Merge branch 'pratik/std-coro/migrate-entry-points' into pratik/std-coro/migrate-test-code

Bring in develop via the upstream branch. Two classes of collision needed
manual resolution:

Namespace case refactor (develop #7933) renamed RPC -> rpc and
xrpl::RPC::Tuning -> xrpl::rpc::tuning. Conflicts were resolved by taking
develop's naming together with this stack's coroutine API (postCoroTask,
CoroTask<void>, no Context::coro):
  - src/test/app/Path_test.cpp
  - src/test/app/PathMPT_test.cpp
  - src/test/jtx/impl/TestHelpers.cpp
  - src/xrpld/rpc/handlers/orderbook/RipplePathFind.cpp (no textual
    conflict; stale spellings carried forward on stack-authored lines)

New old-API caller: develop added postCoro and Context::coro uses in
src/test/app/PayChan_test.cpp, which this stack does not otherwise touch,
so it merged without conflict but would not compile once Context::coro is
removed here. Both call sites are migrated to postCoroTask and the
.coro = {} designated initialisers dropped. The kFeeHeavyBurdenRpc
assertions that motivated develop's change are preserved unchanged.

.cspell.config.yaml

@@ -68,7 +68,6 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - cdylib
   - canonicalised
   - cctools
   - changespq
@@ -106,7 +105,6 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
-  - desugars
   - desync
   - desynced
   - determ
@@ -133,7 +131,6 @@ words:
   - gcov
   - gcovr
   - ghead
-  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
@@ -143,10 +140,7 @@ words:
   - hwaddress
   - hwrap
   - ifndef
-  - impls
   - inequation
-  - initialiser
-  - Injectivity
   - insuf
   - insuff
   - invasively
@@ -256,13 +250,14 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
-  - qself
   - queuable
   - Raphson
   - rcflags
   - replayer
   - repodata
   - repomd
+  - repost
+  - reposts
   - rerandomize
   - rerandomization
   - rerandomized
@@ -310,11 +305,11 @@ words:
   - sponsees
   - SRPMS
   - sslws
+  - stackful
   - statsd
   - STATSDCOLLECTOR
   - stissue
   - stnum
-  - stnumber
   - stobj
   - stobject
   - stpath
@@ -355,7 +350,6 @@ words:
   - unflatten
   - unfund
   - unimpair
-  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -376,8 +370,6 @@ words:
   - vfalco
   - vinnie
   - wasmi
-  - wasmparser
-  - Werror
   - wextra
   - wptr
   - writeme
@@ -386,7 +378,6 @@ words:
   - xbridge
   - xchain
   - xcrun
-  - xfloat
   - ximinez
   - XMACRO
   - xored
@@ -398,4 +389,3 @@ words:
   - xxhasher
   - zstdio
   - CGNAT
-  - ungated

.envrc

@@ -1,8 +1,5 @@
 watch_file nix/*.nix
 
-# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
-watch_file rust-toolchain.toml
-
 # The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
 # change in there has to invalidate direnv's cached environment.
 watch_dir conan

.github/actions/cargo-cache/action.yml

@@ -1,39 +0,0 @@
-name: Use cargo artifacts cache
-description: >
-  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
-  when saving the cache, rust-cache deletes all binaries that were already
-  present there, which on persistent self-hosted runners wipes the tools
-  installed by prepare-runner. Harmless on ephemeral runners, but kept
-  consistent everywhere.
-
-inputs:
-  workspaces:
-    description: "Workspaces to cache, as 'workspace -> target' lines."
-    required: false
-    default: crates
-  key:
-    description: "Additional part of the cache key."
-    required: false
-    default: ""
-  cache-directories:
-    description: "Additional non-workspace directories to cache."
-    required: false
-    default: ""
-  save-if:
-    description: >
-      Condition for saving the cache after the job. Defaults to save only from develop branch
-    required: false
-    default: ${{ github.ref == 'refs/heads/develop' }}
-
-runs:
-  using: composite
-
-  steps:
-    - name: Use cargo artifacts cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      with:
-        cache-bin: "false"
-        cache-directories: ${{ inputs.cache-directories }}
-        key: ${{ inputs.key }}
-        save-if: ${{ inputs.save-if }}
-        workspaces: ${{ inputs.workspaces }}

.github/actions/release-info/action.yml

@@ -7,10 +7,10 @@ outputs:
     value: ${{ steps.version.outputs.version }}
   channel:
     description: "The release channel this build belongs to."
-    value: ${{ steps.release_info.outputs.channel }}
+    value: ${{ steps.channel.outputs.channel }}
   pkg_release:
-    description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
-    value: ${{ steps.release_info.outputs.pkg_release }}
+    description: "The package release number: 1 for a tag, the run number otherwise."
+    value: ${{ steps.pkg_release.outputs.pkg_release }}
 
 runs:
   using: composite
@@ -39,6 +39,52 @@ runs:
 
         echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
 
-    - name: Determine release channel and package release
-      id: release_info
-      uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba
+    # Only a tag says how mature a build is: a push is a develop build whatever
+    # its version, and a non-public codebase keeps its packages to itself.
+    - name: Determine release channel
+      id: channel
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        REF_NAME: ${{ github.ref_name }}
+        VISIBILITY: ${{ github.event.repository.visibility }}
+      run: |
+        pre_release=""
+        if [[ "${REF_NAME}" == *-* ]]; then
+            pre_release="${REF_NAME#*-}"
+        fi
+
+        if [[ "${VISIBILITY}" != "public" ]]; then
+            channel=private
+        elif [[ "${IS_TAG}" != "true" ]]; then
+            channel=develop
+        elif [[ -z "${pre_release}" ]]; then
+            channel=stable
+        elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
+            channel=unstable
+        elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
+            channel=experimental
+        else
+            echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
+            exit 1
+        fi
+
+        echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
+
+    # A tag is packaged once, so its release number is fixed at 1. Develop builds
+    # repeat the same version, so the run number is what makes each push an
+    # upgrade rather than a reinstall.
+    - name: Determine package release
+      id: pkg_release
+      shell: bash
+      env:
+        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+        RUN_NUMBER: ${{ github.run_number }}
+      run: |
+        if [[ "${IS_TAG}" == "true" ]]; then
+            pkg_release=1
+        else
+            pkg_release="${RUN_NUMBER}"
+        fi
+
+        echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"

.github/actions/setup-nix-env/action.yml

@@ -40,11 +40,10 @@ runs:
         # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
         # own trust store, and pinning would break TLS to hosts relying on it.
 
-        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
-        # prepare-runner hands the system toolchain - but under its own name:
-        # that Conan is a different version, and the two would migrate each
-        # other's cache.
-        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
+        # Workspace-local, so `cleanup-workspace` clears it, but not the
+        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
+        # different version, and the two would migrate each other's cache.
+        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
 
     # Config, profiles and remote, exactly as the dev shell sets them up on
     # entry; the `setup-conan` action is skipped for this toolchain.

.github/dependabot.yml

@@ -4,7 +4,6 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/cargo-cache/
       - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-## Context of Change
+### Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-## API Impact
+### API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/levelization/results/ordering.txt

@@ -1,9 +1,6 @@
 benchmarks.libxrpl > xrpl.basics
 benchmarks.libxrpl > xrpl.config
 benchmarks.libxrpl > xrpl.nodestore
-benchmarks.libxrpl > xrpl.protocol
-benchmarks.libxrpl > xrpl.protocol_autogen
-benchmarks.libxrpl > xrpl.tx
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions
@@ -85,6 +82,7 @@ test.app > xrpl.tx
 test.basics > test.jtx
 test.basics > xrpl.basics
 test.basics > xrpl.core
+test.basics > xrpld.rpc
 test.basics > xrpl.json
 test.basics > xrpl.protocol
 test.beast > xrpl.basics
@@ -288,10 +286,10 @@ xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
 xrpld.perflog > xrpld.app
+xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
 xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
-xrpld.perflog > xrpl.server
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
 xrpld.rpc > xrpl.core

.github/scripts/strategy-matrix/generate.py

@@ -12,16 +12,9 @@ _BASE_CMAKE_ARGS = [
     "-Dwerr=ON",
     "-Dxrpld=ON",
     "-Dwextra=ON",
+    "-Drust=ON",
 ]
 
-# The package formats a config can be packaged as, each with its own
-# install-test job in reusable-package.yml.
-PACKAGE_TYPES = ("deb", "rpm")
-
-# The package name a variant suffixes, as build_pkg.py's BASE_NAME spells it:
-# the two have to agree, or the artifact globs miss what was built.
-BASE_NAME = "xrpld"
-
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
     "address": "asan",
@@ -30,19 +23,6 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
-def config_name(
-    distro: str,
-    compiler: str,
-    build_type: str,
-    arch: str,
-    suffix: str = "",
-    sanitizer: str = "",
-) -> str:
-    """Name a config. Its artifacts are named after it, so packaging reuses this."""
-    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
-    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
-
-
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -57,37 +37,17 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest.
+# built for pull requests by default; the full matrix adds the rest. Packaging
+# configs declare it too, but packaging is gated in the workflow, not by it.
 #
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
-# 'package' map to be packaged as well. Note that either applies to every entry
-# a config expands into, so only set them on configs that expand to a single
-# combination.
-
-
-@dataclasses.dataclass
-class PackageConfig:
-    """The 'package' map of a config whose binaries are also packaged."""
-
-    type: str  # has to match what the image provides
-    # The packaging container image: a vanilla distro image, not the nix image
-    # the config itself builds in.
-    image: str
-    # A flavour of the package, named xrpld-<variant>, for a config whose
-    # binaries are not the plain release build. A variant needs no counterpart
-    # in the other format.
-    variant: str = ""
-
-    def __post_init__(self) -> None:
-        assert self.type in PACKAGE_TYPES, (
-            f"unsupported package type {self.type!r}: "
-            f"use one of {', '.join(PACKAGE_TYPES)}."
-        )
+# Configs may also opt into 'benchmark' to smoke-run the benchmarks. Note that
+# the flag applies to every entry a config expands into, so only set it on
+# configs that expand to a single combination.
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in a linux.json 'configs' array."""
+    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
 
     compiler: list[str]
     build_type: list[str]
@@ -97,11 +57,7 @@ class LinuxConfig:
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    package: PackageConfig | None = None  # set to also package this config
-
-    def __post_init__(self) -> None:
-        if isinstance(self.package, dict):
-            self.package = PackageConfig(**self.package)
+    image: str = ""  # only used by package_configs entries
 
 
 @dataclasses.dataclass
@@ -110,16 +66,22 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
+    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
+
+        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
+            return {
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in section.items()
+            }
+
         return cls(
             image_tag=data["image_tag"],
-            configs={
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in data["configs"].items()
-            },
+            configs=parse(data["configs"]),
+            package_configs=parse(data.get("package_configs", {})),
         )
 
 
@@ -194,9 +156,7 @@ class PackagingEntry:
     xrpld_artifact_name: str
     validator_keys_artifact_name: str
     image: str
-    package_type: str  # "deb" or "rpm"; drives the format-specific steps
-    package_variant: str  # passed to build_pkg.py --variant; empty for xrpld
-    package_name: str  # the name it builds under, which the artifact globs use
+    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
 
 
 # ---------------------------------------------------------------------------
@@ -237,9 +197,13 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = config_name(
-                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
-                )
+                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
+                suffix_parts = [
+                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
+                ]
+                if suffix_parts:
+                    name += "-" + "-".join(suffix_parts)
+
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -259,59 +223,33 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from the configs that carry a 'package' map.
+    """Generate the packaging matrix from a LinuxFile's package_configs section.
 
-    Packaging consumes the binaries that config's build job uploaded, so the
-    artifact names come from the same config name, and a packaged config is one
-    that passes -Dvalidator_keys=ON.
+    Packaging uses vanilla distro images (debian:bookworm, almalinux:9) instead of
+    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
+    is taken from the distro's archive rather than from nixpkgs. Each config
+    entry carries its own 'image'.
 
-    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
-    instead of the nix-based build images, because deb/rpm tooling (debhelper,
-    rpm-build) is taken from the distro's archive rather than from nixpkgs.
+    The artifact names must match what the build job uploads: one artifact per
+    binary, each named after the build config.
     """
     entries = []
-    for distro, configs in linux.configs.items():
+    for distro, configs in linux.package_configs.items():
         for cfg in configs:
-            if cfg.package is None:
-                continue
-            for compiler, build_type, arch in itertools.product(
-                cfg.compiler, cfg.build_type, cfg.arch
-            ):
-                # The packaging workflow hardcodes an amd64 runner.
-                assert arch == "amd64", f"cannot package {distro} on {arch}"
-                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
+            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
+                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{name}",
-                        validator_keys_artifact_name=f"validator-keys-{name}",
-                        image=cfg.package.image,
-                        package_type=cfg.package.type,
-                        package_variant=cfg.package.variant,
-                        package_name=(
-                            f"{BASE_NAME}-{cfg.package.variant}"
-                            if cfg.package.variant
-                            else BASE_NAME
-                        ),
+                        xrpld_artifact_name=f"xrpld-{config_name}",
+                        validator_keys_artifact_name=f"validator-keys-{config_name}",
+                        image=cfg.image,
+                        distro=distro,
                     )
                 )
 
     return entries
 
 
-def package_names_by_type(entries: list[PackagingEntry]) -> dict[str, list[str]]:
-    """The names of the packages in 'entries', keyed by format.
-
-    Derived from the packaging matrix rather than listed again, so the packages
-    the install-test jobs look for are the packages that were built.
-    """
-    return {
-        package_type: sorted(
-            {e.package_name for e in entries if e.package_type == package_type}
-        )
-        for package_type in PACKAGE_TYPES
-    }
-
-
 def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]:
     """Expand a PlatformFile (macOS or Windows) into matrix entries.
 
@@ -380,10 +318,6 @@ if __name__ == "__main__":
 
     if args.packaging:
         matrix = expand_linux_packaging(LinuxFile.load(THIS_DIR / "linux.json"))
-        # One list per format, so each install-test job installs the packages its
-        # own format produced.
-        for package_type, names in package_names_by_type(matrix).items():
-            print(f"{package_type}_package_names={json.dumps(names)}")
     else:
         if args.config in ("linux", None):
             matrix += expand_linux_matrix(

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-060957e",
+  "image_tag": "sha-a0074f8",
   "configs": {
     "ubuntu": [
       {
@@ -71,24 +71,7 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
-        }
-      },
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "suffix": "assert",
-        "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
-        "package": {
-          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10",
-          "variant": "assert"
-        }
+        "extra_cmake_args": "-Dvalidator_keys=ON"
       }
     ],
 
@@ -98,11 +81,28 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
-        }
+        "extra_cmake_args": "-Dvalidator_keys=ON"
+      }
+    ]
+  },
+  "package_configs": {
+    "debian": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false,
+        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-a6983f8"
+      }
+    ],
+
+    "rhel": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false,
+        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-a6983f8"
       }
     ]
   }

.github/workflows/build-nix-images.yml

@@ -5,13 +5,14 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
       - "rust-toolchain.toml"
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/**"
+      - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   pull_request:
@@ -23,7 +24,6 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/**"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
@@ -58,7 +58,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -6,13 +6,13 @@ on:
       - develop
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
-      - "package/docker/**"
+      - "package/Dockerfile"
+      - "package/install-packaging-tools.sh"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
-      - "package/docker/**"
+      - "package/Dockerfile"
+      - "package/install-packaging-tools.sh"
   workflow_dispatch:
 
 concurrency:
@@ -33,17 +33,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Newest of each distro: these images only wrap pre-built binaries, so
-        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:trixie
-          # AlmaLinux rather than UBI, which does not ship rpm-sign.
+            base_image: debian:bookworm
+          # AlmaLinux rather than UBI9, which does not ship rpm-sign.
           - name: rhel
-            base_image: almalinux:10
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+            base_image: almalinux:9
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
-      dockerfile: package/docker/Dockerfile
+      dockerfile: package/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
       push: ${{ github.event_name == 'push' }}

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 

.github/workflows/on-pr.yml

@@ -85,7 +85,6 @@ jobs:
             .github/workflows/reusable-build-test.yml
             .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
-            .github/workflows/reusable-package-test-install.yml
             .github/workflows/reusable-package.yml
             .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
@@ -190,12 +189,6 @@ jobs:
     # matrix (i.e. not yet labeled "Ready to merge" or "Full CI build").
     if: ${{ needs.should-run.outputs.go == 'true' && (github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'Ready to merge') || contains(github.event.pull_request.labels.*.name, 'Full CI build')) }}
     uses: ./.github/workflows/reusable-package.yml
-    with:
-      # A pull request builds packages to prove they still build, and publishes
-      # nothing. Stated rather than left to the input's default, so that changing
-      # that default cannot start publishing from pull requests. No secrets are
-      # passed either, which is the second reason a publish here cannot succeed.
-      publish: false
 
   upload-recipe:
     needs:

.github/workflows/on-trigger.yml

@@ -23,7 +23,6 @@ on:
       - ".github/workflows/reusable-build-test.yml"
       - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
-      - ".github/workflows/reusable-package-test-install.yml"
       - ".github/workflows/reusable-package.yml"
       - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -163,10 +163,11 @@ jobs:
           compiler: ${{ inputs.compiler }}
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           key: ${{ inputs.config_name }}
+          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           # two workspaces here because build artifacts are located in 2 places:
           # - crates/target when cargo is called directly
           # - build/cargo when cargo is called by cmake
@@ -372,10 +373,7 @@ jobs:
       - name: Run Rust tests
         if: ${{ !inputs.build_only }}
         working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn
 
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a
@@ -442,7 +440,7 @@ jobs:
 
       - name: Upload coverage report
         if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           disable_search: true
           disable_telem: true

.github/workflows/reusable-clang-tidy.yml

@@ -27,14 +27,14 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-a0074f8"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
         with:
           enable_ccache: false
 
@@ -60,9 +60,10 @@ jobs:
           compiler: ${{ env.COMPILER }}
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
+          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
 
       - name: Setup Conan
@@ -86,6 +87,7 @@ jobs:
               -Dwerr=ON \
               -Dxrpld=ON \
               -Dverify_headers=ON \
+              -Drust=ON \
               ..
 
       - name: Build clang-tidy prerequisites

.github/workflows/reusable-package-test-install.yml

@@ -1,120 +0,0 @@
-# Install one package format on every distro family it targets, one job per
-# package name and image, and run the binaries there. Called once per format by
-# reusable-package.yml, which owns the names and the image lists.
-name: Install packages
-
-on:
-  workflow_call:
-    inputs:
-      package_type:
-        description: 'The package format to install ("deb" or "rpm").'
-        required: true
-        type: string
-      package_names:
-        description: "JSON array of package names built for this format."
-        required: true
-        type: string
-      images:
-        description: "JSON array of container images to install in."
-        required: true
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  PACKAGE_DIR: packages
-
-jobs:
-  install:
-    strategy:
-      fail-fast: false
-      matrix:
-        package_name: ${{ fromJson(inputs.package_names) }}
-        image: ${{ fromJson(inputs.images) }}
-    name: "${{ matrix.package_name }} on ${{ matrix.image }}"
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    container: ${{ matrix.image }}
-    timeout-minutes: 5
-
-    steps:
-      # Every package lands in one directory; the step below picks its own,
-      # which keeps this independent of the artifact names.
-      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: "*-pkg"
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
-
-      - name: Find the package
-        id: find
-        env:
-          PACKAGE_NAME: ${{ matrix.package_name }}
-          PACKAGE_TYPE: ${{ inputs.package_type }}
-        run: |
-          # The version follows the name, separated by '_' in a DEB and '-' in an
-          # RPM. Requiring a digit after it is what keeps 'xrpld' from picking up
-          # another package, such as 'xrpld-assert'.
-          pattern="${PACKAGE_NAME}[_-][0-9]*.${PACKAGE_TYPE}"
-          package="$(find "${PACKAGE_DIR}" -type f -name "${pattern}" -print -quit)"
-          test -n "${package}" || {
-              echo "no ${pattern} found in ${PACKAGE_DIR}" >&2
-              exit 1
-          }
-          echo "package=${package}" >>"${GITHUB_OUTPUT}"
-
-      # Debian 11 went end-of-life on 2026-08-31
-      # (https://www.debian.org/News/2026/20260831) and its packages are
-      # already partly gone from deb.debian.org, so switch to the
-      # snapshot.debian.org entries the image ships commented out in its
-      # sources.list: they are pinned to the snapshot the image was built
-      # from, so they serve every version it needs and never go away.
-      # Snapshots keep their original, long-passed Valid-Until, hence the
-      # disabled check; the retries absorb snapshot.debian.org's throttling.
-      - name: Switch Debian 11 to snapshot.debian.org
-        if: ${{ matrix.image == 'debian:11' }}
-        run: |
-          sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
-          printf '%s\n' \
-              'Acquire::Check-Valid-Until "false";' \
-              'Acquire::Retries "3";' \
-              >/etc/apt/apt.conf.d/99snapshot
-
-      - name: Install the DEB
-        if: ${{ inputs.package_type == 'deb' }}
-        env:
-          DEBIAN_FRONTEND: noninteractive
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: |
-          # Stock Debian and Ubuntu images carry no package lists, so apt has
-          # nothing to resolve the systemd dependency from until it fetches them.
-          apt-get update -qq
-          apt-get install -y "./${PACKAGE}"
-
-      - name: Install the RPM
-        if: ${{ inputs.package_type == 'rpm' }}
-        env:
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y "./${PACKAGE}"
-
-      - name: Run xrpld
-        run: xrpld --version
-
-      - name: Run validator-keys
-        run: validator-keys --version
-
-      - name: Run rippled, the legacy compatibility symlink
-        run: rippled --version
-
-      - name: Check the service account
-        run: id xrpld
-
-      - name: Check the state directory
-        run: test -d /var/lib/xrpld
-
-      - name: Check the log directory
-        run: test -d /var/log/xrpld

.github/workflows/reusable-package.yml

@@ -1,16 +1,11 @@
-# Build, verify and publish Linux packages from the pre-built xrpld and
-# validator-keys artifacts, in three stages:
+# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
 #
-#   - 'package' builds and signs one format per config that carries a "package"
-#     map in linux.json; that map names the container image and the format
-#   - 'test-install-deb' and 'test-install-rpm' call
-#     reusable-package-test-install.yml to install what was built on a range of
-#     distros and run the binaries there, so a package that cannot be installed
-#     never reaches Nexus
-#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
-#     unless 'publish: true'
+#   - one job per distro, taken from "package_configs" in linux.json
+#   - each job runs in that distro's container, which is what decides DEB or RPM
+#   - with 'publish: true' a job also uploads what it built
+#     (see package/publish_pkg.sh)
 #
-# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
+# Only linux/amd64 is supported; the runner is hardcoded in the job below.
 name: Package
 
 on:
@@ -25,7 +20,7 @@ on:
         description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
         required: false
         type: string
-        default: https://packages-upload.xrplf.org
+        default: https://packages.xrplf.org
 
     secrets:
       remote_username:
@@ -44,15 +39,12 @@ defaults:
 
 env:
   BUILD_DIR: build
-  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
-      deb_package_names: ${{ steps.generate.outputs.deb_package_names }}
-      rpm_package_names: ${{ steps.generate.outputs.rpm_package_names }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -78,17 +70,12 @@ jobs:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: ${{ matrix.image }}
-    timeout-minutes: 10
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
       - name: Download pre-built xrpld binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -110,135 +97,33 @@ jobs:
 
       - name: Build package
         env:
-          PACKAGE_TYPE: ${{ matrix.package_type }}
-          PACKAGE_VARIANT: ${{ matrix.package_variant }}
           PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
-          CHANNEL: ${{ steps.release_info.outputs.channel }}
-        run: |
-          ./package/build_pkg.py \
-              --package-type "${PACKAGE_TYPE}" \
-              --build-dir "${BUILD_DIR}" \
-              --pkg-release "${PKG_RELEASE}" \
-              --variant "${PACKAGE_VARIANT}" \
-              --channel "${CHANNEL}"
+          PKG_CHANNEL: ${{ steps.release_info.outputs.channel }}
+        run: ./package/build_pkg.sh
 
-      # Before the upload, so the artifact, the tested package and the published
-      # package are the same bytes.
+      # Before the upload, so the artifact and the published package are the
+      # same bytes. DEBs are not signed, so the key is never set on that job.
       - name: Sign RPM
-        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
+        if: ${{ inputs.publish && matrix.distro == 'rhel' }}
         env:
           PKG_SIGNING_KEY: ${{ secrets.signing_key }}
-        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
+        run: ./package/sign_rpm.sh "${BUILD_DIR}"
 
-      # Split from the debug symbols, which are an order of magnitude larger, so
-      # that test-install downloads only what it installs. In the globs below the
-      # version follows the name, separated by '_' in a DEB and '-' in an RPM. A
-      # version starts with a digit and a longer name does not, so that one digit
-      # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg
           path: |
-            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}_[0-9]*.deb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-[0-9]*.rpm
+            ${{ env.BUILD_DIR }}/debbuild/*.deb
+            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
           if-no-files-found: error
 
-      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
-          path: |
-            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.deb
-            ${{ env.BUILD_DIR }}/debbuild/${{ matrix.package_name }}-dbgsym_[0-9]*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/${{ matrix.package_name }}-debuginfo-[0-9]*.rpm
-          if-no-files-found: error
-
-  # One call per format, so a variant packaged for one format is installed for
-  # that format alone. The images are every distro family that format targets,
-  # oldest release first, so both ends of the dependency range the packages
-  # declare are exercised.
-  test-install-deb:
-    needs: [generate-matrix, package]
-    name: install deb
-    uses: ./.github/workflows/reusable-package-test-install.yml
-    with:
-      package_type: deb
-      package_names: ${{ needs.generate-matrix.outputs.deb_package_names }}
-      images: |
-        [
-          "debian:11",
-          "debian:12",
-          "debian:13",
-          "ubuntu:20.04",
-          "ubuntu:22.04",
-          "ubuntu:24.04",
-          "ubuntu:26.04"
-        ]
-
-  test-install-rpm:
-    needs: [generate-matrix, package]
-    name: install rpm
-    uses: ./.github/workflows/reusable-package-test-install.yml
-    with:
-      package_type: rpm
-      package_names: ${{ needs.generate-matrix.outputs.rpm_package_names }}
-      images: |
-        [
-          "almalinux:9",
-          "almalinux:10",
-          "rockylinux/rockylinux:9",
-          "rockylinux/rockylinux:10",
-          "registry.access.redhat.com/ubi9/ubi",
-          "registry.access.redhat.com/ubi10/ubi"
-        ]
-
-  publish:
-    needs: [generate-matrix, package, test-install-deb, test-install-rpm]
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    # The name says which of the two this is, because the job runs either way:
-    # with publish false it passes --dry-run and uploads nothing, and a job
-    # called "publish ..." succeeding on a pull request reads like a release.
-    name: "publish ${{ matrix.xrpld_artifact_name }}${{ !inputs.publish && ' (dry run)' || '' }}"
-    permissions:
-      contents: read
-    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: ${{ matrix.image }}
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      # Both artifacts, so the debug symbols are published alongside the package.
-      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
-
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
-
       - name: Publish package
+        if: ${{ inputs.publish }}
         env:
           CHANNEL: ${{ steps.release_info.outputs.channel }}
-          DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
           NEXUS_URL: ${{ inputs.nexus_url }}
-          NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
-          NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
-        run: |
-          publish_pkg.py \
-              --channel "${CHANNEL}" \
-              --package-dir "${PACKAGE_DIR}" \
-              --nexus-url "${NEXUS_URL}" \
-              ${DRY_RUN_OPTION}
+          NEXUS_USERNAME: ${{ secrets.remote_username }}
+          NEXUS_PASSWORD: ${{ secrets.remote_password }}
+        run: ./package/publish_pkg.sh "${CHANNEL}" "${BUILD_DIR}"

.github/workflows/reusable-rust.yml

@@ -1,9 +1,8 @@
 # Clippy, coverage and documentation for the Rust crates in crates/. Each runs
 # as an independent job on a GitHub-hosted runner, but inside the same container
 # image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints and the cargo cache) matches what production builds
-# use. Coverage is the exception: it needs the nightly rustc that honours
-# #[coverage(off)], which the image carries alongside the pinned stable.
+# (and therefore the lints, coverage instrumentation and the cargo cache) matches
+# what production builds use.
 #
 # Rust unit tests are deliberately NOT run here. They run as part of the C++
 # build (reusable-build-test-config.yml), which already compiles the crates on a
@@ -28,36 +27,37 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Use the nightly Rust toolchain
-        run: rust-nightly path >>"${GITHUB_PATH}"
-
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
 
       - name: Upload coverage report
         if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           disable_search: true
           disable_telem: true
@@ -70,13 +70,15 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: crates
 
       - name: Build documentation
         env:

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,11 +49,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
       - name: Determine release info
         id: release_info
         uses: ./.github/actions/release-info

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
         with:
           enable_ccache: false
 

.gitignore

@@ -72,16 +72,11 @@ DerivedData
 /.zed/
 
 # AI tools.
-# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
-# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
-# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude/settings.local.json
-AGENTS.override.md
-CLAUDE.local.md
-GEMINI.local.md
+/.claude
+/CLAUDE.md
 
 # Python
 __pycache__

.pre-commit-config.yaml

@@ -70,11 +70,6 @@ repos:
         language: system
         types: [rust]
         pass_filenames: false # rustfmt formats the whole workspace
-      - id: check-coverage-attrs
-        name: check Rust coverage attributes
-        entry: ./bin/pre-commit/check_rust_coverage_attrs.py
-        language: python
-        files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
@@ -87,27 +82,11 @@ repos:
       - id: prettier
         args: [--end-of-line=auto]
 
-  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
-  # so widening these is its own change.
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 7c55798a78262d14b2074abf623d8a992ebb70d4 # frozen: v0.16.2
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
-  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
-    hooks:
-      - id: mypy
-        args: [--strict]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
     hooks:

AGENTS.md

@@ -1,42 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
-
-## Build
-
-Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
-
-```bash
-nix develop
-```
-
-For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
-
-Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
-
-## Testing
-
-Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
-
-- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
-- `--unittest-arg` does nothing — don't use it.
-- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
-- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
-
-## Lint/Format
-
-See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
-
-## Code Style
-
-New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
-
-## Architecture
-
-Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
-
-- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
-- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
-- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
-- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
-- `crates/` — a Rust workspace holding the WebAssembly engine that runs Smart Escrow contracts, bridged into C++ via `cxxbridge`/the `cxx` crate; see [crates/README.md](./crates/README.md) for more details.

API-CHANGELOG.md

@@ -22,48 +22,17 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## XRP Ledger server version 3.4.0
+## Unreleased
 
-Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
+This section contains changes targeting a future version.
 
-### Additions in 3.4.0
+### Additions
 
-- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
-
-### Bugfixes in 3.4.0
-
-- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
-- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
-- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
-- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
-- `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
-
-## XRP Ledger server version 3.3.0
-
-[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
-
-### Additions in 3.3.0
-
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
-
-## XRP Ledger server version 3.2.1
-
-[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.2.0
-
-[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
-
-### Additions in 3.2.0
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
+  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
+
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -71,8 +40,9 @@ This release contains bug fixes only and no API changes.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes in 3.2.0
+### Bugfixes
 
+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -84,24 +54,8 @@ This release contains bug fixes only and no API changes.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
-
-## XRP Ledger server version 3.1.3
-
-[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.2
-
-[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.1
-
-[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
-
-This release contains bug fixes only and no API changes.
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 
 ## XRP Ledger server version 3.1.0
 

BUILD.md

@@ -1,6 +1,6 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
@@ -304,6 +304,7 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 | ---------------- | ------------- | ----------------------------------------------------------------------------- |
 | `assert`         | OFF           | Force enabling assertions.                                                    |
 | `coverage`       | OFF           | Prepare the coverage report.                                                  |
+| `rust`           | OFF           | Build the Rust crates and the C++ code that depends on them.                  |
 | `tests`          | OFF           | Build tests.                                                                  |
 | `unity`          | OFF           | Configure a unity build.                                                      |
 | `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
@@ -318,15 +319,23 @@ builds may be faster for incremental builds, and can be helpful for detecting
 
 ### Rust crates
 
-The build compiles the Rust workspace in `crates/` and generates the cxxbridge
-bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
-at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
-[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
-as described in [Rust](./docs/build/environment.md#rust).
+The Rust crates in `crates/` are only part of the build when `rust` is ON. With
+`-Drust=OFF` (the default) the `crates` directory is not added to the build, no
+cxxbridge bindings are generated, and the C++ tests that exercise the Rust
+interop are not compiled — so no Rust toolchain is needed. CI builds always pass
+`-Drust=ON`.
+
+With `-Drust=ON` you need one extra dependency: a Rust toolchain (`cargo`,
+`rustc`) matching the channel pinned in
+[`rust-toolchain.toml`](./rust-toolchain.toml), which compiles the crates and
+generates the cxxbridge bindings. It is provided by the
+[Nix development shell](./docs/build/nix.md), so `-Drust=ON` works there without
+any extra setup; otherwise install it as described in
+[Rust](./docs/build/environment.md#rust).
 
