Make ApplyFlags a scoped enumeration:

Convert ApplyFlags to a scoped enum, drop the now-redundant `Tap`
prefix from its enumerators and replace the hand-written bitwise
operators by opting in to enum_bitops.

No functional change.

.clang-tidy

@@ -5,10 +5,7 @@ Checks: "-*,
   -bugprone-exception-escape,
   -bugprone-implicit-widening-of-multiplication-result,
   -bugprone-narrowing-conversions,
-  -bugprone-signed-bitwise,
-  -bugprone-std-exception-baseclass,
   -bugprone-throwing-static-initialization,
-  -bugprone-unhandled-code-paths,
 
   cppcoreguidelines-*,
   -cppcoreguidelines-avoid-c-arrays,
@@ -17,7 +14,6 @@ Checks: "-*,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-avoid-non-const-global-variables,
   -cppcoreguidelines-c-copy-assignment-signature,
-  -cppcoreguidelines-explicit-constructor,
   -cppcoreguidelines-interfaces-global-init,
   -cppcoreguidelines-macro-usage,
   -cppcoreguidelines-missing-std-forward,
@@ -36,7 +32,6 @@ Checks: "-*,
   llvm-namespace-comment,
 
   misc-*,
-  -misc-explicit-constructor,
   -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
@@ -50,8 +45,6 @@ Checks: "-*,
   -modernize-avoid-c-style-cast,
   -modernize-return-braced-init-list,
   -modernize-use-integer-sign-comparison,
-  -modernize-use-string-view,
-  -modernize-use-structured-binding,
   -modernize-use-trailing-return-type,
 
   performance-*,
@@ -60,7 +53,6 @@ Checks: "-*,
   -performance-noexcept-move-constructor,
   -performance-unnecessary-copy-initialization,
   -performance-unnecessary-value-param,
-  -performance-use-std-move,
 
   readability-*,
   -readability-avoid-const-params-in-decls,
@@ -73,10 +65,7 @@ Checks: "-*,
   -readability-named-parameter,
   -readability-qualified-auto,
   -readability-redundant-access-specifiers,
-  -readability-redundant-nested-if,
-  -readability-redundant-qualified-alias,
   -readability-static-accessed-through-instance,
-  -readability-trivial-switch,
   -readability-uppercase-literal-suffix
   "
 # ---

.cspell.config.yaml

@@ -69,7 +69,6 @@ words:
   - Btrfs
   - Buildx
   - canonicality
-  - cdylib
   - canonicalised
   - cctools
   - changespq
@@ -107,7 +106,6 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
-  - desugars
   - desync
   - desynced
   - determ
@@ -134,7 +132,6 @@ words:
   - gcov
   - gcovr
   - ghead
-  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
@@ -144,9 +141,7 @@ words:
   - hwaddress
   - hwrap
   - ifndef
-  - impls
   - inequation
-  - initialiser
   - Injectivity
   - insuf
   - insuff
@@ -182,7 +177,6 @@ words:
   - lsmf
   - ltype
   - mathbunnyru
-  - maxima
   - mcmodel
   - MEMORYSTATUSEX
   - MPTAMM
@@ -202,7 +196,6 @@ words:
   - mptokenissuance
   - mptokens
   - mpts
-  - mpt
   - mtgox
   - multisig
   - multisign
@@ -259,7 +252,6 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
-  - qself
   - queuable
   - Raphson
   - rcflags
@@ -318,7 +310,6 @@ words:
   - STATSDCOLLECTOR
   - stissue
   - stnum
-  - stnumber
   - stobj
   - stobject
   - stpath
@@ -359,7 +350,6 @@ words:
   - unflatten
   - unfund
   - unimpair
-  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -380,8 +370,6 @@ words:
   - vfalco
   - vinnie
   - wasmi
-  - wasmparser
-  - Werror
   - wextra
   - wptr
   - writeme
@@ -390,11 +378,9 @@ words:
   - xbridge
   - xchain
   - xcrun
-  - xfloat
   - ximinez
   - XMACRO
   - xored
-  - xrp
   - xrpkuwait
   - xrpl
   - xrpld

.gersemi/definitions.cmake

@@ -108,75 +108,3 @@ endfunction()
 
 function(patch_nix_binary target)
 endfunction()
-
-function(rpcspec_generate_instantiations)
-    set(options)
-    set(oneValueArgs OUT_VAR VALUE_TYPE VIEW_HEADER INCLUDE_DIR)
-    set(multiValueArgs HANDLERS)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_import_crate)
-    set(options
-        ALL_FEATURES
-        NO_DEFAULT_FEATURES
-        NO_STD
-        NO_LINKER_OVERRIDE
-        NO_USES_TERMINAL
-        LOCKED
-        FROZEN
-    )
-    set(oneValueArgs MANIFEST_PATH PROFILE IMPORTED_CRATES)
-    set(multiValueArgs
-        CRATE_TYPES
-        CRATES
-        FEATURES
-        FLAGS
-        OVERRIDE_CRATE_TYPE
-    )
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(corrosion_set_env_vars target_name env_var)
-endfunction()
-
-function(corrosion_add_cxxbridge cxx_target)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()
-
-function(_unlink_libgcc_s crate)
-endfunction()
-
-function(add_xrpl_crate name)
-    set(options)
-    set(oneValueArgs CRATE)
-    set(multiValueArgs FILES)
-    cmake_parse_arguments(
-        THIS_FUNCTION_PREFIX
-        "${options}"
-        "${oneValueArgs}"
-        "${multiValueArgs}"
-        ${ARGN}
-    )
-endfunction()

.github/actions/build-deps/action.yml

@@ -15,9 +15,9 @@ inputs:
     required: false
     default: "false"
   log_verbosity:
-    description: 'The logging verbosity ("quiet", "verbose"), or empty to use the Conan defaults.'
+    description: "The logging verbosity."
     required: false
-    default: ""
+    default: "verbose"
   sanitizers:
     description: "The sanitizers to enable."
     required: false
@@ -35,16 +35,6 @@ runs:
         LOG_VERBOSITY: ${{ inputs.log_verbosity }}
         SANITIZERS: ${{ inputs.sanitizers }}
       run: |
-        # By default, leave the verbosity unset, so CMake configure output is
-        # shown, but compile commands and Boost's b2 debug output (~85k lines
-        # when "verbose") are not.
-        VERBOSITY_ARGS=()
-        if [[ -n "${LOG_VERBOSITY}" ]]; then
-            VERBOSITY_ARGS=(
-                --conf:all tools.build:verbosity="${LOG_VERBOSITY}"
-                --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}"
-            )
-        fi
         conan install \
             --profile:all ci \
             --build="${BUILD_OPTION}" \
@@ -52,13 +42,6 @@ runs:
             --options:host='&:xrpld=True' \
             --settings:all build_type="${BUILD_TYPE}" \
             --conf:all tools.build:jobs=${BUILD_NPROC} \
-            "${VERBOSITY_ARGS[@]}" \
-            --format=json \
-            . >"${RUNNER_TEMP}/conan-graph.json"
-
-    # Tools that run during the build may only load glibc from the Nix store,
-    # as their package ID survives a GCC runtime update.
-    - name: Check build-context packages for Nix store dependencies (Linux)
-      if: ${{ runner.os == 'Linux' }}
-      shell: bash
-      run: ./bin/nix/check-build-context-runtime.sh "${RUNNER_TEMP}/conan-graph.json"
+            --conf:all tools.build:verbosity="${LOG_VERBOSITY}" \
+            --conf:all tools.compilation:verbosity="${LOG_VERBOSITY}" \
+            .

.github/scripts/levelization/results/ordering.txt

@@ -1,9 +1,6 @@
 benchmarks.libxrpl > xrpl.basics
 benchmarks.libxrpl > xrpl.config
 benchmarks.libxrpl > xrpl.nodestore
-benchmarks.libxrpl > xrpl.protocol
-benchmarks.libxrpl > xrpl.protocol_autogen
-benchmarks.libxrpl > xrpl.tx
 libxrpl.basics > xrpl.basics
 libxrpl.conditions > xrpl.basics
 libxrpl.conditions > xrpl.conditions

.github/scripts/strategy-matrix/generate.py

@@ -12,6 +12,7 @@ _BASE_CMAKE_ARGS = [
     "-Dwerr=ON",
     "-Dxrpld=ON",
     "-Dwextra=ON",
+    "-Drust=ON",
 ]
 
 # The package formats a config can be packaged as, each with its own

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-3d526d4",
+  "image_tag": "sha-060957e",
   "configs": {
     "ubuntu": [
       {
@@ -74,7 +74,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f"
         }
       },
       {
@@ -86,7 +86,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON -Dassert=ON",
         "package": {
           "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-e6055dd",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-3a2d19f",
           "variant": "assert"
         }
       }
@@ -101,7 +101,7 @@
         "extra_cmake_args": "-Dvalidator_keys=ON",
         "package": {
           "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-e6055dd"
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-3a2d19f"
         }
       }
     ]

.github/workflows/build-nix-images.yml

@@ -12,7 +12,8 @@ on:
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
-      - "bin/nix/default-loader-path.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
@@ -24,8 +25,8 @@ on:
       - "!nix/devshell.nix"
       - "!nix/check-tools/**"
       - "bin/check-tools.sh"
-      - "bin/nix/default-loader-path.sh"
-      - "bin/install/sanitizer-libs.sh"
+      - "bin/default-loader-path.sh"
+      - "bin/install-sanitizer-libs.sh"
   workflow_dispatch:
 
 concurrency:

.github/workflows/build-packaging-images.yml

@@ -5,12 +5,13 @@ on:
     branches:
       - develop
     paths:
-      - "bin/install/packaging-tools.sh"
+      - ".github/workflows/build-packaging-images.yml"
+      - "bin/install-packaging-tools.sh"
       - "package/images/packaging/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install/packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
       - "package/images/packaging/**"
   workflow_dispatch:
 

.github/workflows/build-pre-commit-image.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - develop
     paths:
+      - ".github/workflows/build-pre-commit-image.yml"
       - "bin/pre-commit/Dockerfile"
       - "rust-toolchain.toml"
   pull_request:

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.
@@ -66,7 +66,7 @@ jobs:
 
       - name: Create issue
         if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
         with:
           title: "cargo audit found vulnerabilities"
           body_file: /tmp/cargo-audit-issue.md

