr = (shiftR < 8) ? s[(start / 8) + 2] : 0;
 
     x = ((long)(cl << 8 | cc) << 8 | cr);  // Put bits together
     x = x >> shiftR;                       // Right justify number
@@ -265,13 +265,13 @@ RFC1751::insert(char* s, int x, int start, int length)
     if (shift + length > 16)
     {
         s[start / 8] |= cl;
-        s[start / 8 + 1] |= cc;
-        s[start / 8 + 2] |= cr;
+        s[(start / 8) + 1] |= cc;
+        s[(start / 8) + 2] |= cr;
     }
     else if (shift + length > 8)
     {
         s[start / 8] |= cc;
-        s[start / 8 + 1] |= cr;
+        s[(start / 8) + 1] |= cr;
     }
     else
     {
@@ -284,7 +284,7 @@ RFC1751::standard(std::string& strWord)
 {
     for (auto& letter : strWord)
     {
-        if (islower(static_cast<unsigned char>(letter)))
+        if (islower(static_cast<unsigned char>(letter)) != 0)
         {
             letter = toupper(static_cast<unsigned char>(letter));
         }
@@ -312,10 +312,10 @@ RFC1751::wsrch(std::string const& strWord, int iMin, int iMax)
     while (iResult < 0 && iMin != iMax)
     {
         // Have a range to search.
-        int iMid = iMin + (iMax - iMin) / 2;
+        int iMid = iMin + ((iMax - iMin) / 2);
         int iDir = strWord.compare(s_dictionary[iMid]);
 
-        if (!iDir)
+        if (iDir == 0)
         {
             iResult = iMid;  // Found it.
         }

src/libxrpl/json/Writer.cpp

@@ -152,7 +152,7 @@ public:
 #ifndef NDEBUG
         // Make sure we haven't already seen this tag.
         auto& tags = stack_.top().tags;
-        check(tags.find(tag) == tags.end(), "Already seen tag " + tag);
+        check(!tags.contains(tag), "Already seen tag " + tag);
         tags.insert(tag);
 #endif
 

src/libxrpl/json/json_reader.cpp

@@ -296,7 +296,7 @@ Reader::match(Location pattern, int patternLength)
 
     int index = patternLength;
 
-    while (index--)
+    while ((index--) != 0)
     {
         if (current_[index] != pattern[index])
             return false;
@@ -362,7 +362,7 @@ Reader::readNumber()
 
         while (current_ != end_)
         {
-            if (!std::isdigit(static_cast<unsigned char>(*current_)))
+            if (std::isdigit(static_cast<unsigned char>(*current_)) == 0)
             {
                 auto ret =
                     std::find(std::begin(extended_tokens), std::end(extended_tokens), *current_);
@@ -913,7 +913,7 @@ Reader::getFormattedErrorMessages() const
         formattedMessage += "* " + getLocationLineAndColumn(error.token_.start_) + "\n";
         formattedMessage += "  " + error.message_ + "\n";
 
-        if (error.extra_)
+        if (error.extra_ != nullptr)
             formattedMessage += "See " + getLocationLineAndColumn(error.extra_) + " for detail.\n";
     }
 

src/libxrpl/json/json_value.cpp

@@ -40,10 +40,10 @@ public:
         //   return 0;
 
         if (length == unknown)
-            length = value ? (unsigned int)strlen(value) : 0;
+            length = (value != nullptr) ? (unsigned int)strlen(value) : 0;
 
         char* newString = static_cast<char*>(malloc(length + 1));
-        if (value)
+        if (value != nullptr)
             memcpy(newString, value, length);
         newString[length] = 0;
         return newString;
@@ -52,7 +52,7 @@ public:
     void
     releaseStringValue(char* value) override
     {
-        if (value)
+        if (value != nullptr)
             free(value);
     }
 };
@@ -108,14 +108,14 @@ Value::CZString::CZString(CZString const& other)
 
 Value::CZString::~CZString()
 {
-    if (cstr_ && index_ == duplicate)
+    if ((cstr_ != nullptr) && index_ == duplicate)
         valueAllocator()->releaseMemberName(const_cast<char*>(cstr_));
 }
 
 bool
 Value::CZString::operator<(CZString const& other) const
 {
-    if (cstr_ && other.cstr_)
+    if ((cstr_ != nullptr) && (other.cstr_ != nullptr))
         return strcmp(cstr_, other.cstr_) < 0;
 
     return index_ < other.index_;
@@ -124,7 +124,7 @@ Value::CZString::operator<(CZString const& other) const
 bool
 Value::CZString::operator==(CZString const& other) const
 {
-    if (cstr_ && other.cstr_)
+    if ((cstr_ != nullptr) && (other.cstr_ != nullptr))
         return strcmp(cstr_, other.cstr_) == 0;
 
     return index_ == other.index_;
@@ -251,7 +251,7 @@ Value::Value(Value const& other) : type_(other.type_)
             break;
 
         case stringValue:
-            if (other.value_.string_)
+            if (other.value_.string_ != nullptr)
             {
                 value_.string_ = valueAllocator()->duplicateStringValue(other.value_.string_);
                 allocated_ = true;
@@ -294,7 +294,7 @@ Value::~Value()
 
         case arrayValue:
         case objectValue:
-            if (value_.map_)
+            if (value_.map_ != nullptr)
                 delete value_.map_;
             break;
 
@@ -392,11 +392,11 @@ operator<(Value const& x, Value const& y)
             return x.value_.real_ < y.value_.real_;
 
         case booleanValue:
-            return x.value_.bool_ < y.value_.bool_;
+            return static_cast<int>(x.value_.bool_) < static_cast<int>(y.value_.bool_);
 
         case stringValue:
-            return (x.value_.string_ == 0 && y.value_.string_) ||
-                (y.value_.string_ && x.value_.string_ &&
+            return (x.value_.string_ == 0 && (y.value_.string_ != nullptr)) ||
+                ((y.value_.string_ != nullptr) && (x.value_.string_ != nullptr) &&
                  strcmp(x.value_.string_, y.value_.string_) < 0);
 
         case arrayValue:
@@ -413,7 +413,7 @@ operator<(Value const& x, Value const& y)
             // LCOV_EXCL_STOP
     }
 
-    return 0;  // unreachable
+    return false;  // unreachable
 }
 
 bool
@@ -422,9 +422,9 @@ operator==(Value const& x, Value const& y)
     if (x.type_ != y.type_)
     {
         if (x.type_ == intValue && y.type_ == uintValue)
-            return !integerCmp(x.value_.int_, y.value_.uint_);
+            return integerCmp(x.value_.int_, y.value_.uint_) == 0;
         if (x.type_ == uintValue && y.type_ == intValue)
-            return !integerCmp(y.value_.int_, x.value_.uint_);
+            return integerCmp(y.value_.int_, x.value_.uint_) == 0;
         return false;
     }
 
@@ -447,8 +447,8 @@ operator==(Value const& x, Value const& y)
 
         case stringValue:
             return x.value_.string_ == y.value_.string_ ||
-                (y.value_.string_ && x.value_.string_ &&
-                 !strcmp(x.value_.string_, y.value_.string_));
+                ((y.value_.string_ != nullptr) && (x.value_.string_ != nullptr) &&
+                 (strcmp(x.value_.string_, y.value_.string_) == 0));
 
         case arrayValue:
         case objectValue:
@@ -461,7 +461,7 @@ operator==(Value const& x, Value const& y)
             // LCOV_EXCL_STOP
     }
 
-    return 0;  // unreachable
+    return false;  // unreachable
 }
 
 char const*
@@ -480,7 +480,7 @@ Value::asString() const
             return "";
 
         case stringValue:
-            return value_.string_ ? value_.string_ : "";
+            return (value_.string_ != nullptr) ? value_.string_ : "";
 
         case booleanValue:
             return value_.bool_ ? "true" : "false";
@@ -525,7 +525,7 @@ Value::asInt() const
 
         case realValue:
             JSON_ASSERT_MESSAGE(
-                value_.real_ >= minInt && value_.real_ <= maxInt,
+                (value_.real_ >= minInt && value_.real_ <= maxInt),
                 "Real out of signed integer range");
             return Int(value_.real_);
 
@@ -533,7 +533,7 @@ Value::asInt() const
             return value_.bool_ ? 1 : 0;
 
         case stringValue: {
-            char const* const str{value_.string_ ? value_.string_ : ""};
+            char const* const str{(value_.string_ != nullptr) ? value_.string_ : ""};
             return beast::lexicalCastThrow<int>(str);
         }
 
@@ -584,7 +584,7 @@ Value::asAbsUInt() const
             return value_.bool_ ? 1 : 0;
 
         case stringValue: {
-            char const* const str{value_.string_ ? value_.string_ : ""};
+            char const* const str{(value_.string_ != nullptr) ? value_.string_ : ""};
             auto const temp = beast::lexicalCastThrow<std::int64_t>(str);
             if (temp < 0)
             {
@@ -626,14 +626,15 @@ Value::asUInt() const
 
         case realValue:
             JSON_ASSERT_MESSAGE(
-                value_.real_ >= 0 && value_.real_ <= maxUInt, "Real out of unsigned integer range");
+                (value_.real_ >= 0 && value_.real_ <= maxUInt),
+                "Real out of unsigned integer range");
             return UInt(value_.real_);
 
         case booleanValue:
             return value_.bool_ ? 1 : 0;
 
         case stringValue: {
-            char const* const str{value_.string_ ? value_.string_ : ""};
+            char const* const str{(value_.string_ != nullptr) ? value_.string_ : ""};
             return beast::lexicalCastThrow<unsigned int>(str);
         }
 
@@ -703,7 +704,7 @@ Value::asBool() const
             return value_.bool_;
 
         case stringValue:
-            return value_.string_ && value_.string_[0] != 0;
+            return (value_.string_ != nullptr) && value_.string_[0] != 0;
 
         case arrayValue:
         case objectValue:
@@ -745,13 +746,13 @@ Value::isConvertibleTo(ValueType other) const
                 other == realValue || other == stringValue || other == booleanValue;
 
         case booleanValue:
-            return (other == nullValue && value_.bool_ == false) || other == intValue ||
+            return (other == nullValue && !value_.bool_) || other == intValue ||
                 other == uintValue || other == realValue || other == stringValue ||
                 other == booleanValue;
 
         case stringValue:
             return other == stringValue ||
-                (other == nullValue && (!value_.string_ || value_.string_[0] == 0));
+                (other == nullValue && ((value_.string_ == nullptr) || value_.string_[0] == 0));
 
         case arrayValue:
             return other == arrayValue || (other == nullValue && value_.map_->empty());
@@ -813,10 +814,10 @@ operator bool() const
     if (isString())
     {
         auto s = asCString();
-        return s && s[0];
+        return (s != nullptr) && (s[0] != 0);
     }
 
-    return !(isArray() || isObject()) || size();
+    return !(isArray() || isObject()) || (size() != 0u);
 }
 
 void
@@ -1139,7 +1140,7 @@ Value::begin() const
     {
         case arrayValue:
         case objectValue:
-            if (value_.map_)
+            if (value_.map_ != nullptr)
                 return const_iterator(value_.map_->begin());
 
             break;
@@ -1157,7 +1158,7 @@ Value::end() const
     {
         case arrayValue:
         case objectValue:
-            if (value_.map_)
+            if (value_.map_ != nullptr)
                 return const_iterator(value_.map_->end());
 
             break;
@@ -1175,7 +1176,7 @@ Value::begin()
     {
         case arrayValue:
         case objectValue:
-            if (value_.map_)
+            if (value_.map_ != nullptr)
                 return iterator(value_.map_->begin());
             break;
         default:
@@ -1192,7 +1193,7 @@ Value::end()
     {
         case arrayValue:
         case objectValue:
-            if (value_.map_)
+            if (value_.map_ != nullptr)
                 return iterator(value_.map_->end());
             break;
         default:

src/libxrpl/json/json_valueiterator.cpp

@@ -89,7 +89,7 @@ ValueIteratorBase::key() const
 {
     Value::CZString const czString = (*current_).first;
 
-    if (czString.c_str())
+    if (czString.c_str() != nullptr)
     {
         if (czString.isStaticString())
             return Value(StaticString(czString.c_str()));
@@ -105,7 +105,7 @@ ValueIteratorBase::index() const
 {
     Value::CZString const czString = (*current_).first;
 
-    if (!czString.c_str())
+    if (czString.c_str() == nullptr)
         return czString.index();
 
     return Value::UInt(-1);
@@ -115,7 +115,7 @@ char const*
 ValueIteratorBase::memberName() const
 {
     char const* name = (*current_).first.c_str();
-    return name ? name : "";
+    return (name != nullptr) ? name : "";
 }
 
 // //////////////////////////////////////////////////////////////////

src/libxrpl/json/json_writer.cpp

@@ -23,7 +23,7 @@ isControlCharacter(char ch)
 static bool
 containsControlCharacter(char const* str)
 {
-    while (*str)
+    while (*str != 0)
     {
         if (isControlCharacter(*(str++)))
             return true;
@@ -106,7 +106,7 @@ valueToQuotedString(char const* value)
     // We have to walk value and escape any special characters.
     // Appending to std::string is not efficient, but this should be rare.
     // (Note: forward slashes are *not* rare, but I am not escaping them.)
-    unsigned maxsize = strlen(value) * 2 + 3;  // all-escaped+quotes+NULL
+    unsigned maxsize = (strlen(value) * 2) + 3;  // all-escaped+quotes+NULL
     std::string result;
     result.reserve(maxsize);  // to avoid lots of mallocs
     result += "\"";
@@ -416,7 +416,7 @@ StyledWriter::isMultilineArray(Value const& value)
     {
         childValues_.reserve(size);
         addChildValues_ = true;
-        int lineLength = 4 + (size - 1) * 2;  // '[ ' + ', '*n + ' ]'
+        int lineLength = 4 + ((size - 1) * 2);  // '[ ' + ', '*n + ' ]'
 
         for (int index = 0; index < size; ++index)
         {
@@ -651,7 +651,7 @@ StyledStreamWriter::isMultilineArray(Value const& value)
     {
         childValues_.reserve(size);
         addChildValues_ = true;
-        int lineLength = 4 + (size - 1) * 2;  // '[ ' + ', '*n + ' ]'
+        int lineLength = 4 + ((size - 1) * 2);  // '[ ' + ', '*n + ' ]'
 
         for (int index = 0; index < size; ++index)
         {

src/libxrpl/ledger/AcceptedLedgerTx.cpp

@@ -2,6 +2,7 @@
 #include <xrpl/basics/StringUtilities.h>
 #include <xrpl/ledger/AcceptedLedgerTx.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/RippleStateHelpers.h>
 #include <xrpl/protocol/UintTypes.h>
 #include <xrpl/protocol/jss.h>
 

src/libxrpl/ledger/ApplyStateTable.cpp

@@ -275,9 +275,7 @@ ApplyStateTable::exists(ReadView const& base, Keylet const& k) const
         case Action::modify:
             break;
     }
-    if (!k.check(*sle))
-        return false;
-    return true;
+    return k.check(*sle);
 }
 
 auto

src/libxrpl/ledger/ApplyView.cpp

@@ -36,7 +36,7 @@ findPreviousPage(ApplyView& view, Keylet const& directory, SLE::ref start)
 
     auto node = start;
 