 The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake (CI runs them with
-`cargo nextest`):
+need only the Rust toolchain, independently of CMake and of the `rust` option
+(CI runs them with `cargo nextest`):
 
 ```bash
 cargo test --manifest-path crates/Cargo.toml --workspace

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

CMakeLists.txt

@@ -160,8 +160,11 @@ endif()
 
 add_custom_target(tidy_prerequisites)
 
-add_subdirectory(crates)
+if(rust)
+    add_subdirectory(crates)
+endif()
 include(XrplCore)
+
 include(XrplProtocolAutogen)
 include(XrplInstall)
 include(XrplValidatorKeys)

CONTRIBUTING.md

@@ -59,17 +59,6 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
-## AI coding agents
-
-[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
-
-If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
-
-- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
-- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
-
-Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
-
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -93,7 +82,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
+- All test source files must go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest
@@ -332,7 +321,7 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+Before running clang-tidy, you must generate the files it depends on (protobuf headers, and, when the project is configured with `-Drust=ON`, the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
 
 ```bash
 cmake --build build --target tidy_prerequisites

bin/check-tools.sh

@@ -158,7 +158,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-nextest cargo nextest --version
     check clippy-driver
     check rust-analyzer
-    check rust-nightly rust-nightly run rustc --version
     check rustc
     check rustfmt
 fi

bin/pre-commit/check_rust_coverage_attrs.py

@@ -1,149 +0,0 @@
-#!/usr/bin/env python3
-"""
-Check that Rust unit tests stay out of the coverage report.
-
-cargo-llvm-cov instruments the test code along with everything else, so a test
-module that is not excluded counts its own body as covered and inflates the
-reported number. Excluding it takes two attributes:
-
-  * every `#[cfg(test)]` module carries
-    `#[cfg_attr(coverage_nightly, coverage(off))]`;
-  * every crate root (lib.rs, main.rs) carries
-    `#![cfg_attr(coverage_nightly, feature(coverage_attribute))]`, which the
-    attribute above needs in order to compile.
-
-Both are inert outside the coverage job: cargo-llvm-cov defines
-`coverage_nightly` only when it runs on a nightly toolchain.
-
-The crate-root gate is checked even in a crate that has no tests yet, because
-that is what lets the first test module added later carry the attribute without
-a build failure. Missing it is a hard error, so it cannot go unnoticed; a
-missing `coverage(off)` fails open, which is why this check exists.
-
-Matching is on exact attribute text, which works because `cargo fmt` runs over
-the whole workspace in the hook ahead of this one: rustfmt puts every attribute
-on its own line and normalizes what is inside it, turning `#[cfg( test )]`
-and `#[cfg(test,)]` alike into `#[cfg(test)]`. So there is nothing here that
-parses Rust. The price is that a cfg this file does not spell out literally --
-`all(test, ...)`, `any(test, ...)`, `not(test)` -- is reported rather than
-classified, on the grounds that guessing at coverage semantics is how a check
-like this ends up quietly wrong.
-
-Usage: ./bin/pre-commit/check_rust_coverage_attrs.py <file1> <file2> ...
-
-Exit status is non-zero if any violation is found.
-"""
-
-import re
-import sys
-from dataclasses import dataclass
-from pathlib import Path
-
-CRATE_ROOTS = {"lib.rs", "main.rs"}
-
-FEATURE_ATTR = "#![cfg_attr(coverage_nightly, feature(coverage_attribute))]"
-COVERAGE_OFF_ATTR = "#[cfg_attr(coverage_nightly, coverage(off))]"
-CFG_TEST_ATTR = "#[cfg(test)]"
-
-# Any other cfg that mentions `test`. String literals are blanked before this
-# runs, so `feature = "test"` does not read as the `test` cfg.
-RE_CFG_MENTIONS_TEST = re.compile(r"^#\[cfg\(.*\btest\b.*\)\]$")
-RE_STRING = re.compile(r'"(?:[^"\\]|\\.)*"')
-RE_MOD = re.compile(r"^(?:pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)")
-
-
-@dataclass(frozen=True)
-class Finding:
-    line: int
-    label: str
-    message: str
-
-
-def _check_module(attrs: list[str], line: int, name: str) -> list[Finding]:
-    """Findings for one module, given the attributes attached to it."""
-    if COVERAGE_OFF_ATTR in attrs:
-        return []  # excluded from coverage; which cfg gates it does not matter
-    if CFG_TEST_ATTR in attrs:
-        return [
-            Finding(
-                line,
-                "missing-coverage-off",
-                f"`mod {name}` is #[cfg(test)] but not excluded from coverage; "
-                f"add {COVERAGE_OFF_ATTR}",
-            )
-        ]
-    unclassified = [
-        attr for attr in attrs if RE_CFG_MENTIONS_TEST.match(RE_STRING.sub('""', attr))
-    ]
-    if unclassified:
-        return [
-            Finding(
-                line,
-                "unclassified-cfg",
-                f"`mod {name}` is gated on {unclassified[0]}, which this check "
-                f"cannot tell apart from a module that ships in the library; "
-                f"add {COVERAGE_OFF_ATTR} if it is test-only, or teach this "
-                f"check the cfg if it is not",
-            )
-        ]
-    return []
-
-
-def _check_test_modules(lines: list[str]) -> list[Finding]:
-    """Findings for every test module that is not excluded from coverage."""
-    findings: list[Finding] = []
-    attrs: list[str] = []
-    attrs_line = 0
-    for number, raw in enumerate(lines, start=1):
-        stripped = raw.strip()
-        # Blank lines and comments are allowed between an attribute and its item.
-        if not stripped or stripped.startswith("//"):
-            continue
-        if stripped.startswith("#["):
-            if not attrs:
-                attrs_line = number
-            attrs.append(stripped)
-            continue
-        module = RE_MOD.match(stripped)
-        if module is not None and attrs:
-            findings += _check_module(attrs, attrs_line, module.group(1))
-        attrs = []
-    return findings
-
-
-def _check_crate_root(name: str, lines: list[str]) -> list[Finding]:
-    """A finding if a crate root is missing the coverage_attribute feature gate."""
-    if name not in CRATE_ROOTS:
-        return []
-    if any(line.strip() == FEATURE_ATTR for line in lines):
-        return []
-    return [
-        Finding(
-            1,
-            "missing-feature-gate",
-            f"crate root is missing {FEATURE_ATTR}",
-        )
-    ]
-
-
-def check_source(name: str, text: str) -> list[Finding]:
-    """Findings for one file's contents; `name` is its base name (lib.rs, ...)."""
-    lines = text.splitlines()
-    return _check_crate_root(name, lines) + _check_test_modules(lines)
-
-
-def check_file(path: Path) -> list[Finding]:
-    return check_source(path.name, path.read_text(encoding="utf-8"))
-
-
-def main() -> int:
-    total = 0
-    for path in (Path(name) for name in sys.argv[1:]):
-        for finding in check_file(path):
-            total += 1
-            print(f"{path}:{finding.line}: {finding.label}: {finding.message}")
-    return 1 if total else 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

cfg/xrpld-example.cfg

@@ -1094,8 +1094,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between online_delete
-#                           SQL deletion batches to allow other functions
+#                           Number of milliseconds to wait between
+#                           online_delete batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,22 +1109,10 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old, and that all
-#                           recent ledgers are available. If not, then continue
+#                           'age_threshold_seconds' old. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 2.
-#
-#       max_waiting_ledgers
-#                           The maximum number of ledgers that may be validated
-#                           while online deletion is waiting for the node to get
-#                           fully synced with the rest of the network. If more than
-#                           this number of ledgers are validated while waiting, then
-#                           online deletion gives up on the current ledger and tries
-#                           again later. Note this only affects situations that cause
-#                           rotation to wait, such as going out of sync, or missing
-#                           ledgers. Forward progress is not penalized. Minimum is 64.
-#                           Default is the online_delete value.
+#                           Default is 5.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.
@@ -1360,39 +1348,6 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
-#   gas_limit = <gas>
-#
-#       The gas limit is the maximum amount of gas that can be
-#       consumed by a single transaction. The gas limit is used to prevent
-#       transactions from consuming too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_limit = 1000000      # 1 million gas
-#
-#   bytecode_size_limit = <bytes>
-#
-#       The bytecode size limit is the maximum size of a WASM extension in
-#       bytes. The size limit is used to prevent extensions from consuming
-#       too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           bytecode_size_limit = 100000      # 100 kb
-#
-#   gas_price = <micro-drops>
-#
-#       The gas price is the conversion between WASM gas and its price in drops.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings

cmake/XrplAddBenchmark.cmake

@@ -29,14 +29,6 @@ function(xrpl_add_benchmark name)
     # XrplCore.cmake. Each file compiles fine on its own.
     set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
 
-    # Land next to `xrpl_tests` in the build root rather than buried under
-    # `src/benchmarks/libxrpl/`. A benchmark is something a person runs by hand,
-    # repeatedly, and comparing two of them should not mean typing two long paths.
-    set_target_properties(
-        ${target}
-        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-    )
-
     isolate_headers(
         ${target}
         "${CMAKE_SOURCE_DIR}/src"

cmake/XrplCompiler.cmake

@@ -120,10 +120,7 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(
-        common
-        INTERFACE -errorreport:none -machine:X64 -ignore:4099
-    )
+    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
 else()
     target_compile_options(
         common

cmake/XrplCore.cmake

@@ -207,11 +207,7 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_module(xrpl consensus)
 target_link_libraries(

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.py) installs to FHS-standard
+   The packaging script (package/build_pkg.sh) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -38,26 +38,19 @@ if(NOT TARGET validator-keys)
     return()
 endif()
 
-if(DPKG_BUILDPACKAGE_EXECUTABLE)
-    set(pkg_type deb)
-else()
-    set(pkg_type rpm)
-endif()
-
-# Unquoted below, so an empty value adds no argument at all.
-set(pkg_variant_option "")
-if(assert)
-    set(pkg_variant_option --variant=assert)
-endif()
+set(package_env
+    SRC_DIR=${CMAKE_SOURCE_DIR}
+    BUILD_DIR=${CMAKE_BINARY_DIR}
+    PKG_RELEASE=${pkg_release}
+)
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
-        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
-        ${pkg_variant_option} --channel=UNRELEASED
+        ${CMAKE_COMMAND} -E env ${package_env}
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
     DEPENDS xrpld validator-keys
-    COMMENT "Building Linux ${pkg_type} package"
+    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
     VERBATIM
 )

cmake/XrplSettings.cmake

@@ -32,6 +32,11 @@ endif()
 
 option(benchmark "Build benchmarks" ON)
 
+# When OFF, the crates directory is not added to the build at all: no Rust
+# toolchain is required, no cxxbridge bindings are generated, and the C++ tests
+# that consume those bindings are left out of the build tree.
+option(rust "Build the Rust crates and the C++ code that depends on them" OFF)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,7 +8,6 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
-import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -54,89 +53,28 @@ def create_transaction_parser():
     return macro_parser
 
 
-# Defaults for xrpl::TxSettings members, mirroring
-# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
-# the members that differ from these.
-SETTING_DEFAULTS = {
-    "delegable": "Delegation::NotDelegable",
-    "amendment": "uint256{}",
-    "privileges": "Privilege::NoPriv",
-}
-
-
-def parse_settings(settings_str):
-    """Parse a TxSettings blob into a dict, filling in defaults.
-
-    Args:
-        settings_str: A string like '({.delegable = Delegation::NotDelegable,
-                      .privileges = Privilege::CreateAcct})', or '({})'.
-
-    Returns:
-        A dict with a value for every key in SETTING_DEFAULTS.
-    """
-    body = settings_str.strip()
-    if not (body.startswith("(") and body.endswith(")")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1].strip()
-    if not (body.startswith("{") and body.endswith("}")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1]
-
-    # Strip comments, which may be interleaved with the designated initializers.
-    body = re.sub(r"//[^\n]*", "", body)
-
-    settings = dict(SETTING_DEFAULTS)
-    seen = set()
-    # Each entry runs from '.key =' up to the next '.key =' or the end.
-    for key, value in re.findall(
-        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
-    ):
-        if key not in SETTING_DEFAULTS:
-            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
-        settings[key] = " ".join(value.split()).rstrip(",")
-        seen.add(key)
-
-    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
-    # Every '.member' in the blob must have been consumed above.
-    if len(re.findall(r"\.\w+", body)) != len(seen):
-        raise ValueError(f"Could not parse every setting in {settings_str!r}")
-
-    # A blob with content but no designated initializer is positional, which
-    # would otherwise be read as "all defaults" and silently generate the
-    # wrong output.
-    if body.strip() and not seen:
-        raise ValueError(
-            "TxSettings requires designated initializers (.member = value), "
-            f"got {settings_str!r}"
-        )
-
-    return settings
-
-
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment',
-                    '({.privileges = Privilege::CreateAcct})', '({...})']
+                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
+                    'uint256{}', 'createAcct', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 5:
+    if len(args_list) < 7:
         raise ValueError(
-            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    settings = parse_settings(args_list[3])
+    delegable = args_list[3]
+    amendments = args_list[4]
+    privileges = args_list[5]
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -146,9 +84,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": settings["delegable"],
-        "amendments": settings["amendment"],
-        "privileges": settings["privileges"],
+        "delegable": delegable,
+        "amendments": amendments,
+        "privileges": privileges,
         "fields": fields,
     }
 

conanfile.py

@@ -149,16 +149,11 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
-        "bin/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
-        "crates/*",
-        "crates/.cargo/*",
-        "!crates/target/*",
         "external/*",
         "include/*",
-        "rust-toolchain.toml",
         "src/*",
     )
 

crates/CMakeLists.txt

@@ -101,11 +101,4 @@ function(add_xrpl_crate name)
     add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()
 
-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)
+add_xrpl_crate(rs_hello_world CRATE rs_hello_world FILES lib.rs)

crates/Cargo.lock

@@ -8,18 +8,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
 [[package]]
 name = "cc"
 version = "1.2.61"
@@ -69,24 +57,24 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
+checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
 dependencies = [
  "cc",
  "cxx-build",
  "cxxbridge-cmd",
  "cxxbridge-flags",
  "cxxbridge-macro",
- "foldhash 0.2.0",
+ "foldhash",
  "link-cplusplus",
 ]
 
 [[package]]
 name = "cxx-build"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
+checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -99,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
+checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -113,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
+checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.199"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
+checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -141,27 +129,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.0"
@@ -175,21 +148,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown",
 ]
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "link-cplusplus"
 version = "1.0.12"
@@ -199,12 +160,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -223,18 +178,19 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rs-hello_world"
+version = "0.1.0"
+dependencies = [
+ "cxx",
+]
+
 [[package]]
 name = "scratch"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
 
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -271,22 +227,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -336,99 +276,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78693fcdd618e0fc34af59c6b8efa9ac5d58c68df940beff4bedddb6acfe7c27"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.228.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a8be2aa467cf2d29e96ff759472c36eeb44a3c81c67fc9cb76c9a24c519c557"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69372d5fda3ea3d1e0aa6603c7888110e0187e88ea17cd8fc2e2df0a0e1f37fa"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f17b774caa13c618c7244f1ee51fe23c5e7b8538a471fa46d9949779758aed6"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.228.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -452,47 +299,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]

crates/Cargo.toml

@@ -1,22 +1,13 @@
 [workspace]
-members = [
-    "xrpl-wasm-vm-ffi",
-    "xrpl-wasm-vm",
-    "xrpl-wasm-testkit",
-    "xrpl-host-functions",
-    "xrpl-host-functions-macros",
-]
+members = ["hello_world"]
 resolver = "3"
 
 [workspace.dependencies]
-cxx = { version = "1.0.199", features = ["c++20"] }
+cxx = { version = "1.0.198", features = ["c++20"] }
 
 [workspace.package]
 edition = "2024"
 
-[workspace.lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage_nightly)' ] }
-
 [profile.release]
 opt-level = 3
 overflow-checks = true

crates/README.md

@@ -1,120 +0,0 @@
-# Rust crates
-
-This directory holds the WebAssembly engine that runs Smart Escrow contracts,
-bridged into C++ via `cxxbridge`/the `cxx` crate.
-
-The workspace is built unconditionally — `add_subdirectory(crates)` in the
-top-level `CMakeLists.txt` is not behind an option, and
-`xrpl_wasm_vm_ffi_cxxbridge` is a `PUBLIC` dependency of
-`xrpl.libxrpl.tx` (see `cmake/XrplCore.cmake`). The Rust toolchain pinned in
-[`rust-toolchain.toml`](../rust-toolchain.toml) is therefore required to build
-`libxrpl` at all; the Nix devshell provides it automatically.
-
-## The crates
-
-Dependencies run in one direction: the ABI crate at the bottom, the engine on
-top of it, and the two bridges at the edge.
-
-### `xrpl-host-functions`
-
-The wasm host ABI, declared exactly once. A `host_functions!` block at the
-bottom of `src/lib.rs` generates the `HostFunctions` trait a host implements and
-the `HostFunctionSpec` table a wasm engine registers from. Only the vocabulary
-the declarations are written in — `HostError`, `HostResult`, `TraceDataType`,
-`HASH_LEN` — is hand-written.
-
-**Add or change a host function here**, never in the engine or the bridge: the
-expansion names nothing this file does not, so neither side of the FFI boundary
-gets to restate a signature.
-
-`no_std`, because this crate is also what a guest contract links against.
-
-### `xrpl-host-functions-macros`
-
-The proc macro behind that block, plus the `wasmi_glue!` marshalling it
-generates. An implementation detail of the crate above — nothing else should
-depend on it.
-
-The dev-dependency back on `xrpl-host-functions` is a deliberate cycle: the
-doctests declare host functions returning `HostResult`, which the facade crate
-hand-writes. Cargo allows it because dev-dependencies sit outside the library
-build graph.
-
-### `xrpl-wasm-vm`
-
-The engine itself, on `wasmi`: preflight validation (`preflight/`), gas
-metering and execution (`vm.rs`), and host-call dispatch (`abi.rs`, `args.rs`,
-`register.rs`).
-
-Two lint decisions are load-bearing, both because this is a consensus path:
-
-- `forbid(unsafe_code)`, so "every guest access reaches linear memory only
-  through wasmi's bounds-checked slice operations" is a property rather than a
-  claim.
-- The truncating, wrapping and sign-losing cast lints are `deny` and each
-  remaining cast is argued for at its site — a bad cast here changes what a
-  contract is charged or told.
-
-It pins `wasmi` with `default-features = false` deliberately. wasmi's `wat`
-feature is on by default and makes `Module::new` accept text as readily as
-binary, which would turn a transaction's validity into a build flag.
-
-Not bridged to C++ directly; it reaches `xrpld` through `xrpl-wasm-vm-ffi`.
-
-### `xrpl-wasm-vm-ffi`
-
-The cxx bridge into `xrpld`. Three crossings:
-
-- **In:** C++ calls `run_escrow`, once per escrow finish.
-- **Back out:** that run's host calls leave through the C++ `HostContext`, which
-  `CxxHost` presents to the engine as an ordinary `HostFunctions` implementor.
-- **In only:** C++ screens a module with `check_escrow`. Screening needs no
-  host, so nothing comes back out.
-
-The C++ side is `src/libxrpl/tx/wasm/WasmVM.cpp` and
-`src/libxrpl/tx/wasm/HostContext.cpp`.
-
-**Neither language may unwind into the other**, and the two halves are not
-symmetric:
-
-- A **Rust panic** is caught here, by `guarded`. Letting one reach C++ is
-  undefined behaviour, and `[profile.release]` enables overflow checks, so this
-  is a live path rather than a formality.
-- A **C++ exception** is stopped on the C++ side: every `HostContext` method is
-  `noexcept` and catches its own. That is what makes `guarded` sufficient.
-
-Everything hand-written here is private, so `cargo doc` needs
-`--document-private-items` to show any of it. That is also why this crate,
-unlike `xrpl-wasm-vm`, does not `deny(unreachable_pub)` — cxx's expansion is
-`pub` throughout by necessity.
-
-### `xrpl-wasm-testkit`
-
-**Test-only.** Assembles WebAssembly text for the C++ test suite, and exposes
-the gas price of each host function by its guest import name for the C++ gas
-benchmarks (read through the bridge rather than transcribed into C++, so the
-numbers cannot drift silently).
-
-A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the
-separation is the point: putting `compile_wat` on the production bridge would
-link `wat` into `xrpld` even if nothing called it. Linked only into
-`xrpl_tests`, never into `libxrpl` or `xrpld`, so "no text assembler in the
-shipped node" holds by the link graph rather than by a flag someone can flip.
-
-## Testing
-
-```bash
-cargo test --manifest-path crates/Cargo.toml --workspace
-```
-
-CI uses `cargo nextest`. This is independent of the CMake build.
-
-One gap that command does not cover: it never compiles `xrpl-host-functions`
-with its `wasmi_glue` feature **off**, because `xrpl-wasm-vm` enables the
-feature and Cargo unifies features across a workspace build. The feature-off
-configuration is the one a guest contract sees, so after touching that crate
-also run:
-
-```bash
-cargo check -p xrpl-host-functions --manifest-path crates/Cargo.toml
-```

crates/hello_world/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "rs-hello_world"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+crate-type = ["staticlib"]
+
+[dependencies]
+cxx.workspace = true

crates/hello_world/src/lib.rs

@@ -0,0 +1,10 @@
+#[cxx::bridge(namespace = "rs::hello_world")]
+mod ffi {
+    extern "Rust" {
+        fn hello_world() -> String;
+    }
+}
+
+pub fn hello_world() -> String {
+    "hello_world".to_string()
+}

crates/xrpl-host-functions-macros/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The doctest declares host functions returning `HostResult`, which the facade
-# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
-# the library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"
-
-[lints]
-workspace = true

crates/xrpl-host-functions-macros/src/enums.rs

@@ -1,289 +0,0 @@
-//! `#[coded_enum]`: an enum of wire codes, and the `ALL`/`code`/`from_code` set
-//! that must not fall behind its variants.
-//!
-//! Rust cannot enumerate an enum's variants — an exhaustive `match` forces an arm per
-//! variant but gives nothing to iterate — so `ALL` is trustworthy only by being
-//! generated from them, as `HostFunctionSpec::ALL` is from the `host_functions!` block.
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{Expr, ExprLit, ExprUnary, Fields, Ident, ItemEnum, Lit, UnOp, Variant};
-
-use crate::errors;
-
-/// One variant as the expansion reads it: the name `ALL` lists and the code
-/// `from_code` matches.
-struct WireVariant<'a> {
-    ident: &'a Ident,
-    code: &'a Expr,
-}
-
-pub(crate) fn expand(args: TokenStream, item: TokenStream) -> syn::Result<TokenStream> {
-    if !args.is_empty() {
-        return Err(syn::Error::new_spanned(
-            args,
-            "`#[coded_enum]` takes no arguments",
-        ));
-    }
-
-    let item: ItemEnum = syn::parse2(item)?;
-    let variants = wire_variants(&item)?;
-
-    let attrs = &item.attrs;
-    let vis = &item.vis;
-    let name = &item.ident;
-    let declarations = item.variants.iter();
-    let identifiers = variants.iter().map(|variant| variant.ident);
-    let arms = variants.iter().map(|variant| {
-        let (ident, code) = (variant.ident, variant.code);
-        quote! { #code => Some(Self::#ident) }
-    });
-
-    Ok(quote! {
-        #(#attrs)*
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        #vis enum #name {
-            #(#declarations,)*
-        }
-
-        impl #name {
-            /// Every variant, in declaration order — the whole set, and whole by
-            /// construction.
-            pub const ALL: &'static [Self] = &[#(Self::#identifiers,)*];
-
-            /// The wire value that names this variant.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The variant `code` names, or `None` if no variant does — what an
-            /// unnamed code means is the caller's to decide.
-            pub const fn from_code(code: i32) -> Option<Self> {
-                match code {
-                    #(#arms,)*
-                    _ => None,
-                }
-            }
-        }
-    })
-}
-
-/// Every variant, checked against what the expansion needs of it, or every
-/// mistake in the list.
-fn wire_variants(item: &ItemEnum) -> syn::Result<Vec<WireVariant<'_>>> {
-    // `#[repr(i32)]` is rejected on a variantless enum, and there is nothing for a
-    // wire enum with no codes to mean anyway.
-    if item.variants.is_empty() {
-        return Err(syn::Error::new_spanned(
-            item,
-            "`#[coded_enum]` needs at least one variant",
-        ));
-    }
-
-    let mut errors = Vec::new();
-    let variants = item
-        .variants
-        .iter()
-        .filter_map(|variant| {
-            let code = errors::record(code_of(variant), &mut errors)?;
-            Some(WireVariant {
-                ident: &variant.ident,
-                code,
-            })
-        })
-        .collect();
-
-    errors::into_result(variants, errors)
-}
-
-/// The code a variant is declared with.
-fn code_of(variant: &Variant) -> syn::Result<&Expr> {
-    if !matches!(variant.fields, Fields::Unit) {
-        return Err(syn::Error::new_spanned(
-            &variant.fields,
-            "a wire enum's variants carry no data: the code is the whole of what crosses",
-        ));
-    }
-
-    let Some((_, code)) = &variant.discriminant else {
-        return Err(syn::Error::new_spanned(
-            variant,
-            "missing `= <code>`: a wire value is declared, never implied by position",
-        ));
-    };
-
-    if !is_integer_literal(code) {
-        return Err(syn::Error::new_spanned(
-            code,
-            "a wire value must be an integer literal, since `from_code` matches it as a pattern",
-        ));
-    }
-
-    Ok(code)
-}
-
-/// `-2147483648` and `7`, but not `i32::MIN` or `1 + 1`: the discriminant is emitted
-/// into pattern position unchanged, where an expression means something else or nothing.
-fn is_integer_literal(code: &Expr) -> bool {
-    match code {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(_), ..
-        }) => true,
-        Expr::Unary(ExprUnary {
-            op: UnOp::Neg(_),
-            expr,
-            ..
-        }) => is_integer_literal(expr),
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The whole expansion for the smallest list that exercises every generated
-    /// item, negative codes included.
-    #[test]
-    fn generates_the_enum_and_the_three_items_over_it() {
-        let generated = generated(quote! {
-            /// How a trace buffer is read.
-            pub enum TraceDataType {
-                /// Eight little-endian bytes.
-                Int64 = 1,
-                Unnamed = -2,
-            }
-        });
-
-        for expected in [
-            // The declaration reaches the output as written, doc comments and all,
-            // under the derives and the representation `code` casts through.
-            "# [doc = r\" How a trace buffer is read.\"] \
-             # [derive (Debug , Clone , Copy , PartialEq , Eq)] # [repr (i32)] \
-             pub enum TraceDataType { # [doc = r\" Eight little-endian bytes.\"] Int64 = 1 , \
-             Unnamed = - 2 , }",
-            "pub const ALL : & 'static [Self] = & [Self :: Int64 , Self :: Unnamed ,] ;",
-            "pub const fn code (self) -> i32 { self as i32 }",
-            "pub const fn from_code (code : i32) -> Option < Self > \
-             { match code { 1 => Some (Self :: Int64) , - 2 => Some (Self :: Unnamed) , \
-             _ => None , } }",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The visibility is the caller's: a `pub` the macro supplied would be one the
-    /// declaration could not take back.
-    #[test]
-    fn keeps_the_declared_visibility() {
-        assert!(
-            generated(quote! {
-                enum Private {
-                    One = 1,
-                }
-            })
-            .contains("enum Private"),
-            "the expansion should not widen a private enum"
-        );
-    }
-
-    /// A variant with no code would take one from its position, which is the
-    /// mistake that silently renumbers a wire value.
-    #[test]
-    fn rejects_a_variant_without_a_code() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal = 0,
-                Greater,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("missing `= <code>`"), "{messages:?}");
-    }
-
-    /// The two shapes a code is tempting to write as and cannot be: a constant's
-    /// path, and arithmetic.
-    #[test]
-    fn rejects_a_code_that_is_not_an_integer_literal() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal = i32::MIN,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        for message in &messages {
-            assert!(message.contains("must be an integer literal"), "{message}");
-        }
-    }
-
-    #[test]
-    fn rejects_a_variant_carrying_data() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal(u8) = 0,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("carry no data"), "{messages:?}");
-    }
-
-    /// `#[repr(i32)]` is rejected on a variantless enum, so the diagnostic has to
-    /// be this one rather than rustc's.
-    #[test]
-    fn rejects_an_enum_with_no_variants() {
-        let messages = messages(quote! {
-            pub enum Nothing {}
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("at least one variant"), "{messages:?}");
-    }
-
-    /// Every mistake in one build, as `host_functions!` reports a block.
-    #[test]
-    fn reports_every_mistake_in_the_list() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_arguments() {
-        let error = expand(quote!(i64), quote! { pub enum Ordering { Equal = 0, } })
-            .expect_err("expected the argument to be refused");
-
-        assert!(error.to_string().contains("takes no arguments"));
-    }
-
-    #[test]
-    fn rejects_an_item_that_is_not_an_enum() {
-        expand(quote!(), quote! { pub struct Ordering; })
-            .expect_err("expected a struct to be refused");
-    }
-
-    fn generated(item: TokenStream) -> String {
-        expand(quote!(), item)
-            .expect("the enum should expand")
-            .to_string()
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(item: TokenStream) -> Vec<String> {
-        let Err(error) = expand(quote!(), item) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-}

crates/xrpl-host-functions-macros/src/errors.rs

@@ -1,33 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}
-
-/// `value`, or the folded diagnostics if any were recorded.
-pub(crate) fn into_result<T>(value: T, errors: Vec<syn::Error>) -> syn::Result<T> {
-    match combine(errors) {
-        Some(error) => Err(error),
-        None => Ok(value),
-    }
-}
-
-/// `result`'s value, or `None` with its error filed in `errors` — so a check that
-/// yields a value can be reported like one that yields nothing, and the caller
-/// keeps going.
-pub(crate) fn record<T>(result: syn::Result<T>, errors: &mut Vec<syn::Error>) -> Option<T> {
-    match result {
-        Ok(value) => Some(value),
-        Err(error) => {
-            errors.push(error);
-            None
-        }
-    }
-}