.github/workflows/check-releases-merged.yml

@@ -53,7 +53,7 @@ jobs:
 
       - name: Create issue
         if: ${{ failure() && github.event_name == 'schedule' && github.repository == 'XRPLF/rippled' }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
         with:
           title: "Releases not merged back into develop"
           body_file: ${{ env.ISSUE_FILE }}

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -108,7 +108,7 @@ jobs:
 
       - name: Upload regenerated snapshot
         if: failure()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: check-tools-${{ runner.os }}-${{ runner.arch }}
           path: ${{ matrix.snapshot }}

.github/workflows/on-pr.yml

@@ -93,8 +93,9 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
+            bin/check-nix-store-refs.sh
             bin/check-tools.sh
-            bin/nix/**
+            bin/default-loader-path.sh
             cfg/**
             cmake/**
             conan/**

.github/workflows/on-trigger.yml

@@ -31,8 +31,9 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
+      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
-      - "bin/nix/**"
+      - "bin/default-loader-path.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@d7f2acb47d9662e1e2f8b1f5feffa6d21cc3290a
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-70b8fd3" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -186,6 +186,9 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ inputs.build_type }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ inputs.sanitizers }}
 
       - name: Configure CMake
@@ -254,20 +257,20 @@ jobs:
       # cache included, since what it holds is what gets uploaded and reused.
       - name: Check the build output for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}"
+        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
 
       # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
       # images always references the store. Same condition it uses.
       - name: Check for Nix store references (Linux)
         if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
         run: |
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
-          ./bin/nix/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
+          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld_tests"
 
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
@@ -280,7 +283,7 @@ jobs:
 
       - name: Upload the binary (Linux)
         if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpld-${{ inputs.config_name }}
           path: ${{ env.BUILD_DIR }}/xrpld
@@ -294,7 +297,7 @@ jobs:
 
       - name: Upload the validator-keys binary
         if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: validator-keys-${{ inputs.config_name }}
           path: |
@@ -305,7 +308,7 @@ jobs:
 
       - name: Upload the test binary (Linux)
         if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpl_tests-${{ inputs.config_name }}
           path: ${{ env.BUILD_DIR }}/xrpl_tests
@@ -321,7 +324,7 @@ jobs:
 
       - name: Upload server definitions
         if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: server-definitions
           path: ${{ env.BUILD_DIR }}/server_definitions.json
@@ -385,10 +388,7 @@ jobs:
       - name: Run Rust tests
         if: ${{ !inputs.build_only }}
         working-directory: crates
-        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
-        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
-        # whose C++ shims only the CMake build defines. The other runners cover these tests.
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn
 
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a

.github/workflows/reusable-clang-tidy.yml

@@ -34,7 +34,7 @@ jobs:
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3d526d4"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -73,6 +73,7 @@ jobs:
         with:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ env.BUILD_TYPE }}
+          log_verbosity: verbose
 
       - name: Configure CMake
         working-directory: ${{ env.BUILD_DIR }}
@@ -85,6 +86,7 @@ jobs:
               -Dwerr=ON \
               -Dxrpld=ON \
               -Dverify_headers=ON \
+              -Drust=ON \
               ..
 
       - name: Build clang-tidy prerequisites
@@ -108,7 +110,7 @@ jobs:
 
       - name: Upload clang-tidy output
         if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: ${{ env.OUTPUT_FILE }}
           archive: false
@@ -132,7 +134,7 @@ jobs:
 
       - name: Upload clang-tidy diff output
         if: ${{ github.event.repository.visibility == 'public' && steps.files_changed.outcome != 'success' }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           path: ${{ env.DIFF_FILE }}
           archive: false
@@ -184,7 +186,7 @@ jobs:
 
       - name: Create issue
         if: ${{ steps.run_clang_tidy.outcome != 'success' && inputs.create_issue_on_failure }}
-        uses: XRPLF/actions/create-issue@b489c21d53928f7dab4874912fec40e4f6c9e85e
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
         with:
           title: "Clang-tidy check failed"
           body_file: ${{ env.ISSUE_FILE }}

.github/workflows/reusable-package-test-install.yml

@@ -44,7 +44,7 @@ jobs:
       # Every package lands in one directory; the step below picks its own,
       # which keeps this independent of the artifact names.
       - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: "*-pkg"
           merge-multiple: true

.github/workflows/reusable-package.yml

@@ -100,18 +100,18 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
       - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}
           path: ${{ env.BUILD_DIR }}
 
       - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ matrix.validator_keys_artifact_name }}
           path: ${{ env.BUILD_DIR }}
@@ -151,7 +151,7 @@ jobs:
       # version starts with a digit and a longer name does not, so that one digit
       # is what tells 'xrpld-3.4.1-...' from 'xrpld-assert-3.4.1-...'.
       - name: Upload package artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg
           path: |
@@ -160,7 +160,7 @@ jobs:
           if-no-files-found: error
 
       - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
           path: |
@@ -225,13 +225,13 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
       # Both artifacts, so the debug symbols are published alongside the package.
       - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
           merge-multiple: true
@@ -287,7 +287,7 @@ jobs:
         run: echo "PUSH=${PUSH}" | tee -a "${GITHUB_ENV}"
 
       - name: Download package artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: "*-pkg"
           merge-multiple: true
@@ -295,7 +295,7 @@ jobs:
 
       - name: Download voidstar binary
         if: ${{ matrix.target == 'voidstar' }}
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: xrpld-ubuntu-clang-debug-amd64-voidstar
           path: ${{ env.CONTEXT }}

.github/workflows/reusable-rust.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -41,7 +41,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -70,7 +70,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3d526d4
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@8e98d61f011fd2a67f3fde5f0f075662c099a527
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -108,11 +108,14 @@ jobs:
           build_nproc: ${{ steps.nproc.outputs.nproc }}
           build_type: ${{ matrix.build_type }}
           force_build: ${{ github.event_name == 'schedule' || github.event.inputs.force_source_build == 'true' }}
+          # Set the verbosity to "quiet" for Windows to avoid an excessive
+          # amount of logs. For other OSes, the "verbose" logs are more useful.
+          log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
       - name: Check the Conan cache for Nix store references (Nix toolchain)
         if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/nix/check-nix-store-refs.sh "${CONAN_HOME}"
+        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}

.pre-commit-config.yaml

@@ -60,7 +60,7 @@ repos:
         types_or: [c++, c]
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: a9a8a861f30ed207ead7d5a3b7e8032283ba5da7 # frozen: v23.1.2
+    rev: e2b496dc2bd8340c2524cb9a2d2a943cde1bb6df # frozen: v23.1.1
     hooks:
       - id: clang-format
         args: [--style=file]
@@ -82,10 +82,9 @@ repos:
         files: ^crates/.*\.rs$
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: 28010ddd6016e1a0f7bd232acb6536ef996ae897 # frozen: 0.29.2
+    rev: f1c4833f8cf23c6d952673abc73525411a5719e8 # frozen: 0.29.1
     hooks:
       - id: gersemi
-        args: [-i, --warnings-as-errors]
 
   - repo: https://github.com/rbubley/mirrors-prettier
     rev: ef4a397f916211b4a39ccf9d3d9cbb6562157251 # frozen: v3.9.9
@@ -96,19 +95,19 @@ repos:
   # Scoped to package/: the rest of the repo's Python has pre-existing findings,
   # so widening these is its own change.
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: f12be1ebaa5351c1fc76472de98db2c3446c8253 # frozen: v0.16.10
+    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd # frozen: v0.16.9
     hooks:
       - id: ruff-check
         args: [--fix]
         files: ^package/.*\.py$
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 96ae3e5802f3fe2d551e703e18f0a367d1a81ac2 # frozen: 26.10.0
+    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 2834ec6639549dd6796205c8f011dedcd587288b # frozen: v2.4.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee # frozen: v2.3.1
     hooks:
       - id: mypy
         args: [--strict]

AGENTS.md

@@ -39,4 +39,4 @@ Paths below reflect the current layout; update this section if modularization mo
 - `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
 - `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
 - `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
-- `crates/` — a Rust workspace holding the WebAssembly engine that runs Smart Escrow contracts, bridged into C++ via `cxxbridge`/the `cxx` crate; see [crates/README.md](./crates/README.md) for more details.
+- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

API-CHANGELOG.md

@@ -28,18 +28,13 @@ Version 3.5.0 is not yet released.
 
 ### Additions in 3.5.0
 
-- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive the same `transaction` message as the `transactions` stream for each validated transaction whose metadata affects a subscribed issuance. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
-- `ledger_entry`: Add full support for checks, NFT offers, payment channels, and signer lists. ([#6319](https://github.com/XRPLF/rippled/pull/6319))
+- `subscribe`, `unsubscribe`: Added an optional `mpt_issuances` request field, an array of MPT issuance IDs (hex strings). Subscribers receive a message with `type` `mptTransaction` for each validated transaction whose metadata affects a subscribed issuance; the message has the same fields as the `transactions` stream. MPT issuance subscriptions count toward the per-connection subscription limit. An empty array, a non-array value, or an invalid ID returns `invalidParams`. ([#5671](https://github.com/XRPLF/rippled/pull/5671))
 
 ### Bugfixes in 3.5.0
 
 - `channel_authorize`: The `channel_id` field now returns an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 - `channel_verify`: The `channel_id` and `signature` fields now return an `invalidParams` error if the value is not a string. [#7582](https://github.com/XRPLF/rippled/pull/7582)
 
-### Bugfixes in 3.5.0
-
-- `feature`: The admin-only `vetoed` field now returns `invalidParams` unless its value is a boolean. [#7583](https://github.com/XRPLF/rippled/pull/7583)
-
 ## XRP Ledger server version 3.4.0
 
 Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
@@ -60,7 +55,6 @@ Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta
 - `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
 - `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
 - `noripple_check`: The `transactions` field is no longer included in error responses; it is still returned (possibly as an empty array) whenever `transactions` is `true` and the request succeeds. A malformed `account` is now rejected before the ledger is looked up, so that error response no longer carries the `ledger_hash`, `ledger_index`, and `validated` fields ([#6303](https://github.com/XRPLF/rippled/pull/6303)).
-- `transaction_entry`: An object or an array in `tx_hash` now returns `malformedRequest`, like any other value that is not a hex hash, instead of an `internal` error.
 