-    if (page)
+    if (page != 0u)
     {
         node = view.peek(keylet::page(directory, page));
         if (!node)

src/libxrpl/ledger/BookDirs.cpp

@@ -1,5 +1,6 @@
 #include <xrpl/ledger/BookDirs.h>
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/DirectoryHelpers.h>
 #include <xrpl/protocol/Indexes.h>
 
 namespace xrpl {

src/libxrpl/ledger/Credit.cpp

@@ -1,60 +0,0 @@
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/AmountConversions.h>
-#include <xrpl/protocol/Indexes.h>
-#include <xrpl/protocol/STAmount.h>
-
-namespace xrpl {
-
-STAmount
-creditLimit(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& issuer,
-    Currency const& currency)
-{
-    STAmount result(Issue{currency, account});
-
-    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
-
-    if (sleRippleState)
-    {
-        result = sleRippleState->getFieldAmount(account < issuer ? sfLowLimit : sfHighLimit);
-        result.setIssuer(account);
-    }
-
-    XRPL_ASSERT(result.getIssuer() == account, "xrpl::creditLimit : result issuer match");
-    XRPL_ASSERT(result.getCurrency() == currency, "xrpl::creditLimit : result currency match");
-    return result;
-}
-
-IOUAmount
-creditLimit2(ReadView const& v, AccountID const& acc, AccountID const& iss, Currency const& cur)
-{
-    return toAmount<IOUAmount>(creditLimit(v, acc, iss, cur));
-}
-
-STAmount
-creditBalance(
-    ReadView const& view,
-    AccountID const& account,
-    AccountID const& issuer,
-    Currency const& currency)
-{
-    STAmount result(Issue{currency, account});
-
-    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
-
-    if (sleRippleState)
-    {
-        result = sleRippleState->getFieldAmount(sfBalance);
-        if (account < issuer)
-            result.negate();
-        result.setIssuer(account);
-    }
-
-    XRPL_ASSERT(result.getIssuer() == account, "xrpl::creditBalance : result issuer match");
-    XRPL_ASSERT(result.getCurrency() == currency, "xrpl::creditBalance : result currency match");
-    return result;
-}
-
-}  // namespace xrpl

src/libxrpl/ledger/PaymentSandbox.cpp

@@ -164,7 +164,7 @@ PaymentSandbox::balanceHook(
     auto delta = amount.zeroed();
     auto lastBal = amount;
     auto minBal = amount;
-    for (auto curSB = this; curSB; curSB = curSB->ps_)
+    for (auto curSB = this; curSB != nullptr; curSB = curSB->ps_)
     {
         if (auto adj = curSB->tab_.adjustments(account, issuer, currency))
         {
@@ -198,7 +198,7 @@ std::uint32_t
 PaymentSandbox::ownerCountHook(AccountID const& account, std::uint32_t count) const
 {
     std::uint32_t result = count;
-    for (auto curSB = this; curSB; curSB = curSB->ps_)
+    for (auto curSB = this; curSB != nullptr; curSB = curSB->ps_)
     {
         if (auto adj = curSB->tab_.ownerCount(account))
             result = std::max(result, *adj);

src/libxrpl/ledger/helpers/AccountRootHelpers.cpp

@@ -0,0 +1,247 @@
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+//
+#include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/digest.h>
+
+#include <algorithm>
+#include <limits>
+
+namespace xrpl {
+
+bool
+isGlobalFrozen(ReadView const& view, AccountID const& issuer)
+{
+    if (isXRP(issuer))
+        return false;
+    if (auto const sle = view.read(keylet::account(issuer)))
+        return sle->isFlag(lsfGlobalFreeze);
+    return false;
+}
+
+// An owner count cannot be negative. If adjustment would cause a negative
+// owner count, clamp the owner count at 0. Similarly for overflow. This
+// adjustment allows the ownerCount to be adjusted up or down in multiple steps.
+// If id != std::nullopt, then do error reporting.
+//
+// Returns adjusted owner count.
+static std::uint32_t
+confineOwnerCount(
+    std::uint32_t current,
+    std::int32_t adjustment,
+    std::optional<AccountID> const& id = std::nullopt,
+    beast::Journal j = beast::Journal{beast::Journal::getNullSink()})
+{
+    std::uint32_t adjusted{current + adjustment};
+    if (adjustment > 0)
+    {
+        // Overflow is well defined on unsigned
+        if (adjusted < current)
+        {
+            if (id)
+            {
+                JLOG(j.fatal()) << "Account " << *id << " owner count exceeds max!";
+            }
+            adjusted = std::numeric_limits<std::uint32_t>::max();
+        }
+    }
+    else
+    {
+        // Underflow is well defined on unsigned
+        if (adjusted > current)
+        {
+            if (id)
+            {
+                JLOG(j.fatal()) << "Account " << *id << " owner count set below 0!";
+            }
+            adjusted = 0;
+            XRPL_ASSERT(!id, "xrpl::confineOwnerCount : id is not set");
+        }
+    }
+    return adjusted;
+}
+
+XRPAmount
+xrpLiquid(ReadView const& view, AccountID const& id, std::int32_t ownerCountAdj, beast::Journal j)
+{
+    auto const sle = view.read(keylet::account(id));
+    if (sle == nullptr)
+        return beast::zero;
+
+    // Return balance minus reserve
+    std::uint32_t const ownerCount =
+        confineOwnerCount(view.ownerCountHook(id, sle->getFieldU32(sfOwnerCount)), ownerCountAdj);
+
+    // Pseudo-accounts have no reserve requirement
+    auto const reserve =
+        isPseudoAccount(sle) ? XRPAmount{0} : view.fees().accountReserve(ownerCount);
+
+    auto const fullBalance = sle->getFieldAmount(sfBalance);
+
+    auto const balance = view.balanceHook(id, xrpAccount(), fullBalance);
+
+    STAmount const amount = (balance < reserve) ? STAmount{0} : balance - reserve;
+
+    JLOG(j.trace()) << "accountHolds:" << " account=" << to_string(id)
+                    << " amount=" << amount.getFullText()
+                    << " fullBalance=" << fullBalance.getFullText()
+                    << " balance=" << balance.getFullText() << " reserve=" << reserve
+                    << " ownerCount=" << ownerCount << " ownerCountAdj=" << ownerCountAdj;
+
+    return amount.xrp();
+}
+
+Rate
+transferRate(ReadView const& view, AccountID const& issuer)
+{
+    auto const sle = view.read(keylet::account(issuer));
+
+    if (sle && sle->isFieldPresent(sfTransferRate))
+        return Rate{sle->getFieldU32(sfTransferRate)};
+
+    return parityRate;
+}
+
+void
+adjustOwnerCount(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sle,
+    std::int32_t amount,
+    beast::Journal j)
+{
+    if (!sle)
+        return;
+    XRPL_ASSERT(amount, "xrpl::adjustOwnerCount : nonzero amount input");
+    std::uint32_t const current{sle->getFieldU32(sfOwnerCount)};
+    AccountID const id = (*sle)[sfAccount];
+    std::uint32_t const adjusted = confineOwnerCount(current, amount, id, j);
+    view.adjustOwnerCountHook(id, current, adjusted);
+    sle->at(sfOwnerCount) = adjusted;
+    view.update(sle);
+}
+
+AccountID
+pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey)
+{
+    // This number must not be changed without an amendment
+    constexpr std::uint16_t maxAccountAttempts = 256;
+    for (std::uint16_t i = 0; i < maxAccountAttempts; ++i)
+    {
+        ripesha_hasher rsh;
+        auto const hash = sha512Half(i, view.header().parentHash, pseudoOwnerKey);
+        rsh(hash.data(), hash.size());
+        AccountID const ret{static_cast<ripesha_hasher::result_type>(rsh)};
+        if (!view.read(keylet::account(ret)))
+            return ret;
+    }
+    return beast::zero;
+}
+
+// Pseudo-account designator fields MUST be maintained by including the
+// SField::sMD_PseudoAccount flag in the SField definition. (Don't forget to
+// "| SField::sMD_Default"!) The fields do NOT need to be amendment-gated,
+// since a non-active amendment will not set any field, by definition.
+// Specific properties of a pseudo-account are NOT checked here, that's what
+// InvariantCheck is for.
+[[nodiscard]] std::vector<SField const*> const&
+getPseudoAccountFields()
+{
+    static std::vector<SField const*> const pseudoFields = []() {
+        auto const ar = LedgerFormats::getInstance().findByType(ltACCOUNT_ROOT);
+        if (!ar)
+        {
+            // LCOV_EXCL_START
+            LogicError(
+                "xrpl::getPseudoAccountFields : unable to find account root "
+                "ledger format");
+            // LCOV_EXCL_STOP
+        }
+        auto const& soTemplate = ar->getSOTemplate();
+
+        std::vector<SField const*> pseudoFields;
+        for (auto const& field : soTemplate)
+        {
+            if (field.sField().shouldMeta(SField::sMD_PseudoAccount))
+                pseudoFields.emplace_back(&field.sField());
+        }
+        return pseudoFields;
+    }();
+    return pseudoFields;
+}
+
+[[nodiscard]] bool
+isPseudoAccount(
+    std::shared_ptr<SLE const> sleAcct,
+    std::set<SField const*> const& pseudoFieldFilter)
+{
+    auto const& fields = getPseudoAccountFields();
+
+    // Intentionally use defensive coding here because it's cheap and makes the
+    // semantics of true return value clean.
+    return sleAcct && sleAcct->getType() == ltACCOUNT_ROOT &&
+        std::count_if(
+            fields.begin(), fields.end(), [&sleAcct, &pseudoFieldFilter](SField const* sf) -> bool {
+                return sleAcct->isFieldPresent(*sf) &&
+                    (pseudoFieldFilter.empty() || pseudoFieldFilter.contains(sf));
+            }) > 0;
+}
+
+Expected<std::shared_ptr<SLE>, TER>
+createPseudoAccount(ApplyView& view, uint256 const& pseudoOwnerKey, SField const& ownerField)
+{
+    [[maybe_unused]]
+    auto const& fields = getPseudoAccountFields();
+    XRPL_ASSERT(
+        std::count_if(
+            fields.begin(),
+            fields.end(),
+            [&ownerField](SField const* sf) -> bool { return *sf == ownerField; }) == 1,
+        "xrpl::createPseudoAccount : valid owner field");
+
+    auto const accountId = pseudoAccountAddress(view, pseudoOwnerKey);
+    if (accountId == beast::zero)
+        return Unexpected(tecDUPLICATE);
+
+    // Create pseudo-account.
+    auto account = std::make_shared<SLE>(keylet::account(accountId));
+    account->setAccountID(sfAccount, accountId);
+    account->setFieldAmount(sfBalance, STAmount{});
+
+    // Pseudo-accounts can't submit transactions, so set the sequence number
+    // to 0 to make them easier to spot and verify, and add an extra level
+    // of protection.
+    std::uint32_t const seqno =                           //
+        view.rules().enabled(featureSingleAssetVault) ||  //
+            view.rules().enabled(featureLendingProtocol)  //
+        ? 0                                               //
+        : view.seq();
+    account->setFieldU32(sfSequence, seqno);
+    // Ignore reserves requirement, disable the master key, allow default
+    // rippling, and enable deposit authorization to prevent payments into
+    // pseudo-account.
+    account->setFieldU32(sfFlags, lsfDisableMaster | lsfDefaultRipple | lsfDepositAuth);
+    // Link the pseudo-account with its owner object.
+    account->setFieldH256(ownerField, pseudoOwnerKey);
+
+    view.insert(account);
+
+    return account;
+}
+
+[[nodiscard]] TER
+checkDestinationAndTag(SLE::const_ref toSle, bool hasDestinationTag)
+{
+    if (toSle == nullptr)
+        return tecNO_DST;
+
+    // The tag is basically account-specific information we don't
+    // understand, but we can require someone to fill it in.
+    if (toSle->isFlag(lsfRequireDestTag) && !hasDestinationTag)
+        return tecDST_TAG_NEEDED;  // Cannot send without a tag
+
+    return tesSUCCESS;
+}
+
+}  // namespace xrpl

src/libxrpl/ledger/helpers/CredentialHelpers.cpp

@@ -1,5 +1,7 @@
-#include <xrpl/ledger/CredentialHelpers.h>
+#include <xrpl/ledger/helpers/CredentialHelpers.h>
+//
 #include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/digest.h>
 
@@ -76,7 +78,7 @@ deleteSLE(ApplyView& view, std::shared_ptr<SLE> const& sleCredential, beast::Jou
 
     auto const issuer = sleCredential->getAccountID(sfIssuer);
     auto const subject = sleCredential->getAccountID(sfSubject);
-    bool const accepted = sleCredential->getFlags() & lsfAccepted;
+    bool const accepted = (sleCredential->getFlags() & lsfAccepted) != 0u;
 
     auto err = delSLE(issuer, sfIssuerNode, !accepted || (subject == issuer));
     if (!isTesSuccess(err))
@@ -145,7 +147,7 @@ valid(STTx const& tx, ReadView const& view, AccountID const& src, beast::Journal
             return tecBAD_CREDENTIALS;
         }
 
-        if (!(sleCred->getFlags() & lsfAccepted))
+        if ((sleCred->getFlags() & lsfAccepted) == 0u)
         {
             JLOG(j.trace()) << "Credential isn't accepted. Cred: " << h;
             return tecBAD_CREDENTIALS;
@@ -186,7 +188,7 @@ validDomain(ReadView const& view, uint256 domainID, AccountID const& subject)
                 foundExpired = true;
                 continue;
             }
-            if (sleCredential->getFlags() & lsfAccepted)
+            if ((sleCredential->getFlags() & lsfAccepted) != 0u)
             {
                 return tesSUCCESS;
             }
@@ -307,7 +309,7 @@ verifyValidDomain(ApplyView& view, AccountID const& account, uint256 domainID, b
         if (!sleCredential)
             continue;  // expired, i.e. deleted in credentials::removeExpired
 
-        if (sleCredential->getFlags() & lsfAccepted)
+        if ((sleCredential->getFlags() & lsfAccepted) != 0u)
             return tesSUCCESS;
     }
 
@@ -334,7 +336,7 @@ verifyDepositPreauth(
     if (credentialsPresent && credentials::removeExpired(view, tx.getFieldV256(sfCredentialIDs), j))
         return tecEXPIRED;
 