crates/xrpl-host-functions-macros/src/glue.rs

@@ -1,472 +0,0 @@
-//! The wasmi registration, generated from the declarations the ABI table is
-//! generated from — so the closure a guest links against cannot disagree with the
-//! signature preflight screens it by.
-//!
-//! Emitted as a `macro_rules!` rather than as the registration itself, because the
-//! crate the expansion lands in is `no_std`, zero-dependency and links into the
-//! guest, and a `macro_rules!` body is inert tokens until someone expands it.
-//!
-//! The body therefore resolves in two crates at once and names nothing free:
-//! `$crate` is the ABI crate, `$env` the module the caller passes in, and every
-//! other path starts at `::wasmi` or `::core`. `$env` is matched as an `ident`
-//! because `$env:path` used as `$env::Foo` is `error: missing angle brackets in
-//! associated item path`.
-//!
-//! The one file that knows an engine's calling convention: how a region arrives as
-//! two wasm parameters, where the gas charge goes, and which helper a result-less
-//! function takes. A second engine would be a second file like it.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, quote};
-
-use crate::lowering::{ResultType, WasmValType};
-use crate::parsed_host_function::{Param, ParsedHostFunction};
-
-/// The `wasmi_glue!` macro: the trait a VM implements one body per host function
-/// in, and the registration that hands each of them to a `Linker`.
-pub(crate) fn wasmi_glue(functions: &[ParsedHostFunction]) -> TokenStream {
-    let bodies = functions.iter().map(body_declaration);
-    let registrations = functions.iter().map(registration);
-    let assertions = charging_assertions();
-    let env = env();
-
-    quote! {
-        /// Expands to the wasmi glue for this ABI: the `HostFunctionBodies` trait
-        /// and `register_host_functions`, at the scope it is called in. A
-        /// declaration added to the ABI is then a missing trait item rather than a
-        /// forgotten registration.
-        ///
-        /// `$env` names a module holding everything the expansion reaches for on
-        /// the engine's side, since this crate can name none of it: the store type
-        /// `VmState`, the charging helpers `charged` and `charged_unreported` with
-        /// their `CallResult`, and the argument types `InBytes`, `InStr`, `InU32`,
-        /// `OutBytes` and `TraceCode`.
-        ///
-        /// ```ignore
-        /// mod glue_env {
-        ///     pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-        ///     pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-        ///     pub(crate) use crate::vm::VmState;
-        /// }
-        ///
-        /// xrpl_host_functions::wasmi_glue!(glue_env);
-        /// ```
-        ///
-        /// The module supplies the spellings; the shapes are pinned by the
-        /// expansion. Each argument type implements [`FromWasmRegion`] or
-        /// [`FromWasmScalar`] — which one is the ABI's decision, so a declared
-        /// `u32` is a region — and each charging helper's signature is asserted
-        /// against a `const _`.
-        #[cfg(feature = "wasmi_glue")]
-        #[macro_export]
-        macro_rules! wasmi_glue {
-            ($env:ident) => {
-                /// One body per host function: what the engine runs once the call's
-                /// gas is charged and its arguments are off the wire.
-                ///
-                /// The methods take no receiver, so a registered closure captures
-                /// nothing — which is what satisfies wasmi's
-                /// `Fn + Send + Sync + 'static` bound, and why the implementor
-                /// itself need not be `'static`. A body does not charge gas; the
-                /// generated closure does, so it cannot be forgotten or charged
-                /// twice.
-                pub(crate) trait HostFunctionBodies {
-                    #(#bodies)*
-                }
-
-                /// Register every host function on `linker`, one `func_wrap` per
-                /// declaration, at the ABI's derived wasm signature — so an import
-                /// that passes [`crate::check`] links here by construction.
-                pub(crate) fn register_host_functions<B: HostFunctionBodies>(
-                    linker: &mut ::wasmi::Linker<#env::VmState<'_>>,
-                ) -> ::core::result::Result<(), ::wasmi::errors::LinkerError> {
-                    #(#registrations)*
-                    Ok(())
-                }
-
-                #assertions
-            };
-        }
-    }
-}
-
-/// The macro argument every engine-side path is qualified by.
-fn env() -> TokenStream {
-    quote!($env)
-}
-
-/// The signature of each charging helper, pinned as a `const _` the expansion
-/// carries: the one part of the contract neither `$env` nor the argument traits
-/// state.
-///
-/// Its value is the diagnostic. A changed helper is already a type error at the
-/// call, but there it is failed inference inside a generated closure and here it
-/// is one line stating the signature that was expected.
-fn charging_assertions() -> TokenStream {
-    let env = env();
-    let assertion = |helper: TokenStream, answer: TokenStream| {
-        quote! {
-            const _: fn(
-                &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-                $crate::HostFunctionSpec,
-                fn(&mut ::wasmi::Caller<'_, #env::VmState<'_>>) -> #env::CallResult<#answer>,
-            ) -> ::core::result::Result<#answer, ::wasmi::Error> = #env::#helper;
-        }
-    };
-
-    let reported = assertion(quote!(charged), quote!(i32));
-    let unreported = assertion(quote!(charged_unreported), quote!(()));
-
-    quote! {
-        #reported
-        #unreported
-    }
-}
-
-/// `fn check_keylet(caller: &mut Caller<'_, $env::VmState<'_>>, account:
-/// $env::InBytes, seq: $env::InU32, out: $env::OutBytes) ->
-/// $env::CallResult<i32>;`
-fn body_declaration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let name = &function.signature.ident;
-    let params = function.params().iter().map(|param| {
-        let name = &param.name;
-        let ty = param.ty.argument_type(&env);
-        quote! { #name: #ty }
-    });
-    let answer = answer_type(function.result());
-
-    quote! {
-        fn #name(
-            caller: &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-            #(#params),*
-        ) -> #answer;
-    }
-}
-
-/// One `linker.func_wrap(…)?;`: the wasm signature as the closure's parameters,
-/// the gas charge around the call, and the body between them.
-fn registration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let body = &function.signature.ident;
-    let spec = spec_path(function);
-    let params = function.params().iter().flat_map(closure_params);
-    let arguments = function.params().iter().map(lift);
-    let (answer, charge) = match function.result() {
-        ResultType::BufferLength | ResultType::Value => (quote!(i32), quote!(#env::charged)),
-        ResultType::Nothing => (quote!(()), quote!(#env::charged_unreported)),
-    };
-
-    quote! {
-        linker.func_wrap(
-            $crate::HOST_MODULE,
-            #spec.wasm_name(),
-            |mut caller: ::wasmi::Caller<'_, #env::VmState<'_>>, #(#params),*|
-             -> ::core::result::Result<#answer, ::wasmi::Error> {
-                #charge(&mut caller, #spec, |caller| {
-                    B::#body(caller, #(#arguments),*)
-                })
-            },
-        )?;
-    }
-}
-
-/// `$crate::HostFunctionSpec::CheckKeylet` — the one name the expansion reaches
-/// back into the ABI crate for.
-fn spec_path(function: &ParsedHostFunction) -> TokenStream {
-    let variant = &function.variant;
-    quote! { $crate::HostFunctionSpec::#variant }
-}
-
-/// One declared parameter as the closure declares it: `account_ptr: i32,
-/// account_len: i32`, or `field: i32`.
-///
-/// Names and types both come from the lowering, so the arity a closure is
-/// registered at *is* the derived arity.
-fn closure_params(param: &Param) -> Vec<TokenStream> {
-    param
-        .ty
-        .wasm_names(&param.name)
-        .into_iter()
-        .zip(param.ty.as_wasm_params())
-        .map(|(name, val_type)| {
-            let ty = rust_type(*val_type);
-            quote! { #name: #ty }
-        })
-        .collect()
-}
-
-/// The argument a body is handed, built from the wasm parameters it arrived as:
-/// `<$env::InBytes as $crate::FromWasmRegion>::from_wasm(account_ptr,
-/// account_len)`, or the scalar itself.
-///
-/// Qualified rather than an inherent call, so the arity comes from the trait the
-/// lowering chose: an argument type implementing the other one is an unsatisfied
-/// bound named at the type, where `Ty::from_wasm(a, b)` would be an unrelated
-/// arity error named here.
-fn lift(param: &Param) -> TokenStream {
-    let Some(argument_trait) = param.ty.argument_trait() else {
-        return param.name.to_token_stream();
-    };
-    let ty = param.ty.argument_type(&env());
-    let names = param.ty.wasm_names(&param.name);
-
-    quote! { <#ty as $crate::#argument_trait>::from_wasm(#(#names),*) }
-}
-
-/// What a body answers: the value the guest is told, or nothing at all for the
-/// function whose whole effect is on the host.
-fn answer_type(result: ResultType) -> TokenStream {
-    let env = env();
-    match result {
-        ResultType::BufferLength | ResultType::Value => quote!(#env::CallResult<i32>),
-        ResultType::Nothing => quote!(#env::CallResult<()>),
-    }
-}
-
-/// A wasm value type as a closure parameter spells it — a Rust type, not
-/// [`WasmValType`]'s own `ToTokens`, which spells the ABI crate's variant.
-fn rust_type(val_type: WasmValType) -> TokenStream {
-    match val_type {
-        WasmValType::I32 => quote!(i32),
-        WasmValType::I64 => quote!(i64),
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use proc_macro2::{Delimiter, Group, TokenTree};
-    use syn::parse_quote;
-
-    fn parsed(function: syn::TraitItemFn) -> ParsedHostFunction {
-        ParsedHostFunction::parse(function).expect("the declaration should parse")
-    }
-
-    /// The declaration whose declared and wasm parameter lists differ most:
-    /// `account`, `out` and `seq` are a `(ptr, len)` pair each, so three arguments
-    /// to the body and six on the wire.
-    #[test]
-    fn lowers_a_declaration_to_a_body_and_a_registration() {
-        let keylet = parsed(parse_quote! {
-            #[gas = 350]
-            #[wasm_name = "check_id"]
-            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&keylet).to_string(),
-            "fn check_keylet (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account : $ env :: InBytes , seq : $ env :: InU32 , out : $ env :: OutBytes) \
-             -> $ env :: CallResult < i32 > ;"
-        );
-
-        assert_eq!(
-            registration(&keylet).to_string(),
-            "linker . func_wrap ($ crate :: HOST_MODULE , \
-             $ crate :: HostFunctionSpec :: CheckKeylet . wasm_name () , \
-             | mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account_ptr : i32 , account_len : i32 , seq_ptr : i32 , seq_len : i32 , \
-             out_ptr : i32 , out_len : i32 | \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > \
-             { $ env :: charged (& mut caller , \
-             $ crate :: HostFunctionSpec :: CheckKeylet , | caller | \
-             { B :: check_keylet (caller , \
-             < $ env :: InBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (account_ptr , account_len) , \
-             < $ env :: InU32 as $ crate :: FromWasmRegion > :: from_wasm (seq_ptr , seq_len) , \
-             < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (out_ptr , out_len)) }) } ,) ? ;"
-        );
-    }
-
-    /// A wasm scalar is passed through as itself, in declaration order: no pair,
-    /// no argument type, and an `i64` that stays one.
-    #[test]
-    fn passes_the_wasm_scalars_through_untouched() {
-        let from_int = parsed(parse_quote! {
-            #[gas = 100]
-            #[wasm_name = "float_from_int"]
-            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&from_int).to_string(),
-            "fn float_from_int (caller : & mut :: wasmi :: Caller < '_ , \
-             $ env :: VmState < '_ >> , \
-             x : i64 , out : $ env :: OutBytes , mode : i32) -> $ env :: CallResult < i32 > ;"
-        );
-
-        let registration = registration(&from_int).to_string();
-        assert!(
-            registration.contains(
-                "| mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-                 x : i64 , out_ptr : i32 , out_len : i32 , mode : i32 |"
-            ),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: float_from_int (caller , x , \
-                 < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (out_ptr , out_len) , mode)"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The function that answers nothing takes the other charging helper, derived
-    /// from its declared `HostResult<()>` rather than named as a special case.
-    /// Its `TraceCode` is also the only place `FromWasmScalar` is reached for.
-    #[test]
-    fn a_declaration_that_answers_nothing_takes_the_other_charge() {
-        let trace = parsed(trace_declaration());
-
-        assert_eq!(
-            body_declaration(&trace).to_string(),
-            "fn trace (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             msg : $ env :: InStr , data_type : $ env :: TraceCode , data : $ env :: InBytes) \
-             -> $ env :: CallResult < () > ;"
-        );
-
-        let registration = registration(&trace).to_string();
-        assert!(
-            registration.contains(":: core :: result :: Result < () , :: wasmi :: Error >"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains("$ env :: charged_unreported (& mut caller"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: trace (caller , \
-                 < $ env :: InStr as $ crate :: FromWasmRegion > :: from_wasm (msg_ptr , msg_len) , \
-                 < $ env :: TraceCode as $ crate :: FromWasmScalar > :: from_wasm (data_type) , \
-                 < $ env :: InBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (data_ptr , data_len))"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The two worlds the macro body resolves in: the ABI crate through `$crate`,
-    /// and one engine by name. `names_no_crate_of_its_own` holds the ABI half of
-    /// the expansion to naming neither.
-    #[test]
-    fn reaches_the_abi_crate_through_dollar_crate_and_the_engine_by_name() {
-        let glue = code(wasmi_glue(&[parsed(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        })]));
-
-        assert!(
-            glue.contains("$ crate :: HostFunctionSpec :: GetLedgerSqn"),
-            "{glue}"
-        );
-        assert!(glue.contains("$ crate :: HOST_MODULE"), "{glue}");
-        assert!(glue.contains(":: wasmi :: Linker"), "{glue}");
-        assert!(!glue.contains("xrpl_host_functions"), "{glue}");
-    }
-
-    /// Every engine-side item is reached through the module the macro is handed: a
-    /// bare name would resolve against whatever the call site has in scope.
-    ///
-    /// `charged` covers `charged_unreported`, being its prefix.
-    #[test]
-    fn names_the_engine_s_own_items_only_through_the_module_it_is_handed() {
-        let glue = code(wasmi_glue(&[
-            parsed(trace_declaration()),
-            parsed(parse_quote! {
-                #[gas = 350]
-                #[wasm_name = "check_id"]
-                fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8])
-                    -> HostResult<usize>;
-            }),
-        ]));
-
-        for item in [
-            "VmState",
-            "CallResult",
-            "charged",
-            "InBytes",
-            "InStr",
-            "InU32",
-            "OutBytes",
-            "TraceCode",
-        ] {
-            for (index, _) in glue.match_indices(item) {
-                assert!(
-                    glue[..index].ends_with("$ env :: "),
-                    "`{item}` named outside `$env`: {glue}"
-                );
-            }
-        }
-    }
-
-    /// The charging helpers' signatures, which nothing else in the contract
-    /// states.
-    #[test]
-    fn pins_both_charging_helpers_signatures() {
-        assert_eq!(
-            charging_assertions().to_string(),
-            "const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < i32 > ,) \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > = $ env :: charged ; \
-             const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < () > ,) \
-             -> :: core :: result :: Result < () , :: wasmi :: Error > \
-             = $ env :: charged_unreported ;"
-        );
-    }
-
-    fn trace_declaration() -> syn::TraitItemFn {
-        parse_quote! {
-            #[gas = 30]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-        }
-    }
-
-    /// The expansion's code alone. `to_string` renders a doc comment as a
-    /// `#[doc = "…"]` literal, and the macro's own documentation names the very
-    /// items the scans above look for.
-    fn code(tokens: TokenStream) -> String {
-        fn is_doc(tree: Option<&TokenTree>) -> bool {
-            let Some(TokenTree::Group(group)) = tree else {
-                return false;
-            };
-            group.delimiter() == Delimiter::Bracket
-                && matches!(group.stream().into_iter().next(),
-                            Some(TokenTree::Ident(ident)) if ident == "doc")
-        }
-
-        fn strip(tokens: TokenStream) -> TokenStream {
-            let mut trees = tokens.into_iter().peekable();
-            let mut kept = Vec::new();
-            while let Some(tree) = trees.next() {
-                match tree {
-                    TokenTree::Punct(ref punct)
-                        if punct.as_char() == '#' && is_doc(trees.peek()) =>
-                    {
-                        trees.next();
-                    }
-                    TokenTree::Group(group) => kept.push(TokenTree::Group(Group::new(
-                        group.delimiter(),
-                        strip(group.stream()),
-                    ))),
-                    other => kept.push(other),
-                }
-            }
-            kept.into_iter().collect()
-        }
-
-        strip(tokens).to_string()
-    }
-}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,539 +0,0 @@
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod enums;
-mod errors;
-mod glue;
-mod lowering;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the declarations refer to and holds the one declaration
-/// block.
-///
-/// # What it generates
-///
-/// Four items, in the scope the block is written in:
-///
-/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
-///   receiver, parameters, return type and doc comment exactly as written. An
-///   execution environment implements it; the rest of the expansion does not
-///   mention it.
-/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
-///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
-///   carrying that declaration's doc comment. Its `const fn wasm_name`, `gas`,
-///   `wasm_params` and `wasm_result` are the ABI metadata, and `ALL` is every
-///   variant in declaration order — what a wasm engine iterates to build its
-///   import table.
-/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
-///   so those accessors read from a single `match` over the declarations, and
-///   never appears in a signature a caller can name.
-/// - `macro_rules! wasmi_glue`: the registration for a wasmi engine, emitted as a
-///   macro rather than as code because it names an engine this crate must not
-///   depend on. Inert until expanded — see its own documentation.
-///
-/// The wasm signature is derived from the declared types rather than stated a
-/// second time: `i32` and `i64` are the wasm scalars spelled as themselves, every
-/// other parameter type is marshalled through a `(ptr, len)` pair or an `i32`
-/// code, and the result comes from the `HostResult<T>` success type. The glue is
-/// generated from that same derivation, so the closure a guest links against and
-/// the signature it is screened by are one statement.
-///
-/// Outside the glue's body the expansion builds only `Self::Variant` and
-/// `WasmValType` paths, so the block compiles wherever the types it names —
-/// `HostResult` and `WasmValType` — resolve.
-///
-/// ```
-/// use xrpl_host_functions::{HostResult, WasmValType};
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // The trait's methods are the declarations, down to the `&self` receiver the
-/// // VM calls the host through.
-/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
-///     host.get_ledger_sqn(out)
-/// }
-///
-/// // The metadata is a `const` table, so gas and import names are available at
-/// // compile time rather than looked up at run time.
-/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
-/// assert_eq!(TRACE_GAS, 500);
-///
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
-/// assert_eq!(
-///     HostFunctionSpec::ALL,
-///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
-/// );
-///
-/// // So is the wasm signature: `out: &mut [u8]` is the pair `(ptr, len)`, and
-/// // `HostResult<usize>` answers the length written to it.
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32],
-/// );
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_result(),
-///     Some(WasmValType::I32),
-/// );
-///
-/// // `trace_num` answers nothing at all, so its import has no result.
-/// assert_eq!(
-///     HostFunctionSpec::TraceNum.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32, WasmValType::I64],
-/// );
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_result(), None);
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self`, with no body and no
-/// generics: it maps to exactly one wasm import signature. Its parameters must be
-/// `i32`, `i64`, `u32`, `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`, and it
-/// must return `HostResult<usize>` if it writes an output region,
-/// `HostResult<i32>` or `HostResult<FloatOrdering>` if it answers a value directly,
-/// or `HostResult<()>` if it answers nothing. Two declarations may not share a
-/// `wasm_name`, nor collapse to the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-/// Declares an enum of wire codes, together with the `ALL`, `code` and
-/// `from_code` set that must not fall behind its variants.
-///
-/// The enum is written as an ordinary one — its own doc comment, its own
-/// visibility, one `Variant = code,` per line — and the attribute supplies the
-/// derives and the `#[repr(i32)]` that `code` casts through. Rust cannot enumerate
-/// an enum's variants, so `ALL` is the only complete set a test can iterate.
-///
-/// A variant carries no data and states its code as an integer literal, since that
-/// literal is also the pattern `from_code` matches it by. What an unnamed code means
-/// is the caller's to decide, being a different condition per enum.
-///
-/// ```
-/// use xrpl_host_functions_macros::coded_enum;
-///
-/// /// How a trace buffer is to be read.
-/// #[coded_enum]
-/// pub enum TraceDataType {
-///     /// 8 little-endian bytes, rendered as a signed decimal.
-///     Int64 = 1,
-///     /// A 20-byte account ID, rendered as base58.
-///     Account = 4,
-/// }
-///
-/// assert_eq!(TraceDataType::Account.code(), 4);
-/// assert_eq!(TraceDataType::from_code(4), Some(TraceDataType::Account));
-/// assert_eq!(TraceDataType::from_code(2), None);
-/// assert_eq!(
-///     TraceDataType::ALL,
-///     &[TraceDataType::Int64, TraceDataType::Account],
-/// );
-/// ```
-#[proc_macro_attribute]
-pub fn coded_enum(
-    args: proc_macro::TokenStream,
-    item: proc_macro::TokenStream,
-) -> proc_macro::TokenStream {
-    enums::expand(args.into(), item.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let functions = parse_block(input)?;
-    let abi = abi_items(&functions);
-    let glue = glue::wasmi_glue(&functions);
-
-    Ok(quote! {
-        #abi
-        #glue
-    })
-}
-
-/// Every declaration in the block, parsed and checked against each other, or
-/// every mistake in it.
-fn parse_block(input: TokenStream) -> syn::Result<Vec<ParsedHostFunction>> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(parsed)
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-/// The ABI itself: the trait a host implements and the table everything else
-/// reads. `glue::wasmi_glue` is the other half of the expansion.
-fn abi_items(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec`]'s accessors
-        /// read from.
-        ///
-        /// Private, and the only reason it exists is to keep all of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-            wasm_params: &'static [WasmValType],
-            wasm_result: Option<WasmValType>,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-
-            /// The wasm parameters this function is imported with, in wire
-            /// order — the list a guest's import must match, which the
-            /// declaration's own parameter list is not: a declared parameter
-            /// marshalled through a `(ptr, len)` region is two of these.
-            ///
-            /// Usable in `const` context, so import lists can be built at
-            /// compile time.
-            pub const fn wasm_params(self) -> &'static [WasmValType] {
-                self.spec().wasm_params
-            }
-
-            /// The wasm result this function answers with, or `None` for the
-            /// one whose whole effect is on the host. An `i32` where there is
-            /// one, whether the host answered a value or the length of what it
-            /// wrote — the wire does not distinguish those.
-            pub const fn wasm_result(self) -> Option<WasmValType> {
-                self.spec().wasm_result
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    /// The ABI half of the expansion alone: the glue's body is written against
-    /// another crate entirely, so the tests below about what the expansion may
-    /// name are not about it.
-    fn abi_expansion(input: TokenStream) -> String {
-        abi_items(&parse_block(input).expect("the block should parse")).to_string()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self , out : & mut [u8]) -> HostResult < usize > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , \
-             wasm_params : & 'static [WasmValType] , wasm_result : Option < WasmValType > , }",
-            "const fn spec (self) -> HostFnSpec",
-            // Two wasm parameters for the one declared region, and a result for
-            // the length written to it.
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
-             wasm_result : Some (WasmValType :: I32) , }",
-            "Self :: TraceNum => HostFnSpec { name : \"trace_num\" , gas : 500u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32 , WasmValType :: I64] , \
-             wasm_result : None , }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-            "pub const fn wasm_params (self) -> & 'static [WasmValType]",
-            "pub const fn wasm_result (self) -> Option < WasmValType >",
-            // The fourth item; its contents are `glue`'s own tests.
-            "macro_rules ! wasmi_glue",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The ABI reaches for nothing outside the crate it lands in, which is what
-    /// lets that crate stay zero-dependency and link into the guest. The glue is
-    /// not held to this — its body names one engine throughout, and `glue`'s own
-    /// tests pin that instead.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // Two roots and no others: `Self::Variant` and `WasmValType::I32`.
-        // Doc comments spell paths without spaces (`Self::ALL`), so they do not
-        // match.
-        for (index, _) in generated.match_indices(" :: ") {
-            let prefix = &generated[..index];
-            assert!(
-                prefix.ends_with("Self") || prefix.ends_with("WasmValType"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<i32>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<i32>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions-macros/src/lowering.rs

@@ -1,492 +0,0 @@
-//! The wire shape of a declaration: everything a declared Rust type decides — the
-//! wasm value types it lowers to, the names those wasm parameters take, the type a
-//! generated body is handed for it, and which of the ABI's two argument traits
-//! builds that type. Kept as one set of `match` arms because the four must agree.
-//!
-//! The whole mapping, and the only place it is written down: a type no arm here
-//! names is a type the ABI does not have, not one that falls back to something.
-//!
-//! Two rows are worth knowing before reading a declaration:
-//!
-//! - **`u32` is not a scalar.** It is a `(ptr, len)` region holding four
-//!   little-endian bytes, which is how the guest SDK passes a sequence number.
-//! - **`usize` and `i32` results are the same on the wire and not
-//!   interchangeable**: the first is the length of what was written to an output
-//!   region, the second the answer itself — as is `FloatOrdering`, a third spelling.
-//!
-//! Matching is on types as they are spelled — a proc macro resolves nothing, so
-//! `type Bytes = u32; … x: Bytes` is unrecognizable — but on a path's last
-//! segment, so any of these types may be spelled qualified.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, format_ident, quote};
-use syn::{Ident, PathArguments, Type, TypePath, TypeReference};
-
-/// What a host function may be handed, and what each costs on the wire.
-///
-/// Declaration order is wasm parameter order, so a reader of a declaration is
-/// reading the import the guest links against.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ParamType {
-    /// `i32`, passed through as itself. Also the spelling for a raw scalar
-    /// whose signedness the ABI does not fix.
-    I32,
-    /// `i64`, passed through as itself.
-    I64,
-    /// `TraceDataType`: an `i32` code the engine resolves to the enum before a
-    /// host sees it.
-    TraceDataType,
-    /// `&[u8]`: a borrowed input region.
-    InBytes,
-    /// `&str`: an input region whose read is also the UTF-8 check.
-    InStr,
-    /// `u32`: an input region holding four little-endian bytes.
-    InU32,
-    /// `&mut [u8]`: the writable output region.
-    OutBytes,
-}
-
-/// The success type of the `HostResult<T>` every declaration returns. These three
-/// are what the ABI has; any other `T` is an error.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ResultType {
-    /// `usize`: the true length of a value written to an output region, which
-    /// the engine turns into the wire's `i32` or into `BufferTooSmall` /
-    /// `DataFieldTooLarge`. Never itself the wire type.
-    BufferLength,
-    /// `i32` or `FloatOrdering`: the answer, from a function that writes no region.
-    /// One variant for both — one wire result, and the declared type still reaches the
-    /// trait verbatim.
-    Value,
-    /// `()`: no wasm result at all — the call's whole effect is on the host, and
-    /// an `Err` reaches the guest in no form.
-    Nothing,
-}
-
-/// The wasm value types this ABI uses, mirroring `xrpl_host_functions::WasmValType`.
-///
-/// Mirrored rather than shared because the dependency runs the other way: the ABI
-/// crate depends on this one, so nothing here can name its types. The [`ToTokens`]
-/// impl below is the whole of the crossing, and emits references to that enum's
-/// variants — so falling out of sync with it is a compile error at the
-/// `host_functions!` call site rather than drift.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum WasmValType {
-    I32,
-    I64,
-}
-
-impl ParamType {
-    /// Recognizes the declared type, or refuses it against its own span.
-    pub(crate) fn parse(ty: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function's parameter must be `i32`, `i64`, `u32`, \
-                               `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`";
-
-        let recognized = match ty {
-            // A lifetime on the reference changes nothing on the wire.
-            Type::Reference(TypeReference {
-                mutability, elem, ..
-            }) => match (mutability, &**elem) {
-                (None, Type::Slice(slice)) if is_named(&slice.elem, "u8") => Some(Self::InBytes),
-                (Some(_), Type::Slice(slice)) if is_named(&slice.elem, "u8") => {
-                    Some(Self::OutBytes)
-                }
-                (None, elem) if is_named(elem, "str") => Some(Self::InStr),
-                _ => None,
-            },
-            _ => match last_path_segment(ty) {
-                Some(name) if name == "i32" => Some(Self::I32),
-                Some(name) if name == "i64" => Some(Self::I64),
-                Some(name) if name == "u32" => Some(Self::InU32),
-                Some(name) if name == "TraceDataType" => Some(Self::TraceDataType),
-                _ => None,
-            },
-        };
-
-        recognized.ok_or_else(|| syn::Error::new_spanned(ty, ALLOWED))
-    }
-
-    /// The wasm parameters this declared type lowers to, in order. `InBytes` and
-    /// `OutBytes` lower alike, so a region's direction survives only in the
-    /// variant.
-    pub(crate) fn as_wasm_params(self) -> &'static [WasmValType] {
-        match self {
-            Self::I32 | Self::TraceDataType => &[WasmValType::I32],
-            Self::I64 => &[WasmValType::I64],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                &[WasmValType::I32, WasmValType::I32]
-            }
-        }
-    }
-
-    /// What a declaration calls each of those wasm parameters: the declared name
-    /// for a scalar, and `{name}_ptr`/`{name}_len` for the pair a region lowers
-    /// to.
-    ///
-    /// **It must answer as many names as [`Self::as_wasm_params`] answers types**,
-    /// since the generated closure declares them one against the other — hence the
-    /// matching arms, and `lowers_every_declared_parameter_type`'s row-by-row
-    /// length check.
-    pub(crate) fn wasm_names(self, name: &Ident) -> Vec<Ident> {
-        match self {
-            Self::I32 | Self::I64 | Self::TraceDataType => vec![name.clone()],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                vec![format_ident!("{name}_ptr"), format_ident!("{name}_len")]
-            }
-        }
-    }
-
-    /// The type a generated body takes this parameter as: a wasm scalar spelled as
-    /// itself, everything else the argument type carrying its shape and direction —
-    /// which is what makes an input region used as an output one a compile error
-    /// naming both.
-    ///
-    /// The argument types are the engine's, so `vm` is the path they are reached
-    /// under; which types need it is decided here, a wasm scalar being `i32` under
-    /// every engine.
-    pub(crate) fn argument_type(self, vm: &TokenStream) -> TokenStream {
-        match self {
-            Self::I32 => quote!(i32),
-            Self::I64 => quote!(i64),
-            Self::TraceDataType => quote!(#vm::TraceCode),
-            Self::InBytes => quote!(#vm::InBytes),
-            Self::InStr => quote!(#vm::InStr),
-            Self::InU32 => quote!(#vm::InU32),
-            Self::OutBytes => quote!(#vm::OutBytes),
-        }
-    }
-
-    /// Which of the ABI's two argument traits builds this parameter's argument
-    /// type, or `None` for a wasm scalar, which reaches a body as itself.
-    ///
-    /// The arity is the whole of the distinction — `FromWasmRegion` takes the two
-    /// of a `(ptr, len)` pair, `FromWasmScalar` the one of a code — so this answers
-    /// alongside [`Self::as_wasm_params`] rather than from a predicate elsewhere.
-    pub(crate) fn argument_trait(self) -> Option<TokenStream> {
-        match self {
-            Self::I32 | Self::I64 => None,
-            Self::TraceDataType => Some(quote!(FromWasmScalar)),
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                Some(quote!(FromWasmRegion))
-            }
-        }
-    }
-
-    /// Whether this parameter is a region the host writes to — what
-    /// [`ResultType::BufferLength`] is the length *of*.
-    pub(crate) fn is_out_region(self) -> bool {
-        matches!(self, Self::OutBytes)
-    }
-}
-
-impl ResultType {
-    /// Recognizes the success type of a declaration's `HostResult<T>`, or
-    /// refuses it against its own span.
-    pub(crate) fn parse(success: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function must return `HostResult<usize>` for a value it \
-                               writes to an output region, `HostResult<i32>` or \
-                               `HostResult<FloatOrdering>` for one it answers directly, or \
-                               `HostResult<()>` for none at all";
-
-        if let Type::Tuple(tuple) = success
-            && tuple.elems.is_empty()
-        {
-            return Ok(Self::Nothing);
-        }
-
-        match last_path_segment(success) {
-            Some(name) if name == "usize" => Ok(Self::BufferLength),
-            Some(name) if name == "i32" || name == "FloatOrdering" => Ok(Self::Value),
-            _ => Err(syn::Error::new_spanned(success, ALLOWED)),
-        }
-    }
-
-    /// The generated table's `wasm_result` field: `Some(WasmValType::I32)`, or
-    /// `None` for the function that answers nothing.
-    ///
-    /// Spelled out here rather than left to `quote`'s `Option` impl, which emits
-    /// nothing at all for `None`.
-    pub(crate) fn wasm_result_tokens(self) -> TokenStream {
-        match self.as_wasm_result() {
-            Some(val_type) => quote! { Some(#val_type) },
-            None => quote! { None },
-        }
-    }
-
-    /// Whether the value reaches the guest as the length of what was written to
-    /// an output region.
-    pub(crate) fn is_buffer_length(self) -> bool {
-        matches!(self, Self::BufferLength)
-    }
-
-    /// The wasm result, which does not distinguish a length from a value.
-    fn as_wasm_result(self) -> Option<WasmValType> {
-        match self {
-            Self::BufferLength | Self::Value => Some(WasmValType::I32),
-            Self::Nothing => None,
-        }
-    }
-}
-
-/// `WasmValType::I32` — the ABI crate's variant, named but never defined here.
-impl ToTokens for WasmValType {
-    fn to_tokens(&self, tokens: &mut TokenStream) {
-        tokens.extend(match self {
-            Self::I32 => quote! { WasmValType::I32 },
-            Self::I64 => quote! { WasmValType::I64 },
-        });
-    }
-}
-
-/// The last segment of a plain path type, when it carries no generic arguments:
-/// `i32`, `core::primitive::i32` and `TraceDataType` all answer their own name,
-/// `Vec<u8>` and `[u8; 4]` nothing.
-fn last_path_segment(ty: &Type) -> Option<&Ident> {
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = ty
-    else {
-        return None;
-    };
-    let last = path.segments.last()?;
-    matches!(last.arguments, PathArguments::None).then_some(&last.ident)
-}
-
-/// Whether `ty` is the named primitive, however it is spelled.
-fn is_named(ty: &Type, name: &str) -> bool {
-    last_path_segment(ty).is_some_and(|segment| segment == name)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use syn::parse_quote;
-
-    use WasmValType::{I32, I64};
-
-    /// Every declared parameter type and everything it decides: what it costs on
-    /// the wire, what a body is handed for it, and which trait builds that.
-    ///
-    /// The names are asserted by length rather than spelling, since a type
-    /// answering fewer names than value types is the one way these answers can
-    /// contradict each other.
-    #[test]
-    fn lowers_every_declared_parameter_type() {
-        let mapping: [(Type, &[WasmValType], &str, Option<&str>); 7] = [
-            (parse_quote!(i32), &[I32], "i32", None),
-            (parse_quote!(i64), &[I64], "i64", None),
-            (
-                parse_quote!(TraceDataType),
-                &[I32],
-                "vm :: TraceCode",
-                Some("FromWasmScalar"),
-            ),
-            (
-                parse_quote!(&[u8]),
-                &[I32, I32],
-                "vm :: InBytes",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&str),
-                &[I32, I32],
-                "vm :: InStr",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(u32),
-                &[I32, I32],
-                "vm :: InU32",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&mut [u8]),
-                &[I32, I32],
-                "vm :: OutBytes",
-                Some("FromWasmRegion"),
-            ),
-        ];
-        let declared_name = format_ident!("seq");
-        let vm = quote!(vm);
-
-        for (declared, wasm, argument, argument_trait) in mapping {
-            let param = ParamType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a parameter type", quoted(&declared)));
-
-            assert_eq!(param.as_wasm_params(), wasm, "`{}`", quoted(&declared));
-            assert_eq!(
-                param.argument_type(&vm).to_string(),
-                argument,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param
-                    .argument_trait()
-                    .map(|name| name.to_string())
-                    .as_deref(),
-                argument_trait,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param.wasm_names(&declared_name).len(),
-                wasm.len(),
-                "one name per wasm parameter: `{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A region's two wasm parameters are named off the declaration, so the
-    /// generated closure reads as the declaration does.
-    #[test]
-    fn names_a_region_s_pair_after_the_declared_parameter() {
-        let seq = format_ident!("seq");
-
-        let names = |declared: Type| {
-            ParamType::parse(&declared)
-                .expect("a parameter type")
-                .wasm_names(&seq)
-                .iter()
-                .map(Ident::to_string)
-                .collect::<Vec<_>>()
-        };
-
-        assert_eq!(names(parse_quote!(u32)), ["seq_ptr", "seq_len"]);
-        assert_eq!(names(parse_quote!(i32)), ["seq"]);
-    }
-
-    /// The two `(ptr, len)` pairs lower alike but are told apart, since only the
-    /// direction says who may write to the region.
-    #[test]
-    fn keeps_the_regions_apart() {
-        let input: Type = parse_quote!(&[u8]);
-        let output: Type = parse_quote!(&mut [u8]);
-
-        assert!(!ParamType::parse(&input).unwrap().is_out_region());
-        assert!(ParamType::parse(&output).unwrap().is_out_region());
-    }
-
-    /// A type outside the mapping is refused rather than lowered to a guess.
-    #[test]
-    fn refuses_parameter_types_outside_the_mapping() {
-        let outside: [Type; 11] = [
-            parse_quote!(u64),
-            parse_quote!(u8),
-            parse_quote!(usize),
-            parse_quote!(bool),
-            parse_quote!(Vec<u8>),
-            parse_quote!([u8; 4]),
-            parse_quote!(&mut str),
-            parse_quote!(&i32),
-            parse_quote!(&[i32]),
-            parse_quote!(&Foo),
-            parse_quote!(()),
-        ];
-
-        for declared in outside {
-            let Err(error) = ParamType::parse(&declared) else {
-                panic!("`{}` should not be a parameter type", quoted(&declared));
-            };
-            assert!(
-                error.to_string().contains("must be `i32`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The declared success types, and the wasm result each becomes. `usize` and `i32`
-    /// agree on the wire and are separate rows; `FloatOrdering` shares `i32`'s.
-    #[test]
-    fn lowers_every_success_type() {
-        let mapping: [(Type, ResultType, Option<WasmValType>); 4] = [
-            (parse_quote!(usize), ResultType::BufferLength, Some(I32)),
-            (parse_quote!(i32), ResultType::Value, Some(I32)),
-            (parse_quote!(FloatOrdering), ResultType::Value, Some(I32)),
-            (parse_quote!(()), ResultType::Nothing, None),
-        ];
-
-        for (declared, expected, wasm_result) in mapping {
-            let result = ResultType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a success type", quoted(&declared)));
-
-            assert_eq!(result, expected, "`{}`", quoted(&declared));
-            assert_eq!(
-                result.as_wasm_result(),
-                wasm_result,
-                "`{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The distinction the wasm result loses: which of the two `i32` results was
-    /// declared decides how the value reaches the guest.
-    #[test]
-    fn tells_a_length_from_a_value() {
-        assert!(ResultType::BufferLength.is_buffer_length());
-        assert!(!ResultType::Value.is_buffer_length());
-        assert!(!ResultType::Nothing.is_buffer_length());
-    }
-
-    #[test]
-    fn refuses_success_types_outside_the_mapping() {
-        let outside: [Type; 6] = [
-            parse_quote!(u32),
-            parse_quote!(i64),
-            parse_quote!(bool),
-            parse_quote!([u8; 32]),
-            parse_quote!(Vec<u8>),
-            parse_quote!((usize, i32)),
-        ];
-
-        for declared in outside {
-            let Err(error) = ResultType::parse(&declared) else {
-                panic!("`{}` should not be a success type", quoted(&declared));
-            };
-            assert!(
-                error
-                    .to_string()
-                    .contains("must return `HostResult<usize>`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A qualified spelling is the same type, matching how the return type finds
-    /// `HostResult`.
-    #[test]
-    fn accepts_qualified_spellings() {
-        let qualified: Type = parse_quote!(core::primitive::i32);
-        assert_eq!(ParamType::parse(&qualified).unwrap(), ParamType::I32);
-
-        let qualified: Type = parse_quote!(xrpl_host_functions::TraceDataType);
-        assert_eq!(
-            ParamType::parse(&qualified).unwrap(),
-            ParamType::TraceDataType
-        );
-    }
-
-    /// The emitted tokens name the ABI crate's variants, which is the whole of
-    /// what crosses out of this crate. Pinned here so a break in the mirror is a
-    /// failure with a span rather than a rustc error at the call site.
-    #[test]
-    fn emits_references_to_the_hand_written_variants() {
-        assert_eq!(I32.to_token_stream().to_string(), "WasmValType :: I32");
-        assert_eq!(I64.to_token_stream().to_string(), "WasmValType :: I64");
-
-        assert_eq!(
-            ResultType::BufferLength.wasm_result_tokens().to_string(),
-            "Some (WasmValType :: I32)"
-        );
-        assert_eq!(ResultType::Nothing.wasm_result_tokens().to_string(), "None");
-    }
-
-    fn quoted(ty: &Type) -> String {
-        ty.to_token_stream().to_string()
-    }
-}

crates/xrpl-host-functions/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
-
-# `wasmi_glue!` and the two argument traits it marshals through are a host's
-# business, and this crate is what a contract links against — so the feature is
-# what keeps `cargo doc` here showing a contract developer only the ABI. It costs
-# nothing either way: a `macro_rules!` is inert and a trait with no impls emits
-# nothing.
-#
-# `xrpl-wasm-vm` enables it and features unify across the graph, so the off
-# configuration is only ever checked by `cargo check -p xrpl-host-functions`,
-# which is in the loop in `tmp/notes/wasm-vm/testing.md` for that reason.
-[features]
-default = []
-wasmi_glue = []
-
-[lints]
-workspace = true

crates/xrpl-host-functions/src/lib.rs

@@ -1,586 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`FloatOrdering`], [`HostResult`], [`HASH_LEN`] —
-//! and everything derived from the declarations is generated. The expansion names
-//! nothing this file does not, so the two sides meet only in the block below.
-//!
-//! Three items cross that split the other way, named by the expansion but by no
-//! declaration: [`WasmValType`], which the derived wasm signatures are spelled in,
-//! and `FromWasmRegion`/`FromWasmScalar`, which `wasmi_glue!` builds a marshalled
-//! argument through.
-
-#![no_std]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::{coded_enum, host_functions};
-
-/// Error codes a host function may return. Every code is negative, which is what lets
-/// a failure and an answer share one `i32` on the wire.
-#[coded_enum]
-pub enum HostError {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-/// How [`HostFunctions::trace`] is to read its data buffer. Wire values shared with the
-/// guest stdlib: append only, never renumber, and starting at 1 so a zeroed argument
-/// names no type. `xrpl-wasm-vm-ffi` holds the second declaration, the one C++ compiles
-/// against — this crate links into the guest too, so it cannot depend on `cxx`.
-#[coded_enum]
-pub enum TraceDataType {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-/// The verdict [`HostFunctions::float_compare`] answers, read as the placing of `x`
-/// against `y`. **Not C's `memcmp` convention**: the wire's negative range belongs to
-/// [`HostError`], so every code here is non-negative — append only, never renumber.
-/// `WasmCommon.h` holds the second declaration, as [`TraceDataType`] has one.
-#[coded_enum]
-pub enum FloatOrdering {
-    Equal = 0,
-    Greater = 1,
-    Less = 2,
-}
-
-/// The wasm module name a guest imports these functions under:
-/// `(import "host_lib" "ldgr_index" …)`.
-pub const HOST_MODULE: &str = "host_lib";
-
-/// A wasm value type, as many of them as this ABI uses — the vocabulary the
-/// generated wasm signatures are spelled in, which an engine maps to its own value
-/// types once.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WasmValType {
-    I32,
-    I64,
-}
-
-/// Builds the argument an engine marshals a `(ptr, len)` region into: a declared
-/// `&[u8]`, `&str`, `u32` or `&mut [u8]`. Nothing is checked here — the pair
-/// arrives as the guest sent it, and refusing a malformed region is the engine's
-/// business.
-///
-/// **Kept apart from [`FromWasmScalar`]** rather than folded into one trait with
-/// an associated wasm type, for the diagnostic: the mistake worth catching is an
-/// arity one — a declared `u32` is a region, not a code — and as two traits that
-/// lands as an unsatisfied bound at the offending argument type rather than an
-/// `i32`-against-`(i32, i32)` mismatch at the macro call.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmRegion {
-    fn from_wasm(ptr: i32, len: i32) -> Self;
-}
-
-/// Builds the argument an engine marshals a single `i32` code into: the declared
-/// `TraceDataType`. [`FromWasmRegion`] says why the two are separate traits.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmScalar {
-    fn from_wasm(code: i32) -> Self;
-}
-
-// Two rules hold over every declaration below, and neither is visible at any one of
-// them. They are what lets the wasm signature be read off the declaration.
-//
-// **Declaration order is wasm parameter order.** So `mode` comes after `out` in the
-// float functions, and `data_type` between `trace`'s two regions: the wire's order,
-// not the one a Rust signature would choose.
-//
-// **`i32` and `i64` are the wasm scalars, spelled as themselves; every other type is
-// marshalled.** `&[u8]`/`&str` and `&mut [u8]` are `(ptr, len)` pairs, `TraceDataType`
-// is an `i32` code the engine names before a host sees it, and **`u32` is four
-// little-endian bytes in a region**, not a scalar, which is how the guest SDK passes a
-// sequence number. A result is `usize` for the length of what was written to an output
-// region, `i32` or `FloatOrdering` for the answer itself, or `()` for none.
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
-    /// the answer is `1` if enabled and `0` if not.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Answers the slot used.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
-    /// multiple of 4).
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
-    /// is valid, `0` if not, or a negative error.
-    #[gas = 300]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
-    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
-    /// issuer).
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
-    /// the account it authorizes.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
-    /// its ticket sequence number.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Sponsorship`, computed from the 20-byte sponsor account
-    /// and the 20-byte sponsee account.
-    #[gas = 350]
-    #[wasm_name = "sponsorship_id"]
-    fn sponsorship_keylet(
-        &self,
-        sponsor: &[u8],
-        sponsee: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `LoanBroker`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_broker_id"]
-    fn loan_broker_keylet(&self, owner: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Loan`, computed from the 32-byte id of its `LoanBroker`
-    /// and the loan's sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_id"]
-    fn loan_keylet(
-        &self,
-        loan_broker_id: &[u8],
-        loan_seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
-    /// host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
-    /// bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
-    /// little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
-    /// little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
-    /// (four little-endian bytes), each written to its own output region.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        out: &mut [u8],
-        mode: i32,
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, answering the [`FloatOrdering`] that places `x`
-    /// against `y`. Reaches the guest as that variant's code, **not `memcmp`'s sign**.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<FloatOrdering>;
-
-    /// The float sum `x + y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, out: &mut [u8], mode: i32) -> HostResult<usize>;
-}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -1,41 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are `WasmValType` and the ones the declarations
-//! themselves spell.
-//!
-//! That this crate compiles is also what shows the emitted `wasmi_glue!` costs
-//! nothing to carry: its body names an engine throughout, there is no engine
-//! here, and nobody here expands it.
-
-use xrpl_host_functions::{HostResult, WasmValType};
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-    assert_eq!(HostFunctionSpec::Ping.wasm_params(), &[WasmValType::I32]);
-    assert_eq!(HostFunctionSpec::Ping.wasm_result(), Some(WasmValType::I32));
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -1,95 +0,0 @@
-//! Exercises what `#[coded_enum]` generates for [`HostError`]: the wire codes, the
-//! set [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), Some(error), "{error:?}");
-    }
-}
-
-/// A code from outside the set names no error and is not rounded to a neighbouring one;
-/// what it means instead is the crossing's to decide, in `xrpl-wasm-vm-ffi`'s `host_error`.
-///
-/// `-21` is the code xrpld would append next; `i32::MIN + 1` is next to the sentinel and
-/// unassigned, which is what makes the sentinel a value rather than a range.
-#[test]
-fn a_code_outside_the_set_names_no_error() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(HostError::from_code(code), None, "{code}");
-    }
-}

crates/xrpl-wasm-testkit/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-wat = "1"
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-
-[lints]
-workspace = true

crates/xrpl-wasm-testkit/src/lib.rs

@@ -1,109 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
-//! into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-
-        /// The gas a host function is charged before it runs, by its guest import name.
-        ///
-        /// For the C++ gas benchmarks, which measure what a host call actually costs and
-        /// report it against what the table says it costs. Reading the declaration through
-        /// here rather than copying the numbers into C++ is the point: 61 transcribed
-        /// constants would drift from `lib.rs` the first time a price changed, and drift
-        /// silently, because a benchmark has nothing to fail.
-        ///
-        /// Throws `rust::Error` on an unknown name — a typo should fail loudly rather than
-        /// quietly compare against zero.
-        fn host_function_gas(wasm_name: &str) -> Result<u64>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-fn host_function_gas(wasm_name: &str) -> Result<u64, UnknownHostFunction> {
-    xrpl_host_functions::HostFunctionSpec::ALL
-        .iter()
-        .find(|op| op.wasm_name() == wasm_name)
-        .map(|op| op.gas())
-        .ok_or_else(|| UnknownHostFunction(wasm_name.to_owned()))
-}
-
-#[derive(Debug)]
-struct UnknownHostFunction(String);
-
-impl std::fmt::Display for UnknownHostFunction {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "no host function is imported as `{}`", self.0)
-    }
-}
-
-impl std::error::Error for UnknownHostFunction {}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_host_function_reports_the_gas_its_declaration_gives_it() {
-        // `trace` is the cheapest declaration in the table; the point is not the number but
-        // that the lookup reaches the same constant the engine charges from.
-        assert_eq!(
-            host_function_gas("trace").expect("trace is a host function"),
-            xrpl_host_functions::HostFunctionSpec::Trace.gas()
-        );
-    }
-
-    #[test]
-    fn every_host_function_is_reachable_by_its_import_name() {
-        for op in xrpl_host_functions::HostFunctionSpec::ALL {
-            assert_eq!(
-                host_function_gas(op.wasm_name()).expect("declared"),
-                op.gas(),
-                "{} must be reachable by name",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_an_error_rather_than_zero_gas() {
-        host_function_gas("not_a_host_function").expect_err("must not resolve");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }
-
-[lints]
-workspace = true

crates/xrpl-wasm-vm/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "2.0.0", default-features = false, features = ["std", "validate", "portable-dispatch"] }
-xrpl-host-functions = { path = "../xrpl-host-functions", features = ["wasmi_glue"] }
-
-[dev-dependencies]
-wat = "1"
-
-[lints]
-workspace = true