 ## XRP Ledger server version 3.3.0
 

BUILD.md

@@ -1,6 +1,6 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, Rust, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
 
 ## Minimum Requirements
 
@@ -308,6 +308,7 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 | ---------------- | ------------- | ----------------------------------------------------------------------------- |
 | `assert`         | OFF           | Force enabling assertions.                                                    |
 | `coverage`       | OFF           | Prepare the coverage report.                                                  |
+| `rust`           | OFF           | Build the Rust crates and the C++ code that depends on them.                  |
 | `tests`          | OFF           | Build tests.                                                                  |
 | `unity`          | OFF           | Configure a unity build.                                                      |
 | `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
@@ -322,15 +323,23 @@ builds may be faster for incremental builds, and can be helpful for detecting
 
 ### Rust crates
 
-The build compiles the Rust workspace in `crates/` and generates the cxxbridge
-bindings the C++ side includes, so it needs a Rust toolchain (`cargo`, `rustc`)
-at the channel pinned in [`rust-toolchain.toml`](./rust-toolchain.toml). The
-[Nix development shell](./docs/build/nix.md) provides one; otherwise install it
-as described in [Rust](./docs/build/environment.md#rust).
+The Rust crates in `crates/` are only part of the build when `rust` is ON. With
+`-Drust=OFF` (the default) the `crates` directory is not added to the build, no
+cxxbridge bindings are generated, and the C++ tests that exercise the Rust
+interop are not compiled — so no Rust toolchain is needed. CI builds always pass
+`-Drust=ON`.
+
+With `-Drust=ON` you need one extra dependency: a Rust toolchain (`cargo`,
+`rustc`) matching the channel pinned in
+[`rust-toolchain.toml`](./rust-toolchain.toml), which compiles the crates and
+generates the cxxbridge bindings. It is provided by the
+[Nix development shell](./docs/build/nix.md), so `-Drust=ON` works there without
+any extra setup; otherwise install it as described in
+[Rust](./docs/build/environment.md#rust).
 
 The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake (CI runs them with
-`cargo nextest`):
+need only the Rust toolchain, independently of CMake and of the `rust` option
+(CI runs them with `cargo nextest`):
 
 ```bash
 cargo test --manifest-path crates/Cargo.toml --workspace

CMakeLists.txt

@@ -160,8 +160,11 @@ endif()
 
 add_custom_target(tidy_prerequisites)
 
-add_subdirectory(crates)
+if(rust)
+    add_subdirectory(crates)
+endif()
 include(XrplCore)
+
 include(XrplProtocolAutogen)
 include(XrplInstall)
 include(XrplValidatorKeys)

CONTRIBUTING.md

@@ -336,7 +336,7 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must generate the files it depends on (protobuf headers and the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
+Before running clang-tidy, you must generate the files it depends on (protobuf headers, and, when the project is configured with `-Drust=ON`, the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
 
 ```bash
 cmake --build build --target tidy_prerequisites

bin/check-nix-store-refs.sh

@@ -10,7 +10,7 @@
 # alone; the scripts in a Conan cache are all git hook samples and autotools
 # scratch, 36 false positives to 0 real.
 #
-# Usage: bin/nix/check-nix-store-refs.sh <path>
+# Usage: bin/check-nix-store-refs.sh <path>
 
 set -euo pipefail
 

bin/check-tools.sh

@@ -20,11 +20,9 @@
 # development setups, but not in the macOS CI environment. They are checked
 # everywhere except when running in CI on macOS.
 #
-# Tools that Nix also exposes under a version-suffixed name
-# (`clang-tidy-<v>`, `g++-<v>`, ...) are probed under both names:
-# a suffixed name can break while the plain one still works
-# (see mkVersionedToolLinks in nix/packages.nix).
-# The suffix is the major version of the plain `clang` / `gcc` on PATH.
+# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
+# `g++-15`, ...) are probed under both names: a suffixed name can break while
+# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
 #
 # Tools scoped to a single dev shell rather than to commonPackages are checked
 # only in that shell, keyed off XRPL_DEVSHELL.
@@ -36,16 +34,9 @@
 
 set -uo pipefail
 
-# major_version <compiler>
-# Major version of a compiler on PATH, or "unknown" when it isn't there.
-major_version() {
-    local version
-    version="$("$1" -dumpversion 2>/dev/null)" || version=""
-    version="${version%%.*}"
-    printf '%s' "${version:-unknown}"
-}
-
-llvm_version="$(major_version clang)"
+# Version suffixes of the Nix tool links, tracking nix/packages.nix.
+gcc_version=15
+llvm_version=22
 
 missing=()
 checked=0
@@ -121,7 +112,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check ClangBuildAnalyzer
     check curl
     check file
-    check jq
     check less
     check make
     # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
@@ -190,7 +180,6 @@ fi
 if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
-    gcc_version="$(major_version gcc)"
     check gcc
     check "gcc-${gcc_version}"
     check g++

bin/nix/check-build-context-runtime.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary of a build-context Conan package loads anything from the Nix
-# store other than glibc, or cannot resolve a library at all.
-#
-# Only binaries linked by the Nix toolchain are checked, i.e. those recording a
-# store path as their interpreter or RUNPATH. Prebuilt upstream binaries (such
-# as the ones the cmake package ships) use the system loader instead.
-#
-# Build-context packages provide the tools that run during the build (protoc,
-# grpc_cpp_plugin, ...). Their package ID does not change when a Nix toolchain
-# update moves the GCC runtime to a new store path, so a cached binary has to
-# get by with the pinned glibc alone. See docs/build/nix.md.
-#
-# Usage: bin/nix/check-build-context-runtime.sh <graph.json>
-#   <graph.json> is the output of `conan install --format=json`.
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <graph.json>" >&2
-    exit 2
-fi
-
-if [ "$(uname -s)" != "Linux" ]; then
-    echo "$0: Linux only" >&2
-    exit 2
-fi
-
-folders="$(jq -r '.graph.nodes[] | select(.context == "build" and .package_folder) | .package_folder' "$1" | sort -u)"
-
-checked=0
-failed=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}")" in
-        ELF*) ;;
-        *) continue ;;
-    esac
-    [[ "$(readelf -ldW "${file}")" == */nix/store/* ]] || continue
-    checked=$((checked + 1))
-
-    # `ldd` lists the interpreter and every library as the loader resolves them.
-    if deps="$(ldd "${file}" 2>&1)"; then
-        bad="$(printf '%s\n' "${deps}" |
-            grep -E 'not found|/nix/store/' |
-            grep -vE '/nix/store/[^/]+-glibc-[^/]+/' || true)"
-    else
-        case "${deps}" in
-            *"not a dynamic executable"*) continue ;;
-        esac
-        bad="${deps}"
-    fi
-    if [ -n "${bad}" ]; then
-        failed=$((failed + 1))
-        echo "::error file=${file}::loads a library from the Nix store other than glibc"
-        echo "${file}"
-        echo "${bad}" | sed 's/^/    /'
-    fi
-done < <(
-    # shellcheck disable=SC2086 # one folder per line, no spaces in Conan paths
-    [ -z "${folders}" ] || find ${folders} -type f \( -perm -u+x -o -name '*.so*' \)
-)
-
-echo "Build-context packages: checked ${checked} binaries, ${failed} failed."
-[ "${failed}" -eq 0 ]

bin/pre-commit/Dockerfile

@@ -23,7 +23,7 @@ apt-get clean
 rm -rf /var/lib/apt/lists/*
 EOF
 
-ARG PRE_COMMIT_VERSION=4.6.2
+ARG PRE_COMMIT_VERSION=4.6.0
 RUN pip install --no-cache --break-system-packages \
     pre-commit==${PRE_COMMIT_VERSION}
 

bin/pre-commit/clang_tidy_check.py

@@ -26,6 +26,8 @@ import sys
 import tempfile
 from pathlib import Path
 
+CLANG_TIDY_VERSION = 22
+
 # Extensions run-clang-tidy can analyse: `.cpp` translation units and, thanks to
 # the `verify_headers` build option, `.h`/`.hpp` headers (each has its own
 # compile_commands.json entry). `.ipp` fragments have no entry and are skipped.
@@ -37,21 +39,8 @@ TIDY_EXTENSIONS = {".cpp", ".h", ".hpp"}
 FILEPATH_RE = re.compile(r"^(\s*(?:-\s+)?FilePath:\s*)'((?:[^']|'')*)'\s*$")
 
 
-def clang_tidy_major() -> str | None:
-    """Major version of the `clang-tidy` on PATH, which run-clang-tidy invokes."""
-    if not (clang_tidy := shutil.which("clang-tidy")):
-        return None
-    output = subprocess.run(
-        [clang_tidy, "--version"], capture_output=True, text=True
-    ).stdout
-    m = re.search(r"LLVM version (\d+)", output)
-    return m.group(1) if m else None
-
-
-def find_tool(name: str, version: str | None) -> str | None:
-    """Prefer `<name>-<version>`, so a host tool of another version can't win."""
-    candidates = ([f"{name}-{version}"] if version else []) + [name]
-    for candidate in candidates:
+def find_tool(name: str) -> str | None:
+    for candidate in (f"{name}-{CLANG_TIDY_VERSION}", name):
         if path := shutil.which(candidate):
             return path
     return None
@@ -114,9 +103,8 @@ def main():
     if not files:
         return 0
 
-    version = clang_tidy_major()
-    run_clang_tidy = find_tool("run-clang-tidy", version)
-    clang_apply_replacements = find_tool("clang-apply-replacements", version)
+    run_clang_tidy = find_tool("run-clang-tidy")
+    clang_apply_replacements = find_tool("clang-apply-replacements")
     missing = [
         name
         for name, path in (
@@ -126,10 +114,9 @@ def main():
         if not path
     ]
     if missing:
-        tried = f" (tried the '-{version}' suffix too)" if version else ""
         print(
             f"clang-tidy check failed: TIDY is enabled but {' and '.join(missing)} "
-            f"was not found in PATH{tried}.",
+            f"was not found in PATH (tried the '-{CLANG_TIDY_VERSION}' suffix too).",
             file=sys.stderr,
         )
         return 1

cfg/xrpld-example.cfg

@@ -1360,39 +1360,6 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
-#   gas_limit = <gas>
-#
-#       The gas limit is the maximum amount of gas that can be
-#       consumed by a single transaction. The gas limit is used to prevent
-#       transactions from consuming too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_limit = 1000000      # 1 million gas
-#
-#   bytecode_size_limit = <bytes>
-#
-#       The bytecode size limit is the maximum size of a WASM extension in
-#       bytes. The size limit is used to prevent extensions from consuming
-#       too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           bytecode_size_limit = 100000      # 100 kb
-#
-#   gas_price = <micro-drops>
-#
-#       The gas price is the conversion between WASM gas and its price in drops.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings

cmake/PatchNixBinary.cmake

@@ -17,7 +17,7 @@
    (runtime libraries resolved through the rpath) are skipped too.
    Everywhere else `patch_nix_binary` is a no-op.
 