-    if (sleDst && (sleDst->getFlags() & lsfDepositAuth))
+    if (sleDst && ((sleDst->getFlags() & lsfDepositAuth) != 0u))
     {
         if (src != dst)
         {

src/libxrpl/ledger/helpers/DirectoryHelpers.cpp

@@ -0,0 +1,177 @@
+#include <xrpl/ledger/helpers/DirectoryHelpers.h>
+//
+#include <xrpl/protocol/LedgerFormats.h>
+
+namespace xrpl {
+
+bool
+dirFirst(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    return detail::internalDirFirst(view, root, page, index, entry);
+}
+
+bool
+dirNext(
+    ApplyView& view,
+    uint256 const& root,
+    std::shared_ptr<SLE>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    return detail::internalDirNext(view, root, page, index, entry);
+}
+
+bool
+cdirFirst(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    return detail::internalDirFirst(view, root, page, index, entry);
+}
+
+bool
+cdirNext(
+    ReadView const& view,
+    uint256 const& root,
+    std::shared_ptr<SLE const>& page,
+    unsigned int& index,
+    uint256& entry)
+{
+    return detail::internalDirNext(view, root, page, index, entry);
+}
+
+void
+forEachItem(
+    ReadView const& view,
+    Keylet const& root,
+    std::function<void(std::shared_ptr<SLE const> const&)> const& f)
+{
+    XRPL_ASSERT(root.type == ltDIR_NODE, "xrpl::forEachItem : valid root type");
+
+    if (root.type != ltDIR_NODE)
+        return;
+
+    auto pos = root;
+
+    while (true)
+    {
+        auto sle = view.read(pos);
+        if (!sle)
+            return;
+        for (auto const& key : sle->getFieldV256(sfIndexes))
+            f(view.read(keylet::child(key)));
+        auto const next = sle->getFieldU64(sfIndexNext);
+        if (next == 0u)
+            return;
+        pos = keylet::page(root, next);
+    }
+}
+
+bool
+forEachItemAfter(
+    ReadView const& view,
+    Keylet const& root,
+    uint256 const& after,
+    std::uint64_t const hint,
+    unsigned int limit,
+    std::function<bool(std::shared_ptr<SLE const> const&)> const& f)
+{
+    XRPL_ASSERT(root.type == ltDIR_NODE, "xrpl::forEachItemAfter : valid root type");
+
+    if (root.type != ltDIR_NODE)
+        return false;
+
+    auto currentIndex = root;
+
+    // If startAfter is not zero try jumping to that page using the hint
+    if (after.isNonZero())
+    {
+        auto const hintIndex = keylet::page(root, hint);
+
+        if (auto hintDir = view.read(hintIndex))
+        {
+            for (auto const& key : hintDir->getFieldV256(sfIndexes))
+            {
+                if (key == after)
+                {
+                    // We found the hint, we can start here
+                    currentIndex = hintIndex;
+                    break;
+                }
+            }
+        }
+
+        bool found = false;
+        for (;;)
+        {
+            auto const ownerDir = view.read(currentIndex);
+            if (!ownerDir)
+                return found;
+            for (auto const& key : ownerDir->getFieldV256(sfIndexes))
+            {
+                if (!found)
+                {
+                    if (key == after)
+                        found = true;
+                }
+                else if (f(view.read(keylet::child(key))) && limit-- <= 1)
+                {
+                    return found;
+                }
+            }
+
+            auto const uNodeNext = ownerDir->getFieldU64(sfIndexNext);
+            if (uNodeNext == 0)
+                return found;
+            currentIndex = keylet::page(root, uNodeNext);
+        }
+    }
+    else
+    {
+        for (;;)
+        {
+            auto const ownerDir = view.read(currentIndex);
+            if (!ownerDir)
+                return true;
+            for (auto const& key : ownerDir->getFieldV256(sfIndexes))
+            {
+                if (f(view.read(keylet::child(key))) && limit-- <= 1)
+                    return true;
+            }
+            auto const uNodeNext = ownerDir->getFieldU64(sfIndexNext);
+            if (uNodeNext == 0)
+                return true;
+            currentIndex = keylet::page(root, uNodeNext);
+        }
+    }
+}
+
+bool
+dirIsEmpty(ReadView const& view, Keylet const& k)
+{
+    auto const sleNode = view.read(k);
+    if (!sleNode)
+        return true;
+    if (!sleNode->getFieldV256(sfIndexes).empty())
+        return false;
+    // The first page of a directory may legitimately be empty even if there
+    // are other pages (the first page is the anchor page) so check to see if
+    // there is another page. If there is, the directory isn't empty.
+    return sleNode->getFieldU64(sfIndexNext) == 0;
+}
+
+std::function<void(SLE::ref)>
+describeOwnerDir(AccountID const& account)
+{
+    return [account](std::shared_ptr<SLE> const& sle) { (*sle)[sfOwner] = account; };
+}
+
+}  // namespace xrpl