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,838 +0,0 @@
-use crate::args::OutBytes;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use core::ops::Range;
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// The guest's memory, for a call that reads its inputs and writes nothing back.
-/// An argument read out of the slice is borrowed rather than copied.
-///
-/// A call that also writes takes both borrows at once, so [`write_buffered`] and
-/// [`write_mant_exp`] hand over the same slice themselves.
-pub(crate) fn guest_memory<'a>(caller: &'a Caller<'_, VmState<'_>>) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(mem.data(caller))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region, the
-/// cap, nor the budget, and all three checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can read any number of input
-/// arguments out of it — which a `&mut` view of that memory would forbid. That is
-/// why the answer goes through a buffer instead of straight into the guest as
-/// [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
-    let region = data
-        .get(range.clone())
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if region.len() < width {
-        return Err(HostError::BufferTooSmall);
-    }
-    Ok(())
-}
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: OutBytes,
-    exponent_out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    let mant_range = mantissa_out.range()?;
-    check_fits(data, &mant_range, MANTISSA_BYTES)?;
-    let exp_range = exponent_out.range()?;
-    check_fits(data, &exp_range, EXPONENT_BYTES)?;
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::{FloatOrdering, TraceDataType};
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sponsorship_keylet(
-            &self,
-            _sponsor: &[u8],
-            _sponsee: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_broker_keylet(
-            &self,
-            _owner: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_keylet(
-            &self,
-            _loan_broker_id: &[u8],
-            _loan_seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data_type: TraceDataType, _data: &[u8]) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<FloatOrdering> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/args.rs

@@ -1,244 +0,0 @@
-//! A host call's arguments as they arrive: one type per declared parameter the
-//! ABI marshals, built by `register.rs`'s generated closures and read by its
-//! bodies. A wasm scalar (`i32`, `i64`) is passed through as itself and has no
-//! type here.
-//!
-//! What the types buy is that **a body cannot mistake one argument for another**:
-//! an input region offered where an output one belongs is a compile error naming
-//! both, where two loose `i32`s would let a rounding mode be read as a buffer
-//! length. A derived signature cannot catch that, every one of these being
-//! `i32, i32` on the wire.
-//!
-//! The arguments arrive unchecked and are judged where they are read — `InU32`'s
-//! region must hold exactly four bytes, `InStr`'s must be UTF-8, a [`TraceCode`]
-//! must name a rendering — so they are refused in the order the body reads them.
-//!
-//! **The `from_wasm` impls below are half of `wasmi_glue!`'s contract** and the
-//! only construction these types have; `register.rs`'s `glue_env` is where the
-//! macro is told which type marshals which declared one. Which of the two traits
-//! a type takes is the ABI's decision, so `InU32` is a region rather than the
-//! scalar its declared `u32` reads like.
-
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{FromWasmRegion, FromWasmScalar, HostError, HostResult, TraceDataType};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// The shared half of the four region types below, which differ in what reading
-/// one means. The fields being out of reach makes [`range`](Region::range) the
-/// only way to indices, so the check can be deferred but not skipped — and
-/// construction is infallible so that a malformed region is refused in the order
-/// the call's own helper chooses.
-#[derive(Copy, Clone)]
-struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check, and the
-    /// checked addition guards a 32-bit `usize`, where two `i32`s can sum past the
-    /// end.
-    fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. The slice aliases `data`.
-    fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}
-
-/// A declared `&[u8]`: an input region the host borrows.
-#[derive(Copy, Clone)]
-pub(crate) struct InBytes(Region);
-
-impl FromWasmRegion for InBytes {
-    fn from_wasm(ptr: i32, len: i32) -> InBytes {
-        InBytes(Region::new(ptr, len))
-    }
-}
-
-impl InBytes {
-    /// The region's bytes, aliasing the guest's memory rather than copied out of it.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        self.0.read(data)
-    }
-}
-
-/// A declared `&str`: an input region whose bytes are text.
-#[derive(Copy, Clone)]
-pub(crate) struct InStr(Region);
-
-impl FromWasmRegion for InStr {
-    fn from_wasm(ptr: i32, len: i32) -> InStr {
-        InStr(Region::new(ptr, len))
-    }
-}
-
-impl InStr {
-    /// The region's bytes as text. The read is also the UTF-8 check, so a host is
-    /// never the one to validate them.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&str> {
-        core::str::from_utf8(self.0.read(data)?).map_err(|_| HostError::InvalidParams)
-    }
-}
-
-/// A declared `u32`: an input region holding the number as four little-endian
-/// bytes, which is how the guest SDK passes a sequence number.
-#[derive(Copy, Clone)]
-pub(crate) struct InU32(Region);
-
-impl FromWasmRegion for InU32 {
-    fn from_wasm(ptr: i32, len: i32) -> InU32 {
-        InU32(Region::new(ptr, len))
-    }
-}
-
-impl InU32 {
-    /// The number the region holds. The width is the ABI's, so any length but four
-    /// is `InvalidParams`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<u32> {
-        let bytes: [u8; 4] = self
-            .0
-            .read(data)?
-            .try_into()
-            .map_err(|_| HostError::InvalidParams)?;
-        Ok(u32::from_le_bytes(bytes))
-    }
-}
-
-/// A declared `&mut [u8]`: the region the host's answer is written to.
-///
-/// It has no `read`: what a call may put here is decided by the `abi.rs` helper
-/// serving it, against the value's length and the run's budget, and the host is
-/// never handed the guest's capacity.
-#[derive(Copy, Clone)]
-pub(crate) struct OutBytes(Region);
-
-impl FromWasmRegion for OutBytes {
-    fn from_wasm(ptr: i32, len: i32) -> OutBytes {
-        OutBytes(Region::new(ptr, len))
-    }
-}
-
-impl OutBytes {
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        self.0.range()
-    }
-}
-
-/// A declared `TraceDataType`: the `i32` code naming how `trace` is to render its
-/// data. The one marshalled argument that is not a region, so reading it needs no
-/// guest memory.
-#[derive(Copy, Clone)]
-pub(crate) struct TraceCode(i32);
-
-impl FromWasmScalar for TraceCode {
-    fn from_wasm(code: i32) -> TraceCode {
-        TraceCode(code)
-    }
-}
-
-impl TraceCode {
-    /// The type the code names, or `InvalidParams`: a rendering the guest did not
-    /// ask for is not one to guess at.
-    pub(crate) fn read(self) -> HostResult<TraceDataType> {
-        TraceDataType::from_code(self.0).ok_or(HostError::InvalidParams)
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The guest memory these tests read out of: sixteen bytes at index 0.
-    const MEMORY: [u8; 16] = [
-        0x78, 0x56, 0x34, 0x12, b'h', b'i', 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-    ];
-
-    #[test]
-    fn a_u32_argument_is_four_little_endian_bytes() {
-        assert_eq!(InU32::from_wasm(0, 4).read(&MEMORY), Ok(0x1234_5678));
-    }
-
-    /// A longer region is refused too, rather than its first four bytes read as
-    /// the answer.
-    #[test]
-    fn a_u32_argument_of_any_other_width_is_refused() {
-        for len in [0, 1, 3, 5, 8] {
-            assert_eq!(
-                InU32::from_wasm(0, len).read(&MEMORY),
-                Err(HostError::InvalidParams),
-                "{len} bytes"
-            );
-        }
-    }
-
-    /// The read is the UTF-8 check, so a host implementing `trace` has nothing
-    /// left to validate.
-    #[test]
-    fn a_str_argument_is_checked_where_it_is_read() {
-        assert_eq!(InStr::from_wasm(4, 2).read(&MEMORY), Ok("hi"));
-        assert_eq!(
-            InStr::from_wasm(6, 1).read(&MEMORY),
-            Err(HostError::InvalidParams),
-            "0xff is not UTF-8"
-        );
-    }
-
-    /// A region past the end of guest memory is refused rather than clamped, and
-    /// one past the field cap is refused before the memory is consulted at all.
-    #[test]
-    fn a_region_is_held_to_the_memory_and_to_the_field_cap() {
-        assert_eq!(
-            InBytes::from_wasm(8, 16).read(&MEMORY),
-            Err(HostError::PointerOutOfBounds)
-        );
-
-        let past_the_cap = i32::try_from(MAX_FIELD_BYTES).expect("the cap is a small constant") + 1;
-        assert_eq!(
-            InBytes::from_wasm(0, past_the_cap).read(&MEMORY),
-            Err(HostError::DataFieldTooLarge)
-        );
-
-        assert_eq!(
-            InBytes::from_wasm(-1, 4).read(&MEMORY),
-            Err(HostError::InvalidParams)
-        );
-    }
-
-    /// Every code the ABI has, and nothing else: an unknown one is refused rather
-    /// than rendered some other way.
-    #[test]
-    fn a_trace_code_names_a_rendering_or_none() {
-        for &data_type in TraceDataType::ALL {
-            assert_eq!(TraceCode::from_wasm(data_type.code()).read(), Ok(data_type));
-        }
-
-        for code in [0, -1, i32::MAX] {
-            assert_eq!(
-                TraceCode::from_wasm(code).read(),
-                Err(HostError::InvalidParams),
-                "{code}"
-            );
-        }
-    }
-}

crates/xrpl-wasm-vm/src/lib.rs

@@ -1,29 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod abi;
-mod args;
-mod preflight;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check, check_all};
-pub use vm::{
-    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError, RunFailure,
-    RunOutcome, TRANSFER_LIMIT_BYTES, run,
-};

crates/xrpl-wasm-vm/src/preflight/mod.rs

@@ -1,505 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the three stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two entry points over one pass: [`check`] stops at the first refusal, which is
-//! all a consensus path can act on, and [`check_all`] reports every one. Both draw
-//! from [`check_error_iter`], so they cannot disagree about which refusal is first.
-//!
-//! One thing it deliberately does not screen: a module exporting **no** linear
-//! memory passes, since a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section needs
-//! no rule of its own — the engine forbids one, so such a module fails to compile.
-//!
-//! Two things it screens that a run can only discover: an exported memory, or an
-//! exported table, larger than the engine grants. Both read the same export list, so
-//! [`check_exported_resources_iter`] is one pass — see it for what stays invisible,
-//! and why the table case leaves much more of it there.
-//!
-//! Every rule is here but one: [`signature`] holds the comparison of an import's
-//! type against the ABI's, which needs machinery the rest of the stage does not.
-
-mod signature;
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::{HOST_MODULE, HostFunctionSpec};
-
-use crate::vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, compile, wasm_engine};
-use signature::check_signature;
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// An import of a host function typed as something other than what the engine
-    /// registers it as. Apart from [`CheckError::Import`] because the ABI does
-    /// have the function the guest asked for.
-    Signature(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-    /// The module asks for a larger table than the engine grants.
-    Table(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            CheckError::Signature(detail) => write!(f, "signature: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-            CheckError::Table(detail) => write!(f, "table: {detail}"),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
-/// have.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let module = compile(&wasm_engine(), wasm).map_err(CheckError::Compile)?;
-    check_error_iter(&module, function_name)
-        .next()
-        .map_or(Ok(()), Err)
-}
-
-/// [`check`], reporting every error found rather than stopping at the first.
-pub fn check_all(wasm: &[u8], function_name: &str) -> Result<(), Vec<CheckError>> {
-    let module =
-        compile(&wasm_engine(), wasm).map_err(|detail| vec![CheckError::Compile(detail)])?;
-    let refusals: Vec<CheckError> = check_error_iter(&module, function_name).collect();
-    if refusals.is_empty() {
-        return Ok(());
-    }
-    Err(refusals)
-}
-
-fn check_error_iter<'a>(
-    module: &'a Module,
-    function_name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    check_imports_iter(module)
-        .chain(check_entry_point_iter(module, function_name))
-        .chain(check_exported_resources_iter(module))
-}
-
-fn check_imports_iter(module: &Module) -> impl Iterator<Item = CheckError> + '_ {
-    module
-        .imports()
-        .filter_map(|import| check_import(import.module(), import.name(), import.ty()).err())
-}
-
-/// Whether the engine defines this one import, as the guest declares it.
-///
-/// Names and signatures both come from the declarations
-/// [`crate::register::register_host_functions`] registers from, so a check and a
-/// run cannot disagree about which imports exist or what they look like.
-///
-/// The rules are ordered, each presuming the ones before it held: a guest
-/// importing `env::malloc` is told about the namespace, which explains every other
-/// import it has too, and only an import that names a real host function as a
-/// function has a signature worth comparing.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), CheckError> {
-    let function = host_function(module, name).map_err(CheckError::Import)?;
-    let imported = imported_function(name, ty).map_err(CheckError::Import)?;
-    check_signature(function, imported).map_err(CheckError::Signature)
-}
-
-/// Which host function this import names: its namespace must be the engine's, and
-/// its name one the ABI declares.
-fn host_function(module: &str, name: &str) -> Result<HostFunctionSpec, String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    HostFunctionSpec::ALL
-        .iter()
-        .find(|function| function.wasm_name() == name)
-        .copied()
-        .ok_or_else(|| format!("no host function '{name}'"))
-}
-
-/// The function type the guest declared. The engine defines these names as
-/// functions and as nothing else, so an import of any other kind does not link.
-fn imported_function<'ty>(name: &str, ty: &'ty ExternType) -> Result<&'ty FuncType, String> {
-    match ty {
-        ExternType::Func(ty) => Ok(ty),
-        _ => Err(format!("'{HOST_MODULE}::{name}' is not a function")),
-    }
-}
-
-fn check_entry_point_iter<'a>(
-    module: &'a Module,
-    name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    std::iter::once_with(move || match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => None,
-        found => Some(CheckError::EntryPoint(entry_point_fault(found, name))),
-    })
-    .flatten()
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may declare no more linear memory, and no larger a table, than the
-/// engine grants. One pass over the exports, since both rules read the same list and
-/// the export table is the only place either is visible.
-///
-/// **A memory or table the module keeps to itself is therefore not screened**: it is
-/// absent from the exports, and the store's limiter is what refuses it, at
-/// instantiation. That gap is wide for tables — Rust exports
-/// `__indirect_function_table` only under `--export-table`, so unexported is the
-/// normal shape — and narrow for memories, since a contract needs an exported one to
-/// make any host call at all.
-///
-/// A module faulting on both yields both, in export order. Neither fault explains
-/// the other, so there is no precedence to preserve — only the need for every node to
-/// reach the same verdict, which export order already gives.
-fn check_exported_resources_iter(module: &Module) -> impl Iterator<Item = CheckError> + '_ {
-    module.exports().filter_map(|export| match export.ty() {
-        ExternType::Memory(ty) => check_initial_pages(ty.minimum())
-            .err()
-            .map(CheckError::Memory),
-        ExternType::Table(ty) => check_initial_elements(ty.minimum())
-            .err()
-            .map(CheckError::Table),
-        _ => None,
-    })
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a table of this declared initial size.
-///
-/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
-/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
-/// than it was declared and a declared maximum past the cap is simply unreachable.
-fn check_initial_elements(elements: u64) -> Result<(), String> {
-    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
-    if elements > cap {
-        return Err(format!(
-            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`] and
-/// [`check_all`]; what is here is what a module cannot state precisely — which rule
-/// fires and in what words the caller logs it. The signature rule's derivation is
-/// tested beside it, in [`signature`].
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::signature::registered_type;
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// The type an import of `function` must declare.
-    fn registered(function: HostFunctionSpec) -> ExternType {
-        ExternType::Func(registered_type(function))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served, at the signature derived from its
-    /// declaration. Derived from `ALL` rather than listed, so a host function added
-    /// to the ABI is covered the day it lands.
-    ///
-    /// Both sides come from the table, so this pins that no declaration is refused,
-    /// not that the table is right. `tests/preflight.rs`'s
-    /// `every_declared_host_function_may_be_imported` and
-    /// `the_derived_signatures_are_what_the_linker_registers` are what compare it
-    /// against hand-written imports and against the real linker.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for &function in HostFunctionSpec::ALL {
-            let name = function.wasm_name();
-            if let Err(refusal) = check_import(HOST_MODULE, name, &registered(function)) {
-                panic!("'{name}' is declared but not served: {refusal}");
-            }
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = host_function(namespace, a_host_function_name()).expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal = host_function(HOST_MODULE, "no_such_function").expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = imported_function(name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = host_function("env", "no_such_function")
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// The signature is the last rule, so an import wrong about the namespace, the
-    /// name or the kind is not told about a signature instead, and the two kinds of
-    /// fault reach the caller as different stages.
-    #[test]
-    fn the_signature_is_the_last_rule() {
-        let name = a_host_function_name();
-        let mistyped = ExternType::Func(FuncType::new([ValType::F32], []));
-        let not_a_function = ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const));
-
-        for (rule, refusal) in [
-            ("the namespace", check_import("env", name, &mistyped)),
-            (
-                "the name",
-                check_import(HOST_MODULE, "no_such_function", &mistyped),
-            ),
-            ("the kind", check_import(HOST_MODULE, name, &not_a_function)),
-        ] {
-            assert!(
-                matches!(refusal, Err(CheckError::Import(_))),
-                "{rule} explains this import, not its signature: {refusal:?}"
-            );
-        }
-
-        assert!(
-            matches!(
-                check_import(HOST_MODULE, name, &mistyped),
-                Err(CheckError::Signature(_))
-            ),
-            "an import that breaks nothing but the signature is a signature fault"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Func(FuncType::new(
-                    [ValType::I32],
-                    [ValType::I32]
-                ))),
-                "finish"
-            ),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The cap itself is granted; one element past it is not. The boundary is the
-    /// whole rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
-        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
-        assert_eq!(check_initial_elements(0), Ok(()));
-        assert_eq!(check_initial_elements(cap), Ok(()));
-
-        let past = cap + 1;
-        let refusal = check_initial_elements(past).expect_err("one element past the cap");
-        assert_eq!(
-            refusal,
-            format!(
-                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-            )
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
-            "table: initial table of 1025 elements"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The stage is the prefix, so the detail must not say "signature" again.
-        assert_eq!(
-            CheckError::Signature(
-                "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'".to_string()
-            )
-            .to_string(),
-            "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-
-    /// Compiling is the one stage that ends the walk for [`check_all`] too: there is
-    /// no module to read the other rules off.
-    #[test]
-    fn a_failed_compile_is_reported_alone() {
-        let refusals = check_all(b"not wasm", "finish").expect_err("not a module");
-        assert!(
-            matches!(refusals.as_slice(), [CheckError::Compile(_)]),
-            "{refusals:?}"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/preflight/signature.rs

@@ -1,154 +0,0 @@
-//! The last rule on an import: an import that names a host function must also
-//! declare the type the engine registers it as.
-//!
-//! A file of its own because it is the one import rule with machinery to carry:
-//! the ABI's derived signature, its map into wasmi's value types, and a rendering
-//! of a function type for the refusal.
-//!
-//! **Arity and value types are the whole of it** — an `i64` in an `i32`'s place, or
-//! a `u32` parameter read as one wasm parameter rather than two. **Parameter order
-//! is invisible**: nearly everything lowers to `i32`, so two swapped parameters of
-//! the same type leave the function type identical.
-
-use wasmi::{FuncType, ValType};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-
-/// Whether this import declares the type the engine registers — one that does not
-/// is what a module parts from the linker over at instantiation.
-pub(super) fn check_signature(
-    function: HostFunctionSpec,
-    imported: &FuncType,
-) -> Result<(), String> {
-    let registered = registered_type(function);
-    if *imported == registered {
-        return Ok(());
-    }
-    Err(format!(
-        "'{}' expected '{}', found '{}'",
-        function.wasm_name(),
-        signature(&registered),
-        signature(imported)
-    ))
-}
-
-/// The type the engine registers `function` as: the wasm signature derived from its
-/// declaration, in wasmi's own vocabulary.
-///
-/// Building one to compare against costs nothing — `FuncType` holds up to 21 value
-/// types inline on a 64-bit target and the ABI's widest signature is nine, so this
-/// is a stack value and the comparison above is one `==`.
-pub(super) fn registered_type(function: HostFunctionSpec) -> FuncType {
-    FuncType::new(
-        function.wasm_params().iter().copied().map(val_type),
-        function.wasm_result().map(val_type),
-    )
-}
-
-/// The one place the ABI's value types become the engine's.
-fn val_type(declared: WasmValType) -> ValType {
-    match declared {
-        WasmValType::I32 => ValType::I32,
-        WasmValType::I64 => ValType::I64,
-    }
-}
-
-/// A function type as `(i32, i32) -> i32`, and as `(i32, i32)` for a function
-/// answering nothing — the spelling [`super::entry_point_fault`] uses, so the two
-/// stages describe a signature the same way.
-fn signature(ty: &FuncType) -> String {
-    let params = to_string(ty.params());
-    match ty.results() {
-        [] => format!("({params})"),
-        results => format!("({params}) -> {}", to_string(results)),
-    }
-}
-
-/// The types of one position, as a signature lists them.
-fn to_string(types: &[ValType]) -> String {
-    types
-        .iter()
-        .copied()
-        .map(as_str)
-        .collect::<Vec<_>>()
-        .join(", ")
-}
-
-/// A wasm value type as the text format spells it. Total over [`ValType`] because a
-/// refusal renders the found side too, which is whatever the module declared.
-fn as_str(val_type: ValType) -> &'static str {
-    match val_type {
-        ValType::I32 => "i32",
-        ValType::I64 => "i64",
-        ValType::F32 => "f32",
-        ValType::F64 => "f64",
-        ValType::V128 => "v128",
-        ValType::FuncRef => "funcref",
-        ValType::ExternRef => "externref",
-    }
-}
-
-/// The rule and the derivation under it, on function types built directly. Which
-/// `CheckError` a refusal becomes and where this rule sits among the other three
-/// are the parent's tests.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The three ways an import's type can differ from the one registered, each
-    /// against a real declaration: a wrong value type, a wrong arity, and a result
-    /// where the ABI answers nothing.
-    ///
-    /// The arity case is the one that matters in practice — a guest that reads
-    /// `check_keylet`'s `seq: u32` as a scalar writes exactly that signature.
-    #[test]
-    fn an_import_of_the_wrong_type_is_refused() {
-        let refusal = check_signature(
-            HostFunctionSpec::GetLedgerSqn,
-            &FuncType::new([ValType::I64, ValType::I64], [ValType::I32]),
-        )
-        .expect_err("i64 where i32 belongs");
-        assert_eq!(
-            refusal,
-            "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::CheckKeylet,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a u32 read as one parameter rather than two");
-        assert_eq!(
-            refusal,
-            "'check_id' expected '(i32, i32, i32, i32, i32, i32) -> i32', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::Trace,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a result from the one function that answers nothing");
-        assert_eq!(
-            refusal,
-            "'trace' expected '(i32, i32, i32, i32, i32)', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-    }
-
-    /// Both of the ABI's value types survive the map to the engine's vocabulary:
-    /// an `i64` collapsed to an `i32` would make the check accept what the linker
-    /// refuses, and a result invented for `trace` would make it refuse what the
-    /// linker accepts.
-    #[test]
-    fn the_derived_type_keeps_i64_and_the_absent_result() {
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::FloatFromInt)),
-            "(i64, i32, i32, i32) -> i32"
-        );
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::Trace)),
-            "(i32, i32, i32, i32, i32)"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/register.rs

@@ -1,714 +0,0 @@
-//! What this engine does with each host call, once the ABI's own machinery has
-//! taken the call apart.
-//!
-//! `wasmi_glue!` expands to the [`HostFunctionBodies`] trait and
-//! [`register_host_functions`], both generated from the declarations in
-//! `xrpl-host-functions` — so the wasm signature every closure is registered at is
-//! the one [`crate::check`] screens an import by. Hand-written here is one body per
-//! declaration, and the compiler will not accept the `impl` without all of them.
-//! [`glue_env`] is this engine's side of that macro's contract.
-//!
-//! **A body charges no gas and touches no wire encoding.** The generated closure
-//! does both, around the call, so a body says only what the call *is*.
-//!
-//! Four shapes cover 59 of the 60, each decided by the declaration's own types:
-//!
-//! - a value the host answers directly — read the arguments, call the host;
-//! - [`write_into`], for a value written straight to the guest's output region:
-//!   the call reads no guest memory, so the host can be handed a `&mut` view of it;
-//! - [`write_buffered`], for one that also reads: the host fills the run's scratch
-//!   buffer, and it is copied out once every rule has passed, which is what lets
-//!   the inputs stay borrowed rather than copied;
-//! - [`write_mant_exp`], for the one call that writes two regions.
-//!
-//! `trace` is the sixtieth: its declared `HostResult<()>` gives it a
-//! `CallResult<()>` body and the `charged_unreported` helper.
-
-use crate::abi::{CallResult, guest_memory, write_buffered, write_into, write_mant_exp};
-use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-use crate::vm::VmState;
-use wasmi::Caller;
-
-/// Everything `wasmi_glue!` names on this side, gathered where the macro can be
-/// handed it — so a rename in `abi.rs` or `args.rs` is an unresolved import here
-/// rather than a name resolved against whatever the call site has in scope.
-///
-/// The shapes are elsewhere and cannot be stated here: `args.rs` implements
-/// `FromWasmRegion`/`FromWasmScalar`, and the expansion pins each charging
-/// helper's signature itself.
-mod glue_env {
-    pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-    pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-    pub(crate) use crate::vm::VmState;
-}
-
-xrpl_host_functions::wasmi_glue!(glue_env);
-
-/// The bodies this engine registers, named as one type so
-/// [`register_host_functions`] can be given them. Never built: every body is an
-/// associated function and the host it calls comes from the store.
-pub(crate) struct Bodies {}
-
-impl HostFunctionBodies for Bodies {
-    fn get_ledger_sqn(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_ledger_sqn(out))
-    }
-
-    fn get_parent_ledger_time(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_time(out))
-    }
-
-    fn get_parent_ledger_hash(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_hash(out))
-    }
-
-    fn get_base_fee(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_base_fee(out))
-    }
-
-    fn is_amendment_enabled(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amendment: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.is_amendment_enabled(amendment.read(memory)?)?)
-    }
-
-    fn cache_ledger_obj(
-        caller: &mut Caller<'_, VmState<'_>>,
-        obj_id: InBytes,
-        cache_idx: i32,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.cache_ledger_obj(obj_id.read(memory)?, cache_idx)?)
-    }
-
-    fn get_tx_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_tx_field(field, out))
-    }
-
-    fn get_current_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_current_ledger_obj_field(field, out)
-        })
-    }
-
-    fn get_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_ledger_obj_field(cache_idx, field, out)
-        })
-    }
-
-    fn get_tx_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_tx_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_current_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_current_ledger_obj_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_ledger_obj_nested_field(cache_idx, locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_tx_array_len(caller: &mut Caller<'_, VmState<'_>>, field: i32) -> CallResult<i32> {
-        Ok(caller.data().host.get_tx_array_len(field)?)
-    }
-
-    fn get_current_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller.data().host.get_current_ledger_obj_array_len(field)?)
-    }
-
-    fn get_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller
-            .data()
-            .host
-            .get_ledger_obj_array_len(cache_idx, field)?)
-    }
-
-    fn get_tx_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_tx_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_current_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_current_ledger_obj_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_ledger_obj_nested_array_len(cache_idx, locator.read(memory)?)?)
-    }
-
-    fn check_signature(
-        caller: &mut Caller<'_, VmState<'_>>,
-        message: InBytes,
-        signature: InBytes,
-        pubkey: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.check_signature(
-            message.read(memory)?,
-            signature.read(memory)?,
-            pubkey.read(memory)?,
-        )?)
-    }
-
-    fn account_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.account_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn amm_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        asset1: InBytes,
-        asset2: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.amm_keylet(asset1.read(memory)?, asset2.read(memory)?, buf)
-        })
-    }
-
-    fn check_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.check_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn credential_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        subject: InBytes,
-        issuer: InBytes,
-        credential_type: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.credential_keylet(
-                subject.read(memory)?,
-                issuer.read(memory)?,
-                credential_type.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn delegate_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.delegate_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn deposit_preauth_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.deposit_preauth_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn did_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.did_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn escrow_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.escrow_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn trust_line_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account1: InBytes,
-        account2: InBytes,
-        currency: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.trust_line_keylet(
-                account1.read(memory)?,
-                account2.read(memory)?,
-                currency.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn mptoken_issuance_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        issuer: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_issuance_keylet(issuer.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn mptoken_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mptid: InBytes,
-        holder: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_keylet(mptid.read(memory)?, holder.read(memory)?, buf)
-        })
-    }
-
-    fn nftoken_offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.nftoken_offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn oracle_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        doc_id: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.oracle_keylet(account.read(memory)?, doc_id.read(memory)?, buf)
-        })
-    }
-
-    fn paychannel_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        destination: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.paychannel_keylet(
-                account.read(memory)?,
-                destination.read(memory)?,
-                seq.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn permissioned_domain_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.permissioned_domain_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn signer_list_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.signer_list_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn ticket_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.ticket_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn vault_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.vault_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn sponsorship_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        sponsor: InBytes,
-        sponsee: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sponsorship_keylet(sponsor.read(memory)?, sponsee.read(memory)?, buf)
-        })
-    }
-
-    fn loan_broker_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        owner: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_broker_keylet(owner.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn loan_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        loan_broker_id: InBytes,
-        loan_seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_keylet(loan_broker_id.read(memory)?, loan_seq.read(memory)?, buf)
-        })
-    }
-
-    fn sha512_half(
-        caller: &mut Caller<'_, VmState<'_>>,
-        data: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sha512_half(data.read(memory)?, buf)
-        })
-    }
-
-    /// The one body with nothing to answer: the wasm function has no result to
-    /// carry a code, so a malformed argument leaves the guest none the wiser and
-    /// the host uncalled.
-    fn trace(
-        caller: &mut Caller<'_, VmState<'_>>,
-        msg: InStr,
-        data_type: TraceCode,
-        data: InBytes,
-    ) -> CallResult<()> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.trace(msg.read(memory)?, data_type.read()?, data.read(memory)?)?)
-    }
-
-    fn update_data(caller: &mut Caller<'_, VmState<'_>>, data: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.update_data(data.read(memory)?)?)
-    }
-
-    fn get_nft(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft(account.read(memory)?, nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_issuer(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_issuer(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_taxon(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_taxon(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_flags(caller: &mut Caller<'_, VmState<'_>>, nft_id: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_flags(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_transfer_fee(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_transfer_fee(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_sequence(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_sequence(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn float_from_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: i64,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.float_from_int(x, out, mode))
-    }
-
-    fn float_from_uint(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_uint(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stamount(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amount: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stamount(amount.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stnumber(
-        caller: &mut Caller<'_, VmState<'_>>,
-        number: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stnumber(number.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_to_int(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        mantissa_out: OutBytes,
-        exponent_out: OutBytes,
-    ) -> CallResult<i32> {
-        write_mant_exp(
-            caller,
-            mantissa_out,
-            exponent_out,
-            |host, memory, mantissa, exponent| {
-                host.float_to_mant_exp(x.read(memory)?, mantissa, exponent)
-            },
-        )
-    }
-
-    fn float_from_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mantissa: i64,
-        exponent: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.float_from_mant_exp(mantissa, exponent, out, mode)
-        })
-    }
-
-    fn float_compare(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        // `FloatOrdering`'s codes are non-negative, which is what lets the verdict share
-        // this `i32` with a negative `HostError`.
-        Ok(host.float_compare(x.read(memory)?, y.read(memory)?)?.code())
-    }
-
-    fn float_add(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_add(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_subtract(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_subtract(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_multiply(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_multiply(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_divide(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_divide(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_power(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        n: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_power(x.read(memory)?, n, buf, mode)
-        })
-    }
-}