-   The default loader is resolved by bin/nix/default-loader-path.sh.
+   The default loader is resolved by bin/default-loader-path.sh.
 #]===================================================================]
 
 include_guard(GLOBAL)
@@ -25,7 +25,7 @@ include_guard(GLOBAL)
 include(CompilationEnv)
 
 # Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/nix/default-loader-path.sh")
+set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
 
 if(
     is_linux

cmake/XrplAddBenchmark.cmake

@@ -29,14 +29,6 @@ function(xrpl_add_benchmark name)
     # XrplCore.cmake. Each file compiles fine on its own.
     set_target_properties(${target} PROPERTIES UNITY_BUILD OFF)
 
-    # Land next to `xrpl_tests` in the build root rather than buried under
-    # `src/benchmarks/libxrpl/`. A benchmark is something a person runs by hand,
-    # repeatedly, and comparing two of them should not mean typing two long paths.
-    set_target_properties(
-        ${target}
-        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-    )
-
     isolate_headers(
         ${target}
         "${CMAKE_SOURCE_DIR}/src"

cmake/XrplCore.cmake

@@ -212,11 +212,7 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-target_link_libraries(
-    xrpl.libxrpl.tx
-    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
-)
-add_dependencies(xrpl.libxrpl.tx xrpl_crates)
+target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
 
 add_module(xrpl consensus)
 target_link_libraries(
@@ -296,14 +292,6 @@ if(xrpld)
     )
     target_sources(xrpld PRIVATE ${sources})
 
-    rpcspec_generate_instantiations(
-        OUT_VAR rpcspec_instantiations
-        VALUE_TYPE "::json::Value"
-        VIEW_HEADER "xrpld/rpc/detail/JsonObjectView.hpp"
-        HANDLERS book_changes ledger transaction_entry
-    )
-    target_sources(xrpld PRIVATE ${rpcspec_instantiations})
-
     if(tests)
         file(
             GLOB_RECURSE sources
@@ -334,7 +322,6 @@ if(xrpld)
         # antithesis_instrumentation.h, which is not exported as INTERFACE
         target_include_directories(
             xrpld
-            SYSTEM
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()

cmake/XrplSanitizers.cmake

@@ -77,24 +77,19 @@ if(is_clang)
     message(STATUS "  Ignorelist: ${ignorelist_path}")
 endif()
 
-# Define the SANITIZERS macro for BuildInfo.cpp, plus one of XRPL_ASAN,
-# XRPL_TSAN and XRPL_UBSAN per active sanitizer, so that code can test for a
-# specific one with #ifdef instead of parsing the dot-joined SANITIZERS string.
+# Define SANITIZERS macro for BuildInfo.cpp
 set(sanitizers_list)
 if(SANITIZERS MATCHES "address")
     set(enable_asan ON)
     list(APPEND sanitizers_list "ASAN")
-    target_compile_definitions(common INTERFACE XRPL_ASAN)
 endif()
 if(SANITIZERS MATCHES "thread")
     set(enable_tsan ON)
     list(APPEND sanitizers_list "TSAN")
-    target_compile_definitions(common INTERFACE XRPL_TSAN)
 endif()
 if(SANITIZERS MATCHES "undefinedbehavior")
     set(enable_ubsan ON)
     list(APPEND sanitizers_list "UBSAN")
-    target_compile_definitions(common INTERFACE XRPL_UBSAN)
 endif()
 
 if(sanitizers_list)

cmake/XrplSettings.cmake

@@ -32,6 +32,11 @@ endif()
 
 option(benchmark "Build benchmarks" ON)
 
+# When OFF, the crates directory is not added to the build at all: no Rust
+# toolchain is required, no cxxbridge bindings are generated, and the C++ tests
+# that consume those bindings are left out of the build tree.
+option(rust "Build the Rust crates and the C++ code that depends on them" OFF)
+
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are

conan.lock

@@ -3,7 +3,7 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "xrpl-rpc-spec/0.1.21#d536f87a2ae7d313452746cfa3ac4404%1790869005.122975",
+        "xrpl-rpc-spec/0.1.19#870b2d3abcfbbf13b61c2d3c69495060%1790348286.187549",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
@@ -20,7 +20,7 @@
         "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
+        "grpc/1.81.1#b87796a4269034856cbc1a2522db16eb%1788275071.530512",
         "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1785888854.601666",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
@@ -34,15 +34,11 @@
     "build_requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
         "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
-        "grpc/1.81.1#aaa93ab6cda2f2baa6a84490582c8adf%1791284951.826256",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",

conan/global.conf

@@ -3,13 +3,5 @@
 core:non_interactive=True
 core.download:parallel={{ os.cpu_count() }}
 core.upload:parallel={{ os.cpu_count() }}
-# Fall back to Conan Center's source backups when a recipe's upstream URL is down
-# (e.g. the GNU FTP mirrors), see
-# https://github.com/conan-io/conan-center-index/issues/28147#issuecomment-3183544772
-# The backups are only tried once every upstream URL has used up its retries,
-# so keep the retries low.
-core.sources:download_urls=["origin", "https://c3i.jfrog.io/artifactory/conan-center-backup-sources"]
-tools.files.download:retry=1
+tools.files.download:retry=5
 tools.files.download:retry_wait=10
-# Fail fast on unreachable hosts (default connect timeout is 30s), keep the 60s read timeout.
-core.net.http:timeout=(5, 60)

conan/profiles/default

@@ -29,9 +29,9 @@ os.version={{ min_macos_version }}
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
 {# Instead it hand-rolls the compiler for user-config.jam, #}
-{# and its fallback probes a version-suffixed binary (e.g. `g++-<major>`) before plain `g++`. #}
-{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-<major>` suffix), #}
-{# so on a host that also has a system `g++-<major>` the probe escapes Nix #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
 {# and picks the system compiler, which is mismatched with the Nix libraries #}
 {# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
 {# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
@@ -49,31 +49,8 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
 
-{% if os == "Linux" and context == "build" %}
-{# Build-context executables (protoc, grpc_cpp_plugin, build tools) run during the build #}
-{# and would otherwise load libstdc++/libgcc from a Nix store path #}
-{# that might change with a Nix toolchain update. #}
-{# --as-needed drops the ones they link but don't use, #}
-{# such as libatomic for grpc_cpp_plugin on arm64. #}
-{% set static_runtime_flags = ["-static-libstdc++", "-static-libgcc", "-Wl,--as-needed"] %}
-tools.build:exelinkflags+={{ static_runtime_flags }}
-tools.info.package_id:confs+=["tools.build:exelinkflags"]
-{% endif %}
-
-{% if os == "Linux" and context == "build" %}
-{# b2 links itself with its own script, which ignores exelinkflags #}
-{# and only takes CXXFLAGS when use_cxx_env is set (see [buildenv] below). #}
-[options]
-b2/*:use_cxx_env=True
-{% endif %}
-
-[buildenv]
-{# gRPC emits thousands of compiler warnings that we cannot act on. #}
-{# CMake picks up CXXFLAGS, and unlike tools.build:cxxflags, #}
-{# this is not part of the package ID, so binaries stay shareable. #}
-grpc/*:CXXFLAGS=-w
-
 {% if os == "Macos" %}
+[buildenv]
 {# os.version adds -mmacosx-version-min to compiler command lines, #}
 {# but Boost.Context's b2 assembly (.S) rule ignores it, #}
 {# so those objects keep the host SDK version and still warn at link time. #}
@@ -81,7 +58,3 @@ grpc/*:CXXFLAGS=-w
 {# Scoped to boost/* since it is the only gap. #}
 boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
 {% endif %}
-
-{% if os == "Linux" and context == "build" %}
-b2/*:CXXFLAGS={{ static_runtime_flags | join(" ") }}
-{% endif %}

conan/profiles/sanitizers

@@ -5,9 +5,6 @@ include(default)
 
 {% if not sanitizers %}
 {# Sanitizers not configured; no additional settings needed #}
-{% elif context == "build" %}
-{# Build-context packages are tools we run, not code we test, #}
-{# so don't instrument them #}
 {% else %}
 
 {% if compiler == "msvc" %}

conanfile.py

@@ -40,7 +40,7 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
-        "xrpl-rpc-spec/0.1.21",
+        "xrpl-rpc-spec/0.1.19",
         "zlib/1.3.2",
     ]
 
@@ -49,8 +49,7 @@ class Xrpl(ConanFile):
     ]
 
     tool_requires = [
-        "grpc/<host_version>",
-        "protobuf/<host_version>",
+        "protobuf/6.33.5",
     ]
 
     default_options = {
@@ -124,10 +123,6 @@ class Xrpl(ConanFile):
         "xxhash/*:shared": False,
     }
 
-    # default_options only reach the host context;
-    # give tool_requires (and their dependencies) the same dependency options.
-    default_build_options = {k: v for k, v in default_options.items() if "/" in k}
-
     def set_version(self):
         self.version = self.version or DEV_VERSION
 
@@ -154,16 +149,12 @@ class Xrpl(ConanFile):
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
-        "bin/nix/default-loader-path.sh",
+        "bin/default-loader-path.sh",
         "CMakeLists.txt",
         "cfg/*",
         "cmake/*",
-        "crates/*",
-        "crates/.cargo/*",
-        "!crates/target/*",
         "external/*",
         "include/*",
-        "rust-toolchain.toml",
         "src/*",
     )
 

crates/CMakeLists.txt

@@ -80,12 +80,13 @@ function(add_xrpl_crate name)
     # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
     # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
     if(is_msvc)
-        corrosion_set_env_vars(${ARG_CRATE} "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>")
+        corrosion_set_env_vars(
+            ${ARG_CRATE}
+            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
+        )
     endif()
-    corrosion_add_cxxbridge(
-        ${name}_cxxbridge
-        CRATE ${ARG_CRATE}
-        FILES ${ARG_FILES}
+    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
+                            ${ARG_FILES}
     )
     # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
     # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
@@ -100,11 +101,4 @@ function(add_xrpl_crate name)
     add_dependencies(xrpl_crates ${name}_cxxbridge)
 endfunction()
 