src/libxrpl/ledger/helpers/MPTokenHelpers.cpp

@@ -0,0 +1,752 @@
+#include <xrpl/ledger/helpers/MPTokenHelpers.h>
+//
+#include <xrpl/basics/Log.h>
+#include <xrpl/ledger/View.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/CredentialHelpers.h>
+#include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/SField.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace xrpl {
+
+bool
+isGlobalFrozen(ReadView const& view, MPTIssue const& mptIssue)
+{
+    if (auto const sle = view.read(keylet::mptIssuance(mptIssue.getMptID())))
+        return sle->isFlag(lsfMPTLocked);
+    return false;
+}
+
+bool
+isIndividualFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue)
+{
+    if (auto const sle = view.read(keylet::mptoken(mptIssue.getMptID(), account)))
+        return sle->isFlag(lsfMPTLocked);
+    return false;
+}
+
+bool
+isFrozen(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue, int depth)
+{
+    return isGlobalFrozen(view, mptIssue) || isIndividualFrozen(view, account, mptIssue) ||
+        isVaultPseudoAccountFrozen(view, account, mptIssue, depth);
+}
+
+[[nodiscard]] bool
+isAnyFrozen(
+    ReadView const& view,
+    std::initializer_list<AccountID> const& accounts,
+    MPTIssue const& mptIssue,
+    int depth)
+{
+    if (isGlobalFrozen(view, mptIssue))
+        return true;
+
+    for (auto const& account : accounts)
+    {
+        if (isIndividualFrozen(view, account, mptIssue))
+            return true;
+    }
+
+    for (auto const& account : accounts)
+    {
+        if (isVaultPseudoAccountFrozen(view, account, mptIssue, depth))
+            return true;
+    }
+
+    return false;
+}
+
+Rate
+transferRate(ReadView const& view, MPTID const& issuanceID)
+{
+    // fee is 0-50,000 (0-50%), rate is 1,000,000,000-2,000,000,000
+    // For example, if transfer fee is 50% then 10,000 * 50,000 = 500,000
+    // which represents 50% of 1,000,000,000
+    if (auto const sle = view.read(keylet::mptIssuance(issuanceID));
+        sle && sle->isFieldPresent(sfTransferFee))
+        return Rate{1'000'000'000u + (10'000 * sle->getFieldU16(sfTransferFee))};
+
+    return parityRate;
+}
+
+[[nodiscard]] TER
+canAddHolding(ReadView const& view, MPTIssue const& mptIssue)
+{
+    auto mptID = mptIssue.getMptID();
+    auto issuance = view.read(keylet::mptIssuance(mptID));
+    if (!issuance)
+    {
+        return tecOBJECT_NOT_FOUND;
+    }
+    if (!issuance->isFlag(lsfMPTCanTransfer))
+    {
+        return tecNO_AUTH;
+    }
+
+    return tesSUCCESS;
+}
+
+[[nodiscard]] TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    MPTIssue const& mptIssue,
+    beast::Journal journal)
+{
+    auto const& mptID = mptIssue.getMptID();
+    auto const mpt = view.peek(keylet::mptIssuance(mptID));
+    if (!mpt)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    if (mpt->isFlag(lsfMPTLocked))
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    if (view.peek(keylet::mptoken(mptID, accountID)))
+        return tecDUPLICATE;
+    if (accountID == mptIssue.getIssuer())
+        return tesSUCCESS;
+
+    return authorizeMPToken(view, priorBalance, mptID, accountID, journal);
+}
+
+[[nodiscard]] TER
+authorizeMPToken(
+    ApplyView& view,
+    XRPAmount const& priorBalance,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    beast::Journal journal,
+    std::uint32_t flags,
+    std::optional<AccountID> holderID)
+{
+    auto const sleAcct = view.peek(keylet::account(account));
+    if (!sleAcct)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // If the account that submitted the tx is a holder
+    // Note: `account_` is holder's account
+    //       `holderID` is NOT used
+    if (!holderID)
+    {
+        // When a holder wants to unauthorize/delete a MPT, the ledger must
+        //      - delete mptokenKey from owner directory
+        //      - delete the MPToken
+        if ((flags & tfMPTUnauthorize) != 0)
+        {
+            auto const mptokenKey = keylet::mptoken(mptIssuanceID, account);
+            auto const sleMpt = view.peek(mptokenKey);
+            if (!sleMpt || (*sleMpt)[sfMPTAmount] != 0)
+                return tecINTERNAL;  // LCOV_EXCL_LINE
+
+            if (!view.dirRemove(
+                    keylet::ownerDir(account), (*sleMpt)[sfOwnerNode], sleMpt->key(), false))
+                return tecINTERNAL;  // LCOV_EXCL_LINE
+
+            adjustOwnerCount(view, sleAcct, -1, journal);
+
+            view.erase(sleMpt);
+            return tesSUCCESS;
+        }
+
+        // A potential holder wants to authorize/hold a mpt, the ledger must:
+        //      - add the new mptokenKey to the owner directory
+        //      - create the MPToken object for the holder
+
+        // The reserve that is required to create the MPToken. Note
+        // that although the reserve increases with every item
+        // an account owns, in the case of MPTokens we only
+        // *enforce* a reserve if the user owns more than two
+        // items. This is similar to the reserve requirements of trust lines.
+        std::uint32_t const uOwnerCount = sleAcct->getFieldU32(sfOwnerCount);
+        XRPAmount const reserveCreate(
+            (uOwnerCount < 2) ? XRPAmount(beast::zero)
+                              : view.fees().accountReserve(uOwnerCount + 1));
+
+        if (priorBalance < reserveCreate)
+            return tecINSUFFICIENT_RESERVE;
+
+        // Defensive check before we attempt to create MPToken for the issuer
+        auto const mpt = view.read(keylet::mptIssuance(mptIssuanceID));
+        if (!mpt || mpt->getAccountID(sfIssuer) == account)
+        {
+            // LCOV_EXCL_START
+            UNREACHABLE("xrpl::authorizeMPToken : invalid issuance or issuers token");
+            if (view.rules().enabled(featureLendingProtocol))
+                return tecINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        auto const mptokenKey = keylet::mptoken(mptIssuanceID, account);
+        auto mptoken = std::make_shared<SLE>(mptokenKey);
+        if (auto ter = dirLink(view, account, mptoken))
+            return ter;  // LCOV_EXCL_LINE
+
+        (*mptoken)[sfAccount] = account;
+        (*mptoken)[sfMPTokenIssuanceID] = mptIssuanceID;
+        (*mptoken)[sfFlags] = 0;
+        view.insert(mptoken);
+
+        // Update owner count.
+        adjustOwnerCount(view, sleAcct, 1, journal);
+
+        return tesSUCCESS;
+    }
+
+    auto const sleMptIssuance = view.read(keylet::mptIssuance(mptIssuanceID));
+    if (!sleMptIssuance)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // If the account that submitted this tx is the issuer of the MPT
+    // Note: `account_` is issuer's account
+    //       `holderID` is holder's account
+    if (account != (*sleMptIssuance)[sfIssuer])
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sleMpt = view.peek(keylet::mptoken(mptIssuanceID, *holderID));
+    if (!sleMpt)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    std::uint32_t const flagsIn = sleMpt->getFieldU32(sfFlags);
+    std::uint32_t flagsOut = flagsIn;
+
+    // Issuer wants to unauthorize the holder, unset lsfMPTAuthorized on
+    // their MPToken
+    if ((flags & tfMPTUnauthorize) != 0)
+    {
+        flagsOut &= ~lsfMPTAuthorized;
+    }
+    // Issuer wants to authorize a holder, set lsfMPTAuthorized on their
+    // MPToken
+    else
+    {
+        flagsOut |= lsfMPTAuthorized;
+    }
+
+    if (flagsIn != flagsOut)
+        sleMpt->setFieldU32(sfFlags, flagsOut);
+
+    view.update(sleMpt);
+    return tesSUCCESS;
+}
+
+[[nodiscard]] TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    MPTIssue const& mptIssue,
+    beast::Journal journal)
+{
+    // If the account is the issuer, then no token should exist. MPTs do not
+    // have the legacy ability to create such a situation, but check anyway. If
+    // a token does exist, it will get deleted. If not, return success.
+    bool const accountIsIssuer = accountID == mptIssue.getIssuer();
+    auto const& mptID = mptIssue.getMptID();
+    auto const mptoken = view.peek(keylet::mptoken(mptID, accountID));
+    if (!mptoken)
+        return accountIsIssuer ? (TER)tesSUCCESS : (TER)tecOBJECT_NOT_FOUND;
+    // Unlike a trust line, if the account is the issuer, and the token has a
+    // balance, it can not just be deleted, because that will throw the issuance
+    // accounting out of balance, so fail. Since this should be impossible
+    // anyway, I'm not going to put any effort into it.
+    if (mptoken->at(sfMPTAmount) != 0)
+        return tecHAS_OBLIGATIONS;
+
+    return authorizeMPToken(
+        view,
+        {},  // priorBalance
+        mptID,
+        accountID,
+        journal,
+        tfMPTUnauthorize  // flags
+    );
+}
+
+[[nodiscard]] TER
+requireAuth(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& account,
+    AuthType authType,
+    int depth)
+{
+    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const sleIssuance = view.read(mptID);
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    auto const mptIssuer = sleIssuance->getAccountID(sfIssuer);
+
+    // issuer is always "authorized"
+    if (mptIssuer == account)  // Issuer won't have MPToken
+        return tesSUCCESS;
+
+    bool const featureSAVEnabled = view.rules().enabled(featureSingleAssetVault);
+
+    if (featureSAVEnabled)
+    {
+        if (depth >= maxAssetCheckDepth)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        // requireAuth is recursive if the issuer is a vault pseudo-account
+        auto const sleIssuer = view.read(keylet::account(mptIssuer));
+        if (!sleIssuer)
+            return tefINTERNAL;  // LCOV_EXCL_LINE
+
+        if (sleIssuer->isFieldPresent(sfVaultID))
+        {
+            auto const sleVault = view.read(keylet::vault(sleIssuer->getFieldH256(sfVaultID)));
+            if (!sleVault)
+                return tefINTERNAL;  // LCOV_EXCL_LINE
+
+            auto const asset = sleVault->at(sfAsset);
+            if (auto const err = std::visit(
+                    [&]<ValidIssueType TIss>(TIss const& issue) {
+                        if constexpr (std::is_same_v<TIss, Issue>)
+                        {
+                            return requireAuth(view, issue, account, authType);
+                        }
+                        else
+                        {
+                            return requireAuth(view, issue, account, authType, depth + 1);
+                        }
+                    },
+                    asset.value());
+                !isTesSuccess(err))
+                return err;
+        }
+    }
+
+    auto const mptokenID = keylet::mptoken(mptID.key, account);
+    auto const sleToken = view.read(mptokenID);
+
+    // if account has no MPToken, fail
+    if (!sleToken && (authType == AuthType::StrongAuth || authType == AuthType::Legacy))
+        return tecNO_AUTH;
+
+    // Note, this check is not amendment-gated because DomainID will be always
+    // empty **unless** writing to it has been enabled by an amendment
+    auto const maybeDomainID = sleIssuance->at(~sfDomainID);
+    if (maybeDomainID)
+    {
+        XRPL_ASSERT(
+            sleIssuance->getFieldU32(sfFlags) & lsfMPTRequireAuth,
+            "xrpl::requireAuth : issuance requires authorization");
+        // ter = tefINTERNAL | tecOBJECT_NOT_FOUND | tecNO_AUTH | tecEXPIRED
+        auto const ter = credentials::validDomain(view, *maybeDomainID, account);
+        if (isTesSuccess(ter))
+        {
+            return ter;  // Note: sleToken might be null
+        }
+        if (!sleToken)
+        {
+            return ter;
+        }
+        // We ignore error from validDomain if we found sleToken, as it could
+        // belong to someone who is explicitly authorized e.g. a vault owner.
+    }
+
+    if (featureSAVEnabled)
+    {
+        // Implicitly authorize Vault and LoanBroker pseudo-accounts
+        if (isPseudoAccount(view, account, {&sfVaultID, &sfLoanBrokerID}))
+            return tesSUCCESS;
+    }
+
+    // mptoken must be authorized if issuance enabled requireAuth
+    if (sleIssuance->isFlag(lsfMPTRequireAuth) &&
+        (!sleToken || !sleToken->isFlag(lsfMPTAuthorized)))
+        return tecNO_AUTH;
+
+    return tesSUCCESS;  // Note: sleToken might be null
+}
+
+[[nodiscard]] TER
+enforceMPTokenAuthorization(
+    ApplyView& view,
+    MPTID const& mptIssuanceID,
+    AccountID const& account,
+    XRPAmount const& priorBalance,  // for MPToken authorization
+    beast::Journal j)
+{
+    auto const sleIssuance = view.read(keylet::mptIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    XRPL_ASSERT(
+        sleIssuance->isFlag(lsfMPTRequireAuth),
+        "xrpl::enforceMPTokenAuthorization : authorization required");
+
+    if (account == sleIssuance->at(sfIssuer))
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const keylet = keylet::mptoken(mptIssuanceID, account);
+    auto const sleToken = view.read(keylet);  //  NOTE: might be null
+    auto const maybeDomainID = sleIssuance->at(~sfDomainID);
+    bool expired = false;
+    bool const authorizedByDomain = [&]() -> bool {
+        // NOTE: defensive here, should be checked in preclaim
+        if (!maybeDomainID.has_value())
+            return false;  // LCOV_EXCL_LINE
+
+        auto const ter = verifyValidDomain(view, account, *maybeDomainID, j);
+        if (isTesSuccess(ter))
+            return true;
+        if (ter == tecEXPIRED)
+            expired = true;
+        return false;
+    }();
+
+    if (!authorizedByDomain && sleToken == nullptr)
+    {
+        // Could not find MPToken and won't create one, could be either of:
+        //
+        // 1. Field sfDomainID not set in MPTokenIssuance or
+        // 2. Account has no matching and accepted credentials or
+        // 3. Account has all expired credentials (deleted in verifyValidDomain)
+        //
+        // Either way, return tecNO_AUTH and there is nothing else to do
+        return expired ? tecEXPIRED : tecNO_AUTH;
+    }
+    if (!authorizedByDomain && maybeDomainID.has_value())
+    {
+        // Found an MPToken but the account is not authorized and we expect
+        // it to have been authorized by the domain. This could be because the
+        // credentials used to create the MPToken have expired or been deleted.
+        return expired ? tecEXPIRED : tecNO_AUTH;
+    }
+    if (!authorizedByDomain)
+    {
+        // We found an MPToken, but sfDomainID is not set, so this is a classic
+        // MPToken which requires authorization by the token issuer.
+        XRPL_ASSERT(
+            sleToken != nullptr && !maybeDomainID.has_value(),
+            "xrpl::enforceMPTokenAuthorization : found MPToken");
+        if (sleToken->isFlag(lsfMPTAuthorized))
+            return tesSUCCESS;
+
+        return tecNO_AUTH;
+    }
+    if (authorizedByDomain && sleToken != nullptr)
+    {
+        // Found an MPToken, authorized by the domain. Ignore authorization flag
+        // lsfMPTAuthorized because it is meaningless. Return tesSUCCESS
+        XRPL_ASSERT(
+            maybeDomainID.has_value(),
+            "xrpl::enforceMPTokenAuthorization : found MPToken for domain");
+        return tesSUCCESS;
+    }
+    if (authorizedByDomain)
+    {
+        // Could not find MPToken but there should be one because we are
+        // authorized by domain. Proceed to create it, then return tesSUCCESS
+        XRPL_ASSERT(
+            maybeDomainID.has_value() && sleToken == nullptr,
+            "xrpl::enforceMPTokenAuthorization : new MPToken for domain");
+        if (auto const err = authorizeMPToken(
+                view,
+                priorBalance,   // priorBalance
+                mptIssuanceID,  // mptIssuanceID
+                account,        // account
+                j);
+            !isTesSuccess(err))
+            return err;
+
+        return tesSUCCESS;
+    }
+
+    // LCOV_EXCL_START
+    UNREACHABLE("xrpl::enforceMPTokenAuthorization : condition list is incomplete");
+    return tefINTERNAL;
+    // LCOV_EXCL_STOP
+}
+
+TER
+canTransfer(
+    ReadView const& view,
+    MPTIssue const& mptIssue,
+    AccountID const& from,
+    AccountID const& to)
+{
+    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto const sleIssuance = view.read(mptID);
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanTransfer))
+    {
+        if (from != (*sleIssuance)[sfIssuer] && to != (*sleIssuance)[sfIssuer])
+            return TER{tecNO_AUTH};
+    }
+    return tesSUCCESS;
+}
+
+TER
+rippleLockEscrowMPT(
+    ApplyView& view,
+    AccountID const& sender,
+    STAmount const& amount,
+    beast::Journal j)
+{
+    auto const mptIssue = amount.get<MPTIssue>();
+    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto sleIssuance = view.peek(mptID);
+    if (!sleIssuance)
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleLockEscrowMPT: MPT issuance not found for "
+                        << mptIssue.getMptID();
+        return tecOBJECT_NOT_FOUND;
+    }  // LCOV_EXCL_STOP
+
+    if (amount.getIssuer() == sender)
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleLockEscrowMPT: sender is the issuer, cannot lock MPTs.";
+        return tecINTERNAL;
+    }  // LCOV_EXCL_STOP
+
+    // 1. Decrease the MPT Holder MPTAmount
+    // 2. Increase the MPT Holder EscrowedAmount
+    {
+        auto const mptokenID = keylet::mptoken(mptID.key, sender);
+        auto sle = view.peek(mptokenID);
+        if (!sle)
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleLockEscrowMPT: MPToken not found for " << sender;
+            return tecOBJECT_NOT_FOUND;
+        }  // LCOV_EXCL_STOP
+
+        auto const amt = sle->getFieldU64(sfMPTAmount);
+        auto const pay = amount.mpt().value();
+
+        // Underflow check for subtraction
+        if (!canSubtract(STAmount(mptIssue, amt), STAmount(mptIssue, pay)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleLockEscrowMPT: insufficient MPTAmount for "
+                            << to_string(sender) << ": " << amt << " < " << pay;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        (*sle)[sfMPTAmount] = amt - pay;
+
+        // Overflow check for addition
+        uint64_t const locked = (*sle)[~sfLockedAmount].value_or(0);
+
+        if (!canAdd(STAmount(mptIssue, locked), STAmount(mptIssue, pay)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleLockEscrowMPT: overflow on locked amount for "
+                            << to_string(sender) << ": " << locked << " + " << pay;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        if (sle->isFieldPresent(sfLockedAmount))
+        {
+            (*sle)[sfLockedAmount] += pay;
+        }
+        else
+        {
+            sle->setFieldU64(sfLockedAmount, pay);
+        }
+
+        view.update(sle);
+    }
+
+    // 1. Increase the Issuance EscrowedAmount
+    // 2. DO NOT change the Issuance OutstandingAmount
+    {
+        uint64_t const issuanceEscrowed = (*sleIssuance)[~sfLockedAmount].value_or(0);
+        auto const pay = amount.mpt().value();
+
+        // Overflow check for addition
+        if (!canAdd(STAmount(mptIssue, issuanceEscrowed), STAmount(mptIssue, pay)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleLockEscrowMPT: overflow on issuance "
+                               "locked amount for "
+                            << mptIssue.getMptID() << ": " << issuanceEscrowed << " + " << pay;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        if (sleIssuance->isFieldPresent(sfLockedAmount))
+        {
+            (*sleIssuance)[sfLockedAmount] += pay;
+        }
+        else
+        {
+            sleIssuance->setFieldU64(sfLockedAmount, pay);
+        }
+
+        view.update(sleIssuance);
+    }
+    return tesSUCCESS;
+}
+
+TER
+rippleUnlockEscrowMPT(
+    ApplyView& view,
+    AccountID const& sender,
+    AccountID const& receiver,
+    STAmount const& netAmount,
+    STAmount const& grossAmount,
+    beast::Journal j)
+{
+    if (!view.rules().enabled(fixTokenEscrowV1))
+    {
+        XRPL_ASSERT(
+            netAmount == grossAmount, "xrpl::rippleUnlockEscrowMPT : netAmount == grossAmount");
+    }
+
+    auto const& issuer = netAmount.getIssuer();
+    auto const& mptIssue = netAmount.get<MPTIssue>();
+    auto const mptID = keylet::mptIssuance(mptIssue.getMptID());
+    auto sleIssuance = view.peek(mptID);
+    if (!sleIssuance)
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleUnlockEscrowMPT: MPT issuance not found for "
+                        << mptIssue.getMptID();
+        return tecOBJECT_NOT_FOUND;
+    }  // LCOV_EXCL_STOP
+
+    // Decrease the Issuance EscrowedAmount
+    {
+        if (!sleIssuance->isFieldPresent(sfLockedAmount))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: no locked amount in issuance for "
+                            << mptIssue.getMptID();
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        auto const locked = sleIssuance->getFieldU64(sfLockedAmount);
+        auto const redeem = grossAmount.mpt().value();
+
+        // Underflow check for subtraction
+        if (!canSubtract(STAmount(mptIssue, locked), STAmount(mptIssue, redeem)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: insufficient locked amount for "
+                            << mptIssue.getMptID() << ": " << locked << " < " << redeem;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        auto const newLocked = locked - redeem;
+        if (newLocked == 0)
+        {
+            sleIssuance->makeFieldAbsent(sfLockedAmount);
+        }
+        else
+        {
+            sleIssuance->setFieldU64(sfLockedAmount, newLocked);
+        }
+        view.update(sleIssuance);
+    }
+
+    if (issuer != receiver)
+    {
+        // Increase the MPT Holder MPTAmount
+        auto const mptokenID = keylet::mptoken(mptID.key, receiver);
+        auto sle = view.peek(mptokenID);
+        if (!sle)
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: MPToken not found for " << receiver;
+            return tecOBJECT_NOT_FOUND;
+        }  // LCOV_EXCL_STOP
+
+        auto current = sle->getFieldU64(sfMPTAmount);
+        auto delta = netAmount.mpt().value();
+
+        // Overflow check for addition
+        if (!canAdd(STAmount(mptIssue, current), STAmount(mptIssue, delta)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: overflow on MPTAmount for "
+                            << to_string(receiver) << ": " << current << " + " << delta;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        (*sle)[sfMPTAmount] += delta;
+        view.update(sle);
+    }
+    else
+    {
+        // Decrease the Issuance OutstandingAmount
+        auto const outstanding = sleIssuance->getFieldU64(sfOutstandingAmount);
+        auto const redeem = netAmount.mpt().value();
+
+        // Underflow check for subtraction
+        if (!canSubtract(STAmount(mptIssue, outstanding), STAmount(mptIssue, redeem)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: insufficient outstanding amount for "
+                            << mptIssue.getMptID() << ": " << outstanding << " < " << redeem;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        sleIssuance->setFieldU64(sfOutstandingAmount, outstanding - redeem);
+        view.update(sleIssuance);
+    }
+
+    if (issuer == sender)
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleUnlockEscrowMPT: sender is the issuer, "
+                           "cannot unlock MPTs.";
+        return tecINTERNAL;
+    }  // LCOV_EXCL_STOP
+    // Decrease the MPT Holder EscrowedAmount
+    auto const mptokenID = keylet::mptoken(mptID.key, sender);
+    auto sle = view.peek(mptokenID);
+    if (!sle)
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleUnlockEscrowMPT: MPToken not found for " << sender;
+        return tecOBJECT_NOT_FOUND;
+    }  // LCOV_EXCL_STOP
+
+    if (!sle->isFieldPresent(sfLockedAmount))
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleUnlockEscrowMPT: no locked amount in MPToken for "
+                        << to_string(sender);
+        return tecINTERNAL;
+    }  // LCOV_EXCL_STOP
+
+    auto const locked = sle->getFieldU64(sfLockedAmount);
+    auto const delta = grossAmount.mpt().value();
+
+    // Underflow check for subtraction
+    if (!canSubtract(STAmount(mptIssue, locked), STAmount(mptIssue, delta)))
+    {  // LCOV_EXCL_START
+        JLOG(j.error()) << "rippleUnlockEscrowMPT: insufficient locked amount for "
+                        << to_string(sender) << ": " << locked << " < " << delta;
+        return tecINTERNAL;
+    }  // LCOV_EXCL_STOP
+
+    auto const newLocked = locked - delta;
+    if (newLocked == 0)
+    {
+        sle->makeFieldAbsent(sfLockedAmount);
+    }
+    else
+    {
+        sle->setFieldU64(sfLockedAmount, newLocked);
+    }
+    view.update(sle);
+
+    // Note: The gross amount is the amount that was locked, the net
+    // amount is the amount that is being unlocked. The difference is the fee
+    // that was charged for the transfer. If this difference is greater than
+    // zero, we need to update the outstanding amount.
+    auto const diff = grossAmount.mpt().value() - netAmount.mpt().value();
+    if (diff != 0)
+    {
+        auto const outstanding = sleIssuance->getFieldU64(sfOutstandingAmount);
+        // Underflow check for subtraction
+        if (!canSubtract(STAmount(mptIssue, outstanding), STAmount(mptIssue, diff)))
+        {  // LCOV_EXCL_START
+            JLOG(j.error()) << "rippleUnlockEscrowMPT: insufficient outstanding amount for "
+                            << mptIssue.getMptID() << ": " << outstanding << " < " << diff;
+            return tecINTERNAL;
+        }  // LCOV_EXCL_STOP
+
+        sleIssuance->setFieldU64(sfOutstandingAmount, outstanding - diff);
+        view.update(sleIssuance);
+    }
+    return tesSUCCESS;
+}
+
+}  // namespace xrpl