crates/xrpl-wasm-vm/src/vm.rs

@@ -1,462 +0,0 @@
-use std::cell::Cell;
-use std::fmt;
-use wasmi::{
-    CompilationMode, Config, CustomFuelCosts, EnforcedLimits, Engine, Export, Linker, Memory,
-    Module, Store, StoreLimits, StoreLimitsBuilder, TrapCode,
-};
-use xrpl_host_functions::HostFunctions;
-
-use crate::abi::{FatalHostError, Fault};
-use crate::preflight::entry_point_fault;
-use crate::register::{Bodies, register_host_functions};
-
-/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
-const WASM_PAGE_BYTES: u32 = 64 * 1024;
-
-/// Linear-memory page cap.
-pub const MAX_MEMORY_PAGES: u32 = 128;
-
-/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
-pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
-
-/// Cap on a table's element count.
-///
-/// A table entry is 8 bytes and wasmi materializes every one of them inside
-/// `instantiate_and_start` — before the guest's first instruction, so no gas charge
-/// can reach the cost. Without this cap the ceiling is the validator's, `u32::MAX`
-/// entries, which a module asks for in five bytes of LEB128 and pays for in ~34 GiB.
-pub const MAX_TABLE_ELEMENTS: usize = 1024;
-
-/// Total bytes the host may write into guest memory in one [`run`], separate from
-/// gas.
-///
-/// One direction only. What the guest passes in is not charged: it reaches the host
-/// as a borrowed slice of guest memory, capped per value at [`MAX_FIELD_BYTES`] by
-/// `Region::read` and in number by gas, and a host that keeps a copy (`update_data`)
-/// bounds it on its own side.
-pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
-
-/// Size cap on any single value crossing the boundary, in either direction; over
-/// it is `DataFieldTooLarge`.
-///
-/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
-pub const MAX_FIELD_BYTES: usize = 1024;
-
-/// State threaded through every host call, stored in the wasmi [`Store`].
-pub(crate) struct VmState<'h> {
-    pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`store_limits`] via `Store::limiter`, which needs a `&mut` into it
-    /// from `&mut VmState` — hence a field rather than a local.
-    pub(crate) mem_limits: StoreLimits,
-    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
-    ///
-    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
-    /// invocation touches the store, so the lack of `Sync` costs nothing.
-    ///
-    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
-    /// until this ABI gains a `FieldLocator` host function.
-    pub(crate) transfer_budget: Cell<u64>,
-    /// The guest's linear memory, resolved once by [`run`] after instantiation so
-    /// no host call pays for an export lookup.
-    ///
-    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
-    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
-    /// re-derive the slice per call.
-    ///
-    /// The handle is scoped to one store, so this assumes **one module, one
-    /// instance, one store per `run`**. Module linking or nested execution would
-    /// have to resolve per instance: a cached handle would serve a call against the
-    /// wrong instance's memory, which is a wrong answer rather than an error.
-    pub(crate) memory: Option<Memory>,
-    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
-    /// to the guest. One buffer per run, so no call zero-fills one of its own.
-    ///
-    /// Inline rather than boxed: the store's data is built once and then only
-    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
-    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
-    /// stack buffer is zero-filled — per call, which is the cost this removes.
-    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
-}
-
-/// Outcome of running an escrow contract to completion.
-#[derive(Debug)]
-pub struct RunOutcome {
-    /// The value returned by the exported entry point (`finish`): `> 0` means
-    /// allow the escrow to finish.
-    pub result: i32,
-    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
-    /// the per-call host charges.
-    pub fuel_used: u64,
-}
-
-/// Why a run produced no result. Each variant is one outcome for the caller to
-/// map to a TER.
-#[derive(Debug)]
-pub enum RunError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// The module compiled but the engine would not accept it: an import the
-    /// linker does not define, or an initial memory past the page cap. Not guest
-    /// code failing — a start section that traps is [`RunError::Trap`].
-    Instantiate(String),
-    /// No export named `function_name` with signature `() -> i32`: absent, not a
-    /// function, or a function of another type — which the detail tells apart.
-    EntryPoint(String),
-    /// Gas exhausted — by the guest's own instructions or by a host call's
-    /// charge. [`RunFailure::fuel_used`] is the whole limit.
-    OutOfGas,
-    /// The host could not serve a call.
-    Internal,
-    /// A host call had no linear memory to work in: the module exports none, or
-    /// the call came from a start section, which runs before there is an instance
-    /// to resolve the memory from.
-    NoMemory,
-    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
-    /// access, or `memory.grow` past the page cap. Wherever the guest was
-    /// executing, including a start section during instantiation.
-    Trap(String),
-}
-
-impl fmt::Display for RunError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            RunError::Compile(detail) => write!(f, "compile: {detail}"),
-            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            RunError::EntryPoint(detail) => write!(f, "{detail}"),
-            RunError::OutOfGas => write!(f, "out of gas"),
-            RunError::Internal => write!(f, "internal error"),
-            RunError::NoMemory => write!(f, "no exported memory"),
-            RunError::Trap(detail) => write!(f, "trap: {detail}"),
-        }
-    }
-}
-
-/// A failed run, with the gas it still owes: a contract that traps or exhausts
-/// its gas is charged for what it burned.
-#[derive(Debug)]
-pub struct RunFailure {
-    pub error: RunError,
-    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
-    /// when the module never ran.
-    pub fuel_used: u64,
-}
-
-impl fmt::Display for RunFailure {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
-    }
-}
-
-impl RunFailure {
-    /// A failure with no fuel accounted: it stopped the run at or before the guest's
-    /// first instruction, or under a store with no meter to read.
-    fn owing_nothing(error: RunError) -> RunFailure {
-        RunFailure {
-            error,
-            fuel_used: 0,
-        }
-    }
-}
-
-/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
-/// trap and refusal all report it the same way.
-///
-/// `Store::get_fuel` fails only on a store without fuel metering, which
-/// [`wasm_engine`] rules out and `run`'s `set_fuel` would already have
-/// caught — so a failure here is a defect in this crate. It must not become a
-/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
-/// everything. [`RunError::Internal`] instead.
-fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
-    store
-        .get_fuel()
-        .map(|remaining| gas.saturating_sub(remaining))
-        .map_err(|_| RunError::Internal)
-}
-
-/// Report `error` with the run's cost attached. A cost that cannot be read replaces
-/// the outcome rather than being invented — see [`fuel_used`].
-fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
-    match fuel_used(store, gas) {
-        Ok(fuel_used) => RunFailure { error, fuel_used },
-        Err(unmetered) => RunFailure::owing_nothing(unmetered),
-    }
-}
-
-/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
-/// the stage that raised it.
-///
-/// Two ways a run halts mid-flight: a host call that could not be served, which
-/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
-/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
-///
-/// Both can happen anywhere the guest executes — including a start section, which
-/// is guest code running during instantiation — so every stage from there on asks
-/// this before naming a failure after itself.
-fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
-    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
-        return Some(fatal.0.into());
-    }
-    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
-}
-
-/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
-/// that can arise anywhere.
-///
-/// A start section is guest code, so it can trap on its own — `unreachable`, a
-/// division by zero, an out-of-bounds access — and a trap is the guest's fault
-/// wherever it happens. Naming that after the *stage* would file it beside the
-/// module faults a caller treats as its own defect, and charge nothing for
-/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
-/// module the linker or the store would not accept at all.
-fn instantiation_failure(error: &wasmi::Error) -> RunError {
-    match error.as_trap_code() {
-        Some(_) => RunError::Trap(error.to_string()),
-        None => RunError::Instantiate(error.to_string()),
-    }
-}
-
-/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
-///
-/// Total and one arm each, because a `Fault` is only ever a condition that stops the
-/// run — the guest-visible codes cannot reach here, which is what
-/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
-/// compile.
-impl From<Fault> for RunError {
-    fn from(fault: Fault) -> RunError {
-        match fault {
-            Fault::OutOfGas => RunError::OutOfGas,
-            Fault::Internal => RunError::Internal,
-            Fault::NoMemory => RunError::NoMemory,
-        }
-    }
-}
-
-/// A fresh wasmi engine for one caller's use: deterministic, minimal features,
-/// fuel metering on.
-///
-/// The configuration is consensus-fixed and identical for every invocation, so any
-/// two engines from here accept exactly the same modules. Each is nonetheless a
-/// distinct engine with its own compiled-code and type registries, and wasmi ties a
-/// [`Module`] to the engine that compiled it — a module cannot be instantiated in a
-/// [`Store`] built on another. A caller that compiles and runs must therefore hold
-/// one engine across both steps, which is why [`compile`] takes the engine rather
-/// than reaching for its own.
-pub(crate) fn wasm_engine() -> Engine {
-    let mut config = Config::default();
-    config.consume_fuel(true);
-    config.ignore_custom_sections(true);
-    config.wasm_mutable_global(false);
-    config.wasm_multi_value(false);
-    config.wasm_sign_extension(false);
-    config.wasm_saturating_float_to_int(false);
-    config.wasm_bulk_memory(false);
-    config.wasm_reference_types(false);
-    config.wasm_tail_call(false);
-    config.wasm_extended_const(false);
-    config.floats(false);
-    config.wasm_multi_memory(false);
-    config.wasm_custom_page_sizes(false);
-    // Disabled through the crate feature flag.
-    // config.wasm_memory64(false);
-    config.wasm_wide_arithmetic(false);
-    config.allow_start_fn(false);
-    config.enforced_limits(EnforcedLimits::strict());
-
-    let fuel_costs = CustomFuelCosts {
-        bytes_copied_per_fuel: 64,
-        fuel_per_bytes_translated: 7,
-        fuel_per_bytes_validated: 2,
-    };
-    config.fuel_cost(fuel_costs);
-    // config.operator_costs is already guarded by the probe_fuel test under budgets.rs
-    // in that a change to operator costs in a future version will be a loud failure.
-
-    config.compilation_mode(CompilationMode::LazyTranslation);
-    Engine::new(&config)
-}
-
-/// Every resource ceiling a run is given, in one place.
-///
-/// The two *size* caps are what a contract can reach today. The three *count* caps
-/// are set to 1 although [`wasm_engine`] already forces each: turning
-/// `wasm_reference_types` on would let a module declare up to
-/// `wasmparser::MAX_WASM_TABLES` tables, `wasm_multi_memory` likewise for memories,
-/// and both size caps are **per table and per memory, not aggregate** — so a feature
-/// flag flipped in isolation would multiply the ceiling by a hundred rather than
-/// leave it be. The counts are what keeps those two decisions independent.
-///
-/// wasmi enforces the counts by asking the limiter before it allocates
-/// (`can_create_more_instances`/`_memories`/`_tables`); they default to 10000, so
-/// leaving them unset is not the same as their being unreachable.
-fn store_limits() -> StoreLimits {
-    StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .table_elements(MAX_TABLE_ELEMENTS)
-        .instances(1)
-        .tables(1)
-        .memories(1)
-        .trap_on_grow_failure(true)
-        .build()
-}
-
-/// Compile `wasm` for `engine`.
-///
-/// The one path to a [`Module`]: the configuration is what decides whether a
-/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
-/// compile against different ones. The engine is the caller's because the module it
-/// returns may only be instantiated in a [`Store`] built on that same engine.
-pub(crate) fn compile(engine: &Engine, wasm: &[u8]) -> Result<Module, String> {
-    Module::new(engine, wasm).map_err(|e| e.to_string())
-}
-
-/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
-/// calls through `host`, and call the exported `function_name`.
-pub fn run<'h>(
-    wasm: &[u8],
-    gas: u64,
-    host: &'h dyn HostFunctions,
-    function_name: &str,
-) -> Result<RunOutcome, RunFailure> {
-    let engine = wasm_engine();
-    let module = compile(&engine, wasm)
-        .map_err(|detail| RunFailure::owing_nothing(RunError::Compile(detail)))?;
-
-    let mut store = Store::new(
-        &engine,
-        VmState {
-            host,
-            mem_limits: store_limits(),
-            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        },
-    );
-
-    store
-        .set_fuel(gas)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-    store.limiter(|state| &mut state.mem_limits);
-
-    let mut linker = Linker::<VmState<'h>>::new(&engine);
-    register_host_functions::<Bodies>(&mut linker)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-
-    let instance = match linker.instantiate_and_start(&mut store, &module) {
-        Ok(instance) => instance,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
-            return Err(failed(&store, gas, error));
-        }
-    };
-    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
-
-    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
-        Ok(function) => function,
-        Err(e) => {
-            let found = instance
-                .get_export(&store, function_name)
-                .map(|export| export.ty(&store));
-            let error =
-                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let result = match function.call(&mut store, ()) {
-        Ok(result) => result,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
-    Ok(RunOutcome { result, fuel_used })
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// Each call is its own engine, which is what makes the engine a caller's to
-    /// hold: a module compiled through one may not be instantiated in a store built
-    /// on another, so `run` must pass the engine it made to [`compile`] rather than
-    /// let it call here a second time.
-    #[test]
-    fn each_call_is_a_new_engine() {
-        assert!(!Engine::same(&wasm_engine(), &wasm_engine()));
-    }
-
-    /// One instance, one table, one memory — asserted here rather than through a
-    /// module, because no module can reach these. `wasm_reference_types(false)` and
-    /// `wasm_multi_memory(false)` make a module declaring a second table or memory
-    /// fail *validation*, so a run never gets far enough to consult the limiter.
-    /// That is exactly why the counts are worth pinning: they are the ceiling that
-    /// survives one of those flags being turned on, and nothing else would fail if
-    /// they were silently dropped.
-    #[test]
-    fn the_store_grants_one_of_each_thing_a_module_can_own() {
-        use wasmi::ResourceLimiter;
-
-        let limits = store_limits();
-        assert_eq!(limits.instances(), 1);
-        assert_eq!(limits.tables(), 1);
-        assert_eq!(limits.memories(), 1);
-    }
-
-    /// The three size-proportional fuel rates, read back off the engine. wasmi
-    /// takes its own defaults for these unless told otherwise, so an upgrade that
-    /// changed one would retune our gas silently. `Config` keeps them
-    /// `pub(crate)` and exposes them only through `Debug`.
-    #[test]
-    fn the_dynamic_fuel_costs_are_pinned() {
-        let config = format!("{:?}", wasm_engine().config());
-        for rate in [
-            "bytes_copied_per_fuel: 64",
-            "fuel_per_bytes_translated: 7",
-            "fuel_per_bytes_validated: 2",
-        ] {
-            assert!(config.contains(rate), "expected `{rate}` in {config}");
-        }
-    }
-
-    /// [`EnforcedLimits::strict`] is the one line in [`wasm_engine`] that takes a
-    /// value rather than stating one — the fields are `pub(crate)`, so the preset is
-    /// the only way to set them.
-    #[test]
-    fn the_enforced_limits_are_pinned() {
-        const EXPECTED: &str = concat!(
-            "EnforcedLimits { ",
-            "max_globals: Some(1000), ",
-            "max_functions: Some(10000), ",
-            "max_tables: Some(100), ",
-            "max_element_segments: Some(1000), ",
-            "max_memories: Some(1), ",
-            "max_data_segments: Some(1000), ",
-            "max_params: Some(32), ",
-            "max_results: Some(32), ",
-            "min_avg_bytes_per_function: Some(AvgBytesPerFunctionLimit { ",
-            "req_funcs_bytes: 1000, min_avg_bytes_per_function: 40 }) }",
-        );
-
-        let config = format!("{:?}", wasm_engine().config());
-        assert!(
-            config.contains(EXPECTED),
-            "expected `{EXPECTED}` in {config}"
-        );
-    }
-
-    /// The only place these numbers appear as literals; every other test derives
-    /// them from the constants.
-    #[test]
-    fn the_limits_are_the_protocol_limits() {
-        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
-        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
-        assert_eq!(MAX_TABLE_ELEMENTS, 1024, "table-element cap");
-        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
-        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
-    }
-}

crates/xrpl-wasm-vm/tests/memory_policy.rs

@@ -1,621 +0,0 @@
-//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
-//! crossing the boundary. This is the policy the guest observes, so each rule is
-//! pinned to the code it answers with.
-
-mod support;
-
-use support::{
-    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
-    traced,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
-
-/// One page, so anything at or past 65536 is out of bounds.
-const PAGE: i64 = 64 * 1024;
-
-/// The per-field size cap, as a wasm operand.
-const CAP: i64 = MAX_FIELD_BYTES as i64;
-/// One byte over the cap: the smallest value the engine must refuse.
-const OVER_CAP: i64 = CAP + 1;
-
-// ---------------------------------------------------------------------------
-// Output regions (`write_into`)
-// ---------------------------------------------------------------------------
-
-/// The whole output region must be in bounds, not merely its start — the engine
-/// checks `[dst, dst + cap)` before the host is allowed to write.
-#[test]
-fn an_output_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// A region ending exactly at the last byte of memory is in bounds.
-#[test]
-fn an_output_region_ending_at_the_last_byte_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
-    );
-    assert_eq!(status(&wat, &host), 4);
-}
-
-/// The wire carries `i32`, so a guest can present a negative pointer or length.
-#[test]
-fn a_negative_output_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// The host reports a value's true length whether or not it fitted; a value that
-/// did not fit is the guest's error, not the host's.
-#[test]
-fn a_value_larger_than_the_buffer_is_refused() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(64));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
-}
-
-/// A zero-length output region is in bounds and simply cannot hold anything.
-#[test]
-fn a_zero_length_output_region_is_in_bounds_but_too_small() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 0))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-}
-
-/// A host that reports more than the per-field cap is refused even when the
-/// guest offered room for it: the cap is the engine's rule, not the buffer's.
-#[test]
-fn a_value_past_the_field_cap_is_refused() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::claiming(OVER_CAP as usize))
-        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
-}
-
-/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
-/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
-/// declared, so a value past the cap does not fit the region it is offered and no
-/// prefix of it can reach guest memory either.
-///
-/// The host answers with a real over-cap value: [`Answer::claiming`] writes
-/// nothing whatever the engine does, so it could not tell the two apart. The
-/// second module folds the *whole* declared buffer rather than one byte, so the
-/// claim is about the region and not about its first byte.
-#[test]
-fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
-    /// The buffer the guest declares: well over the cap, so the clamp bites.
-    const BUFFER: usize = 4096;
-
-    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
-    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
-    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
-
-    // The status the guest sees, from a module that returns it directly.
-    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
-    assert_eq!(
-        status(&refusing, &host),
-        code(HostError::DataFieldTooLarge),
-        "the value is refused"
-    );
-
-    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
-    // so any byte the host wrote shows up here.
-    let reading = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $seen i32)
-             (drop {call})
-             (loop $l
-               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $seen)"
-        ),
-    );
-    assert_eq!(
-        status(&reading, &host),
-        0,
-        "and not one of its bytes is in the guest's buffer"
-    );
-}
-
-/// The field cap is checked before the buffer-fit rule, so a value that breaks both
-/// is reported as over-cap. The guest branches on the code, and the two rules
-/// answer different questions, so the order is worth pinning.
-#[test]
-fn the_field_cap_precedes_the_buffer_fit_check() {
-    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
-
-    // A 63-byte buffer: the value is both over the cap and far too big to fit.
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-}
-
-// ---------------------------------------------------------------------------
-// Input regions (`Region::read`, via `sha512_half`)
-//
-// `sha512_half`'s first pair is an input region like any other, and it is the
-// input the guest gets a status back from: `trace`, the other reader, answers
-// nothing at all. So the codes are pinned here and the silence below.
-// ---------------------------------------------------------------------------
-
-/// An input region is bounds-checked the same way an output region is. Every case
-/// here stays within the field cap, which on an input is checked first.
-#[test]
-fn an_input_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "ptr {ptr} len {len}"
-        );
-        assert!(host.digested.borrow().is_empty(), "the host is not called");
-    }
-}
-
-#[test]
-fn a_negative_input_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "ptr {ptr} len {len}"
-        );
-    }
-}
-
-/// The field cap bounds what the guest may hand *in*, too.
-#[test]
-fn an_input_past_the_field_cap_is_refused() {
-    let host = FakeHost::new();
-    let digest = |len: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const 0) (i32.const {len})
-                                    (i32.const 2048) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    assert_eq!(
-        status(&digest(OVER_CAP), &host),
-        code(HostError::DataFieldTooLarge)
-    );
-    assert!(host.digested.borrow().is_empty());
-
-    assert_eq!(
-        status(&digest(CAP), &host),
-        HASH_LEN as i32,
-        "the cap itself is allowed"
-    );
-}
-
-/// The two directions check in opposite orders: an input's length is known before
-/// the read, so the cap comes first, while an output's region has to be resolved
-/// before the host can produce a value, so bounds come first there.
-#[test]
-fn the_field_cap_precedes_the_bounds_check_on_an_input() {
-    let host = FakeHost::new();
-
-    let reading = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {})
-                                (i32.const 0) (i32.const {HASH_LEN}))",
-            PAGE + 1
-        ),
-    );
-    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
-
-    let writing = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
-    );
-    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
-}
-
-// ---------------------------------------------------------------------------
-// The reader with no result (`read_borrowed`, via `trace`)
-// ---------------------------------------------------------------------------
-
-/// `trace` reads two regions and either one being bad refuses the call. The same
-/// rule as above, and the guest is told nothing: the refusal is the host not being
-/// called, and the run carries on to the constant that follows.
-#[test]
-fn both_of_traces_regions_are_checked_silently() {
-    let host = FakeHost::new();
-    let regions = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-            EMPTY_REGION.to_owned(),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const 0) (i32.const {OVER_CAP})"),
-        ),
-        (
-            "(i32.const -1) (i32.const 1)".to_owned(),
-            EMPTY_REGION.to_owned(),
-        ),
-    ];
-
-    for (msg, data) in regions {
-        let wat = module(
-            &[import::TRACE, ONE_PAGE],
-            &traced(TraceDataType::AsHex, &msg, &data),
-        );
-        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
-        assert!(
-            host.traces().is_empty(),
-            "msg {msg} data {data}: the host must not be called"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Both at once (`write_buffered`, via `sha512_half`)
-// ---------------------------------------------------------------------------
-
-/// A call with an input and an output region decides everything about the input
-/// before anything about the output, so a bad input is reported however the output
-/// region is wrong — out of bounds, or a pointer that is not one at all.
-///
-/// The whole output region, params included, is judged after the host has answered.
-/// Hoisting any part of that above the call would put the output's verdict first for
-/// these cases, and there is no half of it that can be hoisted on a principle the
-/// other half shares.
-#[test]
-fn a_read_write_checks_its_input_before_its_output() {
-    let host = FakeHost::new();
-    let digest = |src: i64, src_len: i64, dst: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
-                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    let over_cap = digest(0, OVER_CAP, 0);
-    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
-
-    let out_of_bounds = digest(PAGE, 4, 0);
-    assert_eq!(
-        status(&out_of_bounds, &host),
-        code(HostError::PointerOutOfBounds)
-    );
-
-    // A bad input against each way the output can be wrong: the input's verdict is
-    // the one reported, and the host is never asked for a value nobody can take.
-    for dst in [PAGE, -1] {
-        let both_bad = digest(0, OVER_CAP, dst);
-        assert_eq!(
-            status(&both_bad, &host),
-            code(HostError::DataFieldTooLarge),
-            "dst {dst}"
-        );
-    }
-    assert!(host.digested.borrow().is_empty(), "the host is not reached");
-}
-
-/// The output half of a read-write call obeys the same rules as a plain write.
-#[test]
-fn a_read_write_output_obeys_the_write_rules() {
-    let host = FakeHost::new().answering_digest(Answer::filler(32));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// A refused value reaches guest memory in no part, however much of it the host
-/// wrote. The host answers with 32 bytes it did write and a length it did not, so
-/// the refusal happens with the value sitting in the run's output buffer — and the
-/// guest's buffer has to come back untouched.
-///
-/// Stronger than the contract asks for: a guest must not read its buffer on a
-/// negative status. It holds because the buffer is copied to the guest only after
-/// the length, the bounds, the fit and the budget have all passed, so there is no
-/// window in which a refused value is in guest memory.
-#[test]
-fn a_refused_value_leaves_nothing_in_guest_memory() {
-    const MARKER: u8 = 77;
-
-    // The two refusals a value can meet after the host has produced it: longer
-    // than the field cap, and longer than the buffer the guest offered.
-    let refusals = [
-        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
-        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
-    ];
-
-    for (claimed, cap, expected) in refusals {
-        let host =
-            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
-        let call = format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
-        );
-
-        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
-        assert_eq!(
-            status(&refused, &host),
-            code(expected),
-            "claiming {claimed}"
-        );
-
-        // The same call, reporting what is at the output region afterwards.
-        let inspect = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
-        );
-        assert_eq!(
-            status(&inspect, &host),
-            0,
-            "claiming {claimed}: the refused value must not have been written"
-        );
-    }
-}
-
-/// An input region may overlap the output region: the host is served the input as
-/// it stands and its answer lands afterwards, so the two cannot interfere. The
-/// marker is any byte distinct from the input's first (`a`), so `finish` returning
-/// it proves the write landed.
-#[test]
-fn an_input_may_overlap_the_output() {
-    const MARKER: u8 = 99;
-
-    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
-
-    let wat = module(
-        &[
-            import::SHA512_HALF,
-            ONE_PAGE,
-            r#"(data (i32.const 0) "abcd")"#,
-        ],
-        &format!(
-            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
-                                      (i32.const 0) (i32.const {HASH_LEN})))
-             (i32.load8_u (i32.const 0))"
-        ),
-    );
-    assert_eq!(
-        status(&wat, &host),
-        i32::from(MARKER),
-        "the output overwrote the input"
-    );
-    assert_eq!(
-        *host.digested.borrow(),
-        vec![b"abcd".to_vec()],
-        "the host saw the input as it was"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The memory export itself
-// ---------------------------------------------------------------------------
-
-/// A host call with no memory to work in ends the run instead of answering the
-/// guest: there is no buffer for a status to describe, and nothing the guest could
-/// do about the answer — which is what puts this beside out-of-gas on the fatal
-/// channel. What the guest burned getting there is still charged.
-fn assert_no_memory(wat: &str, host: &FakeHost) {
-    let failure = failure(wat, host);
-    assert!(
-        matches!(failure.error, RunError::NoMemory),
-        "expected the run to end for want of a memory export, got: {failure}"
-    );
-    assert!(failure.fuel_used > 0, "{failure}");
-}
-
-/// Every region is relative to the guest's exported memory, so a module without
-/// one cannot make a host call at all.
-#[test]
-fn a_module_that_exports_no_memory_cannot_call_the_host() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, "(memory 1)"],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// Having no memory is answered before anything about a call's arguments, so a
-/// module without one ends the run even when its arguments would have earned a
-/// guest-visible code of their own (here an input over the field cap).
-///
-/// The order is deliberate: no memory is a fact about the instance, not about this
-/// call, and a region cannot be validated against a memory that is not there. It
-/// costs the guest nothing — every call such a module makes ends the run anyway.
-#[test]
-fn no_memory_is_answered_before_a_calls_arguments_are() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::SHA512_HALF, "(memory 1)"],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
-                                (i32.const 0) (i32.const {HASH_LEN}))"
-        ),
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// The memory's export *name* is not part of the contract: the engine takes the
-/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
-/// to `"memory"` — it is a toolchain convention, so the kind decides.
-#[test]
-fn a_memory_exported_under_any_name_is_the_guests_memory() {
-    let host = FakeHost::new();
-
-    for name in ["mem", "linear", "the memory"] {
-        let wat = module(
-            &[
-                import::LDGR_INDEX,
-                &format!(r#"(memory (export "{name}") 1)"#),
-            ],
-            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-             (i32.load (i32.const 64))",
-        );
-        assert_eq!(
-            status(&wat, &host),
-            7,
-            "the host wrote into the memory exported as '{name}'"
-        );
-    }
-}
-
-/// One memory exported under several names is one memory. The engine resolves the
-/// first export of kind memory, and with at most one memory per module every such
-/// export is that memory, so the order the exports are walked in cannot change the
-/// answer.
-#[test]
-fn one_memory_exported_under_several_names_is_still_that_memory() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
-        ],
-        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-         (i32.load (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 7);
-}
-
-/// The export has to *be* a memory: a global named `memory` is not one, and it
-/// neither serves as the guest's memory nor hides the memory the module really
-/// exports. The kind decides, so the conventional name carries no weight on
-/// either side.
-#[test]
-fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
-    let host = FakeHost::new();
-
-    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
-
-    let wrong_kind = module(
-        &[
-            import::LDGR_INDEX,
-            "(memory 1)",
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_no_memory(&wrong_kind, &host);
-
-    let shadowed = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "mem") 1)"#,
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_eq!(
-        status(&shadowed, &host),
-        4,
-        "the real memory is found past the global that took its name"
-    );
-}
-
-/// Bounds follow the memory the module actually declared, not a fixed page.
-#[test]
-fn bounds_follow_the_declared_memory_size() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
-        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
-    );
-    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
-}