-add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
-
-add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
-
-target_include_directories(
-    xrpl_wasm_vm_ffi_cxxbridge
-    PRIVATE ${CMAKE_SOURCE_DIR}/include
-)
+add_xrpl_crate(rs_hello_world CRATE rs_hello_world FILES lib.rs)

crates/Cargo.lock

@@ -8,18 +8,6 @@ version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
-[[package]]
-name = "bitflags"
-version = "2.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
-
-[[package]]
-name = "bumpalo"
-version = "3.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
-
 [[package]]
 name = "cc"
 version = "1.2.61"
@@ -69,24 +57,24 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8a02bfeba9074b2bbb39492c9b0908ec854f455a3cccdcde7a1de55e2315e40"
+checksum = "13f6de320895f42e6e081abb5c7983bedcf0b6d0ff9323de0d33f620c8ac1199"
 dependencies = [
  "cc",
  "cxx-build",
  "cxxbridge-cmd",
  "cxxbridge-flags",
  "cxxbridge-macro",
- "foldhash 0.2.0",
+ "foldhash",
  "link-cplusplus",
 ]
 
 [[package]]
 name = "cxx-build"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbc2ac76997619d2d888b58ad79488f1c835de41ca4dd3dd7082acf4ecb0a50f"
+checksum = "4fde53ca86b9704a943fef0f1e1d836239a6aedca5de3c65fa9f97ec0bd46d39"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -99,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a486ed16a3f2a053fe7f5b98db4c1a59846a23e8cb9e49f9d1bd48830d51a2"
+checksum = "07bae89236c811fd4d08ed3441759ac4ac98d752cbfd3de341315ba16ad20ec3"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -113,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c72569be94e2283764d334cd285980b747dbe221e27e315484eb6bcd93fa808a"
+checksum = "49045042e5fced01b80742aba5508de82aa4f13677ed3fa2b4cda709c40c5918"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.205"
+version = "1.0.202"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "423e795284a7f7b3f843c956a5322c4bc497b60c2dd1a6339da10313cb18d575"
+checksum = "b181252e2e3d3b5d183afbdc033a3958b445eb3e1a0ae65fc3d4f5259f5da6fd"
 dependencies = [
  "indexmap",
  "proc-macro2",
@@ -141,27 +129,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.17.0"
@@ -175,21 +148,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown",
 ]
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
-[[package]]
-name = "libm"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
-
 [[package]]
 name = "link-cplusplus"
 version = "1.0.12"
@@ -199,12 +160,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "memchr"
-version = "2.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -223,18 +178,19 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rs-hello_world"
+version = "0.1.0"
+dependencies = [
+ "cxx",
+]
+
 [[package]]
 name = "scratch"
 version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
 
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -271,22 +227,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "spin"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
-
-[[package]]
-name = "string-interner"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
-dependencies = [
- "hashbrown 0.15.5",
- "serde",
-]
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -336,95 +276,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
-[[package]]
-name = "wasm-encoder"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.254.0",
-]
-
-[[package]]
-name = "wasmi"
-version = "2.0.0"
-source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
-dependencies = [
- "spin",
- "wasmi_collections",
- "wasmi_core",
- "wasmi_ir",
- "wasmparser 0.228.0",
-]
-
-[[package]]
-name = "wasmi_collections"
-version = "2.0.0"
-source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
-dependencies = [
- "string-interner",
-]
-
-[[package]]
-name = "wasmi_core"
-version = "2.0.0"
-source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmi_ir"
-version = "2.0.0"
-source = "git+https://github.com/TimothyBanks/wasmi.git?branch=parser_callback#1be4a903162990371da09f5224b3351983999b05"
-dependencies = [
- "wasmi_core",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.228.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4abf1132c1fdf747d56bbc1bb52152400c70f336870f968b85e89ea422198ae3"
-dependencies = [
- "bitflags",
- "indexmap",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
-dependencies = [
- "bitflags",
- "indexmap",
- "semver",
-]
-
-[[package]]
-name = "wast"
-version = "254.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
-dependencies = [
- "bumpalo",
- "leb128fmt",
- "memchr",
- "unicode-width",
- "wasm-encoder",
-]
-
-[[package]]
-name = "wat"
-version = "1.254.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
-dependencies = [
- "wast",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -448,47 +299,3 @@ checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
  "windows-link",
 ]
-
-[[package]]
-name = "xrpl-host-functions"
-version = "0.1.0"
-dependencies = [
- "xrpl-host-functions-macros",
-]
-
-[[package]]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.3",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-dependencies = [
- "wasmi",
- "wat",
- "xrpl-host-functions",
-]
-
-[[package]]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-dependencies = [
- "cxx",
- "xrpl-host-functions",
- "xrpl-wasm-vm",
-]

crates/Cargo.toml

@@ -1,24 +1,9 @@
 [workspace]
-members = [
-    "xrpl-wasm-vm-ffi",
-    "xrpl-wasm-vm",
-    "xrpl-wasm-testkit",
-    "xrpl-host-functions",
-    "xrpl-host-functions-macros",
-]
+members = ["hello_world"]
 resolver = "3"
 
 [workspace.dependencies]
-cxx = { version = "1.0.199", features = ["c++20"] }
-
-# Not for merge: builds against a wasmi fork with `ModuleInspector`
-# (TimothyBanks/wasmi, branch `parser_callback`) until it is accepted upstream.
-# All four crates come from the fork so that there is one `wasmi_core`.
-[patch.crates-io]
-wasmi = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
-wasmi_core = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
-wasmi_ir = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
-wasmi_collections = { git = "https://github.com/TimothyBanks/wasmi.git", branch = "parser_callback" }
+cxx = { version = "1.0.198", features = ["c++20"] }
 
 [workspace.package]
 edition = "2024"
@@ -30,5 +15,4 @@ unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage
 opt-level = 3
 overflow-checks = true
 lto = true
-codegen-units = 1
 debug = true

crates/README.md

@@ -1,120 +0,0 @@
-# Rust crates
-
-This directory holds the WebAssembly engine that runs Smart Escrow contracts,
-bridged into C++ via `cxxbridge`/the `cxx` crate.
-
-The workspace is built unconditionally — `add_subdirectory(crates)` in the
-top-level `CMakeLists.txt` is not behind an option, and
-`xrpl_wasm_vm_ffi_cxxbridge` is a `PUBLIC` dependency of
-`xrpl.libxrpl.tx` (see `cmake/XrplCore.cmake`). The Rust toolchain pinned in
-[`rust-toolchain.toml`](../rust-toolchain.toml) is therefore required to build
-`libxrpl` at all; the Nix devshell provides it automatically.
-
-## The crates
-
-Dependencies run in one direction: the ABI crate at the bottom, the engine on
-top of it, and the two bridges at the edge.
-
-### `xrpl-host-functions`
-
-The wasm host ABI, declared exactly once. A `host_functions!` block at the
-bottom of `src/lib.rs` generates the `HostFunctions` trait a host implements and
-the `HostFunctionSpec` table a wasm engine registers from. Only the vocabulary
-the declarations are written in — `HostError`, `HostResult`, `TraceDataType`,
-`HASH_LEN` — is hand-written.
-
-**Add or change a host function here**, never in the engine or the bridge: the
-expansion names nothing this file does not, so neither side of the FFI boundary
-gets to restate a signature.
-
-`no_std`, because this crate is also what a guest contract links against.
-
-### `xrpl-host-functions-macros`
-
-The proc macro behind that block, plus the `wasmi_glue!` marshalling it
-generates. An implementation detail of the crate above — nothing else should
-depend on it.
-
-The dev-dependency back on `xrpl-host-functions` is a deliberate cycle: the
-doctests declare host functions returning `HostResult`, which the facade crate
-hand-writes. Cargo allows it because dev-dependencies sit outside the library
-build graph.
-
-### `xrpl-wasm-vm`
-
-The engine itself, on `wasmi`: preflight validation (`preflight/`), gas
-metering and execution (`vm.rs`), and host-call dispatch (`abi.rs`, `args.rs`,
-`register.rs`).
-
-Two lint decisions are load-bearing, both because this is a consensus path:
-
-- `forbid(unsafe_code)`, so "every guest access reaches linear memory only
-  through wasmi's bounds-checked slice operations" is a property rather than a
-  claim.
-- The truncating, wrapping and sign-losing cast lints are `deny` and each
-  remaining cast is argued for at its site — a bad cast here changes what a
-  contract is charged or told.
-
-It pins `wasmi` with `default-features = false` deliberately. wasmi's `wat`
-feature is on by default and makes `Module::new` accept text as readily as
-binary, which would turn a transaction's validity into a build flag.
-
-Not bridged to C++ directly; it reaches `xrpld` through `xrpl-wasm-vm-ffi`.
-
-### `xrpl-wasm-vm-ffi`
-
-The cxx bridge into `xrpld`. Three crossings:
-
-- **In:** C++ calls `run_escrow`, once per escrow finish.
-- **Back out:** that run's host calls leave through the C++ `HostContext`, which
-  `CxxHost` presents to the engine as an ordinary `HostFunctions` implementor.
-- **In only:** C++ screens a module with `check_escrow`. Screening needs no
-  host, so nothing comes back out.
-
-The C++ side is `src/libxrpl/tx/wasm/WasmVM.cpp` and
-`src/libxrpl/tx/wasm/HostContext.cpp`.
-
-**Neither language may unwind into the other**, and the two halves are not
-symmetric:
-
-- A **Rust panic** is caught here, by `guarded`. Letting one reach C++ is
-  undefined behaviour, and `[profile.release]` enables overflow checks, so this
-  is a live path rather than a formality.
-- A **C++ exception** is stopped on the C++ side: every `HostContext` method is
-  `noexcept` and catches its own. That is what makes `guarded` sufficient.
-
-Everything hand-written here is private, so `cargo doc` needs
-`--document-private-items` to show any of it. That is also why this crate,
-unlike `xrpl-wasm-vm`, does not `deny(unreachable_pub)` — cxx's expansion is
-`pub` throughout by necessity.
-
-### `xrpl-wasm-testkit`
-
-**Test-only.** Assembles WebAssembly text for the C++ test suite, and exposes
-the gas price of each host function by its guest import name for the C++ gas
-benchmarks (read through the bridge rather than transcribed into C++, so the
-numbers cannot drift silently).
-
-A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the
-separation is the point: putting `compile_wat` on the production bridge would
-link `wat` into `xrpld` even if nothing called it. Linked only into
-`xrpl_tests`, never into `libxrpl` or `xrpld`, so "no text assembler in the
-shipped node" holds by the link graph rather than by a flag someone can flip.
-
-## Testing
-
-```bash
-cargo test --manifest-path crates/Cargo.toml --workspace
-```
-
-CI uses `cargo nextest`. This is independent of the CMake build.
-
-One gap that command does not cover: it never compiles `xrpl-host-functions`
-with its `wasmi_glue` feature **off**, because `xrpl-wasm-vm` enables the
-feature and Cargo unifies features across a workspace build. The feature-off
-configuration is the one a guest contract sees, so after touching that crate
-also run:
-
-```bash
-cargo check -p xrpl-host-functions --manifest-path crates/Cargo.toml
-```