src/libxrpl/ledger/helpers/OfferHelpers.cpp

@@ -0,0 +1,58 @@
+#include <xrpl/ledger/helpers/OfferHelpers.h>
+//
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/st.h>
+
+namespace xrpl {
+
+TER
+offerDelete(ApplyView& view, std::shared_ptr<SLE> const& sle, beast::Journal j)
+{
+    if (!sle)
+        return tesSUCCESS;
+    auto offerIndex = sle->key();
+    auto owner = sle->getAccountID(sfAccount);
+
+    // Detect legacy directories.
+    uint256 uDirectory = sle->getFieldH256(sfBookDirectory);
+
+    if (!view.dirRemove(keylet::ownerDir(owner), sle->getFieldU64(sfOwnerNode), offerIndex, false))
+    {
+        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
+    }
+
+    if (!view.dirRemove(keylet::page(uDirectory), sle->getFieldU64(sfBookNode), offerIndex, false))
+    {
+        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
+    }
+
+    if (sle->isFieldPresent(sfAdditionalBooks))
+    {
+        XRPL_ASSERT(
+            sle->isFlag(lsfHybrid) && sle->isFieldPresent(sfDomainID),
+            "xrpl::offerDelete : should be a hybrid domain offer");
+
+        auto const& additionalBookDirs = sle->getFieldArray(sfAdditionalBooks);
+
+        for (auto const& bookDir : additionalBookDirs)
+        {
+            auto const& dirIndex = bookDir.getFieldH256(sfBookDirectory);
+            auto const& dirNode = bookDir.getFieldU64(sfBookNode);
+
+            if (!view.dirRemove(keylet::page(dirIndex), dirNode, offerIndex, false))
+            {
+                return tefBAD_LEDGER;  // LCOV_EXCL_LINE
+            }
+        }
+    }
+
+    adjustOwnerCount(view, view.peek(keylet::account(owner)), -1, j);
+
+    view.erase(sle);
+
+    return tesSUCCESS;
+}
+
+}  // namespace xrpl