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -1,803 +0,0 @@
-//! What screening refuses, and that it refuses nothing a run would have served.
-//!
-//! `check` reaches its verdict from the compiled module alone, so these tests take
-//! no host — except the ones that put the same module through `run` to compare the
-//! two.
-//!
-//! These screen with `check`, which reports the earliest refusal; the last section
-//! is what `check_all` adds.
-
-mod support;
-
-use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage screening refused a module at, because the caller maps the
-/// stages separately. The error comes back out for the tests that also read its
-/// message.
-macro_rules! assert_stage {
-    ($refusal:expr, $stage:pat) => {{
-        let refusal = $refusal;
-        assert!(
-            matches!(refusal, $stage),
-            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
-            refusal
-        );
-        refusal
-    }};
-}
-
-/// Screens `wat`, which must assemble.
-fn check(wat: &str) -> Result<(), CheckError> {
-    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
-}
-
-fn refusal(wat: &str) -> CheckError {
-    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
-}
-
-fn passes(wat: &str) {
-    if let Err(refusal) = check(wat) {
-        panic!("expected this module to pass, but: {refusal}\n{wat}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Compiling
-// ---------------------------------------------------------------------------
-
-/// A contract that imports a host function, exports its memory and exports the
-/// entry point is what screening is looking for.
-#[test]
-fn a_runnable_contract_passes() {
-    passes(&module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    ));
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_pass() {
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// Screening takes wasm binaries, and text is not one — the same rule the VM
-/// applies, from the same `wasmi` built without its `wat` feature. Turning that
-/// feature on would make this transaction blob valid at both ends.
-#[test]
-fn a_text_format_module_does_not_pass() {
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let refusal =
-        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
-    assert_stage!(refusal, CheckError::Compile(_));
-
-    // The same module, assembled first, passes: the text is sound and only the
-    // format was refused.
-    passes(&text);
-}
-
-/// A feature the engine disables is refused here too, because both stages compile
-/// against engines built from the same configuration. `vm_limits.rs` walks every
-/// disabled feature; this pins that screening sees that configuration.
-#[test]
-fn a_disabled_feature_does_not_pass() {
-    let refusal = refusal(&module(
-        &[ONE_PAGE],
-        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// Every host function the ABI declares, spelled as a guest imports it, full
-/// signatures and hand-written. The count is asserted against the ABI so a
-/// function added to it cannot be left out here.
-///
-/// Hand-written is the point: these are a statement of the wire the ABI's derived
-/// table did not produce, so putting them through `check` compares the two rather
-/// than comparing the table with itself.
-const ALL_IMPORTS: [&str; 63] = [
-    import::LDGR_INDEX,
-    import::PARENT_LDGR_TIME,
-    import::PARENT_LDGR_HASH,
-    import::BASE_FEE,
-    import::AMENDMENT_ENABLED,
-    import::CACHE_LE,
-    import::TX_FIELD,
-    import::HOME_LE_FIELD,
-    import::LE_FIELD,
-    import::TX_INNER,
-    import::HOME_LE_INNER,
-    import::LE_INNER,
-    import::TX_ARR_LEN,
-    import::HOME_LE_ARR_LEN,
-    import::LE_ARR_LEN,
-    import::TX_INNER_ARR_LEN,
-    import::HOME_LE_INNER_ARR_LEN,
-    import::LE_INNER_ARR_LEN,
-    import::CHECK_SIG,
-    import::ACCOUNTROOT_ID,
-    import::AMM_ID,
-    import::CHECK_ID,
-    import::CREDENTIAL_ID,
-    import::DELEGATE_ID,
-    import::DEPOSIT_PREAUTH_ID,
-    import::DID_ID,
-    import::ESCROW_ID,
-    import::TRUSTLINE_ID,
-    import::MPT_ISSUANCE_ID,
-    import::MPTOKEN_ID,
-    import::NFT_OFFER_ID,
-    import::OFFER_ID,
-    import::ORACLE_ID,
-    import::PAYCHAN_ID,
-    import::PERMISSIONED_DOMAIN_ID,
-    import::SIGNERS_ID,
-    import::TICKET_ID,
-    import::VAULT_ID,
-    import::SPONSORSHIP_ID,
-    import::LOAN_BROKER_ID,
-    import::LOAN_ID,
-    import::SHA512_HALF,
-    import::TRACE,
-    import::SET_DATA,
-    import::NFT_URI,
-    import::NFT_ISSUER,
-    import::NFT_TAXON,
-    import::NFT_FLAGS,
-    import::NFT_XFER_FEE,
-    import::NFT_SERIAL,
-    import::FLOAT_FROM_INT,
-    import::FLOAT_FROM_UINT,
-    import::FLOAT_FROM_STAMOUNT,
-    import::FLOAT_FROM_STNUMBER,
-    import::FLOAT_TO_INT,
-    import::FLOAT_TO_MANT_EXP,
-    import::FLOAT_FROM_MANT_EXP,
-    import::FLOAT_CMP,
-    import::FLOAT_ADD,
-    import::FLOAT_SUB,
-    import::FLOAT_MULT,
-    import::FLOAT_DIV,
-    import::FLOAT_POW,
-];
-
-#[test]
-fn every_declared_host_function_may_be_imported() {
-    assert_eq!(
-        ALL_IMPORTS.len(),
-        HostFunctionSpec::ALL.len(),
-        "the ABI gained a host function with no import declaration in this test"
-    );
-
-    let mut parts = ALL_IMPORTS.to_vec();
-    parts.push(ONE_PAGE);
-    passes(&module(&parts, "(i32.const 0)"));
-}
-
-/// A module may import fewer host functions than are registered, but not more.
-#[test]
-fn an_unknown_host_function_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("no host function 'no_such_function'"),
-        "{refusal}"
-    );
-}
-
-/// Host functions live under one module name — `host_lib` — and an import naming
-/// another is refused even when the function name is real. `env` is in the list
-/// because that is what plain clang emits.
-#[test]
-fn an_import_from_another_module_does_not_pass() {
-    for module_name in ["host", "env", ""] {
-        let refusal = refusal(&module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        ));
-        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-    }
-}
-
-/// A host function's name imported as something other than a function. The engine
-/// defines it as a function and nothing else, so this does not link either.
-#[test]
-fn a_host_function_imported_as_a_global_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
-            ONE_PAGE,
-        ],
-        "(global.get $g)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("'host_lib::ldgr_index' is not a function"),
-        "{refusal}"
-    );
-}
-
-/// A module faulty at two stages is refused by the earlier one — it imports what no
-/// engine serves *and* exports no entry point. The imports are what the rest of the
-/// module depends on, so that is the message worth having.
-#[test]
-fn the_earlier_stage_is_the_one_reported() {
-    let refusal = refusal(
-        r#"(module
-             (import "host_lib" "no_such_function" (func $f (result i32)))
-             (memory (export "memory") 1)
-             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
-    );
-
-    assert_stage!(refusal, CheckError::Import(_));
-}
-
-/// An import naming a real host function with the wrong type is refused, at a
-/// stage of its own since the ABI does have the function the guest asked for.
-///
-/// The run half is what the refusal is worth: without it this module reaches the
-/// engine and parts from the linker at instantiation, which is a fault a node
-/// discovers rather than one a transaction is turned away for.
-#[test]
-fn an_import_with_the_wrong_signature_does_not_pass() {
-    let wat = module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(i32.const 0)",
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Signature(_)).to_string();
-    assert_eq!(
-        refusal,
-        "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-    );
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a mistyped import must not link");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1)
-                              (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "no entry point 'finish'");
-}
-
-/// The entry point is looked up by the name the caller asks for, as a run looks it
-/// up: screening a contract for one entry point says nothing about another.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let wasm = assemble(
-        r#"(module (memory (export "memory") 1)
-             (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-
-    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
-    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
-}
-
-/// Both halves of the entry point's type are screened: a module returning the
-/// wrong thing, or taking anything at all, would fail the run's typed lookup.
-#[test]
-fn an_entry_point_of_the_wrong_type_does_not_pass() {
-    for (signature, body) in [
-        ("(result i64)", "(i64.const 0)"),
-        ("(param i32) (result i32)", "(i32.const 0)"),
-        ("", "(nop)"),
-    ] {
-        let refusal = refusal(&format!(
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") {signature} {body}))"#
-        ));
-        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-        assert_eq!(
-            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
-            "{signature}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "export 'finish' is not a function");
-}
-
-// ---------------------------------------------------------------------------
-// Agreement with a run
-// ---------------------------------------------------------------------------
-
-/// A module with no linear memory to export passes. A contract that makes no host
-/// call needs none, and one that does is refused at the call and charged — a
-/// runtime fault, not a malformed module.
-#[test]
-fn a_module_exporting_no_memory_passes() {
-    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
-    passes(wat);
-
-    let host = FakeHost::new();
-    assert_eq!(
-        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
-            .expect("a module that calls no host function needs no memory")
-            .result,
-        0
-    );
-}
-
-/// Modules spanning what screening decides, each also put through a run.
-fn modules() -> Vec<(&'static str, String)> {
-    vec![
-        (
-            "a runnable contract",
-            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
-        ),
-        (
-            "a contract that traps",
-            module(&[ONE_PAGE], "(unreachable)"),
-        ),
-        (
-            "a disabled feature",
-            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
-        ),
-        (
-            "an unknown host function",
-            module(
-                &[
-                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(call $f)",
-            ),
-        ),
-        (
-            "an import from another module",
-            module(
-                &[
-                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "a host function imported as a global",
-            module(
-                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
-                "(global.get $g)",
-            ),
-        ),
-        (
-            "an import with the wrong signature",
-            module(
-                &[
-                    r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "no entry point",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "other") (result i32) (i32.const 0)))"#
-                .to_string(),
-        ),
-        (
-            "an entry point of the wrong type",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") (result i64) (i64.const 0)))"#
-                .to_string(),
-        ),
-    ]
-}
-
-/// Screening refuses a module exactly when a run would refuse it at one of the
-/// three stages screening covers — nothing it rejects would have run, and nothing
-/// it passes stops before the entry point is called. The exceptions are the ones
-/// [`what_static_screening_cannot_see`] lists.
-#[test]
-fn screening_and_a_run_agree() {
-    let host = FakeHost::new();
-
-    for (label, wat) in modules() {
-        let wasm = assemble(&wat);
-        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => matches!(
-                failure.error,
-                RunError::Compile(_) | RunError::Instantiate(_) | RunError::EntryPoint(_)
-            ),
-            Ok(_) => false,
-        };
-
-        assert_eq!(
-            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
-            refused_early,
-            "{label}"
-        );
-    }
-}
-
-/// The signatures screening derives are the ones the linker registers: a module
-/// importing all 60 host functions at the type `HostFunctionSpec` derives must
-/// instantiate.
-///
-/// Unlike [`ALL_IMPORTS`], the other side of this is live code — the registration
-/// as it is rather than a description of it — so it is what a changed engine has to
-/// answer to. **What it cannot see is the table and the linker being wrong the same
-/// way**, the closures being generated from this very table; that is what
-/// [`ALL_IMPORTS`] and `generated_abi.rs`'s 60 literals are for.
-#[test]
-fn the_derived_signatures_are_what_the_linker_registers() {
-    let declarations: Vec<String> = HostFunctionSpec::ALL
-        .iter()
-        .copied()
-        .map(derived_import)
-        .collect();
-    let mut parts: Vec<&str> = declarations.iter().map(String::as_str).collect();
-    parts.push(ONE_PAGE);
-
-    let host = FakeHost::new();
-    let wasm = assemble(&module(&parts, "(i32.const 0)"));
-    let outcome = xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY)
-        .expect("every import built from the ABI's table must link");
-
-    assert_eq!(outcome.result, 0);
-}
-
-/// One `(import …)` declaration, spelled out of the ABI's derived signature rather
-/// than by hand — the opposite of [`ALL_IMPORTS`].
-fn derived_import(function: HostFunctionSpec) -> String {
-    let types: Vec<&str> = function
-        .wasm_params()
-        .iter()
-        .copied()
-        .map(spelled)
-        .collect();
-    let params = match types.as_slice() {
-        [] => String::new(),
-        types => format!(" (param {})", types.join(" ")),
-    };
-    let result = match function.wasm_result() {
-        Some(result) => format!(" (result {})", spelled(result)),
-        None => String::new(),
-    };
-
-    format!(
-        r#"(import "host_lib" "{}" (func{params}{result}))"#,
-        function.wasm_name()
-    )
-}
-
-fn spelled(declared: WasmValType) -> &'static str {
-    match declared {
-        WasmValType::I32 => "i32",
-        WasmValType::I64 => "i64",
-    }
-}
-
-/// A module asking for more memory than the engine grants is refused, so the
-/// contract that could never run does not reach the ledger. The cap itself passes.
-#[test]
-fn an_exported_memory_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
-    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    ));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, so screening
-/// must not turn it away: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(memory (export "memory") 1 {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// A module asking for more table than the engine grants is refused for the same
-/// reason a memory is. The cap itself passes.
-#[test]
-fn an_exported_table_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(table (export "t") {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Table(_)).to_string();
-    assert!(refusal.contains("past the 1024-element cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") {MAX_TABLE_ELEMENTS} funcref)"#
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// Both caps are applied in one pass over the exports, so neither may end the walk
-/// early: a passing memory must not hide a failing table declared after it, and a
-/// passing table must not hide a failing memory.
-#[test]
-fn one_pass_screens_both_resources() {
-    let after_a_passing_memory = refusal(&module(
-        &[
-            ONE_PAGE,
-            &format!(r#"(table (export "t") {} funcref)"#, MAX_TABLE_ELEMENTS + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_memory, CheckError::Table(_));
-
-    let after_a_passing_table = refusal(&module(
-        &[
-            r#"(table (export "t") 1 funcref)"#,
-            &format!(r#"(memory (export "memory") {})"#, MAX_MEMORY_PAGES + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_table, CheckError::Memory(_));
-}
-
-/// As with memory, a declared *maximum* past the cap is unreachable rather than
-/// wrong: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_table_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") 1 {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// The gap, listed rather than described. A memory or a table a module keeps to
-/// itself is not in its exports, so these are the modules that pass screening and
-/// then fail to *instantiate* — which is why a run's refusal at that stage cannot be
-/// read as the node's fault.
-///
-/// The two entries are not equally remote. A contract needs an exported memory to
-/// make any host call, so the memory row can do nothing but compute and the SDK does
-/// not produce one. A table, though, is *normally* unexported — Rust exports
-/// `__indirect_function_table` only under `--export-table` — so the table row is the
-/// shape a hostile module actually takes, and the store's limiter is the only thing
-/// standing in front of it.
-#[test]
-fn what_static_screening_cannot_see() {
-    let host = FakeHost::new();
-
-    for (label, declaration) in [
-        ("memory", format!("(memory {})", MAX_MEMORY_PAGES + 1)),
-        (
-            "table",
-            format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1),
-        ),
-    ] {
-        let wat = format!(
-            r#"(module {declaration}
-                 (func (export "finish") (result i32) (i32.const 0)))"#
-        );
-
-        passes(&wat);
-
-        let failure = match xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => failure,
-            Ok(outcome) => panic!(
-                "the store's limiter must refuse the {label}, but the module returned {}",
-                outcome.result
-            ),
-        };
-        assert!(
-            matches!(failure.error, RunError::Instantiate(_)),
-            "{label}: {failure}"
-        );
-    }
-}
-
-/// A start section runs guest code at instantiation, before the entry point. The
-/// engine disallows it, so screening refuses the module outright rather than letting
-/// any code run ahead of the entry point.
-#[test]
-fn a_start_section_is_refused_by_screening() {
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("start"), "{refusal}");
-}
-
-#[test]
-fn a_memory64_memory_is_refused_by_screening() {
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let refusal = assert_stage!(refusal(wat), CheckError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("memory64") || refusal.contains("i64"),
-        "{refusal}"
-    );
-}
-
-/// The corruption fixtures below are written as hex strings, which is how the old Beast suite
-/// carried them — the bytes are deliberately malformed, so there is nothing to assemble them
-/// from.
-fn hex(s: &str) -> Vec<u8> {
-    (0..s.len())
-        .step_by(2)
-        .map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap())
-        .collect()
-}
-
-/// Malformed modules crafted to abuse the parser rather than merely be invalid — a vector
-/// length that lies about its size, a section that overruns its payload, a locals-count bomb,
-/// and a non-terminating LEB128 — are refused at compile like any other garbage. These guard
-/// the parser against resource-exhaustion shapes (ported from the old Beast section-corruption
-/// fixtures); the plainer "bad magic / wrong version" shapes are covered by `garbage_does_not_pass`.
-#[test]
-fn parser_abuse_shapes_are_refused() {
-    let cases = [
-        ("vector length lies", "0061736d010000000105ffffffff0f"),
-        ("section overruns its payload", "0061736d01000000010a0160"),
-        (
-            "locals-count bomb",
-            "0061736d01000000010401600000030201000a0f010d01ffffffff0f7f0b",
-        ),
-        (
-            "non-terminating LEB128",
-            "0061736d0100000001058080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080",
-        ),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// The plain structurally-malformed modules from the old section-corruption fixtures — a
-/// corrupt magic, a wrong version, a lying section length, sections out of order, junk after
-/// the last section, an unknown section id — are all refused at compile. Belt-and-suspenders
-/// alongside `garbage_does_not_pass`: guards against a wasmi upgrade loosening the validator.
-#[test]
-fn structurally_malformed_modules_are_refused() {
-    let cases = [
-        ("corrupt magic number", "0161736d01000000"),
-        ("wrong version", "0061736d02000000"),
-        ("lying section length", "0061736d01000000018080808008"),
-        ("sections out of order", "0061736d010000000a02000b03020000"),
-        (
-            "junk after last section",
-            "0061736d01000000010a01600000000000000000",
-        ),
-        ("unknown section id", "0061736d01000000ff0100"),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Reporting every refusal
-// ---------------------------------------------------------------------------
-
-/// A module that breaks every rule past compiling, once each.
-fn a_module_faulting_at_every_stage() -> String {
-    format!(
-        r#"(module
-             (import "host_lib" "no_such_function" (func (param i32) (result i32)))
-             (import "host_lib" "ldgr_index" (func (param i64 i64) (result i32)))
-             (memory (export "memory") {pages})
-             (table (export "t") {elements} funcref)
-             (func (export "{ENTRY}") (result i64) (i64.const 0)))"#,
-        pages = MAX_MEMORY_PAGES + 1,
-        elements = MAX_TABLE_ELEMENTS + 1,
-    )
-}
-
-#[test]
-fn check_all_reports_a_refusal_from_every_stage() {
-    let refusals = xrpl_wasm_vm::check_all(&assemble(&a_module_faulting_at_every_stage()), ENTRY)
-        .expect_err("this module breaks every rule past compiling");
-
-    assert!(
-        matches!(
-            refusals.as_slice(),
-            [
-                CheckError::Import(_),
-                CheckError::Signature(_),
-                CheckError::EntryPoint(_),
-                CheckError::Memory(_),
-                CheckError::Table(_),
-            ]
-        ),
-        "{refusals:?}"
-    );
-}
-
-/// What lets the consensus path keep fail-fast without a second implementation of
-/// the stage order to drift from.
-#[test]
-fn check_reports_what_check_all_reports_first() {
-    let wasm = assemble(&a_module_faulting_at_every_stage());
-
-    let first = xrpl_wasm_vm::check(&wasm, ENTRY).expect_err("five faults");
-    let all = xrpl_wasm_vm::check_all(&wasm, ENTRY).expect_err("five faults");
-
-    assert_eq!(first.to_string(), all[0].to_string());
-}
-
-/// Nothing to report is `Ok`, never an empty `Vec`.
-#[test]
-fn check_all_passes_a_runnable_contract() {
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-
-    if let Err(refusals) = xrpl_wasm_vm::check_all(&assemble(&wat), ENTRY) {
-        panic!("expected this module to pass, but: {refusals:?}\n{wat}");
-    }
-}

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -1,737 +0,0 @@
-//! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the memory and table caps.
-//!
-//! These are the sandbox's outer wall. Everything here fails the run rather than
-//! returning a code to the guest, so each test reads the failure's message.
-
-mod support;
-
-use support::{
-    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
-};
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage a run failed at, because the caller maps the stages to
-/// different outcomes. A stage is one `RunError` variant, so the expectation is a
-/// pattern; the failure comes back out for the tests that also read its message.
-macro_rules! assert_stage {
-    ($failure:expr, $stage:pat) => {{
-        let failure = $failure;
-        assert!(
-            matches!(failure.error, $stage),
-            concat!("expected a ", stringify!($stage), " failure, got: {}"),
-            failure
-        );
-        failure
-    }};
-}
-
-// ---------------------------------------------------------------------------
-// Linear memory
-// ---------------------------------------------------------------------------
-
-/// A module declaring more than the cap fails to instantiate — the limit applies
-/// to the initial memory, not only to growth.
-#[test]
-fn an_initial_memory_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_memory_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
-/// `memory.grow` otherwise would, because the engine's limiter sets
-/// `trap_on_grow_failure(true)`.
-#[test]
-fn growth_stops_at_the_cap() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
-    );
-    assert_eq!(
-        run(&wat, &host).expect("should run").result,
-        1,
-        "growing to exactly the cap answers the previous size"
-    );
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// A module may declare a maximum above the cap: the cap is enforced on the initial
-/// memory and on growth, not on the memory type's declared bound.
-#[test]
-fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
-
-    let wat = module(&[&memory], "(i32.const 0)");
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    let wat = module(
-        &[&memory],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-// ---------------------------------------------------------------------------
-// Tables
-// ---------------------------------------------------------------------------
-
-/// A table's whole cost is paid at instantiation: wasmi writes all 8 bytes of every
-/// element before the guest's first instruction, so a module declaring more than the
-/// cap must be refused there rather than charged for it.
-#[test]
-fn an_initial_table_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_table_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {MAX_TABLE_ELEMENTS} funcref)")],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// The cap binds a table the module keeps to itself, which is the case that matters:
-/// a contract has no reason to export its table, so screening never sees the one a
-/// hostile module declares.
-#[test]
-fn the_table_cap_binds_an_unexported_table() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", u32::from(u16::MAX) * 100)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, mirroring what
-/// linear memory allows. Nothing can reach it: `table.grow` is a reference-types
-/// instruction and the engine turns that feature off, so a table's declared minimum
-/// is also its final size.
-#[test]
-fn a_declared_table_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            "(table 1 {} funcref)",
-            u64::try_from(MAX_TABLE_ELEMENTS).expect("fits") + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Engine configuration
-// ---------------------------------------------------------------------------
-
-/// One row per feature `wasm_engine` turns off: the smallest module that uses
-/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
-/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
-/// instead — except `wasm_multi_memory`, where two memories are the point and one
-/// of them has to be imported to reach the feature check at all.
-fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
-    vec![
-        (
-            "wasm_multi_value",
-            vec![
-                ONE_PAGE,
-                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
-            ],
-            "(call $two) (drop) (drop) (i32.const 0)",
-            "multi-value",
-        ),
-        (
-            "wasm_sign_extension",
-            vec![ONE_PAGE],
-            "(i32.extend8_s (i32.const 1))",
-            "sign extension",
-        ),
-        (
-            "wasm_bulk_memory",
-            vec![ONE_PAGE],
-            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
-            "bulk memory",
-        ),
-        (
-            "wasm_reference_types",
-            vec![ONE_PAGE, "(table 1 externref)"],
-            "(i32.const 0)",
-            "reference types",
-        ),
-        // The proposal covers mutable globals crossing the module boundary; an
-        // internal one is core wasm and stays allowed — see the test below.
-        (
-            "wasm_mutable_global",
-            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
-            "(i32.const 0)",
-            "mutable global",
-        ),
-        (
-            "wasm_tail_call",
-            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
-            "(return_call $f)",
-            "tail call",
-        ),
-        // Arithmetic in a constant initialiser. wasmi names the operator rather
-        // than the proposal here.
-        (
-            "wasm_extended_const",
-            vec![
-                ONE_PAGE,
-                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
-            ],
-            "(global.get $g)",
-            "non-constant operator",
-        ),
-        // One memory imported, one defined. `EnforcedLimits::strict()` caps memories
-        // at one and checks the memory *section* before the validator sees it
-        // (`module/parser/mod.rs`, `process_memories`), so two *defined* memories are
-        // refused for exceeding the cap and never reach the feature check. An import
-        // is not in that section, so this is the shape that names the proposal.
-        (
-            "wasm_multi_memory",
-            vec![r#"(import "host_lib" "mem" (memory 1))"#, ONE_PAGE],
-            "(i32.const 0)",
-            "multiple memories",
-        ),
-        (
-            "wasm_memory64",
-            vec![r#"(memory (export "memory") i64 1)"#],
-            "(i32.const 0)",
-            "memory64",
-        ),
-        (
-            "wasm_custom_page_sizes",
-            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
-            "(i32.const 0)",
-            "custom page sizes",
-        ),
-        (
-            "wasm_wide_arithmetic",
-            vec![ONE_PAGE],
-            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
-             (i32.const 0)",
-            "wide arithmetic",
-        ),
-        // Determinism across nodes is the reason floats are off.
-        (
-            "floats",
-            vec![ONE_PAGE],
-            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-            "floating-point",
-        ),
-    ]
-}
-
-/// Every feature the engine disables is refused, and refused for that reason.
-///
-/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
-/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against this engine's own config.
-#[test]
-fn every_disabled_feature_is_refused_by_name() {
-    let host = FakeHost::new();
-
-    for (knob, parts, body, expected) in disabled_features() {
-        let wat = module(&parts, body);
-        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-
-        assert!(
-            failure.contains(expected),
-            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
-        );
-    }
-}
-
-/// The knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// configuration is the same for every engine `wasm_engine` builds, so a test
-/// observes the one `wasm_engine` makes: a knob masked by another, or with no
-/// caller-visible effect, has no distinguishing module.
-#[test]
-fn the_knobs_without_a_module_of_their_own() {
-    let host = FakeHost::new();
-
-    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
-    // float operand, so `floats(false)` refuses it first, as the message shows.
-    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
-    let refusal = failure(&wat, &host).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-    assert!(!refusal.contains("saturating"), "{refusal}");
-
-    // `EnforcedLimits::strict()`'s `max_memories: Some(1)`, which masks
-    // `wasm_multi_memory(false)` for every module that defines its two memories
-    // rather than importing one — the case a real contract would hit. The feature
-    // flag itself is covered by name in [`disabled_features`].
-    let wat = module(&[ONE_PAGE, "(memory 1)"], "(i32.const 0)");
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 1 memories"), "{refusal}");
-
-    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
-    // sections, not accept/reject, so this pins only that one is harmless.
-    let wat = module(
-        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
-    // before instantiating, so every test in the suite fails.
-    let wat = module(&[ONE_PAGE], "(i32.const 0)");
-    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
-}
-
-/// A mutable global the module keeps to itself is core wasm, so the disabled
-/// proposal does not reach it: a guest can still have mutable state.
-#[test]
-fn an_internal_mutable_global_is_still_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
-        "(global.set $g (i32.const 7)) (global.get $g)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 7);
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_compile() {
-    let host = FakeHost::new();
-
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
-            .expect_err("garbage must not compile");
-        assert_stage!(failure, RunError::Compile(_));
-    }
-}
-
-/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
-/// default and would have `Module::new` assemble text too, so the crate builds
-/// wasmi without it; turning it back on would make this transaction blob valid.
-#[test]
-fn the_vm_refuses_a_text_format_module() {
-    let host = FakeHost::new();
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
-        .expect_err("text must not compile as a module");
-    assert_stage!(failure, RunError::Compile(_));
-
-    // The same module, assembled first, runs: the text is sound and only the
-    // format was refused.
-    assert_eq!(run(&text, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// A module may import fewer host functions than are registered, but not more:
-/// an import the linker does not define fails instantiation.
-#[test]
-fn an_unknown_import_fails_instantiation() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// Host functions are registered under one module name — `host_lib`, the name the
-/// guest SDK and this repo's fixtures import from — and a guest naming a different
-/// one does not link. `env` is in the list because that is what plain clang emits.
-#[test]
-fn the_import_module_name_must_match() {
-    let host = FakeHost::new();
-
-    for module_name in ["host", "env", ""] {
-        let wat = module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// An import spelled with the wrong signature does not link even under the right
-/// name, which is what makes the registered signatures load-bearing.
-#[test]
-fn an_import_with_the_wrong_signature_fails_instantiation() {
-    let host = FakeHost::new();
-
-    for signature in [
-        "(param i32) (result i32)",         // too few parameters
-        "(param i32 i32 i32) (result i32)", // too many
-        "(param i64 i64) (result i32)",     // wrong parameter types
-        "(param i32 i32) (result i64)",     // wrong result type
-        "(param i32 i32)",                  // no result
-    ] {
-        let wat = module(
-            &[
-                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// A module that imports a host function it never calls still has to link.
-#[test]
-fn an_unused_import_is_still_linked() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// The start section
-// ---------------------------------------------------------------------------
-
-/// The engine disallows start sections, so a module carrying one is rejected at
-/// compile and never runs. No guest code executes ahead of the entry point, whatever
-/// that code would have done — trap, loop, or call the host — so nothing is metered
-/// and no fuel is burned. Screening catches the same module up front
-/// (`preflight::a_start_section_is_refused_by_screening`); this pins that `run`
-/// refuses it the same way rather than instantiating it.
-#[test]
-fn a_start_section_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module with a start section must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "no guest code runs, so nothing is charged: {failure}"
-    );
-}
-
-/// What `RunError::Instantiate` is left to mean: a module the linker or the store
-/// would not accept, rather than one whose guest code failed. Its two shapes, so the
-/// variant is not left standing for nothing.
-#[test]
-fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
-    let host = FakeHost::new();
-
-    // The linker defines no such import.
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-
-    // The store's limiter will not grant the memory, and does not trap to say so.
-    let wat = module(
-        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_fails() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module without the entry point must not run"),
-        RunError::EntryPoint(_)
-    );
-    assert!(
-        failure.to_string().contains("no entry point 'finish'"),
-        "{failure}"
-    );
-}
-
-/// The entry point is looked up by the name the caller asks for.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
-    let outcome = run_entry(wat, &host, "other").expect("should run");
-    assert_eq!(outcome.result, 9);
-}
-
-/// The entry point must take nothing and return an `i32`. A module that exports the
-/// name with another signature is told so, rather than being told the export is
-/// missing: wasmi answers both cases with one error, and "no entry point" would send
-/// a contract author looking for a function they already have.
-#[test]
-fn an_entry_point_of_the_wrong_type_fails() {
-    let host = FakeHost::new();
-
-    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
-        let body = if signature.contains("result i64") {
-            "(i64.const 0)"
-        } else if signature.is_empty() {
-            "(nop)"
-        } else {
-            "(i32.const 0)"
-        };
-        let wat = format!(
-            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
-        );
-        let failure = assert_stage!(
-            run_with_gas(&wat, PLENTY_OF_GAS, &host)
-                .expect_err("a wrongly-typed entry point must not run"),
-            RunError::EntryPoint(_)
-        )
-        .to_string();
-        assert!(
-            failure.contains("entry point 'finish' has the wrong signature"),
-            "{signature}: {failure}"
-        );
-        assert!(
-            !failure.contains("no entry point"),
-            "a present export must not be reported as absent — {signature}: {failure}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_fails() {
-    let host = FakeHost::new();
-
-    let wat =
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
-        RunError::EntryPoint(_)
-    )
-    .to_string();
-    assert!(
-        failure.contains("export 'finish' is not a function"),
-        "{failure}"
-    );
-}
-
-/// A guest that traps fails the run rather than returning a value.
-#[test]
-fn a_trapping_guest_fails_the_run() {
-    let host = FakeHost::new();
-
-    let wat = module(&[ONE_PAGE], "(unreachable)");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-
-    // An out-of-bounds guest access is a trap too, caught by the engine rather
-    // than anything the host is asked about.
-    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_memory64_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module using 64-bit memory must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "rejected before instantiation, so nothing is charged: {failure}"
-    );
-}
-
-/// A function declaring more parameters than wasm allows (1000) is refused at compile, so a
-/// contract cannot smuggle an unbounded signature past screening.
-#[test]
-fn a_function_with_too_many_params_is_refused() {
-    let host = FakeHost::new();
-    let params = " i32".repeat(1001);
-    let wat = format!(
-        "(module {ONE_PAGE} (func (param{params}) (result i32) (i32.const 0)) \
-         (func (export \"finish\") (result i32) (i32.const 0)))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// A function declaring more locals than wasm allows (50 000) is refused at compile.
-#[test]
-fn a_function_with_too_many_locals_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(50_001));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// Below the compile cap but past the engine's register frame, a locals-heavy function is
-/// refused when the frame is built rather than at compile — still refused, just later.
-#[test]
-fn a_function_past_the_register_frame_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(40_000));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// Unbounded recursion is stopped by the engine's call-stack limit — it traps rather than
-/// running the host's native stack off the end (the portable dispatcher makes loops safe;
-/// this pins that guest *calls* are bounded too).
-#[test]
-fn unbounded_recursion_is_stopped_by_the_call_stack_limit() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} \
-          (func $rec (param i32) (result i32) \
-            (if (result i32) (i32.eqz (local.get 0)) (then (i32.const 0)) \
-              (else (call $rec (i32.sub (local.get 0) (i32.const 1)))))) \
-          (func (export \"finish\") (result i32) (call $rec (i32.const 1000000))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// The CodeMap-DoS defense, from the guest's side: a module of thousands of tiny
-/// functions is refused in `Module::new`, before anything is translated.
-///
-/// Both of `EnforcedLimits::strict()`'s function rules are load-bearing here, which
-/// is why the second half exists — dropping under the count cap does not get a
-/// module past the defense, because the bodies then fail the minimum average. The
-/// values themselves are pinned in `vm.rs`'s `the_enforced_limits_are_pinned`.
-#[test]
-fn a_module_of_too_many_functions_is_refused() {
-    let host = FakeHost::new();
-
-    let tiny_funcs = |count: usize| {
-        let funcs: String = (0..count)
-            .map(|i| format!("(func $f{i} (result i32) (i32.const {}))", i % 7))
-            .collect();
-        format!("(module {ONE_PAGE} {funcs} (func (export \"finish\") (result i32) (call $f0)))")
-    };
-
-    // `max_functions: Some(10000)`, checked before the bodies are looked at.
-    let wat = tiny_funcs(10_001);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 10000 functions"), "{refusal}");
-
-    // `min_avg_bytes_per_function: 40`, enforced once the bodies total 1 KiB. These
-    // average five bytes, so the count cap is not the only thing holding.
-    let wat = tiny_funcs(9_999);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("minimum average bytes per function of 40"),
-        "{refusal}"
-    );
-}
-
-/// The trap *kinds* wasmi distinguishes all reach the caller identically — a guest trap
-/// charged as the contract's fault — so the `unreachable` representative pins the mapping.
-/// These pin the individual kinds too, guarding against a wasmi upgrade reclassifying any of
-/// them as something other than a trap.
-#[test]
-fn a_division_by_zero_traps() {
-    let host = FakeHost::new();
-    let wat = module(&[ONE_PAGE], "(i32.div_s (i32.const 1) (i32.const 0))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_signed_integer_overflow_traps() {
-    let host = FakeHost::new();
-    let wat = module(
-        &[ONE_PAGE],
-        "(i32.div_s (i32.const 0x80000000) (i32.const -1))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_to_a_null_table_entry_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $t (func (result i32))) (table 1 funcref) \
-          (func (export \"finish\") (result i32) (call_indirect (type $t) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_with_a_mismatched_signature_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $void (func)) (type $i32 (func (result i32))) \
-          (table 1 funcref) (elem (i32.const 0) $f) (func $f (type $void)) \
-          (func (export \"finish\") (result i32) (call_indirect (type $i32) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}

docs/build/environment.md

@@ -1,5 +1,5 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
-environment complete with Git, Python, Conan, CMake, Rust, and a C++ compiler.
+environment complete with Git, Python, Conan, CMake, and a C++ compiler.
 This document explains how to set one up.
 
 [BUILD.md]: ../../BUILD.md
@@ -36,17 +36,19 @@ compiler building. Treat support for anything outside the table as best-effort.
 
 Besides a compiler, building `xrpld` requires:
 
-| Tool                                        | Minimum version          |
-| ------------------------------------------- | ------------------------ |
-| [Git](https://git-scm.com/downloads)        | any recent               |
-| [Python](https://www.python.org/downloads/) | 3.11                     |
-| [Conan](https://conan.io/downloads.html)    | 2.17                     |
-| [CMake](https://cmake.org/download/)        | 3.16                     |
-| [Rust](https://rustup.rs)                   | 1.95 (see [Rust](#rust)) |
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |
 
 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
 (see below). On Windows they have to be installed manually.
 
+Building with `-Drust=ON` additionally requires a Rust toolchain, see
+[Rust](#rust). A default build does not, so it is not in the table above.
+
 Once they are in place, verify that everything is installed and runnable with:
 
 ```bash
@@ -120,14 +122,18 @@ manually:
   "x64 Native Tools Command Prompt". CI configures CMake with the
   `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- Python, Conan, CMake, and Rust, at the versions listed in
+- Python, Conan, and CMake, at the versions listed in
   [Required tools](#required-tools).
+- a [Rust toolchain](https://rustup.rs) — only needed to build with
+  `-Drust=ON`, see [Rust](#rust)
 
 ## Rust
 
 The repository contains a Rust workspace in [`crates/`](../../crates), whose
-crates are exposed to C++ through [cxx](https://cxx.rs) bindings and compiled by
-the CMake build, so a Rust toolchain is required.
+crates are exposed to C++ through [cxx](https://cxx.rs) bindings. It is **not**
+part of a default build: the CMake `rust` option is OFF by default, and with it
+off no Rust toolchain is needed. It is only required when configuring with
+`-Drust=ON` (which is what CI does), see [Options](../../BUILD.md#options).
 
 The toolchain (`cargo`, `rustc`) is pinned to the channel in
 [`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If

docs/build/nix.md

@@ -128,8 +128,9 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
-The Rust toolchain the build needs is included too: every shell provides the
-channel pinned in [`rust-toolchain.toml`](../../rust-toolchain.toml) (see
+Builds of the Rust crates (`-Drust=ON`) also work out of the box: every shell
+provides the Rust toolchain pinned in
+[`rust-toolchain.toml`](../../rust-toolchain.toml) (see
 [Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
 `cargo-nextest` plugins.
 

docs/install.md

@@ -6,17 +6,16 @@
 
 `xrpld` is published as DEB and RPM packages for 64-bit x86 Linux.
 Use APT on Debian-based distributions such as Debian and Ubuntu,
-and DNF on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux,
-where `yum` is a symlink to `dnf`.
+and YUM on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux.
 To build from source instead, see [BUILD.md](../BUILD.md).
 
 ## Release channels
 
 Packages are published to four channels:
 
-- `stable` - production releases
-- `rc` - release candidates
-- `beta` - beta builds
+- `stable` - the latest production release
+- `unstable` - release candidates
+- `experimental` - beta builds
 - `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)
 
 See [Publishing packages](../package/README.md#publishing-packages) for how channels are produced.
@@ -66,7 +65,7 @@ wherever it appears in the repository configuration.
 4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \
         sudo tee /etc/apt/sources.list.d/xrplf.list
     ```
 
@@ -82,7 +81,7 @@ wherever it appears in the repository configuration.
     sudo apt -y install xrpld
     ```
 
-### With the DNF package manager
+### With the YUM package manager
 
 1.  Add the XRPL Foundation package-signing key:
 
@@ -93,40 +92,26 @@ wherever it appears in the repository configuration.
 2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    cat << 'REPOFILE' | sudo tee /etc/yum.repos.d/xrplf.repo
+    cat << REPOFILE | sudo tee /etc/yum.repos.d/xrplf.repo
     [xrplf-stable]
     name=XRP Ledger Packages
     enabled=1
-    baseurl=https://packages.xrplf.org/repository/rpm-stable/$basearch/
+    baseurl=https://packages.xrplf.org/repository/rpm-stable/
     gpgcheck=1
-    repo_gpgcheck=1
+    repo_gpgcheck=0
     gpgkey=https://packages.xrplf.org/xrplf.asc
     REPOFILE
     ```
 
     `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
+    `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed.
 
 3.  Install the `xrpld` package:
 
     ```bash
-    sudo dnf install -y xrpld
+    sudo yum install -y xrpld
     ```
 
-### Optional: the assert-enabled build
-
-Every channel also carries `xrpld-assert` as a DEB, the same build with assertions
-enabled, for diagnosing a problem on a non-production server.
-It installs the same files as `xrpld` and replaces it, so install one or the other:
-
-```bash
-sudo apt -y install xrpld-assert # APT removes xrpld itself
-```
-
-Switching stops the service, since it is a removal and an installation rather than an upgrade,
-and APT starts it again.
-Install `xrpld` the same way to switch back.
-
 ## The xrpld service
 
 Both package managers install a systemd unit and enable it, so `xrpld` starts on boot.
@@ -136,7 +121,7 @@ Check whether it is already running:
 systemctl status xrpld.service
 ```
 