crates/hello_world/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "rs-hello_world"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+crate-type = ["staticlib"]
+
+[dependencies]
+cxx.workspace = true
+
+[lints]
+workspace = true

crates/hello_world/src/lib.rs

@@ -0,0 +1,23 @@
+#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
+
+#[cxx::bridge(namespace = "rs::hello_world")]
+mod ffi {
+    extern "Rust" {
+        fn hello_world() -> String;
+    }
+}
+
+pub fn hello_world() -> String {
+    "hello_world".to_string()
+}
+
+#[cfg(test)]
+#[cfg_attr(coverage_nightly, coverage(off))]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hello_world_returns_hello_world() {
+        assert_eq!(hello_world(), "hello_world")
+    }
+}

crates/xrpl-host-functions-macros/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "xrpl-host-functions-macros"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { version = "3", features = ["full"] }
-quote = "1"
-proc-macro2 = "1"
-
-# The doctest declares host functions returning `HostResult`, which the facade
-# crate hand-writes. Cargo allows this cycle because dev-dependencies are outside
-# the library build graph.
-[dev-dependencies]
-xrpl-host-functions.path = "../xrpl-host-functions"
-
-[lints]
-workspace = true

crates/xrpl-host-functions-macros/src/enums.rs

@@ -1,289 +0,0 @@
-//! `#[coded_enum]`: an enum of wire codes, and the `ALL`/`code`/`from_code` set
-//! that must not fall behind its variants.
-//!
-//! Rust cannot enumerate an enum's variants — an exhaustive `match` forces an arm per
-//! variant but gives nothing to iterate — so `ALL` is trustworthy only by being
-//! generated from them, as `HostFunctionSpec::ALL` is from the `host_functions!` block.
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{Expr, ExprLit, ExprUnary, Fields, Ident, ItemEnum, Lit, UnOp, Variant};
-
-use crate::errors;
-
-/// One variant as the expansion reads it: the name `ALL` lists and the code
-/// `from_code` matches.
-struct WireVariant<'a> {
-    ident: &'a Ident,
-    code: &'a Expr,
-}
-
-pub(crate) fn expand(args: TokenStream, item: TokenStream) -> syn::Result<TokenStream> {
-    if !args.is_empty() {
-        return Err(syn::Error::new_spanned(
-            args,
-            "`#[coded_enum]` takes no arguments",
-        ));
-    }
-
-    let item: ItemEnum = syn::parse2(item)?;
-    let variants = wire_variants(&item)?;
-
-    let attrs = &item.attrs;
-    let vis = &item.vis;
-    let name = &item.ident;
-    let declarations = item.variants.iter();
-    let identifiers = variants.iter().map(|variant| variant.ident);
-    let arms = variants.iter().map(|variant| {
-        let (ident, code) = (variant.ident, variant.code);
-        quote! { #code => Some(Self::#ident) }
-    });
-
-    Ok(quote! {
-        #(#attrs)*
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        #[repr(i32)]
-        #vis enum #name {
-            #(#declarations,)*
-        }
-
-        impl #name {
-            /// Every variant, in declaration order — the whole set, and whole by
-            /// construction.
-            pub const ALL: &'static [Self] = &[#(Self::#identifiers,)*];
-
-            /// The wire value that names this variant.
-            #[inline]
-            pub const fn code(self) -> i32 {
-                self as i32
-            }
-
-            /// The variant `code` names, or `None` if no variant does — what an
-            /// unnamed code means is the caller's to decide.
-            pub const fn from_code(code: i32) -> Option<Self> {
-                match code {
-                    #(#arms,)*
-                    _ => None,
-                }
-            }
-        }
-    })
-}
-
-/// Every variant, checked against what the expansion needs of it, or every
-/// mistake in the list.
-fn wire_variants(item: &ItemEnum) -> syn::Result<Vec<WireVariant<'_>>> {
-    // `#[repr(i32)]` is rejected on a variantless enum, and there is nothing for a
-    // wire enum with no codes to mean anyway.
-    if item.variants.is_empty() {
-        return Err(syn::Error::new_spanned(
-            item,
-            "`#[coded_enum]` needs at least one variant",
-        ));
-    }
-
-    let mut errors = Vec::new();
-    let variants = item
-        .variants
-        .iter()
-        .filter_map(|variant| {
-            let code = errors::record(code_of(variant), &mut errors)?;
-            Some(WireVariant {
-                ident: &variant.ident,
-                code,
-            })
-        })
-        .collect();
-
-    errors::into_result(variants, errors)
-}
-
-/// The code a variant is declared with.
-fn code_of(variant: &Variant) -> syn::Result<&Expr> {
-    if !matches!(variant.fields, Fields::Unit) {
-        return Err(syn::Error::new_spanned(
-            &variant.fields,
-            "a wire enum's variants carry no data: the code is the whole of what crosses",
-        ));
-    }
-
-    let Some((_, code)) = &variant.discriminant else {
-        return Err(syn::Error::new_spanned(
-            variant,
-            "missing `= <code>`: a wire value is declared, never implied by position",
-        ));
-    };
-
-    if !is_integer_literal(code) {
-        return Err(syn::Error::new_spanned(
-            code,
-            "a wire value must be an integer literal, since `from_code` matches it as a pattern",
-        ));
-    }
-
-    Ok(code)
-}
-
-/// `-2147483648` and `7`, but not `i32::MIN` or `1 + 1`: the discriminant is emitted
-/// into pattern position unchanged, where an expression means something else or nothing.
-fn is_integer_literal(code: &Expr) -> bool {
-    match code {
-        Expr::Lit(ExprLit {
-            lit: Lit::Int(_), ..
-        }) => true,
-        Expr::Unary(ExprUnary {
-            op: UnOp::Neg(_),
-            expr,
-            ..
-        }) => is_integer_literal(expr),
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The whole expansion for the smallest list that exercises every generated
-    /// item, negative codes included.
-    #[test]
-    fn generates_the_enum_and_the_three_items_over_it() {
-        let generated = generated(quote! {
-            /// How a trace buffer is read.
-            pub enum TraceDataType {
-                /// Eight little-endian bytes.
-                Int64 = 1,
-                Unnamed = -2,
-            }
-        });
-
-        for expected in [
-            // The declaration reaches the output as written, doc comments and all,
-            // under the derives and the representation `code` casts through.
-            "# [doc = r\" How a trace buffer is read.\"] \
-             # [derive (Debug , Clone , Copy , PartialEq , Eq)] # [repr (i32)] \
-             pub enum TraceDataType { # [doc = r\" Eight little-endian bytes.\"] Int64 = 1 , \
-             Unnamed = - 2 , }",
-            "pub const ALL : & 'static [Self] = & [Self :: Int64 , Self :: Unnamed ,] ;",
-            "pub const fn code (self) -> i32 { self as i32 }",
-            "pub const fn from_code (code : i32) -> Option < Self > \
-             { match code { 1 => Some (Self :: Int64) , - 2 => Some (Self :: Unnamed) , \
-             _ => None , } }",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The visibility is the caller's: a `pub` the macro supplied would be one the
-    /// declaration could not take back.
-    #[test]
-    fn keeps_the_declared_visibility() {
-        assert!(
-            generated(quote! {
-                enum Private {
-                    One = 1,
-                }
-            })
-            .contains("enum Private"),
-            "the expansion should not widen a private enum"
-        );
-    }
-
-    /// A variant with no code would take one from its position, which is the
-    /// mistake that silently renumbers a wire value.
-    #[test]
-    fn rejects_a_variant_without_a_code() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal = 0,
-                Greater,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("missing `= <code>`"), "{messages:?}");
-    }
-
-    /// The two shapes a code is tempting to write as and cannot be: a constant's
-    /// path, and arithmetic.
-    #[test]
-    fn rejects_a_code_that_is_not_an_integer_literal() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal = i32::MIN,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        for message in &messages {
-            assert!(message.contains("must be an integer literal"), "{message}");
-        }
-    }
-
-    #[test]
-    fn rejects_a_variant_carrying_data() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal(u8) = 0,
-            }
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("carry no data"), "{messages:?}");
-    }
-
-    /// `#[repr(i32)]` is rejected on a variantless enum, so the diagnostic has to
-    /// be this one rather than rustc's.
-    #[test]
-    fn rejects_an_enum_with_no_variants() {
-        let messages = messages(quote! {
-            pub enum Nothing {}
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(messages[0].contains("at least one variant"), "{messages:?}");
-    }
-
-    /// Every mistake in one build, as `host_functions!` reports a block.
-    #[test]
-    fn reports_every_mistake_in_the_list() {
-        let messages = messages(quote! {
-            pub enum Ordering {
-                Equal,
-                Greater = 1 + 1,
-            }
-        });
-
-        assert_eq!(messages.len(), 2, "{messages:?}");
-    }
-
-    #[test]
-    fn rejects_arguments() {
-        let error = expand(quote!(i64), quote! { pub enum Ordering { Equal = 0, } })
-            .expect_err("expected the argument to be refused");
-
-        assert!(error.to_string().contains("takes no arguments"));
-    }
-
-    #[test]
-    fn rejects_an_item_that_is_not_an_enum() {
-        expand(quote!(), quote! { pub struct Ordering; })
-            .expect_err("expected a struct to be refused");
-    }
-
-    fn generated(item: TokenStream) -> String {
-        expand(quote!(), item)
-            .expect("the enum should expand")
-            .to_string()
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(item: TokenStream) -> Vec<String> {
-        let Err(error) = expand(quote!(), item) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-}