src/libxrpl/ledger/helpers/RippleStateHelpers.cpp

@@ -0,0 +1,760 @@
+#include <xrpl/ledger/helpers/RippleStateHelpers.h>
+//
+#include <xrpl/basics/Log.h>
+#include <xrpl/ledger/ApplyView.h>
+#include <xrpl/ledger/ReadView.h>
+#include <xrpl/ledger/helpers/AccountRootHelpers.h>
+#include <xrpl/ledger/helpers/DirectoryHelpers.h>
+#include <xrpl/protocol/AmountConversions.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/Rules.h>
+
+namespace xrpl {
+
+//------------------------------------------------------------------------------
+//
+// Credit functions (from Credit.cpp)
+//
+//------------------------------------------------------------------------------
+
+STAmount
+creditLimit(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& issuer,
+    Currency const& currency)
+{
+    STAmount result(Issue{currency, account});
+
+    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
+
+    if (sleRippleState)
+    {
+        result = sleRippleState->getFieldAmount(account < issuer ? sfLowLimit : sfHighLimit);
+        result.setIssuer(account);
+    }
+
+    XRPL_ASSERT(result.getIssuer() == account, "xrpl::creditLimit : result issuer match");
+    XRPL_ASSERT(result.getCurrency() == currency, "xrpl::creditLimit : result currency match");
+    return result;
+}
+
+IOUAmount
+creditLimit2(ReadView const& v, AccountID const& acc, AccountID const& iss, Currency const& cur)
+{
+    return toAmount<IOUAmount>(creditLimit(v, acc, iss, cur));
+}
+
+STAmount
+creditBalance(
+    ReadView const& view,
+    AccountID const& account,
+    AccountID const& issuer,
+    Currency const& currency)
+{
+    STAmount result(Issue{currency, account});
+
+    auto sleRippleState = view.read(keylet::line(account, issuer, currency));
+
+    if (sleRippleState)
+    {
+        result = sleRippleState->getFieldAmount(sfBalance);
+        if (account < issuer)
+            result.negate();
+        result.setIssuer(account);
+    }
+
+    XRPL_ASSERT(result.getIssuer() == account, "xrpl::creditBalance : result issuer match");
+    XRPL_ASSERT(result.getCurrency() == currency, "xrpl::creditBalance : result currency match");
+    return result;
+}
+
+//------------------------------------------------------------------------------
+//
+// Freeze checking (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+bool
+isIndividualFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer)
+{
+    if (isXRP(currency))
+        return false;
+    if (issuer != account)
+    {
+        // Check if the issuer froze the line
+        auto const sle = view.read(keylet::line(account, issuer, currency));
+        if (sle && sle->isFlag((issuer > account) ? lsfHighFreeze : lsfLowFreeze))
+            return true;
+    }
+    return false;
+}
+
+// Can the specified account spend the specified currency issued by
+// the specified issuer or does the freeze flag prohibit it?
+bool
+isFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer)
+{
+    if (isXRP(currency))
+        return false;
+    auto sle = view.read(keylet::account(issuer));
+    if (sle && sle->isFlag(lsfGlobalFreeze))
+        return true;
+    if (issuer != account)
+    {
+        // Check if the issuer froze the line
+        sle = view.read(keylet::line(account, issuer, currency));
+        if (sle && sle->isFlag((issuer > account) ? lsfHighFreeze : lsfLowFreeze))
+            return true;
+    }
+    return false;
+}
+
+bool
+isDeepFrozen(
+    ReadView const& view,
+    AccountID const& account,
+    Currency const& currency,
+    AccountID const& issuer)
+{
+    if (isXRP(currency))
+    {
+        return false;
+    }
+
+    if (issuer == account)
+    {
+        return false;
+    }
+
+    auto const sle = view.read(keylet::line(account, issuer, currency));
+    if (!sle)
+    {
+        return false;
+    }
+
+    return sle->isFlag(lsfHighDeepFreeze) || sle->isFlag(lsfLowDeepFreeze);
+}
+
+//------------------------------------------------------------------------------
+//
+// Trust line operations
+//
+//------------------------------------------------------------------------------
+
+TER
+trustCreate(
+    ApplyView& view,
+    bool const bSrcHigh,
+    AccountID const& uSrcAccountID,
+    AccountID const& uDstAccountID,
+    uint256 const& uIndex,      // --> ripple state entry
+    SLE::ref sleAccount,        // --> the account being set.
+    bool const bAuth,           // --> authorize account.
+    bool const bNoRipple,       // --> others cannot ripple through
+    bool const bFreeze,         // --> funds cannot leave
+    bool bDeepFreeze,           // --> can neither receive nor send funds
+    STAmount const& saBalance,  // --> balance of account being set.
+                                // Issuer should be noAccount()
+    STAmount const& saLimit,    // --> limit for account being set.
+                                // Issuer should be the account being set.
+    std::uint32_t uQualityIn,
+    std::uint32_t uQualityOut,
+    beast::Journal j)
+{
+    JLOG(j.trace()) << "trustCreate: " << to_string(uSrcAccountID) << ", "
+                    << to_string(uDstAccountID) << ", " << saBalance.getFullText();
+
+    auto const& uLowAccountID = !bSrcHigh ? uSrcAccountID : uDstAccountID;
+    auto const& uHighAccountID = bSrcHigh ? uSrcAccountID : uDstAccountID;
+    if (uLowAccountID == uHighAccountID)
+    {
+        // LCOV_EXCL_START
+        UNREACHABLE("xrpl::trustCreate : trust line to self");
+        if (view.rules().enabled(featureLendingProtocol))
+            return tecINTERNAL;
+        // LCOV_EXCL_STOP
+    }
+
+    auto const sleRippleState = std::make_shared<SLE>(ltRIPPLE_STATE, uIndex);
+    view.insert(sleRippleState);
+
+    auto lowNode = view.dirInsert(
+        keylet::ownerDir(uLowAccountID), sleRippleState->key(), describeOwnerDir(uLowAccountID));
+
+    if (!lowNode)
+        return tecDIR_FULL;  // LCOV_EXCL_LINE
+
+    auto highNode = view.dirInsert(
+        keylet::ownerDir(uHighAccountID), sleRippleState->key(), describeOwnerDir(uHighAccountID));
+
+    if (!highNode)
+        return tecDIR_FULL;  // LCOV_EXCL_LINE
+
+    bool const bSetDst = saLimit.getIssuer() == uDstAccountID;
+    bool const bSetHigh = bSrcHigh ^ bSetDst;
+
+    XRPL_ASSERT(sleAccount, "xrpl::trustCreate : non-null SLE");
+    if (!sleAccount)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    XRPL_ASSERT(
+        sleAccount->getAccountID(sfAccount) == (bSetHigh ? uHighAccountID : uLowAccountID),
+        "xrpl::trustCreate : matching account ID");
+    auto const slePeer = view.peek(keylet::account(bSetHigh ? uLowAccountID : uHighAccountID));
+    if (!slePeer)
+        return tecNO_TARGET;
+
+    // Remember deletion hints.
+    sleRippleState->setFieldU64(sfLowNode, *lowNode);
+    sleRippleState->setFieldU64(sfHighNode, *highNode);
+
+    sleRippleState->setFieldAmount(bSetHigh ? sfHighLimit : sfLowLimit, saLimit);
+    sleRippleState->setFieldAmount(
+        bSetHigh ? sfLowLimit : sfHighLimit,
+        STAmount(Issue{saBalance.getCurrency(), bSetDst ? uSrcAccountID : uDstAccountID}));
+
+    if (uQualityIn != 0u)
+        sleRippleState->setFieldU32(bSetHigh ? sfHighQualityIn : sfLowQualityIn, uQualityIn);
+
+    if (uQualityOut != 0u)
+        sleRippleState->setFieldU32(bSetHigh ? sfHighQualityOut : sfLowQualityOut, uQualityOut);
+
+    std::uint32_t uFlags = bSetHigh ? lsfHighReserve : lsfLowReserve;
+
+    if (bAuth)
+    {
+        uFlags |= (bSetHigh ? lsfHighAuth : lsfLowAuth);
+    }
+    if (bNoRipple)
+    {
+        uFlags |= (bSetHigh ? lsfHighNoRipple : lsfLowNoRipple);
+    }
+    if (bFreeze)
+    {
+        uFlags |= (bSetHigh ? lsfHighFreeze : lsfLowFreeze);
+    }
+    if (bDeepFreeze)
+    {
+        uFlags |= (bSetHigh ? lsfHighDeepFreeze : lsfLowDeepFreeze);
+    }
+
+    if ((slePeer->getFlags() & lsfDefaultRipple) == 0)
+    {
+        // The other side's default is no rippling
+        uFlags |= (bSetHigh ? lsfLowNoRipple : lsfHighNoRipple);
+    }
+
+    sleRippleState->setFieldU32(sfFlags, uFlags);
+    adjustOwnerCount(view, sleAccount, 1, j);
+
+    // ONLY: Create ripple balance.
+    sleRippleState->setFieldAmount(sfBalance, bSetHigh ? -saBalance : saBalance);
+
+    view.creditHook(uSrcAccountID, uDstAccountID, saBalance, saBalance.zeroed());
+
+    return tesSUCCESS;
+}
+
+TER
+trustDelete(
+    ApplyView& view,
+    std::shared_ptr<SLE> const& sleRippleState,
+    AccountID const& uLowAccountID,
+    AccountID const& uHighAccountID,
+    beast::Journal j)
+{
+    // Detect legacy dirs.
+    std::uint64_t uLowNode = sleRippleState->getFieldU64(sfLowNode);
+    std::uint64_t uHighNode = sleRippleState->getFieldU64(sfHighNode);
+
+    JLOG(j.trace()) << "trustDelete: Deleting ripple line: low";
+
+    if (!view.dirRemove(keylet::ownerDir(uLowAccountID), uLowNode, sleRippleState->key(), false))
+    {
+        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
+    }
+
+    JLOG(j.trace()) << "trustDelete: Deleting ripple line: high";
+
+    if (!view.dirRemove(keylet::ownerDir(uHighAccountID), uHighNode, sleRippleState->key(), false))
+    {
+        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
+    }
+
+    JLOG(j.trace()) << "trustDelete: Deleting ripple line: state";
+    view.erase(sleRippleState);
+
+    return tesSUCCESS;
+}
+
+//------------------------------------------------------------------------------
+//
+// IOU issuance/redemption
+//
+//------------------------------------------------------------------------------
+
+static bool
+updateTrustLine(
+    ApplyView& view,
+    SLE::pointer state,
+    bool bSenderHigh,
+    AccountID const& sender,
+    STAmount const& before,
+    STAmount const& after,
+    beast::Journal j)
+{
+    if (!state)
+        return false;
+    std::uint32_t const flags(state->getFieldU32(sfFlags));
+
+    auto sle = view.peek(keylet::account(sender));
+    if (!sle)
+        return false;
+
+    // YYY Could skip this if rippling in reverse.
+    if (before > beast::zero
+        // Sender balance was positive.
+        && after <= beast::zero
+        // Sender is zero or negative.
+        && ((flags & (!bSenderHigh ? lsfLowReserve : lsfHighReserve)) != 0u)
+        // Sender reserve is set.
+        && static_cast<bool>(flags & (!bSenderHigh ? lsfLowNoRipple : lsfHighNoRipple)) !=
+            static_cast<bool>(sle->getFlags() & lsfDefaultRipple) &&
+        ((flags & (!bSenderHigh ? lsfLowFreeze : lsfHighFreeze)) == 0u) &&
+        !state->getFieldAmount(!bSenderHigh ? sfLowLimit : sfHighLimit)
+        // Sender trust limit is 0.
+        && (state->getFieldU32(!bSenderHigh ? sfLowQualityIn : sfHighQualityIn) == 0u)
+        // Sender quality in is 0.
+        && (state->getFieldU32(!bSenderHigh ? sfLowQualityOut : sfHighQualityOut) == 0u))
+    // Sender quality out is 0.
+    {
+        // VFALCO Where is the line being deleted?
+        // Clear the reserve of the sender, possibly delete the line!
+        adjustOwnerCount(view, sle, -1, j);
+
+        // Clear reserve flag.
+        state->setFieldU32(sfFlags, flags & (!bSenderHigh ? ~lsfLowReserve : ~lsfHighReserve));
+
+        // Balance is zero, receiver reserve is clear.
+        if (!after  // Balance is zero.
+            && ((flags & (bSenderHigh ? lsfLowReserve : lsfHighReserve)) == 0u))
+            return true;
+    }
+    return false;
+}
+
+TER
+issueIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j)
+{
+    XRPL_ASSERT(
+        !isXRP(account) && !isXRP(issue.account),
+        "xrpl::issueIOU : neither account nor issuer is XRP");
+
+    // Consistency check
+    XRPL_ASSERT(issue == amount.issue(), "xrpl::issueIOU : matching issue");
+
+    // Can't send to self!
+    XRPL_ASSERT(issue.account != account, "xrpl::issueIOU : not issuer account");
+
+    JLOG(j.trace()) << "issueIOU: " << to_string(account) << ": " << amount.getFullText();
+
+    bool bSenderHigh = issue.account > account;
+
+    auto const index = keylet::line(issue.account, account, issue.currency);
+
+    if (auto state = view.peek(index))
+    {
+        STAmount final_balance = state->getFieldAmount(sfBalance);
+
+        if (bSenderHigh)
+            final_balance.negate();  // Put balance in sender terms.
+
+        STAmount const start_balance = final_balance;
+
+        final_balance -= amount;
+
+        auto const must_delete = updateTrustLine(
+            view, state, bSenderHigh, issue.account, start_balance, final_balance, j);
+
+        view.creditHook(issue.account, account, amount, start_balance);
+
+        if (bSenderHigh)
+            final_balance.negate();
+
+        // Adjust the balance on the trust line if necessary. We do this even
+        // if we are going to delete the line to reflect the correct balance
+        // at the time of deletion.
+        state->setFieldAmount(sfBalance, final_balance);
+        if (must_delete)
+        {
+            return trustDelete(
+                view,
+                state,
+                bSenderHigh ? account : issue.account,
+                bSenderHigh ? issue.account : account,
+                j);
+        }
+
+        view.update(state);
+
+        return tesSUCCESS;
+    }
+
+    // NIKB TODO: The limit uses the receiver's account as the issuer and
+    // this is unnecessarily inefficient as copying which could be avoided
+    // is now required. Consider available options.
+    STAmount const limit(Issue{issue.currency, account});
+    STAmount final_balance = amount;
+
+    final_balance.setIssuer(noAccount());
+
+    auto const receiverAccount = view.peek(keylet::account(account));
+    if (!receiverAccount)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    bool noRipple = (receiverAccount->getFlags() & lsfDefaultRipple) == 0;
+
+    return trustCreate(
+        view,
+        bSenderHigh,
+        issue.account,
+        account,
+        index.key,
+        receiverAccount,
+        false,
+        noRipple,
+        false,
+        false,
+        final_balance,
+        limit,
+        0,
+        0,
+        j);
+}
+
+TER
+redeemIOU(
+    ApplyView& view,
+    AccountID const& account,
+    STAmount const& amount,
+    Issue const& issue,
+    beast::Journal j)
+{
+    XRPL_ASSERT(
+        !isXRP(account) && !isXRP(issue.account),
+        "xrpl::redeemIOU : neither account nor issuer is XRP");
+
+    // Consistency check
+    XRPL_ASSERT(issue == amount.issue(), "xrpl::redeemIOU : matching issue");
+
+    // Can't send to self!
+    XRPL_ASSERT(issue.account != account, "xrpl::redeemIOU : not issuer account");
+
+    JLOG(j.trace()) << "redeemIOU: " << to_string(account) << ": " << amount.getFullText();
+
+    bool bSenderHigh = account > issue.account;
+
+    if (auto state = view.peek(keylet::line(account, issue.account, issue.currency)))
+    {
+        STAmount final_balance = state->getFieldAmount(sfBalance);
+
+        if (bSenderHigh)
+            final_balance.negate();  // Put balance in sender terms.
+
+        STAmount const start_balance = final_balance;
+
+        final_balance -= amount;
+
+        auto const must_delete =
+            updateTrustLine(view, state, bSenderHigh, account, start_balance, final_balance, j);
+
+        view.creditHook(account, issue.account, amount, start_balance);
+
+        if (bSenderHigh)
+            final_balance.negate();
+
+        // Adjust the balance on the trust line if necessary. We do this even
+        // if we are going to delete the line to reflect the correct balance
+        // at the time of deletion.
+        state->setFieldAmount(sfBalance, final_balance);
+
+        if (must_delete)
+        {
+            return trustDelete(
+                view,
+                state,
+                bSenderHigh ? issue.account : account,
+                bSenderHigh ? account : issue.account,
+                j);
+        }
+
+        view.update(state);
+        return tesSUCCESS;
+    }
+
+    // In order to hold an IOU, a trust line *MUST* exist to track the
+    // balance. If it doesn't, then something is very wrong. Don't try
+    // to continue.
+    // LCOV_EXCL_START
+    JLOG(j.fatal()) << "redeemIOU: " << to_string(account) << " attempts to "
+                    << "redeem " << amount.getFullText() << " but no trust line exists!";
+
+    return tefINTERNAL;
+    // LCOV_EXCL_STOP
+}
+
+//------------------------------------------------------------------------------
+//
+// Authorization and transfer checks (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+TER
+requireAuth(ReadView const& view, Issue const& issue, AccountID const& account, AuthType authType)
+{
+    if (isXRP(issue) || issue.account == account)
+        return tesSUCCESS;
+
+    auto const trustLine = view.read(keylet::line(account, issue.account, issue.currency));
+    // If account has no line, and this is a strong check, fail
+    if (!trustLine && authType == AuthType::StrongAuth)
+        return tecNO_LINE;
+
+    // If this is a weak or legacy check, or if the account has a line, fail if
+    // auth is required and not set on the line
+    if (auto const issuerAccount = view.read(keylet::account(issue.account));
+        issuerAccount && (((*issuerAccount)[sfFlags] & lsfRequireAuth) != 0u))
+    {
+        if (trustLine)
+        {
+            return (((*trustLine)[sfFlags] &
+                     ((account > issue.account) ? lsfLowAuth : lsfHighAuth)) != 0u)
+                ? tesSUCCESS
+                : TER{tecNO_AUTH};
+        }
+        return TER{tecNO_LINE};
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, AccountID const& to)
+{
+    if (issue.native())
+        return tesSUCCESS;
+
+    auto const& issuerId = issue.getIssuer();
+    if (issuerId == from || issuerId == to)
+        return tesSUCCESS;
+    auto const sleIssuer = view.read(keylet::account(issuerId));
+    if (sleIssuer == nullptr)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const isRippleDisabled = [&](AccountID account) -> bool {
+        // Line might not exist, but some transfers can create it. If this
+        // is the case, just check the default ripple on the issuer account.
+        auto const line = view.read(keylet::line(account, issue));
+        if (line)
+        {
+            bool const issuerHigh = issuerId > account;
+            return line->isFlag(issuerHigh ? lsfHighNoRipple : lsfLowNoRipple);
+        }
+        return !sleIssuer->isFlag(lsfDefaultRipple);
+    };
+
+    // Fail if rippling disabled on both trust lines
+    if (isRippleDisabled(from) && isRippleDisabled(to))
+        return terNO_RIPPLE;
+
+    return tesSUCCESS;
+}
+
+//------------------------------------------------------------------------------
+//
+// Empty holding operations (IOU-specific)
+//
+//------------------------------------------------------------------------------
+
+TER
+addEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    XRPAmount priorBalance,
+    Issue const& issue,
+    beast::Journal journal)
+{
+    // Every account can hold XRP. An issuer can issue directly.
+    if (issue.native() || accountID == issue.getIssuer())
+        return tesSUCCESS;
+
+    auto const& issuerId = issue.getIssuer();
+    auto const& currency = issue.currency;
+    if (isGlobalFrozen(view, issuerId))
+        return tecFROZEN;  // LCOV_EXCL_LINE
+
+    auto const& srcId = issuerId;
+    auto const& dstId = accountID;
+    auto const high = srcId > dstId;
+    auto const index = keylet::line(srcId, dstId, currency);
+    auto const sleSrc = view.peek(keylet::account(srcId));
+    auto const sleDst = view.peek(keylet::account(dstId));
+    if (!sleDst || !sleSrc)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+    if (!sleSrc->isFlag(lsfDefaultRipple))
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    // If the line already exists, don't create it again.
+    if (view.read(index))
+        return tecDUPLICATE;
+
+    // Can the account cover the trust line reserve ?
+    std::uint32_t const ownerCount = sleDst->at(sfOwnerCount);
+    if (priorBalance < view.fees().accountReserve(ownerCount + 1))
+        return tecNO_LINE_INSUF_RESERVE;
+
+    return trustCreate(
+        view,
+        high,
+        srcId,
+        dstId,
+        index.key,
+        sleDst,
+        /*bAuth=*/false,
+        /*bNoRipple=*/true,
+        /*bFreeze=*/false,
+        /*deepFreeze*/ false,
+        /*saBalance=*/STAmount{Issue{currency, noAccount()}},
+        /*saLimit=*/STAmount{Issue{currency, dstId}},
+        /*uQualityIn=*/0,
+        /*uQualityOut=*/0,
+        journal);
+}
+
+TER
+removeEmptyHolding(
+    ApplyView& view,
+    AccountID const& accountID,
+    Issue const& issue,
+    beast::Journal journal)
+{
+    if (issue.native())
+    {
+        auto const sle = view.read(keylet::account(accountID));
+        if (!sle)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        auto const balance = sle->getFieldAmount(sfBalance);
+        if (balance.xrp() != 0)
+            return tecHAS_OBLIGATIONS;
+
+        return tesSUCCESS;
+    }
+
+    // `asset` is an IOU.
+    // If the account is the issuer, then no line should exist. Check anyway.
+    // If a line does exist, it will get deleted. If not, return success.
+    bool const accountIsIssuer = accountID == issue.account;
+    auto const line = view.peek(keylet::line(accountID, issue));
+    if (!line)
+        return accountIsIssuer ? (TER)tesSUCCESS : (TER)tecOBJECT_NOT_FOUND;
+    if (!accountIsIssuer && line->at(sfBalance)->iou() != beast::zero)
+        return tecHAS_OBLIGATIONS;
+
+    // Adjust the owner count(s)
+    if (line->isFlag(lsfLowReserve))
+    {
+        // Clear reserve for low account.
+        auto sleLowAccount = view.peek(keylet::account(line->at(sfLowLimit)->getIssuer()));
+        if (!sleLowAccount)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        adjustOwnerCount(view, sleLowAccount, -1, journal);
+        // It's not really necessary to clear the reserve flag, since the line
+        // is about to be deleted, but this will make the metadata reflect an
+        // accurate state at the time of deletion.
+        line->clearFlag(lsfLowReserve);
+    }
+
+    if (line->isFlag(lsfHighReserve))
+    {
+        // Clear reserve for high account.
+        auto sleHighAccount = view.peek(keylet::account(line->at(sfHighLimit)->getIssuer()));
+        if (!sleHighAccount)
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+
+        adjustOwnerCount(view, sleHighAccount, -1, journal);
+        // It's not really necessary to clear the reserve flag, since the line
+        // is about to be deleted, but this will make the metadata reflect an
+        // accurate state at the time of deletion.
+        line->clearFlag(lsfHighReserve);
+    }
+
+    return trustDelete(
+        view, line, line->at(sfLowLimit)->getIssuer(), line->at(sfHighLimit)->getIssuer(), journal);
+}
+
+TER
+deleteAMMTrustLine(
+    ApplyView& view,
+    std::shared_ptr<SLE> sleState,
+    std::optional<AccountID> const& ammAccountID,
+    beast::Journal j)
+{
+    if (!sleState || sleState->getType() != ltRIPPLE_STATE)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const& [low, high] = std::minmax(
+        sleState->getFieldAmount(sfLowLimit).getIssuer(),
+        sleState->getFieldAmount(sfHighLimit).getIssuer());
+    auto sleLow = view.peek(keylet::account(low));
+    auto sleHigh = view.peek(keylet::account(high));
+    if (!sleLow || !sleHigh)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    bool const ammLow = sleLow->isFieldPresent(sfAMMID);
+    bool const ammHigh = sleHigh->isFieldPresent(sfAMMID);
+
+    // can't both be AMM
+    if (ammLow && ammHigh)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // at least one must be
+    if (!ammLow && !ammHigh)
+        return terNO_AMM;
+
+    // one must be the target amm
+    if (ammAccountID && (low != *ammAccountID && high != *ammAccountID))
+        return terNO_AMM;
+
+    if (auto const ter = trustDelete(view, sleState, low, high, j); !isTesSuccess(ter))
+    {
+        JLOG(j.error()) << "deleteAMMTrustLine: failed to delete the trustline.";
+        return ter;
+    }
+
+    auto const uFlags = !ammLow ? lsfLowReserve : lsfHighReserve;
+    if ((sleState->getFlags() & uFlags) == 0u)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    adjustOwnerCount(view, !ammLow ? sleLow : sleHigh, -1, j);
+
+    return tesSUCCESS;
+}
+
+}  // namespace xrpl