-The DEB packages start it immediately as well; the RPM packages do not, so start it yourself:
+The APT packages start it immediately as well; the YUM packages do not, so start it yourself:
 
 ```bash
 sudo systemctl start xrpld.service

include/xrpl/basics/Number.h

@@ -543,21 +543,8 @@ public:
     setround(RoundingMode inMode);
 
     /**
-     * Convert an integer to a RoundingMode, validating that it is in range.
+     * Returns which mantissa scale is currently in use for normalization.
      *
-     * Returns std::nullopt if the value does not correspond to a valid
-     * RoundingMode.
-     */
-    static std::optional<RoundingMode>
-    checkedRoundingMode(int mode) noexcept
-    {
-        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
-            mode > static_cast<int>(RoundingMode::Upward))
-            return std::nullopt;
-        return static_cast<RoundingMode>(mode);
-    }
-
-    /**
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale

include/xrpl/basics/StringUtilities.h

@@ -162,89 +162,4 @@ toUInt64(std::string const& s);
 bool
 isProperlyFormedTomlDomain(std::string_view domain);
 
-/**
- * Whether a view can be passed on as a C string.
- *
- * A reader given only data() stops at the first null, so the view must reach the
- * terminating null. The test rebuilds the view from data() and compares: a view
- * that stops earlier rebuilds longer, and so compares unequal.
- *
- * consteval because reading the byte after the view is only defined when @p str
- * points into storage holding a null at or after its end, such as a string
- * literal. An unterminated view is then a compile error, not an out-of-bounds
- * read.
- *
- * @param str The view to test.
- * @return Whether @p str is null-terminated. A view with no data is not.
- */
-consteval bool
-isNullTerminated(std::string_view str)
-{
-    if (str.data() == nullptr)
-        return false;
-
-    // Reading past the view is the point, so the usual data() warning does not
-    // apply.
-    // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
-    return std::string_view{str.data()} == str;
-}
-
-/**
- * A string that is known to reach its terminating null.
- *
- * Converts to std::string_view, so it compares and hashes as one. Unlike a
- * view, asCString() may be handed to a reader that expects a C string, such
- * as json::StaticString.
- *
- * The only constructor is consteval and rejects a view that stops before the
- * null, so the property holds by construction and no caller asserts it.
- */
-class NullTerminatedView
-{
-public:
-    /**
-     * Build a view from one that reaches its terminating null.
-     *
-     * Explicit, so that a plain view cannot become a proof of termination by
-     * accident. The conversion the other way stays implicit.
-     *
-     * @param view The string to hold. Rejected at compile time if it stops
-     *        before its terminating null, or has no data.
-     */
-    explicit consteval NullTerminatedView(std::string_view view)
-        : data_(view.data()), size_(view.size())
-    {
-        if (!isNullTerminated(view))
-            throw "xrpl::NullTerminatedView : view does not reach a null";
-    }
-
-    constexpr
-    operator std::string_view() const noexcept
-    {
-        return view();
-    }
-
-    /**
-     * @return The string as a view.
-     */
-    [[nodiscard]] constexpr std::string_view
-    view() const noexcept
-    {
-        return {data_, size_};
-    }
-
-    /**
-     * @return The string as a C string. Never null.
-     */
-    [[nodiscard]] constexpr char const*
-    asCString() const noexcept
-    {
-        return data_;
-    }
-
-private:
-    char const* data_;
-    std::size_t size_;
-};
-
 }  // namespace xrpl

include/xrpl/basics/base_uint.h

@@ -518,7 +518,7 @@ public:
      * The input must be precisely `2 * bytes` hexadecimal characters
      * long, with one exception: the value '0'.
      *
-     * @param sv A string of hexadecimal characters
+     * @param sv A null-terminated string of hexadecimal characters
      * @return true if the input was parsed properly; false otherwise.
      */
     [[nodiscard]] constexpr bool

include/xrpl/beast/net/IPAddress.h

@@ -103,7 +103,7 @@ namespace boost {
 template <>
 struct hash<::beast::ip::Address>
 {
-    hash() = default;
+    explicit hash() = default;
 
     std::size_t
     operator()(::beast::ip::Address const& addr) const

include/xrpl/config/Constants.h

@@ -94,7 +94,6 @@ struct Keys
     static constexpr auto kBbtOptions = "bbt_options";
     static constexpr auto kBgThreads = "bg_threads";
     static constexpr auto kBlockSize = "block_size";
-    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
     static constexpr auto kCacheAge = "cache_age";
     static constexpr auto kCacheMb = "cache_mb";
     static constexpr auto kCacheSize = "cache_size";
@@ -109,8 +108,6 @@ struct Keys
     static constexpr auto kFileSizeMult = "file_size_mult";
     static constexpr auto kFilterBits = "filter_bits";
     static constexpr auto kFilterFull = "filter_full";
-    static constexpr auto kGasLimit = "gas_limit";
-    static constexpr auto kGasPrice = "gas_price";
     static constexpr auto kHardSet = "hard_set";
     static constexpr auto kHighThreads = "high_threads";
     static constexpr auto kHoldTime = "hold_time";
@@ -128,7 +125,6 @@ struct Keys
     static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
     static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
     static constexpr auto kMemoryLevel = "memory_level";
-    static constexpr auto kMaxWaitingLedgers = "max_waiting_ledgers";
     static constexpr auto kMinLedgersToComputeSizeLimit = "min_ledgers_to_compute_size_limit";
     static constexpr auto kMinimumEscalationMultiplier = "minimum_escalation_multiplier";
     static constexpr auto kMinimumLastLedgerBuffer = "minimum_last_ledger_buffer";

include/xrpl/core/CoroTask.h

@@ -0,0 +1,713 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+
+#include <coroutine>
+#include <exception>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace xrpl {
+
+template <typename T = void>
+class CoroTask;
+
+/**
+ * CoroTask<void> -- coroutine return type for void-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<void>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - exception_    : std::exception_ptr           |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_void()                                |
+ *   | + unhandled_exception()                        |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter
+ *   +-----------------------------------------------+
+ *   | await_suspend(h):                              |
+ *   |   if continuation_ set -> symmetric transfer   |
+ *   |   else                 -> noop_coroutine        |
+ *   +-----------------------------------------------+
+ *
+ * Design Notes
+ * ------------
+ * - Lazy start: initial_suspend returns suspend_always, so the coroutine
+ *   body does not execute until the handle is explicitly resumed.
+ * - Symmetric transfer: await_suspend returns a coroutine_handle instead
+ *   of void/bool, allowing the scheduler to jump directly to the next
+ *   coroutine without growing the call stack.
+ * - Continuation chaining: when one CoroTask is co_await-ed inside
+ *   another, the caller's handle is stored as continuation_ so
+ *   FinalAwaiter can resume it when this task finishes.
+ * - Move-only: the handle is exclusively owned; copy is deleted.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Basic void coroutine (the most common case in xrpld):
+ *
+ *      CoroTask<void> doWork(std::shared_ptr<CoroTaskRunner> runner) {
+ *          // do something
+ *          co_await runner->suspend();   // yield control
+ *          // resumed later via runner->post() or runner->resume()
+ *          co_return;
+ *      }
+ *
+ * 2. co_await-ing one CoroTask<void> from another (chaining):
+ *
+ *      CoroTask<void> inner() {
+ *          // ...
+ *          co_return;
+ *      }
+ *      CoroTask<void> outer() {
+ *          co_await inner();   // continuation_ links outer -> inner
+ *          co_return;          // FinalAwaiter resumes outer
+ *      }
+ *
+ * 3. Exceptions propagate through co_await:
+ *
+ *      CoroTask<void> failing() {
+ *          throw std::runtime_error("oops");
+ *          co_return;
+ *      }
+ *      CoroTask<void> caller() {
+ *          try { co_await failing(); }
+ *          catch (std::runtime_error const&) { // caught here }
+ *      }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Dangling references in coroutine parameters.
+ *   Coroutine parameters are copied into the frame, but references
+ *   are NOT -- they are stored as-is. If the referent goes out of scope
+ *   before the coroutine finishes, you get use-after-free.
+ *
+ *      // BROKEN -- local dies before coroutine runs:
+ *      CoroTask<void> bad(int& ref) { co_return; }
+ *      void launch() {
+ *          int local = 42;
+ *          auto task = bad(local);  // frame stores &local
+ *      }  // local destroyed; frame holds dangling ref
+ *
+ *      // FIX -- pass by value, or ensure lifetime via shared_ptr.
+ *
+ * BUG-RISK: GCC 14 corrupts reference captures in coroutine lambdas.
+ *   When a lambda that returns CoroTask captures by reference ([&]),
+ *   GCC 14 may generate a corrupted coroutine frame. Always capture
+ *   by explicit pointer-to-value instead:
+ *
+ *      // BROKEN on GCC 14:
+ *      jq.postCoroTask(t, n, [&](auto) -> CoroTask<void> { ... });
+ *
+ *      // FIX -- capture pointers explicitly:
+ *      jq.postCoroTask(t, n, [ptr = &val](auto) -> CoroTask<void> { ... });
+ *
+ * BUG-RISK: Resuming a destroyed or completed CoroTask.
+ *   Calling handle().resume() after the coroutine has already run to
+ *   completion (done() == true) is undefined behavior. The CoroTaskRunner
+ *   guards against this with an XRPL_ASSERT, but standalone usage of
+ *   CoroTask must check done() before resuming.
+ *
+ * BUG-RISK: Moving a CoroTask that is being awaited.
+ *   If task A is co_await-ed by task B (so A.continuation_ == B), moving
+ *   or destroying A will invalidate the continuation link. Never move
+ *   or reassign a CoroTask while it is mid-execution or being awaited.
+ *
+ * LIMITATION: CoroTask is fire-and-forget for the top-level owner.
+ *   There is no built-in notification when the coroutine finishes.
+ *   The caller must use external synchronization (e.g. CoroTaskRunner::join
+ *   or a gate/condition_variable) to know when it is done.
+ *
+ * LIMITATION: No cancellation token.
+ *   There is no way to cancel a suspended CoroTask from outside. The
+ *   coroutine body must cooperatively check a flag (e.g. jq_.isStopping())
+ *   after each co_await and co_return early if needed.
+ *
+ * LIMITATION: Stackless -- cannot suspend from nested non-coroutine calls.
+ *   If a coroutine calls a regular function that wants to "yield", it
+ *   cannot. Only the immediate coroutine body can use co_await.
+ *   This is acceptable for xrpld because all yield() sites are shallow.
+ */
+template <>
+class CoroTask<void>
+{
+public:
+    // The C++ coroutine protocol mandates these names (promise_type,
+    // initial_suspend, await_ready, ...) and instance-callable awaiter
+    // methods, which conflict with the project naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise. Compiler uses this to manage coroutine state.
+     * Stores the exception (if any) and the continuation handle for
+     * symmetric transfer back to the awaiting coroutine.
+     */
+    struct promise_type
+    {
+        // Captured exception from the coroutine body, rethrown in
+        // await_resume() when this task is co_await-ed by a caller.
+        std::exception_ptr exception_;
+
+        // Handle to the coroutine that is co_await-ing this task.
+        // Set by await_suspend(). FinalAwaiter uses it for symmetric
+        // transfer back to the caller. Null if this is a top-level task.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. The coroutine body does not execute until the
+         * handle is explicitly resumed (e.g. by CoroTaskRunner::resume).
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Awaiter returned by final_suspend(). Uses symmetric transfer:
+         * if a continuation exists, transfers control directly to it
+         * (tail-call, no stack growth). Otherwise returns noop_coroutine
+         * so the coroutine frame stays alive for the owner to destroy.
+         */
+        struct FinalAwaiter
+        {
+            /**
+             * Always false. We need await_suspend to run for
+             * symmetric transfer.
+             */
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Symmetric transfer: returns the continuation handle so
+             * the compiler emits a tail-call instead of a nested resume.
+             * If no continuation is set, returns noop_coroutine to
+             * suspend at final_suspend without destroying the frame.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        /**
+         * Returns FinalAwaiter for symmetric transfer at coroutine end.
+         */
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return;` (void coroutine).
+         */
+        void
+        return_void()
+        {
+        }
+
+        /**
+         * Called by the compiler when an exception escapes the coroutine
+         * body. Captures it for later rethrowing in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            exception_ = std::current_exception();
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    [[nodiscard]] Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    [[nodiscard]] bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `co_await someCoroTask;` --
+
+    /**
+     * Always false. This task is lazy, so co_await always suspends
+     * the caller to set up the continuation link.
+     */
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores the caller's handle as our continuation, then returns
+     * our handle for symmetric transfer (caller suspends, we resume).
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;  // Symmetric transfer
+    }
+
+    /**
+     * Called in the awaiting coroutine's context after this task
+     * completes. Rethrows any exception captured by
+     * unhandled_exception().
+     */
+    void
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<void>::await_resume : handle is valid");
+        if (auto& ep = handle_.promise().exception_)
+            std::rethrow_exception(ep);
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+/**
+ * CoroTask<T> -- coroutine return type for value-returning coroutines.
+ *
+ * Class / Dependency Diagram
+ * ==========================
+ *
+ *   CoroTask<T>
+ *   +-----------------------------------------------+
+ *   | - handle_ : Handle (coroutine_handle<promise>) |
+ *   +-----------------------------------------------+
+ *   | + handle(), done()                             |
+ *   | + await_ready/suspend/resume  (Awaiter iface)  |
+ *   +-----------------------------------------------+
+ *            |  owns
+ *            v
+ *   promise_type
+ *   +-----------------------------------------------+
+ *   | - result_       : variant<monostate, T,        |
+ *   |                           exception_ptr>       |
+ *   | - continuation_ : std::coroutine_handle<>      |
+ *   +-----------------------------------------------+
+ *   | + get_return_object() -> CoroTask              |
+ *   | + initial_suspend()   -> suspend_always (lazy) |
+ *   | + final_suspend()     -> FinalAwaiter          |
+ *   | + return_value(T)     -> stores in result_[1]  |
+ *   | + unhandled_exception -> stores in result_[2]  |
+ *   +-----------------------------------------------+
+ *            |  returns at final_suspend
+ *            v
+ *   FinalAwaiter  (same symmetric-transfer pattern as CoroTask<void>)
+ *
+ * Value Extraction
+ * ----------------
+ * await_resume() inspects the variant:
+ *   - index 2 (exception_ptr) -> rethrow
+ *   - index 1 (T)             -> return value via move
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Simple value return:
+ *
+ *      CoroTask<int> computeAnswer() { co_return 42; }
+ *
+ *      CoroTask<void> caller() {
+ *          int v = co_await computeAnswer();  // v == 42
+ *      }
+ *
+ * 2. Chaining value-returning coroutines:
+ *
+ *      CoroTask<int> add(int a, int b) { co_return a + b; }
+ *      CoroTask<int> doubleSum(int a, int b) {
+ *          int s = co_await add(a, b);
+ *          co_return s * 2;
+ *      }
+ *
+ * 3. Exception propagation from inner to outer:
+ *
+ *      CoroTask<int> failing() {
+ *          throw std::runtime_error("bad");
+ *          co_return 0;  // never reached
+ *      }
+ *      CoroTask<void> caller() {
+ *          try {
+ *              int v = co_await failing();  // throws here
+ *          } catch (std::runtime_error const& e) {
+ *              // e.what() == "bad"
+ *          }
+ *      }
+ *
+ * Caveats / Pitfalls (in addition to CoroTask<void> caveats above)
+ * ================================================================
+ *
+ * BUG-RISK: await_resume() moves the value out of the variant.
+ *   Calling co_await on the same CoroTask<T> instance twice is undefined
+ *   behavior -- the second call will see a moved-from T. CoroTask is
+ *   single-shot: one co_return, one co_await.
+ *
+ * BUG-RISK: T must be move-constructible.
+ *   return_value(T) takes by value and moves into the variant.
+ *   Types that are not movable cannot be used as T.
+ *
+ * LIMITATION: No co_yield support.
+ *   CoroTask<T> only supports a single co_return. It does not implement
+ *   yield_value(), so using co_yield inside a CoroTask<T> coroutine is a
+ *   compile error. For streaming values, a different return type
+ *   (e.g. Generator<T>) would be needed.
+ *
+ * LIMITATION: Result is only accessible via co_await.
+ *   There is no .get() or .result() method. The value can only be
+ *   extracted by co_await-ing the CoroTask<T> from inside another
+ *   coroutine. For extracting results in non-coroutine code, pass a
+ *   pointer to the caller and write through it (as the tests do).
+ */
+template <typename T>
+class CoroTask
+{
+    static_assert(
+        std::is_move_constructible_v<T>,
+        "CoroTask<T> requires T to be move-constructible");
+
+public:
+    // The C++ coroutine protocol mandates these names (promise_type,
+    // initial_suspend, await_ready, ...) and instance-callable awaiter
+    // methods, which conflict with the project naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct promise_type;
+    using Handle = std::coroutine_handle<promise_type>;
+
+    /**
+     * Coroutine promise for value-returning coroutines.
+     * Stores the result as a variant: monostate (not yet set),
+     * T (co_return value), or exception_ptr (unhandled exception).
+     */
+    struct promise_type
+    {
+        // Tri-state result:
+        //   index 0 (monostate) -- coroutine has not yet completed
+        //   index 1 (T)         -- co_return value stored here
+        //   index 2 (exception) -- unhandled exception captured here
+        std::variant<std::monostate, T, std::exception_ptr> result_;
+
+        // Handle to the coroutine co_await-ing this task. Used by
+        // FinalAwaiter for symmetric transfer. Null for top-level tasks.
+        std::coroutine_handle<> continuation_;
+
+        /**
+         * Create the CoroTask return object.
+         * Called by the compiler at coroutine creation.
+         */
+        CoroTask
+        get_return_object()
+        {
+            return CoroTask{Handle::from_promise(*this)};
+        }
+
+        /**
+         * Lazy start. Coroutine body does not run until explicitly resumed.
+         */
+        std::suspend_always
+        initial_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Symmetric-transfer awaiter at coroutine completion.
+         * Same pattern as CoroTask<void>::FinalAwaiter.
+         */
+        struct FinalAwaiter
+        {
+            bool
+            await_ready() noexcept
+            {
+                return false;
+            }
+
+            /**
+             * Returns continuation for symmetric transfer, or
+             * noop_coroutine if this is a top-level task.
+             *
+             * @param h Handle to this completing coroutine
+             *
+             * @return Continuation handle, or noop_coroutine
+             */
+            std::coroutine_handle<>
+            await_suspend(Handle h) noexcept
+            {
+                if (auto cont = h.promise().continuation_)
+                    return cont;
+                return std::noop_coroutine();
+            }
+
+            void
+            await_resume() noexcept
+            {
+            }
+        };
+
+        FinalAwaiter
+        final_suspend() noexcept
+        {
+            return {};
+        }
+
+        /**
+         * Called by the compiler for `co_return value;`.
+         * Moves the value into result_ at index 1.
+         *
+         * @param value The value to store
+         */
+        void
+        return_value(T value)
+        {
+            result_.template emplace<1>(std::move(value));
+        }
+
+        /**
+         * Captures unhandled exceptions at index 2 of result_.
+         * Rethrown later in await_resume().
+         */
+        void
+        unhandled_exception()
+        {
+            result_.template emplace<2>(std::current_exception());
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+    /**
+     * Default constructor. Creates an empty (null handle) task.
+     */
+    CoroTask() = default;
+
+    /**
+     * Takes ownership of a compiler-generated coroutine handle.
+     *
+     * @param h Coroutine handle to own
+     */
+    explicit CoroTask(Handle h) : handle_(h)
+    {
+    }
+
+    /**
+     * Destroys the coroutine frame if this task owns one.
+     */
+    ~CoroTask()
+    {
+        if (handle_)
+            handle_.destroy();
+    }
+
+    /**
+     * Move constructor. Transfers handle ownership, leaves other empty.
+     */
+    CoroTask(CoroTask&& other) noexcept : handle_(std::exchange(other.handle_, {}))
+    {
+    }
+
+    /**
+     * Move assignment. Destroys current frame (if any), takes other's.
+     */
+    CoroTask&
+    operator=(CoroTask&& other) noexcept
+    {
+        if (this != &other)
+        {
+            if (handle_)
+                handle_.destroy();
+            handle_ = std::exchange(other.handle_, {});
+        }
+        return *this;
+    }
+
+    CoroTask(CoroTask const&) = delete;
+    CoroTask&
+    operator=(CoroTask const&) = delete;
+
+    /**
+     * @return The underlying coroutine_handle
+     */
+    [[nodiscard]] Handle
+    handle() const
+    {
+        return handle_;
+    }
+
+    /**
+     * @return true if the coroutine has run to completion (or thrown)
+     */
+    [[nodiscard]] bool
+    done() const
+    {
+        return handle_ && handle_.done();
+    }
+
+    // -- Awaiter interface: allows `T val = co_await someCoroTask;` --
+
+    /**
+     * Always false. co_await always suspends to set up continuation.
+     */
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Stores caller as continuation, returns our handle for
+     * symmetric transfer.
+     *
+     * @param caller Handle of the coroutine doing co_await on us
+     *
+     * @return Our handle for symmetric transfer
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> caller) noexcept
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_suspend : handle is valid");
+        handle_.promise().continuation_ = caller;
+        return handle_;
+    }
+
+    /**
+     * Extracts the result: rethrows if exception, otherwise moves
+     * the T value out of the variant. Single-shot: calling twice
+     * on the same task is undefined (moved-from T).
+     *
+     * @return The co_return-ed value
+     */
+    T
+    await_resume()
+    {
+        XRPL_ASSERT(handle_, "xrpl::CoroTask<T>::await_resume : handle is valid");
+        auto& result = handle_.promise().result_;
+        if (auto* ep = std::get_if<2>(&result))
+            std::rethrow_exception(*ep);
+        return std::get<1>(std::move(result));
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+
+private:
+    // Exclusively-owned coroutine handle. Null after move or default
+    // construction. Destroyed in the destructor.
+    Handle handle_;
+};
+
+}  // namespace xrpl

include/xrpl/core/CoroTaskRunner.ipp

@@ -0,0 +1,448 @@
+#pragma once
+
+/**
+ * @file CoroTaskRunner.ipp
+ *
+ * CoroTaskRunner inline implementation.
+ *
+ * This file contains the business logic for managing C++20 coroutines
+ * on the JobQueue. It is included at the bottom of JobQueue.h.
+ *
+ * Data Flow: suspend / post / resume cycle
+ * =========================================
+ *
+ *         coroutine body                 CoroTaskRunner              JobQueue
+ *         --------------                 --------------              --------
+ *              |
+ *    co_await runner->suspend()
+ *              |
+ *              +--- await_suspend ------> onSuspend()
+ *              |                            ++nSuspend_ ------------> nSuspend_
+ *              |                          [coroutine is now suspended]
+ *              |
+ *              .    (externally or by yieldAndPost())
+ *              .
+ *              +--- (caller calls) -----> post()
+ *              |                            ++runCount_
+ *              |                            addJob(resume) ----------> job enqueued
+ *              |                                                        |
+ *              |                                                      [worker picks up]
+ *              |                                                        |
+ *              +--- <----- resume() <-----------------------------------+
+ *              |             --nSuspend_ ------> nSuspend_
+ *              |             swap in LocalValues (lvs_)
+ *              |             task_.handle().resume()
+ *              |                |
+ *              |    [coroutine body continues here]
+ *              |                |
+ *              |             swap out LocalValues
+ *              |             --runCount_
+ *              |             cv_.notify_all()
+ *              v
+ *
+ * Thread Safety
+ * =============
+ * - mutex_     : guards task_.handle().resume() so that post()-before-suspend
+ *                races cannot resume the coroutine while it is still running.
+ *                (See the race condition discussion in JobQueue.h)
+ * - mutexRun_ : guards runCount_ counter; used by join() to wait until
+ *                all in-flight resume operations complete.
+ * - jq_.mutex_: guards nSuspend_ increments/decrements.
+ *
+ * Common Mistakes When Modifying This File
+ * =========================================
+ *
+ * 1. Changing lock ordering.
+ *    resume() acquires locks sequentially (never held simultaneously):
+ *    jq_.mutex_ (released immediately), then mutex_ (held across resume),
+ *    then mutexRun_ (released after decrement). post() acquires only
+ *    mutexRun_. Any new code path must follow the same order.
+ *
+ * 2. Removing the shared_from_this() capture in post().
+ *    The lambda passed to addJob captures [this, sp = shared_from_this()].
+ *    If you remove sp, 'this' can be destroyed before the job runs,
+ *    causing use-after-free. The sp capture is load-bearing.
+ *
+ * 3. Forgetting to decrement nSuspend_ on a new code path.
+ *    Every ++nSuspend_ must have a matching --nSuspend_. If you add a new
+ *    suspension path (e.g. a new awaiter) and forget to decrement on resume
+ *    or on failure, JobQueue::stop() will hang.
+ *
+ * 4. Calling task_.handle().resume() without holding mutex_.
+ *    This allows a race where the coroutine runs on two threads
+ *    simultaneously. Always hold mutex_ around resume().
+ *
+ * 5. Swapping LocalValues outside of the mutex_ critical section.
+ *    The swap-in and swap-out of LocalValues must bracket the resume()
+ *    call. If you move the swap-out before the lock_guard(mutex_) is
+ *    released, you break LocalValue isolation for any code that runs
+ *    after the coroutine suspends but before the lock is dropped.
+ */
+
+namespace xrpl {
+
+/**
+ * Construct a CoroTaskRunner. Sets runCount_ to 0; does not
+ * create the coroutine. Call init() afterwards.
+ *
+ * @param jq   The JobQueue this coroutine will run on
+ * @param type Job type for scheduling priority
+ * @param name Human-readable name for logging
+ */
+inline JobQueue::CoroTaskRunner::CoroTaskRunner(
+    CreateT,
+    JobQueue& jq,
+    JobType type,
+    std::string name)
+    : jq_(jq), type_(type), name_(std::move(name))
+{
+}
+
+/**
+ * Initialize with a coroutine-returning callable.
+ * Stores the callable on the heap (FuncStore) so it outlives the
+ * coroutine frame. Coroutine frames store a reference to the
+ * callable's implicit object parameter (the lambda). If the callable
+ * is a temporary, that reference dangles after the caller returns.
+ * Keeping the callable alive here ensures the coroutine's captures
+ * remain valid.
+ *
+ * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+ */
+template <class F>
+void
+JobQueue::CoroTaskRunner::init(F&& f)
+{
+    using Fn = std::decay_t<F>;
+    auto store = std::make_unique<FuncStore<Fn>>(std::forward<F>(f));
+    task_ = store->func(shared_from_this());
+    storedFunc_ = std::move(store);
+}
+
+/**
+ * Destructor. Waits for any in-flight resume() to complete, then
+ * asserts (debug) that the coroutine has finished or
+ * expectEarlyExit() was called.
+ *
+ * The join() call is necessary because with async dispatch the
+ * coroutine runs on a worker thread. The gate signal (which wakes
+ * the test thread) can arrive before resume() has set finished_.
+ * join() synchronizes via mutexRun_, establishing a happens-before
+ * edge: finished_ = true -> unlock(mutexRun_) in resume() ->
+ * lock(mutexRun_) in join() -> read finished_.
+ */
+inline JobQueue::CoroTaskRunner::~CoroTaskRunner()
+{
+#ifndef NDEBUG
+    join();
+    XRPL_ASSERT(finished_, "xrpl::JobQueue::CoroTaskRunner::~CoroTaskRunner : is finished");
+#endif
+}
+
+/**
+ * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+ */
+inline void
+JobQueue::CoroTaskRunner::onSuspend()
+{
+    std::scoped_lock const lock(jq_.mutex_);
+    ++jq_.nSuspend_;
+}
+
+/**
+ * Decrement nSuspend_ without resuming.
+ */
+inline void
+JobQueue::CoroTaskRunner::onUndoSuspend()
+{
+    std::scoped_lock const lock(jq_.mutex_);
+    --jq_.nSuspend_;
+}
+
+/**
+ * Return a SuspendAwaiter whose await_suspend() increments nSuspend_
+ * before the coroutine actually suspends. The caller must later call
+ * post() or resume() to continue execution.
+ *
+ * @return Awaiter for use with `co_await runner->suspend()`
+ */
+inline auto
+JobQueue::CoroTaskRunner::suspend()
+{
+    /**
+     * Custom awaiter for suspend(). Always suspends (await_ready
+     * returns false) and increments nSuspend_ in await_suspend().
+     */
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct SuspendAwaiter
+    {
+        CoroTaskRunner& runner_;  // The runner that owns this coroutine.
+
+        /**
+         * Always returns false so the coroutine suspends.
+         */
+        [[nodiscard]] bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        /**
+         * Called when the coroutine suspends. Increments nSuspend_
+         * so the JobQueue knows a coroutine is waiting.
+         */
+        void
+        await_suspend(std::coroutine_handle<>) const
+        {
+            runner_.onSuspend();
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+    return SuspendAwaiter{*this};
+}
+
+/**
+ * Suspend and immediately repost on the JobQueue. Equivalent to
+ * `co_await JobQueueAwaiter{runner}` but uses an inline struct
+ * to work around a GCC-12 codegen bug (see declaration in JobQueue.h).
+ *
+ * If the JobQueue is stopping (post fails), the suspend count is
+ * undone and the coroutine continues immediately via symmetric
+ * transfer back to its own handle.
+ *
+ * @return An inline YieldPostAwaiter
+ */
+inline auto
+JobQueue::CoroTaskRunner::yieldAndPost()
+{
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    struct YieldPostAwaiter
+    {
+        CoroTaskRunner& runner_;
+
+        [[nodiscard]] bool
+        await_ready() const noexcept
+        {
+            return false;
+        }
+
+        /**
+         * Returns a coroutine_handle<> (symmetric transfer) rather than
+         * void + h.resume(). Two reasons:
+         *
+         *  1. h.resume() runs the coroutine nested inside this frame. A
+         *     coroutine that yields in a loop against a stopping JobQueue
+         *     fails post() every iteration, so the stack grows without
+         *     bound. Symmetric transfer is a tail call and does not nest.
+         *
+         *  2. After h.resume() returns, the coroutine may have completed
+         *     and destroyed its frame -- the frame this awaiter lives in.
+         *     Returning from await_suspend would then touch freed memory.
+         *
+         * A bool return would also avoid nesting, but GCC-12 miscompiles
+         * bool-returning await_suspend (see JobQueueAwaiter.h).
+         *
+         * @return noop_coroutine() to stay suspended (job posted);
+         *         the caller's handle to continue now (JQ stopping)
+         */
+        std::coroutine_handle<>
+        await_suspend(std::coroutine_handle<> h)
+        {
+            runner_.onSuspend();
+            if (!runner_.post())
+            {
+                runner_.onUndoSuspend();
+                return h;
+            }
+            return std::noop_coroutine();
+        }
+
+        void
+        await_resume() const noexcept
+        {
+        }
+    };
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+    return YieldPostAwaiter{*this};
+}
+
+/**
+ * Schedule coroutine resumption as a job on the JobQueue.
+ * A shared_ptr capture (sp) prevents this CoroTaskRunner from being
+ * destroyed while the job is queued but not yet executed.
+ *
+ * @return false if the JobQueue rejected the job (shutting down)
+ */
+inline bool
+JobQueue::CoroTaskRunner::post()
+{
+    {
+        std::scoped_lock const lk(mutexRun_);
+        ++runCount_;
+    }
+
+    // sp prevents 'this' from being destroyed while the job is pending
+    if (jq_.addJob(type_, name_, [this, sp = shared_from_this()]() { resume(); }))
+    {
+        return true;
+    }
+
+    // The coroutine will not run. Undo the runCount_ increment.
+    std::scoped_lock const lk(mutexRun_);
+    --runCount_;
+    cv_.notify_all();
+    return false;
+}
+
+/**
+ * Resume the coroutine on the current thread.
+ *
+ * Steps:
+ *   1. Decrement nSuspend_ (under jq_.mutex_)
+ *   2. Swap in this coroutine's LocalValues for thread-local isolation
+ *   3. Resume the coroutine handle (under mutex_)
+ *   4. Swap out LocalValues, restoring the thread's previous state
+ *   5. Decrement runCount_ and notify join() waiters
+ *
+ * @pre post() must have been called before resume(). Direct calls
+ *      without a prior post() will corrupt runCount_ and break join().
+ * Note: runCount_ is NOT incremented here — post() already did that.
+ * This ensures join() stays blocked for the entire post->resume lifetime.
+ */
+inline void
+JobQueue::CoroTaskRunner::resume()
+{
+    {
+        std::scoped_lock const lock(jq_.mutex_);
+        --jq_.nSuspend_;
+    }
+    auto saved = detail::getLocalValues().release();
+    detail::getLocalValues().reset(&lvs_);
+    std::scoped_lock const lock(mutex_);
+    XRPL_ASSERT(
+        task_.handle() && !task_.done(),
+        "xrpl::JobQueue::CoroTaskRunner::resume : task handle is valid and not done");
+    if (task_.handle() && !task_.done())
+    {
+        task_.handle().resume();
+    }
+    else
+    {
+        // A resume() with no coroutine to run (e.g. a duplicate external
+        // post() after completion). Resuming a null or finished handle is
+        // undefined behavior, so skip it -- this matches the old
+        // Coro::resume() `if (coro_)` guard. The bookkeeping below still
+        // runs to balance the ++runCount_ done by the post() that
+        // scheduled this call.
+        JLOG(jq_.journal_.warn())
+            << "CoroTaskRunner::resume called for coroutine '" << name_
+            << "' with no runnable coroutine (duplicate post or already completed)";
+    }
+    detail::getLocalValues().release();
+    detail::getLocalValues().reset(saved);
+    if (task_.done())
+    {
+        finished_ = true;
+        // An exception that escapes a top-level coroutine body is captured
+        // by promise_type::unhandled_exception() but has no awaiter to
+        // rethrow it, so it would vanish with the frame. Surface it in the
+        // log. (The old Boost path propagated it out of resume() instead.)
+        if (auto const& ep = task_.handle().promise().exception_)
+        {
+            try
+            {
+                std::rethrow_exception(ep);
+            }
+            catch (std::exception const& e)
+            {
+                JLOG(jq_.journal_.error())
+                    << "Unhandled exception in coroutine '" << name_ << "': " << e.what();
+            }
+            catch (...)
+            {
+                JLOG(jq_.journal_.error())
+                    << "Unhandled non-standard exception in coroutine '" << name_ << "'";
+            }
+        }
+        // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+        // Use std::move (not task_ = {}) so task_.handle_ is null BEFORE the
+        // frame is destroyed. operator= would destroy the frame while handle_
+        // still holds the old value -- a re-entrancy hazard on GCC-12 if
+        // frame destruction triggers runner cleanup.
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    std::scoped_lock const lk(mutexRun_);
+    --runCount_;
+    cv_.notify_all();
+}
+
+/**
+ * @return true if the coroutine has not yet run to completion
+ */
+inline bool
+JobQueue::CoroTaskRunner::runnable() const
+{
+    // After normal completion, task_ is reset to break the shared_ptr cycle
+    // (handle_ becomes null). A null handle means the coroutine is done.
+    return task_.handle() && !task_.done();
+}
+
+/**
+ * Handle early termination when the coroutine never ran (e.g. JobQueue
+ * is stopping). Decrements nSuspend_ and destroys the coroutine frame
+ * to break the shared_ptr cycle: frame -> lambda -> runner -> frame.
+ */
+inline void
+JobQueue::CoroTaskRunner::expectEarlyExit()
+{
+    if (!finished_)
+    {
+        std::scoped_lock const lock(jq_.mutex_);
+        --jq_.nSuspend_;
+        finished_ = true;
+    }
+    // Break the shared_ptr cycle: frame -> shared_ptr<runner> -> this.
+    // The coroutine is at initial_suspend and never ran user code, so
+    // destroying it is safe. Use std::move (not task_ = {}) so
+    // task_.handle_ is null before the frame is destroyed.
+    {
+        [[maybe_unused]] auto completed = std::move(task_);
+    }
+    storedFunc_.reset();
+}
+
+/**
+ * Block until all pending/active resume operations complete.
+ * Uses cv_ + mutexRun_ to wait until runCount_ reaches 0 or
+ * finished_ becomes true. The finished_ check handles the case
+ * where resume() is called directly (without post()), which
+ * decrements runCount_ below zero. In that scenario runCount_
+ * never returns to 0, but finished_ becoming true guarantees
+ * the coroutine is done and no more resumes will occur.
+ *
+ * Note: when join() returns via the finished_ disjunct, the final
+ * resume() call may still be executing its post-completion
+ * bookkeeping (the --runCount_ / notify after finished_ is set).
+ * That is safe -- the coroutine body has fully completed and the
+ * runner is kept alive by the resume job's shared_ptr -- but
+ * callers must not assume resume() itself has returned.
+ */
+inline void
+JobQueue::CoroTaskRunner::join()
+{
+    std::unique_lock<std::mutex> lk(mutexRun_);
+    cv_.wait(lk, [this]() { return runCount_ == 0 || finished_; });
+}
+
+}  // namespace xrpl

include/xrpl/core/HashRouter.h

@@ -34,10 +34,7 @@ enum class HashRouterFlags : std::uint16_t {
     PRIVATE4 = 0x0800,
     // Used in EscrowFinish.cpp
     PRIVATE5 = 0x1000,
-    PRIVATE6 = 0x2000,
-    // Used in apply.cpp
-    PRIVATE7 = 0x4000,
-    PRIVATE8 = 0x8000
+    PRIVATE6 = 0x2000
 };
 
 constexpr HashRouterFlags

include/xrpl/core/JobQueue.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/LocalValue.h>
 #include <xrpl/core/ClosureCounter.h>
+#include <xrpl/core/CoroTask.h>
 #include <xrpl/core/JobTypeData.h>
 #include <xrpl/core/detail/Workers.h>
 #include <xrpl/json/json_value.h>
@@ -152,6 +153,420 @@ public:
         join();
     };
 
+    /**
+     * C++20 coroutine lifecycle manager. Replaces Coro for new code.
+     *
+     *  Class / Inheritance / Dependency Diagram
+     *  =========================================
+     *
+     *  std::enable_shared_from_this<CoroTaskRunner>
+     *            ^
+     *            | (public inheritance)
+     *            |
+     *  CoroTaskRunner