crates/xrpl-host-functions-macros/src/errors.rs

@@ -1,33 +0,0 @@
-/// Folds accumulated diagnostics into the single error a macro can return.
-///
-/// `syn::Error` is itself a collection: `combine` appends, and
-/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
-/// instead of returning the first error means every mistake in a
-/// `host_functions!` block surfaces in one build rather than one per rebuild.
-pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
-    errors.into_iter().reduce(|mut first, next| {
-        first.combine(next);
-        first
-    })
-}
-
-/// `value`, or the folded diagnostics if any were recorded.
-pub(crate) fn into_result<T>(value: T, errors: Vec<syn::Error>) -> syn::Result<T> {
-    match combine(errors) {
-        Some(error) => Err(error),
-        None => Ok(value),
-    }
-}
-
-/// `result`'s value, or `None` with its error filed in `errors` — so a check that
-/// yields a value can be reported like one that yields nothing, and the caller
-/// keeps going.
-pub(crate) fn record<T>(result: syn::Result<T>, errors: &mut Vec<syn::Error>) -> Option<T> {
-    match result {
-        Ok(value) => Some(value),
-        Err(error) => {
-            errors.push(error);
-            None
-        }
-    }
-}

crates/xrpl-host-functions-macros/src/glue.rs

@@ -1,472 +0,0 @@
-//! The wasmi registration, generated from the declarations the ABI table is
-//! generated from — so the closure a guest links against cannot disagree with the
-//! signature preflight screens it by.
-//!
-//! Emitted as a `macro_rules!` rather than as the registration itself, because the
-//! crate the expansion lands in is `no_std`, zero-dependency and links into the
-//! guest, and a `macro_rules!` body is inert tokens until someone expands it.
-//!
-//! The body therefore resolves in two crates at once and names nothing free:
-//! `$crate` is the ABI crate, `$env` the module the caller passes in, and every
-//! other path starts at `::wasmi` or `::core`. `$env` is matched as an `ident`
-//! because `$env:path` used as `$env::Foo` is `error: missing angle brackets in
-//! associated item path`.
-//!
-//! The one file that knows an engine's calling convention: how a region arrives as
-//! two wasm parameters, where the gas charge goes, and which helper a result-less
-//! function takes. A second engine would be a second file like it.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, quote};
-
-use crate::lowering::{ResultType, WasmValType};
-use crate::parsed_host_function::{Param, ParsedHostFunction};
-
-/// The `wasmi_glue!` macro: the trait a VM implements one body per host function
-/// in, and the registration that hands each of them to a `Linker`.
-pub(crate) fn wasmi_glue(functions: &[ParsedHostFunction]) -> TokenStream {
-    let bodies = functions.iter().map(body_declaration);
-    let registrations = functions.iter().map(registration);
-    let assertions = charging_assertions();
-    let env = env();
-
-    quote! {
-        /// Expands to the wasmi glue for this ABI: the `HostFunctionBodies` trait
-        /// and `register_host_functions`, at the scope it is called in. A
-        /// declaration added to the ABI is then a missing trait item rather than a
-        /// forgotten registration.
-        ///
-        /// `$env` names a module holding everything the expansion reaches for on
-        /// the engine's side, since this crate can name none of it: the store type
-        /// `VmState`, the charging helpers `charged` and `charged_unreported` with
-        /// their `CallResult`, and the argument types `InBytes`, `InStr`, `InU32`,
-        /// `OutBytes` and `TraceCode`.
-        ///
-        /// ```ignore
-        /// mod glue_env {
-        ///     pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-        ///     pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-        ///     pub(crate) use crate::vm::VmState;
-        /// }
-        ///
-        /// xrpl_host_functions::wasmi_glue!(glue_env);
-        /// ```
-        ///
-        /// The module supplies the spellings; the shapes are pinned by the
-        /// expansion. Each argument type implements [`FromWasmRegion`] or
-        /// [`FromWasmScalar`] — which one is the ABI's decision, so a declared
-        /// `u32` is a region — and each charging helper's signature is asserted
-        /// against a `const _`.
-        #[cfg(feature = "wasmi_glue")]
-        #[macro_export]
-        macro_rules! wasmi_glue {
-            ($env:ident) => {
-                /// One body per host function: what the engine runs once the call's
-                /// gas is charged and its arguments are off the wire.
-                ///
-                /// The methods take no receiver, so a registered closure captures
-                /// nothing — which is what satisfies wasmi's
-                /// `Fn + Send + Sync + 'static` bound, and why the implementor
-                /// itself need not be `'static`. A body does not charge gas; the
-                /// generated closure does, so it cannot be forgotten or charged
-                /// twice.
-                pub(crate) trait HostFunctionBodies {
-                    #(#bodies)*
-                }
-
-                /// Register every host function on `linker`, one `func_wrap` per
-                /// declaration, at the ABI's derived wasm signature — so an import
-                /// that passes [`crate::check`] links here by construction.
-                pub(crate) fn register_host_functions<B: HostFunctionBodies>(
-                    linker: &mut ::wasmi::Linker<#env::VmState<'_>>,
-                ) -> ::core::result::Result<(), ::wasmi::errors::LinkerError> {
-                    #(#registrations)*
-                    Ok(())
-                }
-
-                #assertions
-            };
-        }
-    }
-}
-
-/// The macro argument every engine-side path is qualified by.
-fn env() -> TokenStream {
-    quote!($env)
-}
-
-/// The signature of each charging helper, pinned as a `const _` the expansion
-/// carries: the one part of the contract neither `$env` nor the argument traits
-/// state.
-///
-/// Its value is the diagnostic. A changed helper is already a type error at the
-/// call, but there it is failed inference inside a generated closure and here it
-/// is one line stating the signature that was expected.
-fn charging_assertions() -> TokenStream {
-    let env = env();
-    let assertion = |helper: TokenStream, answer: TokenStream| {
-        quote! {
-            const _: fn(
-                &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-                $crate::HostFunctionSpec,
-                fn(&mut ::wasmi::Caller<'_, #env::VmState<'_>>) -> #env::CallResult<#answer>,
-            ) -> ::core::result::Result<#answer, ::wasmi::Error> = #env::#helper;
-        }
-    };
-
-    let reported = assertion(quote!(charged), quote!(i32));
-    let unreported = assertion(quote!(charged_unreported), quote!(()));
-
-    quote! {
-        #reported
-        #unreported
-    }
-}
-
-/// `fn check_keylet(caller: &mut Caller<'_, $env::VmState<'_>>, account:
-/// $env::InBytes, seq: $env::InU32, out: $env::OutBytes) ->
-/// $env::CallResult<i32>;`
-fn body_declaration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let name = &function.signature.ident;
-    let params = function.params().iter().map(|param| {
-        let name = &param.name;
-        let ty = param.ty.argument_type(&env);
-        quote! { #name: #ty }
-    });
-    let answer = answer_type(function.result());
-
-    quote! {
-        fn #name(
-            caller: &mut ::wasmi::Caller<'_, #env::VmState<'_>>,
-            #(#params),*
-        ) -> #answer;
-    }
-}
-
-/// One `linker.func_wrap(…)?;`: the wasm signature as the closure's parameters,
-/// the gas charge around the call, and the body between them.
-fn registration(function: &ParsedHostFunction) -> TokenStream {
-    let env = env();
-    let body = &function.signature.ident;
-    let spec = spec_path(function);
-    let params = function.params().iter().flat_map(closure_params);
-    let arguments = function.params().iter().map(lift);
-    let (answer, charge) = match function.result() {
-        ResultType::BufferLength | ResultType::Value => (quote!(i32), quote!(#env::charged)),
-        ResultType::Nothing => (quote!(()), quote!(#env::charged_unreported)),
-    };
-
-    quote! {
-        linker.func_wrap(
-            $crate::HOST_MODULE,
-            #spec.wasm_name(),
-            |mut caller: ::wasmi::Caller<'_, #env::VmState<'_>>, #(#params),*|
-             -> ::core::result::Result<#answer, ::wasmi::Error> {
-                #charge(&mut caller, #spec, |caller| {
-                    B::#body(caller, #(#arguments),*)
-                })
-            },
-        )?;
-    }
-}
-
-/// `$crate::HostFunctionSpec::CheckKeylet` — the one name the expansion reaches
-/// back into the ABI crate for.
-fn spec_path(function: &ParsedHostFunction) -> TokenStream {
-    let variant = &function.variant;
-    quote! { $crate::HostFunctionSpec::#variant }
-}
-
-/// One declared parameter as the closure declares it: `account_ptr: i32,
-/// account_len: i32`, or `field: i32`.
-///
-/// Names and types both come from the lowering, so the arity a closure is
-/// registered at *is* the derived arity.
-fn closure_params(param: &Param) -> Vec<TokenStream> {
-    param
-        .ty
-        .wasm_names(&param.name)
-        .into_iter()
-        .zip(param.ty.as_wasm_params())
-        .map(|(name, val_type)| {
-            let ty = rust_type(*val_type);
-            quote! { #name: #ty }
-        })
-        .collect()
-}
-
-/// The argument a body is handed, built from the wasm parameters it arrived as:
-/// `<$env::InBytes as $crate::FromWasmRegion>::from_wasm(account_ptr,
-/// account_len)`, or the scalar itself.
-///
-/// Qualified rather than an inherent call, so the arity comes from the trait the
-/// lowering chose: an argument type implementing the other one is an unsatisfied
-/// bound named at the type, where `Ty::from_wasm(a, b)` would be an unrelated
-/// arity error named here.
-fn lift(param: &Param) -> TokenStream {
-    let Some(argument_trait) = param.ty.argument_trait() else {
-        return param.name.to_token_stream();
-    };
-    let ty = param.ty.argument_type(&env());
-    let names = param.ty.wasm_names(&param.name);
-
-    quote! { <#ty as $crate::#argument_trait>::from_wasm(#(#names),*) }
-}
-
-/// What a body answers: the value the guest is told, or nothing at all for the
-/// function whose whole effect is on the host.
-fn answer_type(result: ResultType) -> TokenStream {
-    let env = env();
-    match result {
-        ResultType::BufferLength | ResultType::Value => quote!(#env::CallResult<i32>),
-        ResultType::Nothing => quote!(#env::CallResult<()>),
-    }
-}
-
-/// A wasm value type as a closure parameter spells it — a Rust type, not