src/libxrpl/ledger/helpers/VaultHelpers.cpp

@@ -0,0 +1,112 @@
+#include <xrpl/ledger/helpers/VaultHelpers.h>
+//
+#include <xrpl/basics/Number.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/st.h>
+
+namespace xrpl {
+
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets)
+{
+    XRPL_ASSERT(!assets.negative(), "xrpl::assetsToSharesDeposit : non-negative assets");
+    XRPL_ASSERT(
+        assets.asset() == vault->at(sfAsset),
+        "xrpl::assetsToSharesDeposit : assets and vault match");
+    if (assets.negative() || assets.asset() != vault->at(sfAsset))
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    Number const assetTotal = vault->at(sfAssetsTotal);
+    STAmount shares{vault->at(sfShareMPTID)};
+    if (assetTotal == 0)
+    {
+        return STAmount{
+            shares.asset(),
+            Number(assets.mantissa(), assets.exponent() + vault->at(sfScale)).truncate()};
+    }
+
+    Number const shareTotal = issuance->at(sfOutstandingAmount);
+    shares = ((shareTotal * assets) / assetTotal).truncate();
+    return shares;
+}
+
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsDeposit(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares)
+{
+    XRPL_ASSERT(!shares.negative(), "xrpl::sharesToAssetsDeposit : non-negative shares");
+    XRPL_ASSERT(
+        shares.asset() == vault->at(sfShareMPTID),
+        "xrpl::sharesToAssetsDeposit : shares and vault match");
+    if (shares.negative() || shares.asset() != vault->at(sfShareMPTID))
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    Number const assetTotal = vault->at(sfAssetsTotal);
+    STAmount assets{vault->at(sfAsset)};
+    if (assetTotal == 0)
+    {
+        return STAmount{
+            assets.asset(), shares.mantissa(), shares.exponent() - vault->at(sfScale), false};
+    }
+
+    Number const shareTotal = issuance->at(sfOutstandingAmount);
+    assets = (assetTotal * shares) / shareTotal;
+    return assets;
+}
+
+[[nodiscard]] std::optional<STAmount>
+assetsToSharesWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& assets,
+    TruncateShares truncate)
+{
+    XRPL_ASSERT(!assets.negative(), "xrpl::assetsToSharesWithdraw : non-negative assets");
+    XRPL_ASSERT(
+        assets.asset() == vault->at(sfAsset),
+        "xrpl::assetsToSharesWithdraw : assets and vault match");
+    if (assets.negative() || assets.asset() != vault->at(sfAsset))
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    Number assetTotal = vault->at(sfAssetsTotal);
+    assetTotal -= vault->at(sfLossUnrealized);
+    STAmount shares{vault->at(sfShareMPTID)};
+    if (assetTotal == 0)
+        return shares;
+    Number const shareTotal = issuance->at(sfOutstandingAmount);
+    Number result = (shareTotal * assets) / assetTotal;
+    if (truncate == TruncateShares::yes)
+        result = result.truncate();
+    shares = result;
+    return shares;
+}
+
+[[nodiscard]] std::optional<STAmount>
+sharesToAssetsWithdraw(
+    std::shared_ptr<SLE const> const& vault,
+    std::shared_ptr<SLE const> const& issuance,
+    STAmount const& shares)
+{
+    XRPL_ASSERT(!shares.negative(), "xrpl::sharesToAssetsWithdraw : non-negative shares");
+    XRPL_ASSERT(
+        shares.asset() == vault->at(sfShareMPTID),
+        "xrpl::sharesToAssetsWithdraw : shares and vault match");
+    if (shares.negative() || shares.asset() != vault->at(sfShareMPTID))
+        return std::nullopt;  // LCOV_EXCL_LINE
+
+    Number assetTotal = vault->at(sfAssetsTotal);
+    assetTotal -= vault->at(sfLossUnrealized);
+    STAmount assets{vault->at(sfAsset)};
+    if (assetTotal == 0)
+        return assets;
+    Number const shareTotal = issuance->at(sfOutstandingAmount);
+    assets = (assetTotal * shares) / shareTotal;
+    return assets;
+}
+
+}  // namespace xrpl

src/libxrpl/net/HTTPClient.cpp

@@ -59,6 +59,7 @@ public:
     //--------------------------------------------------------------------------
 
     void
+    // NOLINTNEXTLINE(readability-convert-member-functions-to-static)
     makeGet(std::string const& strPath, boost::asio::streambuf& sb, std::string const& strHost)
     {
         std::ostream osRequest(&sb);

src/libxrpl/nodestore/ManagerImp.cpp

@@ -55,7 +55,7 @@ ManagerImp::make_Backend(
         missing_backend();
 
     auto factory{find(type)};
-    if (!factory)
+    if (factory == nullptr)
     {
         missing_backend();
     }

src/libxrpl/nodestore/backend/RocksDBFactory.cpp

@@ -213,7 +213,7 @@ public:
         rocksdb::DB* db = nullptr;
         m_options.create_if_missing = createIfMissing;
         rocksdb::Status status = rocksdb::DB::Open(m_options, m_name, &db);
-        if (!status.ok() || !db)
+        if (!status.ok() || (db == nullptr))
         {
             Throw<std::runtime_error>(
                 std::string("Unable to open/create RocksDB: ") + status.ToString());

src/libxrpl/protocol/BuildInfo.cpp

@@ -140,7 +140,7 @@ encodeSoftwareVersion(std::string_view versionStr)
                 if (x == 0)
                     x = parsePreRelease(id, "b", 0x40, 0, 63);
 
-                if (x & 0xC0)
+                if ((x & 0xC0) != 0)
                 {
                     c |= static_cast<std::uint64_t>(x) << 16;
                     break;

src/libxrpl/protocol/ErrorCodes.cpp

@@ -205,9 +205,7 @@ make_error(error_code_i code, std::string const& message)
 bool
 contains_error(Json::Value const& json)
 {
-    if (json.isObject() && json.isMember(jss::error))
-        return true;
-    return false;
+    return json.isObject() && json.isMember(jss::error);
 }
 
 int

src/libxrpl/protocol/Feature.cpp

@@ -209,7 +209,7 @@ FeatureCollections::getRegisteredFeature(std::string const& name) const
     XRPL_ASSERT(
         readOnly.load(), "xrpl::FeatureCollections::getRegisteredFeature : startup completed");
     Feature const* feature = getByName(name);
-    if (feature)
+    if (feature != nullptr)
         return feature->feature;
     return std::nullopt;
 }
@@ -229,7 +229,7 @@ FeatureCollections::registerFeature(std::string const& name, Supported support,
         support == Supported::yes || vote == VoteBehavior::DefaultNo,
         "Invalid feature parameters. Must be supported to be up-voted.");
     Feature const* i = getByName(name);
-    if (!i)
+    if (i == nullptr)
     {
         check(features.size() < detail::numFeatures, "More features defined than allocated.");
 
@@ -283,7 +283,7 @@ FeatureCollections::featureToBitsetIndex(uint256 const& f) const
         readOnly.load(), "xrpl::FeatureCollections::featureToBitsetIndex : startup completed");
 
     Feature const* feature = getByFeature(f);
-    if (!feature)
+    if (feature == nullptr)
         LogicError("Invalid Feature ID");
 
     return getIndex(*feature);
@@ -303,7 +303,7 @@ FeatureCollections::featureToName(uint256 const& f) const
 {
     XRPL_ASSERT(readOnly.load(), "xrpl::FeatureCollections::featureToName : startup completed");
     Feature const* feature = getByFeature(f);
-    return feature ? feature->name : to_string(f);
+    return (feature != nullptr) ? feature->name : to_string(f);
 }
 
 FeatureCollections featureCollections;

src/libxrpl/protocol/IOUAmount.cpp

@@ -186,7 +186,7 @@ mulRatio(IOUAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundU
 {
     using namespace boost::multiprecision;
 
-    if (!den)
+    if (den == 0u)
         Throw<std::runtime_error>("division by zero");
 
     // A vector with the value 10^index for indexes from 0 to 29

src/libxrpl/protocol/InnerObjectFormats.cpp

@@ -172,7 +172,7 @@ SOTemplate const*
 InnerObjectFormats::findSOTemplateBySField(SField const& sField) const
 {
     auto itemPtr = findByType(sField.getCode());
-    if (itemPtr)
+    if (itemPtr != nullptr)
         return &(itemPtr->getSOTemplate());
 
     return nullptr;

src/libxrpl/protocol/NFTokenOfferID.cpp

@@ -24,7 +24,7 @@ canHaveNFTokenOfferID(
         return false;
 
     TxType const tt = serializedTx->getTxnType();
-    if (!(tt == ttNFTOKEN_MINT && serializedTx->isFieldPresent(sfAmount)) &&
+    if ((tt != ttNFTOKEN_MINT || !serializedTx->isFieldPresent(sfAmount)) &&
         tt != ttNFTOKEN_CREATE_OFFER)
         return false;
 

src/libxrpl/protocol/Permissions.cpp

@@ -176,13 +176,13 @@ Permission::isDelegable(std::uint32_t const& permissionValue, Rules const& rules
 }
 
 uint32_t
-Permission::txToPermissionType(TxType const& type) const
+Permission::txToPermissionType(TxType const& type)
 {
     return static_cast<uint32_t>(type) + 1;
 }
 
 TxType
-Permission::permissionToTxType(uint32_t const& value) const
+Permission::permissionToTxType(uint32_t const& value)
 {
     return static_cast<TxType>(value - 1);
 }

src/libxrpl/protocol/PublicKey.cpp

@@ -75,7 +75,7 @@ static std::string
 sliceToHex(Slice const& slice)
 {
     std::string s;
-    if (slice[0] & 0x80)
+    if ((slice[0] & 0x80) != 0)
     {
         s.reserve(2 * (slice.size() + 2));
         s = "0x00";

src/libxrpl/protocol/STAccount.cpp

@@ -84,7 +84,7 @@ bool
 STAccount::isEquivalent(STBase const& t) const
 {
     auto const* const tPtr = dynamic_cast<STAccount const*>(&t);
-    return tPtr && (default_ == tPtr->default_) && (value_ == tPtr->value_);
+    return (tPtr != nullptr) && (default_ == tPtr->default_) && (value_ == tPtr->value_);
 }
 
 bool

src/libxrpl/protocol/STAmount.cpp

@@ -152,7 +152,7 @@ STAmount::STAmount(SerialIter& sit, SField const& name) : STBase(name)
 
     value &= ~(1023ull << (64 - 10));
 
-    if (value)
+    if (value != 0u)
     {
         bool isNegative = (offset & 256) == 0;
         offset = (offset & 255) - 97;  // center the range
@@ -505,14 +505,11 @@ canAdd(STAmount const& a, STAmount const& b)
         XRPAmount A = a.xrp();
         XRPAmount B = b.xrp();
 
-        if ((B > XRPAmount{0} &&
+        return !(
+            (B > XRPAmount{0} &&
              A > XRPAmount{std::numeric_limits<XRPAmount::value_type>::max()} - B) ||
             (B < XRPAmount{0} &&
-             A < XRPAmount{std::numeric_limits<XRPAmount::value_type>::min()} - B))
-        {
-            return false;
-        }
-        return true;
+             A < XRPAmount{std::numeric_limits<XRPAmount::value_type>::min()} - B));
     }
 
     // IOU case (precision check)
@@ -530,15 +527,11 @@ canAdd(STAmount const& a, STAmount const& b)
     {
         MPTAmount A = a.mpt();
         MPTAmount B = b.mpt();
-        if ((B > MPTAmount{0} &&
+        return !(
+            (B > MPTAmount{0} &&
              A > MPTAmount{std::numeric_limits<MPTAmount::value_type>::max()} - B) ||
             (B < MPTAmount{0} &&
-             A < MPTAmount{std::numeric_limits<MPTAmount::value_type>::min()} - B))
-        {
-            return false;
-        }
-
-        return true;
+             A < MPTAmount{std::numeric_limits<MPTAmount::value_type>::min()} - B));
     }
     // LCOV_EXCL_START
     UNREACHABLE("STAmount::canAdd : unexpected STAmount type");
@@ -803,7 +796,7 @@ bool
 STAmount::isEquivalent(STBase const& t) const
 {
     STAmount const* v = dynamic_cast<STAmount const*>(&t);
-    return v && (*v == *this);
+    return (v != nullptr) && (*v == *this);
 }
 
 bool

src/libxrpl/protocol/STBlob.cpp

@@ -53,7 +53,7 @@ bool
 STBlob::isEquivalent(STBase const& t) const
 {
     STBlob const* v = dynamic_cast<STBlob const*>(&t);
-    return v && (value_ == v->value_);
+    return (v != nullptr) && (value_ == v->value_);
 }
 
 bool

src/libxrpl/protocol/STCurrency.cpp

@@ -56,7 +56,7 @@ bool
 STCurrency::isEquivalent(STBase const& t) const
 {
     STCurrency const* v = dynamic_cast<STCurrency const*>(&t);
-    return v && (*v == *this);
+    return (v != nullptr) && (*v == *this);
 }
 
 bool

src/libxrpl/protocol/STIssue.cpp

@@ -110,7 +110,7 @@ bool
 STIssue::isEquivalent(STBase const& t) const
 {
     STIssue const* v = dynamic_cast<STIssue const*>(&t);
-    return v && (*v == *this);
+    return (v != nullptr) && (*v == *this);
 }
 
 bool

src/libxrpl/protocol/STLedgerEntry.cpp

@@ -136,7 +136,7 @@ STLedgerEntry::isThreadedType(Rules const& rules) const
     // Exclude PrevTxnID/PrevTxnLgrSeq if the fixPreviousTxnID amendment is not
     // enabled and the ledger object type is in the above set
     bool const excludePrevTxnID = !rules.enabled(fixPreviousTxnID) &&
-        std::count(newPreviousTxnIDTypes.cbegin(), newPreviousTxnIDTypes.cend(), type_);
+        (std::count(newPreviousTxnIDTypes.cbegin(), newPreviousTxnIDTypes.cend(), type_) != 0);
     return !excludePrevTxnID && getFieldIndex(sfPreviousTxnID) != -1;
 }
 

src/libxrpl/protocol/STObject.cpp

@@ -204,7 +204,7 @@ void
 STObject::applyTemplateFromSField(SField const& sField)
 {
     SOTemplate const* elements = InnerObjectFormats::getInstance().findSOTemplateBySField(sField);
-    if (elements)
+    if (elements != nullptr)
         applyTemplate(*elements);  // May throw
 }
 
@@ -276,7 +276,7 @@ STObject::hasMatchingEntry(STBase const& t) const
 {
     STBase const* o = peekAtPField(t.getFName());
 
-    if (!o)
+    if (o == nullptr)
         return false;
 
     return t == *o;
@@ -343,7 +343,7 @@ STObject::isEquivalent(STBase const& t) const
 {
     STObject const* v = dynamic_cast<STObject const*>(&t);
 
-    if (!v)
+    if (v == nullptr)
         return false;
 
     if (mType != nullptr && v->mType == mType)
@@ -480,7 +480,7 @@ STObject::setFlag(std::uint32_t f)
 {
     STUInt32* t = dynamic_cast<STUInt32*>(getPField(sfFlags, true));
 
-    if (!t)
+    if (t == nullptr)
         return false;
 
     t->setValue(t->value() | f);
@@ -492,7 +492,7 @@ STObject::clearFlag(std::uint32_t f)
 {
     STUInt32* t = dynamic_cast<STUInt32*>(getPField(sfFlags));
 
-    if (!t)
+    if (t == nullptr)
         return false;
 
     t->setValue(t->value() & ~f);
@@ -510,7 +510,7 @@ STObject::getFlags(void) const
 {
     STUInt32 const* t = dynamic_cast<STUInt32 const*>(peekAtPField(sfFlags));
 
-    if (!t)
+    if (t == nullptr)
         return 0;
 
     return t->value();
@@ -574,7 +574,7 @@ STObject::delField(int index)
 SOEStyle
 STObject::getStyle(SField const& field) const
 {
-    return mType ? mType->style(field) : soeINVALID;
+    return (mType != nullptr) ? mType->style(field) : soeINVALID;
 }
 
 unsigned char
@@ -877,10 +877,7 @@ STObject::operator==(STObject const& obj) const
             ++fields;
     }
 