+     *  +---------------------------------------------------+
+     *  | - lvs_         : detail::LocalValues               |
+     *  | - jq_          : JobQueue&                         |
+     *  | - type_        : JobType                           |
+     *  | - name_        : std::string                       |
+     *  | - runCount_    : int         (in-flight resumes)    |
+     *  | - mutex_       : std::mutex      (coroutine guard) |
+     *  | - mutexRun_    : std::mutex      (join guard)      |
+     *  | - cv_          : condition_variable                 |
+     *  | - task_        : CoroTask<void>                    |
+     *  | - storedFunc_  : unique_ptr<FuncBase> (type-erased)|
+     *  +---------------------------------------------------+
+     *  | + init(F&&)         : set up coroutine callable    |
+     *  | + onSuspend()       : ++jq_.nSuspend_              |
+     *  | + onUndoSuspend()   : --jq_.nSuspend_              |
+     *  | + suspend()         : returns SuspendAwaiter       |
+     *  | + post()            : schedule resume on JobQueue  |
+     *  | + resume()          : resume coroutine on caller   |
+     *  | + runnable()        : !task_.done()                |
+     *  | + expectEarlyExit() : teardown for failed post     |
+     *  | + join()            : block until not running       |
+     *  +---------------------------------------------------+
+     *          |                          |
+     *          | owns                     | references
+     *          v                          v
+     *    CoroTask<void>             JobQueue
+     *    (coroutine frame)          (thread pool + nSuspend_)
+     *
+     *    FuncBase / FuncStore<F>    (type-erased heap storage
+     *                                for the coroutine lambda)
+     *
+     *  Coroutine Lifecycle (Control Flow)
+     *  ===================================
+     *
+     *  Caller thread              JobQueue worker thread
+     *  -------------              ----------------------
+     *  postCoroTask(f)
+     *    |
+     *    +-- reserve a jobCounter_ slot (reject if JQ shutting down)
+     *    +-- ++nSuspend_  (lazy start counts as suspended)
+     *    +-- make_shared<CoroTaskRunner>
+     *    +-- init(f)
+     *    |     +-- store lambda on heap (FuncStore)
+     *    |     +-- task_ = f(shared_from_this())
+     *    |           [coroutine created, suspended at initial_suspend]
+     *    +-- post()
+     *    |     +-- ++runCount_
+     *    |     +-- addJob(type_, [resume]{})
+     *    |                                    resume()
+     *    |                                      |
+     *    |                                      +-- --nSuspend_
+     *    |                                      +-- swap in LocalValues
+     *    |                                      +-- task_.handle().resume()
+     *    |                                      |     [coroutine body runs]
+     *    |                                      |     ...
+     *    |                                      |     co_await suspend()
+     *    |                                      |       +-- ++nSuspend_
+     *    |                                      |       [coroutine suspends]
+     *    |                                      +-- swap out LocalValues
+     *    |                                      +-- --runCount_
+     *    |                                      +-- cv_.notify_all()
+     *    |
+     *  post()  <-- called externally or by yieldAndPost()
+     *    +-- ++runCount_
+     *    +-- addJob(type_, [resume]{})
+     *                                         resume()
+     *                                           |
+     *                                           +-- [coroutine body continues]
+     *                                           +-- co_return
+     *                                           +-- --runCount_
+     *                                           +-- cv_.notify_all()
+     *  join()
+     *    +-- cv_.wait([]{runCount_ == 0})
+     *    +-- [done]
+     *
+     *  Usage Examples
+     *  ==============
+     *
+     *  1. Fire-and-forget coroutine (most common pattern):
+     *
+     *      jq.postCoroTask(JtClient, "MyWork",
+     *          [](auto runner) -> CoroTask<void> {
+     *              doSomeWork();
+     *              co_await runner->suspend();  // yield to other jobs
+     *              doMoreWork();
+     *              co_return;
+     *          });
+     *
+     *  2. Manually controlling suspend / resume (external trigger):
+     *
+     *      auto runner = jq.postCoroTask(JtClient, "ExtTrigger",
+     *          [&result](auto runner) -> CoroTask<void> {
+     *              startAsyncOperation(callback);
+     *              co_await runner->suspend();
+     *              // callback called runner->post() to get here
+     *              result = collectResult();
+     *              co_return;
+     *          });
+     *      // ... later, from the callback:
+     *      runner->post();   // reschedule the coroutine on the JobQueue
+     *
+     *  3. Using yieldAndPost() for automatic suspend + repost:
+     *
+     *      jq.postCoroTask(JtClient, "AutoRepost",
+     *          [](auto runner) -> CoroTask<void> {
+     *              step1();
+     *              co_await runner->yieldAndPost();  // yield + auto-repost
+     *              step2();
+     *              co_await runner->yieldAndPost();
+     *              step3();
+     *              co_return;
+     *          });
+     *
+     *  4. Checking shutdown after co_await (cooperative cancellation):
+     *
+     *      jq.postCoroTask(JtClient, "Cancellable",
+     *          [&jq](auto runner) -> CoroTask<void> {
+     *              while (moreWork()) {
+     *                  co_await runner->yieldAndPost();
+     *                  if (jq.isStopping())
+     *                      co_return;  // bail out cleanly
+     *                  processNextItem();
+     *              }
+     *              co_return;
+     *          });
+     *
+     *  Caveats / Pitfalls
+     *  ==================
+     *
+     *  BUG-RISK: Calling suspend() without a matching post()/resume().
+     *    After co_await runner->suspend(), the coroutine is parked and
+     *    nSuspend_ is incremented.  If nothing ever calls post() or
+     *    resume(), the coroutine is leaked and JobQueue::stop() will
+     *    hang forever waiting for nSuspend_ to reach zero.
+     *
+     *  BUG-RISK: Calling post() on an already-running coroutine.
+     *    post() schedules a resume() job.  If the coroutine has not
+     *    actually suspended yet (no co_await executed), the resume job
+     *    will try to call handle().resume() while the coroutine is still
+     *    running on another thread.  This is UB.  The mutex_ prevents
+     *    data corruption but the logic is wrong — always co_await
+     *    suspend() before calling post().  (The test incorrect_order()
+     *    shows this works only because mutex_ serializes the calls.)
+     *
+     *  BUG-RISK: Dropping the shared_ptr<CoroTaskRunner> before join().
+     *    The CoroTaskRunner destructor asserts that finished_ is true
+     *    (the coroutine completed). If you let the last shared_ptr die
+     *    while the coroutine is still running or suspended, you get an
+     *    assertion failure in debug and UB in release.  Always call
+     *    join() or expectEarlyExit() first.
+     *
+     *  BUG-RISK: Lambda captures outliving the coroutine frame.
+     *    The lambda passed to postCoroTask is heap-allocated (FuncStore)
+     *    to prevent dangling.  But objects captured by pointer still need
+     *    their own lifetime management.  If you capture a raw pointer to
+     *    a stack variable, and the stack frame exits before the coroutine
+     *    finishes, the pointer dangles.  Use shared_ptr or ensure the
+     *    pointed-to object outlives the coroutine.
+     *
+     *  BUG-RISK: Forgetting co_return in a void coroutine.
+     *    If the coroutine body falls off the end without co_return,
+     *    the compiler may silently treat it as co_return (per standard),
+     *    but some compilers warn.  Always write explicit co_return.
+     *
+     *  LIMITATION: CoroTaskRunner only supports CoroTask<void>.
+     *    The task_ member is CoroTask<void>.  To return values from
+     *    the top-level coroutine, write through a captured pointer
+     *    (as the tests demonstrate), or co_await inner CoroTask<T>
+     *    coroutines that return values.
+     *
+     *  LIMITATION: One coroutine per CoroTaskRunner.
+     *    init() must be called exactly once.  You cannot reuse a
+     *    CoroTaskRunner to run a second coroutine.  Create a new one
+     *    via postCoroTask() instead.
+     *
+     *  LIMITATION: No timeout on join().
+     *    join() blocks indefinitely.  If the coroutine is suspended
+     *    and never posted, join() will deadlock.  Use timed waits
+     *    on the gate pattern (condition_variable + wait_for) in tests.
+     */
+    class CoroTaskRunner : public std::enable_shared_from_this<CoroTaskRunner>
+    {
+    private:
+        // Per-coroutine thread-local storage. Swapped in before resume()
+        // and swapped out after, so each coroutine sees its own LocalValue
+        // state regardless of which worker thread executes it.
+        detail::LocalValues lvs_;
+
+        // Back-reference to the owning JobQueue. Used to post jobs,
+        // increment/decrement nSuspend_, and acquire jq_.mutex_.
+        JobQueue& jq_;
+
+        // Job type passed to addJob() when posting this coroutine.
+        JobType type_;
+
+        // Human-readable name for this coroutine job (for logging).
+        std::string name_;
+
+        // Number of in-flight resume operations (pending + active).
+        // Incremented by post(), decremented when resume() finishes.
+        // Guarded by mutexRun_. join() blocks until this reaches 0.
+        //
+        // A counter (not a bool) is needed because post() can be called
+        // from within the coroutine body (e.g. via yieldAndPost()),
+        // enqueuing a second resume while the first is still running.
+        // A bool would be clobbered: R2.post() sets true, then R1's
+        // cleanup sets false — losing the fact that R2 is still pending.
+        int runCount_ = 0;
+
+        // Serializes all coroutine resume() calls, preventing concurrent
+        // execution of the coroutine body on multiple threads. Handles the
+        // race where post() enqueues a resume before the coroutine has
+        // actually suspended (post-before-suspend pattern).
+        std::mutex mutex_;
+
+        // Guards runCount_. Used with cv_ for join() to wait
+        // until all pending/active resume operations complete.
+        std::mutex mutexRun_;
+
+        // Notified when runCount_ reaches zero, allowing
+        // join() waiters to wake up.
+        std::condition_variable cv_;
+
+        // The coroutine handle wrapper. Owns the coroutine frame.
+        // Set by init(). Reset to empty in resume() upon coroutine
+        // completion (to break the shared_ptr cycle) or in
+        // expectEarlyExit() on early termination.
+        CoroTask<void> task_;
+
+        /**
+         * Type-erased base for heap-stored callables.
+         * Prevents the coroutine lambda from being destroyed before
+         * the coroutine frame is done with it.
+         *
+         * @see FuncStore
+         */
+        struct FuncBase
+        {
+            virtual ~FuncBase() = default;
+        };
+
+        /**
+         * Concrete type-erased storage for a callable of type F.
+         * The coroutine frame stores a reference to the lambda's implicit
+         * object parameter. If the lambda is a temporary, that reference
+         * dangles after the call returns. FuncStore keeps it alive on
+         * the heap for the lifetime of the CoroTaskRunner.
+         */
+        template <class F>
+        struct FuncStore : FuncBase
+        {
+            F func;  // The stored callable (coroutine lambda).
+            explicit FuncStore(F&& f) : func(std::move(f))
+            {
+            }
+        };
+
+        // Heap-allocated callable storage. Set by init(), ensures the
+        // lambda outlives the coroutine frame that references it.
+        std::unique_ptr<FuncBase> storedFunc_;
+
+        // True once the coroutine has completed or expectEarlyExit() was
+        // called. Asserted in the destructor (debug) to catch leaked
+        // runners. Available in all builds to guard expectEarlyExit()
+        // against double-decrementing nSuspend_.
+        bool finished_ = false;
+
+    public:
+        /**
+         * Tag type for private construction. Prevents external code
+         * from constructing CoroTaskRunner directly. Use postCoroTask().
+         */
+        struct CreateT
+        {
+            explicit CreateT() = default;
+        };
+
+        /**
+         * Construct a CoroTaskRunner. Private by convention (CreateT tag).
+         *
+         * @param jq   The JobQueue this coroutine will run on
+         * @param type Job type for scheduling priority
+         * @param name Human-readable name for logging
+         */
+        CoroTaskRunner(CreateT, JobQueue&, JobType, std::string);
+
+        CoroTaskRunner(CoroTaskRunner const&) = delete;
+        CoroTaskRunner&
+        operator=(CoroTaskRunner const&) = delete;
+
+        /**
+         * Destructor. Asserts (debug) that the coroutine has finished
+         * or expectEarlyExit() was called.
+         */
+        ~CoroTaskRunner();
+
+        /**
+         * Initialize with a coroutine-returning callable.
+         * Must be called exactly once, after the object is managed by
+         * shared_ptr (because init uses shared_from_this internally).
+         * This is handled automatically by postCoroTask().
+         *
+         * @param f Callable: CoroTask<void>(shared_ptr<CoroTaskRunner>)
+         */
+        template <class F>
+        void
+        init(F&& f);
+
+        /**
+         * Increment the JobQueue's suspended-coroutine count (nSuspend_).
+         * Called when the coroutine is about to suspend. Every call
+         * must be balanced by a corresponding decrement (via resume()
+         * or onUndoSuspend()), or JobQueue::stop() will hang.
+         */
+        void
+        onSuspend();
+
+        /**
+         * Decrement nSuspend_ without resuming.
+         * Used to undo onSuspend() when a scheduled post() fails
+         * (e.g. JobQueue is stopping).
+         */
+        void
+        onUndoSuspend();
+
+        /**
+         * Suspend the coroutine.
+         * The awaiter's await_suspend() increments nSuspend_ before the
+         * coroutine actually suspends. The caller must later call post()
+         * or resume() to continue execution.
+         *
+         * @return An awaiter for use with `co_await runner->suspend()`
+         */
+        auto
+        suspend();
+
+        /**
+         * Suspend the coroutine and immediately repost it on the
+         * JobQueue. Combines suspend() + post() atomically inside
+         * await_suspend, so there is no window where an external
+         * event could race between the two.
+         *
+         * Equivalent to JobQueueAwaiter but defined as an inline
+         * awaiter returned from a member function. This avoids a
+         * GCC-12 coroutine codegen bug where an external awaiter
+         * struct (JobQueueAwaiter) used at multiple co_await points
+         * corrupts the coroutine state machine's resume index,
+         * causing the coroutine to hang on the third resumption.
+         *
+         * @return An awaiter for use with `co_await runner->yieldAndPost()`
+         */
+        auto
+        yieldAndPost();
+
+        /**
+         * Schedule coroutine resumption as a job on the JobQueue.
+         * Captures shared_from_this() to prevent this runner from being
+         * destroyed while the job is queued.
+         *
+         * @return true if the job was accepted; false if the JobQueue
+         *         is stopping (caller must handle cleanup)
+         */
+        bool
+        post();
+
+        /**
+         * Resume the coroutine on the current thread.
+         * Decrements nSuspend_, swaps in LocalValues, resumes the
+         * coroutine handle, swaps out LocalValues, and notifies join()
+         * waiters. Lock ordering (sequential, non-overlapping):
+         * jq_.mutex_ -> mutex_ -> mutexRun_.
+         *
+         * @pre post() must have been called before resume(). Direct
+         *      calls without a prior post() will corrupt runCount_
+         *      and break join().
+         */
+        void
+        resume();
+
+        /**
+         * @return true if the coroutine has not yet run to completion
+         */
+        bool
+        runnable() const;
+
+        /**
+         * Handle early termination when the coroutine never ran.
+         * Decrements nSuspend_ and destroys the coroutine frame to
+         * break the shared_ptr cycle (frame -> lambda -> runner -> frame).
+         * Called by postCoroTask() when post() fails.
+         */
+        void
+        expectEarlyExit();
+
+        /**
+         * Block until all pending/active resume operations complete.
+         * Uses cv_ + mutexRun_ to wait until runCount_ reaches 0.
+         * Warning: deadlocks if the coroutine is suspended and never posted.
+         */
+        void
+        join();
+    };
+
     using JobFunction = std::function<void()>;
 
     JobQueue(
@@ -197,6 +612,20 @@ public:
     std::shared_ptr<Coro>
     postCoro(JobType t, std::string const& name, F&& f);
 
+    /**
+     * Creates a C++20 coroutine and adds a job to the queue to run it.
+     *
+     * @param t The type of job.
+     * @param name Name of the job.
+     * @param f Callable with signature
+     * CoroTask<void>(std::shared_ptr<CoroTaskRunner>).
+     *
+     * @return shared_ptr to posted CoroTaskRunner. nullptr if not successful.
+     */
+    template <class F>
+    std::shared_ptr<CoroTaskRunner>
+    postCoroTask(JobType t, std::string const& name, F&& f);
+
     /**
      * Jobs waiting at this priority.
      */
@@ -419,7 +848,8 @@ private:
 
 }  // namespace xrpl
 
-#include <xrpl/core/Coro.ipp>  // IWYU pragma: keep
+#include <xrpl/core/Coro.ipp>            // IWYU pragma: keep
+#include <xrpl/core/CoroTaskRunner.ipp>  // IWYU pragma: keep
 
 namespace xrpl {
 
@@ -442,4 +872,82 @@ JobQueue::postCoro(JobType t, std::string const& name, F&& f)
     return coro;
 }
 
+// postCoroTask — entry point for launching a C++20 coroutine on the JobQueue.
+//
+// Control Flow
+// ============
+//
+//   postCoroTask(t, name, f)
+//     |
+//     +-- 1. Reserve a jobCounter_ slot — reject if JQ shutting down
+//     |
+//     +-- 2. ++nSuspend_   (mirrors Boost Coro ctor's implicit yield)
+//     |        The coroutine is "suspended" from the JobQueue's perspective
+//     |        even though it hasn't run yet — this keeps the JQ shutdown
+//     |        logic correct (it waits for nSuspend_ to reach 0).
+//     |
+//     +-- 3. Create CoroTaskRunner (shared_ptr, ref-counted)
+//     |
+//     +-- 4. runner->init(f)
+//     |        +-- Heap-allocate the lambda (FuncStore) to prevent
+//     |        |   dangling captures in the coroutine frame
+//     |        +-- task_ = f(shared_from_this())
+//     |              [coroutine created but NOT started — lazy initial_suspend]
+//     |
+//     +-- 5. runner->post()
+//     |        +-- addJob(type_, [resume]{})   → resume on worker thread
+//     |        +-- failure (JQ stopping):
+//     |              +-- runner->expectEarlyExit()
+//     |              |     --nSuspend_, destroy coroutine frame
+//     |              +-- return nullptr
+//     |
+//     +-- 6. Release the jobCounter_ slot (on return)
+//
+// Why reserve a jobCounter_ slot?
+// ===============================
+// JobQueue::stop() joins jobCounter_ before it acquires mutex_ and asserts
+// nSuspend_ == 0.  Without a reservation, stop() could run to completion in
+// the window between the ++nSuspend_ in step 2 and the balancing post() or
+// expectEarlyExit() in step 5, tripping that assert.  Holding a slot blocks
+// stop()'s join() for the whole function, closing the window.  wrap() also
+// returns nullopt once the counter is joined, so it doubles as the shutdown
+// check — a plain stopping_ read cannot do this, because the read and the
+// ++nSuspend_ are not a single atomic step.
+//
+// Why async post() instead of synchronous resume()?
+// ==================================================
+// The initial dispatch MUST use async post() so the coroutine body runs on
+// a JobQueue worker thread, not the caller's thread.  resume() swaps the
+// caller's thread-local LocalValues with the coroutine's private copy.
+// If the coroutine mutates LocalValues (e.g. thread_specific_storage test),
+// those mutations bleed back into the caller's thread-local state after the
+// swap-out, corrupting subsequent tests that share the same thread pool.
+// Async post() avoids this by running the coroutine on a worker thread whose
+// LocalValues are managed by the thread pool, not by the caller.
+//
+template <class F>
+std::shared_ptr<JobQueue::CoroTaskRunner>
+JobQueue::postCoroTask(JobType t, std::string const& name, F&& f)
+{
+    // Held until this function returns. Null once jobCounter_ is joined,
+    // which is how a shutting-down JobQueue rejects new coroutines.
+    auto const shutdownGuard = jobCounter_.wrap([]() {});
+    if (!shutdownGuard)
+        return nullptr;
+
+    {
+        std::scoped_lock const lock(mutex_);
+        ++nSuspend_;
+    }
+
+    auto runner = std::make_shared<CoroTaskRunner>(CoroTaskRunner::CreateT{}, *this, t, name);
+    runner->init(std::forward<F>(f));
+    if (!runner->post())
+    {
+        runner->expectEarlyExit();
+        runner.reset();
+    }
+    return runner;
+}
+
 }  // namespace xrpl

include/xrpl/core/JobQueueAwaiter.h

@@ -0,0 +1,212 @@
+#pragma once
+
+#include <xrpl/beast/utility/instrumentation.h>
+#include <xrpl/core/JobQueue.h>
+
+#include <coroutine>
+#include <memory>
+
+namespace xrpl {
+
+/**
+ * Awaiter that suspends and immediately reschedules on the JobQueue.
+ * Equivalent to calling yield() followed by post() in the old Coro API.
+ *
+ * Usage:
+ *     co_await JobQueueAwaiter{runner};
+ *
+ * What it waits for: The coroutine is re-queued as a job and resumes
+ * when a worker thread picks it up.
+ *
+ * Which thread resumes: A JobQueue worker thread.
+ *
+ * What await_resume() returns: void.
+ *
+ * Dependency Diagram
+ * ==================
+ *
+ *   JobQueueAwaiter
+ *   +----------------------------------------------+
+ *   | + runner : shared_ptr<CoroTaskRunner>         |
+ *   +----------------------------------------------+
+ *   | + await_ready()   -> false (always suspend)   |
+ *   | + await_suspend() -> bool (suspend or cancel) |
+ *   | + await_resume()  -> void                     |
+ *   +----------------------------------------------+
+ *          |                         |
+ *          | uses                    | uses
+ *          v                         v
+ *   CoroTaskRunner              JobQueue
+ *   .onSuspend()                (via runner->post() -> addJob)
+ *   .onUndoSuspend()
+ *   .post()
+ *
+ * Control Flow (await_suspend)
+ * ============================
+ *
+ *   co_await JobQueueAwaiter{runner}
+ *     |
+ *     +-- await_ready() -> false
+ *     +-- await_suspend(handle)
+ *           |
+ *           +-- runner->onSuspend()     // ++nSuspend_
+ *           +-- runner->post()          // addJob to JobQueue
+ *           |     |
+ *           |     +-- success? return noop_coroutine()
+ *           |     |     // coroutine stays suspended;
+ *           |     |     // worker thread will call resume()
+ *           |     +-- failure? (JQ stopping)
+ *           |           +-- runner->onUndoSuspend()  // --nSuspend_
+ *           |           +-- return handle  // symmetric transfer back
+ *           |                              // coroutine continues immediately
+ *           |                              // so it can clean up and co_return
+ *
+ * DEPRECATED — prefer `co_await runner->yieldAndPost()`
+ * =====================================================
+ *
+ * GCC-12 has a coroutine codegen bug where using this external awaiter
+ * struct at multiple co_await points in the same coroutine corrupts the
+ * state machine's resume index. After the second co_await, the third
+ * resumption enters handle().resume() but never reaches await_resume()
+ * or any subsequent user code — the coroutine hangs indefinitely.
+ *
+ * The fix is `co_await runner->yieldAndPost()`, which defines the
+ * awaiter as an inline struct inside a CoroTaskRunner member function.
+ * GCC-12 handles inline awaiters correctly at multiple co_await points.
+ *
+ * This struct is retained for single-use scenarios and documentation
+ * purposes. For any code that may use co_await in a loop or at
+ * multiple points, always use `runner->yieldAndPost()`.
+ *
+ * Usage Examples
+ * ==============
+ *
+ * 1. Yield and auto-repost (preferred — works on all compilers):
+ *
+ *     CoroTask<void> handler(auto runner) {
+ *         doPartA();
+ *         co_await runner->yieldAndPost();   // yield + repost
+ *         doPartB();                         // runs on a worker thread
+ *         co_return;
+ *     }
+ *
+ * 2. Multiple yield points in a loop:
+ *
+ *     CoroTask<void> batchProcessor(auto runner) {
+ *         for (auto& item : items) {
+ *             process(item);
+ *             co_await runner->yieldAndPost();  // let other jobs run
+ *         }
+ *         co_return;
+ *     }
+ *
+ * 3. Graceful shutdown — checking after resume:
+ *
+ *     CoroTask<void> longTask(auto runner, JobQueue& jq) {
+ *         while (hasWork()) {
+ *             co_await runner->yieldAndPost();
+ *             // If JQ is stopping, await_suspend resumes the coroutine
+ *             // immediately without re-queuing. Always check
+ *             // isStopping() to decide whether to proceed:
+ *             if (jq.isStopping())
+ *                 co_return;
+ *             doNextChunk();
+ *         }
+ *         co_return;
+ *     }
+ *
+ * Caveats / Pitfalls
+ * ==================
+ *
+ * BUG-RISK: Using a stale or null runner.
+ *   The runner shared_ptr must be valid and point to the CoroTaskRunner
+ *   that owns the coroutine currently executing. Passing a runner from
+ *   a different coroutine, or a default-constructed shared_ptr, is UB.
+ *
+ * BUG-RISK: Assuming resume happens on the same thread.
+ *   After co_await, the coroutine resumes on whatever worker thread
+ *   picks up the job. Do not rely on thread-local state unless it is
+ *   managed through LocalValue (which CoroTaskRunner automatically
+ *   swaps in/out).
+ *
+ * BUG-RISK: Ignoring the shutdown path.
+ *   When the JobQueue is stopping, post() fails and await_suspend()
+ *   resumes the coroutine immediately (symmetric transfer back to h).
+ *   The coroutine body continues on the same thread. If your code
+ *   after co_await assumes it was re-queued and is running on a worker
+ *   thread, that assumption breaks during shutdown. Always handle the
+ *   "JQ is stopping" case, either by checking jq.isStopping() or by
+ *   letting the coroutine fall through to co_return naturally.
+ *
+ * DIFFERENCE from runner->suspend() + runner->post():
+ *   Both JobQueueAwaiter and yieldAndPost() combine suspend + post
+ *   in one atomic operation. With the manual suspend()/post() pattern,
+ *   there is a window between the two calls where an external event
+ *   could race. The atomic awaiters remove that window — onSuspend()
+ *   and post() happen within the same await_suspend() call while the
+ *   coroutine is guaranteed to be suspended. Use yieldAndPost() unless
+ *   you need an external party to decide *when* to call post().
+ */
+struct JobQueueAwaiter
+{
+    // The CoroTaskRunner that owns the currently executing coroutine.
+    std::shared_ptr<JobQueue::CoroTaskRunner> runner;
+
+    /**
+     * Always returns false so the coroutine suspends.
+     */
+    // The C++ coroutine protocol mandates these awaiter names and
+    // instance-callable methods, which conflict with the project
+    // naming/static conventions.
+    // NOLINTBEGIN(readability-identifier-naming, readability-convert-member-functions-to-static)
+    [[nodiscard]] bool
+    await_ready() const noexcept
+    {
+        return false;
+    }
+
+    /**
+     * Increment nSuspend (equivalent to yield()) and schedule resume
+     * on the JobQueue (equivalent to post()). If the JobQueue is
+     * stopping, undoes the suspend count and transfers back to the
+     * coroutine so it can clean up and co_return.
+     *
+     * Returns a coroutine_handle<> (symmetric transfer) instead of
+     * bool to work around a GCC-12 codegen bug where bool-returning
+     * await_suspend leaves the coroutine in an invalid state —
+     * neither properly suspended nor resumed — causing a hang.
+     *
+     * WARNING: GCC-12 has an additional codegen bug where using this
+     * external awaiter struct at multiple co_await points in the same
+     * coroutine corrupts the state machine's resume index, causing the
+     * coroutine to hang on the third resumption. Prefer
+     * `co_await runner->yieldAndPost()` which uses an inline awaiter
+     * that GCC-12 handles correctly.
+     *
+     * @return noop_coroutine() to stay suspended (job posted);
+     *         the caller's handle to resume immediately (JQ stopping)
+     */
+    std::coroutine_handle<>
+    await_suspend(std::coroutine_handle<> h)
+    {
+        XRPL_ASSERT(runner, "xrpl::JobQueueAwaiter::await_suspend : runner is valid");
+        runner->onSuspend();
+        if (!runner->post())
+        {
+            // JobQueue is stopping. Undo the suspend count and
+            // transfer back to the coroutine so it can clean up
+            // and co_return.
+            runner->onUndoSuspend();
+            return h;
+        }
+        return std::noop_coroutine();
+    }
+
+    void
+    await_resume() const noexcept
+    {
+    }
+    // NOLINTEND(readability-identifier-naming, readability-convert-member-functions-to-static)
+};
+
+}  // namespace xrpl

include/xrpl/core/PerfLog.h

@@ -1,7 +1,6 @@
 #pragma once
 
 #include <xrpl/basics/Log.h>
-#include <xrpl/basics/StringUtilities.h>
 #include <xrpl/core/Job.h>
 #include <xrpl/json/json_value.h>
 
@@ -10,8 +9,7 @@
 #include <filesystem>
 #include <functional>
 #include <memory>
-#include <span>
-#include <string_view>
+#include <string>
 
 namespace beast {
 class Journal;
@@ -69,7 +67,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcStart(std::string_view method, std::uint64_t requestId) = 0;
+    rpcStart(std::string const& method, std::uint64_t requestId) = 0;
 
     /**
      * Log successful finish of RPC call
@@ -78,7 +76,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcFinish(std::string_view method, std::uint64_t requestId) = 0;
+    rpcFinish(std::string const& method, std::uint64_t requestId) = 0;
 
     /**
      * Log errored RPC call
@@ -87,7 +85,7 @@ public:
      * @param requestId Unique identifier to track command
      */
     virtual void
-    rpcError(std::string_view method, std::uint64_t requestId) = 0;
+    rpcError(std::string const& method, std::uint64_t requestId) = 0;
 
     /**
      * Log queued job
@@ -152,20 +150,10 @@ public:
 PerfLog::Setup
 setupPerfLog(Section const& section, std::filesystem::path const& configDir);
 
-/**
- * @param methodNames The RPC methods to count, one counter per name. Reported
- *        as JSON keys that borrow each name and read it as a C string, which is
- *        why the parameter type requires one that reaches its terminating null.
- *        The names must outlive the returned object, which holds views of them.
- *        The range itself need not: it is copied.
- *        Passed in rather than looked up here, so that this layer needs no
- *        knowledge of the dispatch table.
- */
 std::unique_ptr<PerfLog>
 makePerfLog(
     PerfLog::Setup const& setup,
     Application& app,
-    std::span<NullTerminatedView const> methodNames,
     beast::Journal journal,
     std::function<void()>&& signalStop);
 
@@ -173,7 +161,7 @@ template <typename Func, class Rep, class Period>
 auto
 measureDurationAndLog(
     Func&& func,
-    std::string_view actionDescription,
+    std::string const& actionDescription,
     std::chrono::duration<Rep, Period> maxDelay,
     beast::Journal const& journal)
 {

include/xrpl/ledger/ApplyViewImpl.h

@@ -13,7 +13,6 @@
 #include <xrpl/protocol/TxMeta.h>
 
 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <optional>
 
@@ -69,18 +68,6 @@ public:
         deliver_ = amount;
     }
 
-    void
-    setGasUsed(std::optional<std::uint32_t> const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    void
-    setVMReturnCode(std::int32_t const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
     /**
      * Get the number of modified entries
      */
@@ -101,8 +88,6 @@ public:
 
 private:
     std::optional<STAmount> deliver_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;
 };
 
 }  // namespace xrpl

include/xrpl/ledger/View.h

@@ -24,7 +24,6 @@
 #include <optional>
 #include <set>
 #include <utility>
-#include <vector>
 
 namespace xrpl {
 
@@ -199,10 +198,7 @@ dirLink(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it (account-based or credential-based).
- *    - Expects any credentials passed in to already exist in the ledger, and
- *      returns an internal error otherwise. Validate them beforehand with
- *      credentials::valid().
+ *      the sender has it.
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -213,8 +209,7 @@ canWithdraw(
     AccountID const& to,
     SLE::const_ref toSle,
     STAmount const& amount,
-    bool hasDestinationTag,
-    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
+    bool hasDestinationTag);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
@@ -227,10 +222,7 @@ canWithdraw(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it (account-based or credential-based).
- *    - Expects any credentials passed in to already exist in the ledger, and
- *      returns an internal error otherwise. Validate them beforehand with
- *      credentials::valid().
+ *      the sender has it.
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -240,25 +232,20 @@ canWithdraw(
     AccountID const& from,
     AccountID const& to,
     STAmount const& amount,
-    bool hasDestinationTag,
-    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
+    bool hasDestinationTag);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
- * destination account (sfDestination). Credentials, if any, are taken from the
- * transaction's sfCredentialIDs field.
+ * destination account (sfDestination).
  *
  *    - Checks that the receiver account exists.
  *    - If the receiver requires a destination tag, check that one exists, even
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it (account-based or credential-based).
- *    - Expects any credentials in sfCredentialIDs to already exist in the
- *      ledger, and returns an internal error otherwise. Validate them
- *      beforehand with credentials::valid().
+ *      the sender has it.
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */

include/xrpl/ledger/detail/ApplyStateTable.h

@@ -16,7 +16,6 @@
 #include <xrpl/protocol/XRPAmount.h>
 
 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <map>
 #include <optional>
@@ -63,8 +62,6 @@ public:
         TER ter,
         std::optional<STAmount> const& deliver,
         std::optional<uint256 const> const& parentBatchId,
-        std::optional<std::uint32_t> const& gasUsed,
-        std::optional<std::int32_t> const& vmReturnCode,
         bool isDryRun,
         beast::Journal j);
 

include/xrpl/ledger/helpers/AccountRootHelpers.h

@@ -15,6 +15,7 @@
 #include <cstdint>
 #include <expected>
 #include <optional>
+#include <set>
 #include <vector>
 
 namespace xrpl {
@@ -352,14 +353,14 @@ pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
  *
  * The list is constructed during initialization and is const after that.
  * Pseudo-account designator fields MUST be maintained by including the
- * SField::kSmdPseudoAccount flag in the SField definition.
+ * SField::sMD_PseudoAccount flag in the SField definition.
  */
 [[nodiscard]] std::vector<SField const*> const&
 getPseudoAccountFields();
 
 /**
- * Returns true if and only if sleAcct is a pseudo-account of any kind
- * (i.e. carries at least one field flagged with SField::kSmdPseudoAccount).
+ * Returns true if and only if sleAcct is a pseudo-account or specific
+ * pseudo-accounts in pseudoFieldFilter.
  *
  * Returns false if sleAcct is:
  * - NOT a pseudo-account OR
@@ -367,15 +368,18 @@ getPseudoAccountFields();
  * - null pointer
  */
 [[nodiscard]] bool
-isPseudoAccount(SLE::const_pointer sleAcct);
+isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter = {});
 
 /**
  * Convenience overload that reads the account from the view.
  */
 [[nodiscard]] inline bool
-isPseudoAccount(ReadView const& view, AccountID const& accountId)
+isPseudoAccount(
+    ReadView const& view,
+    AccountID const& accountId,
+    std::set<SField const*> const& pseudoFieldFilter = {})
 {
-    return isPseudoAccount(view.read(keylet::account(accountId)));
+    return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
 }
 
 /**

include/xrpl/ledger/helpers/EscrowHelpers.h

@@ -12,7 +12,6 @@
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Concepts.h>
 #include <xrpl/protocol/Feature.h>
-#include <xrpl/protocol/Fees.h>
 #include <xrpl/protocol/Indexes.h>
 #include <xrpl/protocol/Issue.h>
 #include <xrpl/protocol/Keylet.h>
@@ -26,8 +25,6 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
-#include <cstdint>
-
 namespace xrpl {
 
 template <ValidIssueType T>
@@ -275,45 +272,4 @@ escrowUnlockApplyHelper<MPTIssue>(
         journal);
 }
 
-/**
- * Smart escrow kill switches, driven by the voted FeeSettings.
- *
- * Zeroing `bytecodeSizeLimit` stops new uploads while leaving existing escrows
- * finishable without forcing holders to wait for `CancelAfter`.
- * Zeroing `gasLimit` stops both.
- */
-/** @{ */
-inline bool
-isBytecodeUploadDisabled(Fees const& fees)
-{
-    return fees.bytecodeSizeLimit == 0 || fees.gasLimit == 0;
-}
-
-inline bool
-isBytecodeExecutionDisabled(Fees const& fees)
-{
-    return fees.gasLimit == 0;
-}
-/** @} */
-
-template <class T>
-static int32_t
-calculateAdditionalReserve(T const& finishFunction)
-{
-    // First 500 bytes included in the normal reserve
-    // Each additional 500 bytes requires an additional reserve
-    static auto constexpr kBytecodeReserveIncrement = 500;
-
-    if (!finishFunction)
-        return 1;
-
-    // Ceiling division answers 0 for an empty field, which would subtract less than
-    // the create added.
-    auto const size = finishFunction->size();
-    if (size == 0)
-        return 1;
-
-    return static_cast<int32_t>((size + kBytecodeReserveIncrement - 1) / kBytecodeReserveIncrement);
-}
-
 }  // namespace xrpl

include/xrpl/ledger/helpers/LendingHelpers.h

@@ -324,12 +324,6 @@ computeFullPaymentInterest(
     std::uint32_t startDate,
     TenthBips32 closeInterestRate);
 
-// Returns true if the loan's next payment is late per protocol rules. The
-// boundary is amendment-gated: with fixCleanup3_4_0 the due date must be
-// strictly in the past, otherwise the exact due-date instant counts as late.
-[[nodiscard]] bool
-isPaymentLate(ReadView const& view, SLE::const_ref loanSle);
-
 // Deltas applied to Vault.AssetsTotal and LoanBroker.DebtTotal at a single
 // accounting touch point (origination, payment, impair/unimpair/default).
 struct AccountingDeltas
@@ -338,9 +332,9 @@ struct AccountingDeltas
     Number debtTotalDelta;
 };
 
-// Instant interest recognition (pre-LendingProtocolV1_1): interest is
-// recognized into AssetsTotal/DebtTotal immediately, at origination.
-namespace instant_recognition {
+// Whole-life (pre-LendingProtocolV1_1) recognition model: interest is
+// recognized into AssetsTotal/DebtTotal up front, at origination.
+namespace accrual {
 
 // LoanSet origination: what's added to Vault.AssetsTotal and LoanBroker.DebtTotal
 AccountingDeltas
@@ -362,7 +356,7 @@ loanVaultExposure(SLE::const_ref loanSle);
 AccountingDeltas
 loanPaymentDeltas(LoanPaymentParts const& parts);
 
-}  // namespace instant_recognition
+}  // namespace accrual
 
 // Cash-basis (LendingProtocolV1_1) recognition model: AssetsTotal/DebtTotal
 // are principal-only, interest is recognized only as it's actually paid.
@@ -381,7 +375,7 @@ loanPaymentDeltas(LoanPaymentParts const& parts);
 
 // Public dispatchers: pick cash_basis:: if featureLendingProtocolV1_1 is
 // enabled AND the Vault's LEVersion (VaultHelpers::getVaultVersion) is
-// VaultVersion::CashBasis, else instant_recognition::. These are the only entry points
+// VaultVersion::CashBasis, else accrual::. These are the only entry points
 // transactors call.
 AccountingDeltas
 loanOriginationDeltas(