-    if (fields != matches)
-        return false;
-
-    return true;
+    return fields == matches;
 }
 
 void
@@ -917,7 +914,8 @@ STObject::getSortedFields(STObject const& objToSort, WhichFields whichFields)
     for (detail::STVar const& elem : objToSort.v_)
     {
         STBase const& base = elem.get();
-        if ((base.getSType() != STI_NOTPRESENT) && base.getFName().shouldInclude(whichFields))
+        if ((base.getSType() != STI_NOTPRESENT) &&
+            base.getFName().shouldInclude(static_cast<bool>(whichFields)))
         {
             sf.push_back(&base);
         }

src/libxrpl/protocol/STParsedJSON.cpp

@@ -1075,20 +1075,20 @@ parseArray(
             // TODO: There doesn't seem to be a nice way to get just the
             // first/only key in an object without copying all keys into
             // a vector
-            std::string const objectName(json[i].getMemberNames()[0]);
+            std::string const memberName(json[i].getMemberNames()[0]);
             ;
-            auto const& nameField(SField::getField(objectName));
+            auto const& nameField(SField::getField(memberName));
 
             if (nameField == sfInvalid)
             {
-                error = unknown_field(json_name, objectName);
+                error = unknown_field(json_name, memberName);
                 return std::nullopt;
             }
 
-            Json::Value const objectFields(json[i][objectName]);
+            Json::Value const objectFields(json[i][memberName]);
 
             std::stringstream ss;
-            ss << json_name << "." << "[" << i << "]." << objectName;
+            ss << json_name << "." << "[" << i << "]." << memberName;
 
             auto ret = parseObject(ss.str(), objectFields, nameField, depth + 1, error);
             if (!ret)

src/libxrpl/protocol/STPathSet.cpp

@@ -61,7 +61,7 @@ STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
             if (iType == STPathElement::typeNone)
                 return;
         }
-        else if (iType & ~STPathElement::typeAll)
+        else if ((iType & ~STPathElement::typeAll) != 0)
         {
             JLOG(debugLog().error()) << "Bad path element " << iType << " in pathset";
             Throw<std::runtime_error>("bad path element");
@@ -76,13 +76,13 @@ STPathSet::STPathSet(SerialIter& sit, SField const& name) : STBase(name)
             Currency currency;
             AccountID issuer;
 
-            if (hasAccount)
+            if (hasAccount != 0)
                 account = sit.get160();
 
-            if (hasCurrency)
+            if (hasCurrency != 0)
                 currency = sit.get160();
 
-            if (hasIssuer)
+            if (hasIssuer != 0)
                 issuer = sit.get160();
 
             path.emplace_back(account, currency, issuer, hasCurrency);
@@ -127,7 +127,7 @@ bool
 STPathSet::isEquivalent(STBase const& t) const
 {
     STPathSet const* v = dynamic_cast<STPathSet const*>(&t);
-    return v && (value == v->value);
+    return (v != nullptr) && (value == v->value);
 }
 
 bool
@@ -160,13 +160,13 @@ STPath::getJson(JsonOptions) const
 
         elem[jss::type] = iType;
 
-        if (iType & STPathElement::typeAccount)
+        if ((iType & STPathElement::typeAccount) != 0u)
             elem[jss::account] = to_string(it.getAccountID());
 
-        if (iType & STPathElement::typeCurrency)
+        if ((iType & STPathElement::typeCurrency) != 0u)
             elem[jss::currency] = to_string(it.getCurrency());
 
-        if (iType & STPathElement::typeIssuer)
+        if ((iType & STPathElement::typeIssuer) != 0u)
             elem[jss::issuer] = to_string(it.getIssuerID());
 
         ret.append(elem);
@@ -209,13 +209,13 @@ STPathSet::add(Serializer& s) const
 
             s.add8(iType);
 
-            if (iType & STPathElement::typeAccount)
+            if ((iType & STPathElement::typeAccount) != 0)
                 s.addBitString(speElement.getAccountID());
 
-            if (iType & STPathElement::typeCurrency)
+            if ((iType & STPathElement::typeCurrency) != 0)
                 s.addBitString(speElement.getCurrency());
 
-            if (iType & STPathElement::typeIssuer)
+            if ((iType & STPathElement::typeIssuer) != 0)
                 s.addBitString(speElement.getIssuerID());
         }
 

src/libxrpl/protocol/STTx.cpp

@@ -574,7 +574,7 @@ STTx::getBatchTransactionIDs() const
 {
     XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::getBatchTransactionIDs : not a batch transaction");
     XRPL_ASSERT(
-        getFieldArray(sfRawTransactions).size() != 0,
+        !getFieldArray(sfRawTransactions).empty(),
         "STTx::getBatchTransactionIDs : empty raw transactions");
 
     // The list of inner ids is built once, then reused on subsequent calls.
@@ -618,7 +618,7 @@ isMemoOkay(STObject const& st, std::string& reason)
     {
         auto memoObj = dynamic_cast<STObject const*>(&memo);
 
-        if (!memoObj || (memoObj->getFName() != sfMemo))
+        if ((memoObj == nullptr) || (memoObj->getFName() != sfMemo))
         {
             reason = "A memo array may contain only Memo objects.";
             return false;
@@ -669,7 +669,7 @@ isMemoOkay(STObject const& st, std::string& reason)
 
             for (unsigned char c : *optData)
             {
-                if (!allowedSymbols[c])
+                if (allowedSymbols[c] == 0)
                 {
                     reason =
                         "The MemoType and MemoFormat fields may only "
@@ -691,7 +691,7 @@ isAccountFieldOkay(STObject const& st)
     for (int i = 0; i < st.getCount(); ++i)
     {
         auto t = dynamic_cast<STAccount const*>(st.peekAtPIndex(i));
-        if (t && t->isDefault())
+        if ((t != nullptr) && t->isDefault())
             return false;
     }
 

src/libxrpl/protocol/STValidation.cpp

@@ -107,7 +107,7 @@ STValidation::isValid() const noexcept
             getSignerPublic(),
             getSigningHash(),
             makeSlice(getFieldVL(sfSignature)),
-            getFlags() & vfFullyCanonicalSig);
+            (getFlags() & vfFullyCanonicalSig) != 0u);
     }
 
     return valid_.value();

src/libxrpl/protocol/STVar.cpp

@@ -60,7 +60,7 @@ STVar::operator=(STVar const& rhs)
     if (&rhs != this)
     {
         destroy();
-        if (rhs.p_)
+        if (rhs.p_ != nullptr)
         {
             p_ = rhs.p_->copy(max_size, &d_);
         }

src/libxrpl/protocol/STVector256.cpp

@@ -68,7 +68,7 @@ bool
 STVector256::isEquivalent(STBase const& t) const
 {
     STVector256 const* v = dynamic_cast<STVector256 const*>(&t);
-    return v && (mValue == v->mValue);
+    return (v != nullptr) && (mValue == v->mValue);
 }
 
 Json::Value

src/libxrpl/protocol/STXChainBridge.cpp

@@ -167,7 +167,7 @@ bool
 STXChainBridge::isEquivalent(STBase const& t) const
 {
     STXChainBridge const* v = dynamic_cast<STXChainBridge const*>(&t);
-    return v && (*v == *this);
+    return (v != nullptr) && (*v == *this);
 }
 
 bool

src/libxrpl/protocol/Serializer.cpp

@@ -199,7 +199,7 @@ Serializer::addVL(void const* ptr, int len)
 {
     int ret = addEncoded(len);
 
-    if (len)
+    if (len != 0)
         addRaw(ptr, len);
 
     return ret;
@@ -298,7 +298,7 @@ Serializer::decodeVLLength(int b1, int b2)
     if (b1 > 240)
         Throw<std::overflow_error>("b1>240");
 
-    return 193 + (b1 - 193) * 256 + b2;
+    return 193 + ((b1 - 193) * 256) + b2;
 }
 
 int
@@ -310,7 +310,7 @@ Serializer::decodeVLLength(int b1, int b2, int b3)
     if (b1 > 254)
         Throw<std::overflow_error>("b1>254");
 
-    return 12481 + (b1 - 241) * 65536 + b2 * 256 + b3;
+    return 12481 + ((b1 - 241) * 65536) + (b2 * 256) + b3;
 }
 
 //------------------------------------------------------------------------------

src/libxrpl/protocol/TxMeta.cpp

@@ -28,7 +28,7 @@ TxMeta::TxMeta(uint256 const& txid, std::uint32_t ledger, STObject const& obj)
 
     auto affectedNodes = dynamic_cast<STArray const*>(obj.peekAtPField(sfAffectedNodes));
     XRPL_ASSERT(affectedNodes, "xrpl::TxMeta::TxMeta(STObject) : type cast succeeded");
-    if (affectedNodes)
+    if (affectedNodes != nullptr)
         nodes_ = *affectedNodes;
 
     setAdditionalFields(obj);
@@ -96,7 +96,7 @@ TxMeta::getAffectedAccounts() const
         {
             auto const* inner = dynamic_cast<STObject const*>(&node.peekAtIndex(index));
             XRPL_ASSERT(inner, "xrpl::getAffectedAccounts : STObject type cast succeeded");
-            if (inner)
+            if (inner != nullptr)
             {
                 for (auto const& field : *inner)
                 {

src/libxrpl/protocol/UintTypes.cpp

@@ -63,7 +63,7 @@ to_string(Currency const& currency)
 bool
 to_currency(Currency& currency, std::string const& code)
 {
-    if (code.empty() || !code.compare(systemCurrencyCode()))
+    if (code.empty() || (code.compare(systemCurrencyCode()) == 0))
     {
         currency = beast::zero;
         return true;

src/libxrpl/protocol/tokens.cpp

@@ -263,7 +263,7 @@ decodeBase58(std::string const& s)
 
     // Allocate enough space in big-endian base256 representation.
     // log(58) / log(256), rounded up.
-    std::vector<unsigned char> b256(remain * 733 / 1000 + 1);
+    std::vector<unsigned char> b256((remain * 733 / 1000) + 1);
     while (remain > 0)
     {
         auto carry = alphabetReverse[*psz];
@@ -308,7 +308,7 @@ encodeBase58Token(TokenType type, void const* token, std::size_t size)
     // Lay the data out as
     //      <type><token><checksum>
     buf[0] = safe_cast<std::underlying_type_t<TokenType>>(type);
-    if (size)
+    if (size != 0u)
         std::memcpy(buf.data() + 1, token, size);
     checksum(buf.data() + 1 + size, buf.data(), 1 + size);
 
@@ -383,7 +383,7 @@ b256_to_b58_be(std::span<std::uint8_t const> input, std::span<std::uint8_t> out)
             {
                 break;
             }
-            auto const src_i_end = input.size() - i * 8;
+            auto const src_i_end = input.size() - (i * 8);
             if (src_i_end >= 8)
             {
                 std::memcpy(&base_2_64_coeff_buf[num_coeff], &input[src_i_end - 8], 8);
@@ -450,7 +450,7 @@ b256_to_b58_be(std::span<std::uint8_t const> input, std::span<std::uint8_t> out)
         {
             to_skip = count_leading_zeros(b58_be_s);
             skip_zeros = false;
-            if (out.size() < (i + 1) * 10 - to_skip)
+            if (out.size() < ((i + 1) * 10) - to_skip)
             {
                 return Unexpected(TokenCodecErrc::outputTooSmall);
             }
@@ -502,7 +502,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     // log(2^(38*8),58^10)) ~= 5.18. So 6 coeff are enough
     std::array<std::uint64_t, 6> b_58_10_coeff{};
     auto [num_full_coeffs, partial_coeff_len] = xrpl::b58_fast::detail::div_rem(input.size(), 10);
-    auto const num_partial_coeffs = partial_coeff_len ? 1 : 0;
+    auto const num_partial_coeffs = (partial_coeff_len != 0u) ? 1 : 0;
     auto const num_b_58_10_coeffs = num_full_coeffs + num_partial_coeffs;
     XRPL_ASSERT(
         num_b_58_10_coeffs <= b_58_10_coeff.size(),
@@ -521,7 +521,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
     {
         for (int j = 0; j < num_full_coeffs; ++j)
         {
-            unsigned char c = input[partial_coeff_len + j * 10 + i];
+            unsigned char c = input[partial_coeff_len + (j * 10) + i];
             auto cur_val = ::xrpl::alphabetReverse[c];
             if (cur_val < 0)
             {
@@ -586,7 +586,7 @@ b58_to_b256_be(std::string_view input, std::span<std::uint8_t> out)
             cur_out_i += 1;
         }
     }
-    if ((cur_out_i + 8 * (cur_result_size - 1)) > out.size())
+    if ((cur_out_i + (8 * (cur_result_size - 1))) > out.size())
     {
         return Unexpected(TokenCodecErrc::outputTooSmall);
     }

src/libxrpl/rdb/DatabaseCon.cpp

@@ -72,7 +72,7 @@ DatabaseCon::~DatabaseCon()
         // checkpoint is currently in progress. Wait for it to end, otherwise
         // creating a new DatabaseCon to the same database may fail due to the
         // database being locked by our (now old) Checkpointer.
-        while (wk.use_count())
+        while (wk.use_count() != 0)
         {
             std::this_thread::sleep_for(std::chrono::milliseconds(100));
         }
@@ -84,7 +84,7 @@ std::unique_ptr<std::vector<std::string> const> DatabaseCon::Setup::globalPragma
 void
 DatabaseCon::setupCheckpointing(JobQueue* q, Logs& l)
 {
-    if (!q)
+    if (q == nullptr)
         Throw<std::logic_error>("No JobQueue");
     checkpointer_ = checkpointers.create(session_, *q, l);
 }

src/libxrpl/rdb/SociDB.cpp

@@ -98,7 +98,7 @@ getConnection(soci::session& s)
     if (auto b = dynamic_cast<soci::sqlite3_session_backend*>(be))
         result = b->conn_;
 
-    if (!result)
+    if (result == nullptr)
         Throw<std::logic_error>("Didn't get a database connection.");
 
     return result;
@@ -107,7 +107,7 @@ getConnection(soci::session& s)
 std::uint32_t
 getKBUsedAll(soci::session& s)
 {
-    if (!getConnection(s))
+    if (getConnection(s) == nullptr)
         Throw<std::logic_error>("No connection found.");
     return static_cast<size_t>(sqlite_api::sqlite3_memory_used() / kilobytes(1));
 }
@@ -249,7 +249,7 @@ public:
     {
         auto [conn, keepAlive] = getConnection();
         (void)keepAlive;
-        if (!conn)
+        if (conn == nullptr)
             return;
 
         int log = 0, ckpt = 0;