-/// [`WasmValType`]'s own `ToTokens`, which spells the ABI crate's variant.
-fn rust_type(val_type: WasmValType) -> TokenStream {
-    match val_type {
-        WasmValType::I32 => quote!(i32),
-        WasmValType::I64 => quote!(i64),
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use proc_macro2::{Delimiter, Group, TokenTree};
-    use syn::parse_quote;
-
-    fn parsed(function: syn::TraitItemFn) -> ParsedHostFunction {
-        ParsedHostFunction::parse(function).expect("the declaration should parse")
-    }
-
-    /// The declaration whose declared and wasm parameter lists differ most:
-    /// `account`, `out` and `seq` are a `(ptr, len)` pair each, so three arguments
-    /// to the body and six on the wire.
-    #[test]
-    fn lowers_a_declaration_to_a_body_and_a_registration() {
-        let keylet = parsed(parse_quote! {
-            #[gas = 350]
-            #[wasm_name = "check_id"]
-            fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&keylet).to_string(),
-            "fn check_keylet (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account : $ env :: InBytes , seq : $ env :: InU32 , out : $ env :: OutBytes) \
-             -> $ env :: CallResult < i32 > ;"
-        );
-
-        assert_eq!(
-            registration(&keylet).to_string(),
-            "linker . func_wrap ($ crate :: HOST_MODULE , \
-             $ crate :: HostFunctionSpec :: CheckKeylet . wasm_name () , \
-             | mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             account_ptr : i32 , account_len : i32 , seq_ptr : i32 , seq_len : i32 , \
-             out_ptr : i32 , out_len : i32 | \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > \
-             { $ env :: charged (& mut caller , \
-             $ crate :: HostFunctionSpec :: CheckKeylet , | caller | \
-             { B :: check_keylet (caller , \
-             < $ env :: InBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (account_ptr , account_len) , \
-             < $ env :: InU32 as $ crate :: FromWasmRegion > :: from_wasm (seq_ptr , seq_len) , \
-             < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-             :: from_wasm (out_ptr , out_len)) }) } ,) ? ;"
-        );
-    }
-
-    /// A wasm scalar is passed through as itself, in declaration order: no pair,
-    /// no argument type, and an `i64` that stays one.
-    #[test]
-    fn passes_the_wasm_scalars_through_untouched() {
-        let from_int = parsed(parse_quote! {
-            #[gas = 100]
-            #[wasm_name = "float_from_int"]
-            fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-        });
-
-        assert_eq!(
-            body_declaration(&from_int).to_string(),
-            "fn float_from_int (caller : & mut :: wasmi :: Caller < '_ , \
-             $ env :: VmState < '_ >> , \
-             x : i64 , out : $ env :: OutBytes , mode : i32) -> $ env :: CallResult < i32 > ;"
-        );
-
-        let registration = registration(&from_int).to_string();
-        assert!(
-            registration.contains(
-                "| mut caller : :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-                 x : i64 , out_ptr : i32 , out_len : i32 , mode : i32 |"
-            ),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: float_from_int (caller , x , \
-                 < $ env :: OutBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (out_ptr , out_len) , mode)"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The function that answers nothing takes the other charging helper, derived
-    /// from its declared `HostResult<()>` rather than named as a special case.
-    /// Its `TraceCode` is also the only place `FromWasmScalar` is reached for.
-    #[test]
-    fn a_declaration_that_answers_nothing_takes_the_other_charge() {
-        let trace = parsed(trace_declaration());
-
-        assert_eq!(
-            body_declaration(&trace).to_string(),
-            "fn trace (caller : & mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             msg : $ env :: InStr , data_type : $ env :: TraceCode , data : $ env :: InBytes) \
-             -> $ env :: CallResult < () > ;"
-        );
-
-        let registration = registration(&trace).to_string();
-        assert!(
-            registration.contains(":: core :: result :: Result < () , :: wasmi :: Error >"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains("$ env :: charged_unreported (& mut caller"),
-            "{registration}"
-        );
-        assert!(
-            registration.contains(
-                "B :: trace (caller , \
-                 < $ env :: InStr as $ crate :: FromWasmRegion > :: from_wasm (msg_ptr , msg_len) , \
-                 < $ env :: TraceCode as $ crate :: FromWasmScalar > :: from_wasm (data_type) , \
-                 < $ env :: InBytes as $ crate :: FromWasmRegion > \
-                 :: from_wasm (data_ptr , data_len))"
-            ),
-            "{registration}"
-        );
-    }
-
-    /// The two worlds the macro body resolves in: the ABI crate through `$crate`,
-    /// and one engine by name. `names_no_crate_of_its_own` holds the ABI half of
-    /// the expansion to naming neither.
-    #[test]
-    fn reaches_the_abi_crate_through_dollar_crate_and_the_engine_by_name() {
-        let glue = code(wasmi_glue(&[parsed(parse_quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        })]));
-
-        assert!(
-            glue.contains("$ crate :: HostFunctionSpec :: GetLedgerSqn"),
-            "{glue}"
-        );
-        assert!(glue.contains("$ crate :: HOST_MODULE"), "{glue}");
-        assert!(glue.contains(":: wasmi :: Linker"), "{glue}");
-        assert!(!glue.contains("xrpl_host_functions"), "{glue}");
-    }
-
-    /// Every engine-side item is reached through the module the macro is handed: a
-    /// bare name would resolve against whatever the call site has in scope.
-    ///
-    /// `charged` covers `charged_unreported`, being its prefix.
-    #[test]
-    fn names_the_engine_s_own_items_only_through_the_module_it_is_handed() {
-        let glue = code(wasmi_glue(&[
-            parsed(trace_declaration()),
-            parsed(parse_quote! {
-                #[gas = 350]
-                #[wasm_name = "check_id"]
-                fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8])
-                    -> HostResult<usize>;
-            }),
-        ]));
-
-        for item in [
-            "VmState",
-            "CallResult",
-            "charged",
-            "InBytes",
-            "InStr",
-            "InU32",
-            "OutBytes",
-            "TraceCode",
-        ] {
-            for (index, _) in glue.match_indices(item) {
-                assert!(
-                    glue[..index].ends_with("$ env :: "),
-                    "`{item}` named outside `$env`: {glue}"
-                );
-            }
-        }
-    }
-
-    /// The charging helpers' signatures, which nothing else in the contract
-    /// states.
-    #[test]
-    fn pins_both_charging_helpers_signatures() {
-        assert_eq!(
-            charging_assertions().to_string(),
-            "const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < i32 > ,) \
-             -> :: core :: result :: Result < i32 , :: wasmi :: Error > = $ env :: charged ; \
-             const _ : fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >> , \
-             $ crate :: HostFunctionSpec , \
-             fn (& mut :: wasmi :: Caller < '_ , $ env :: VmState < '_ >>) \
-             -> $ env :: CallResult < () > ,) \
-             -> :: core :: result :: Result < () , :: wasmi :: Error > \
-             = $ env :: charged_unreported ;"
-        );
-    }
-
-    fn trace_declaration() -> syn::TraitItemFn {
-        parse_quote! {
-            #[gas = 30]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-        }
-    }
-
-    /// The expansion's code alone. `to_string` renders a doc comment as a
-    /// `#[doc = "…"]` literal, and the macro's own documentation names the very
-    /// items the scans above look for.
-    fn code(tokens: TokenStream) -> String {
-        fn is_doc(tree: Option<&TokenTree>) -> bool {
-            let Some(TokenTree::Group(group)) = tree else {
-                return false;
-            };
-            group.delimiter() == Delimiter::Bracket
-                && matches!(group.stream().into_iter().next(),
-                            Some(TokenTree::Ident(ident)) if ident == "doc")
-        }
-
-        fn strip(tokens: TokenStream) -> TokenStream {
-            let mut trees = tokens.into_iter().peekable();
-            let mut kept = Vec::new();
-            while let Some(tree) = trees.next() {
-                match tree {
-                    TokenTree::Punct(ref punct)
-                        if punct.as_char() == '#' && is_doc(trees.peek()) =>
-                    {
-                        trees.next();
-                    }
-                    TokenTree::Group(group) => kept.push(TokenTree::Group(Group::new(
-                        group.delimiter(),
-                        strip(group.stream()),
-                    ))),
-                    other => kept.push(other),
-                }
-            }
-            kept.into_iter().collect()
-        }
-
-        strip(tokens).to_string()
-    }
-}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -1,539 +0,0 @@
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod enums;
-mod errors;
-mod glue;
-mod lowering;
-mod parsed_host_function;
-
-use std::collections::HashSet;
-
-use proc_macro2::TokenStream;
-use quote::quote;
-use syn::{
-    TraitItemFn,
-    parse::{Parse, ParseStream},
-    parse2,
-};
-
-use parsed_host_function::ParsedHostFunction;
-
-/// Declares the wasm host ABI once, and generates everything that follows from it.
-///
-/// The input is a block of `fn` declarations, each carrying the gas cost the host
-/// charges before the call and the name the guest imports it under. Doc comments
-/// are kept and appear on the generated items.
-///
-/// This crate is an implementation detail of `xrpl-host-functions`, which
-/// hand-writes the types the declarations refer to and holds the one declaration
-/// block.
-///
-/// # What it generates
-///
-/// Four items, in the scope the block is written in:
-///
-/// - `pub trait HostFunctions`: one method per declaration, emitted verbatim —
-///   receiver, parameters, return type and doc comment exactly as written. An
-///   execution environment implements it; the rest of the expansion does not
-///   mention it.
-/// - `pub enum HostFunctionSpec`: one variant per declaration, named by
-///   PascalCasing the function name (`get_ledger_sqn` becomes `GetLedgerSqn`) and
-///   carrying that declaration's doc comment. Its `const fn wasm_name`, `gas`,
-///   `wasm_params` and `wasm_result` are the ABI metadata, and `ALL` is every
-///   variant in declaration order — what a wasm engine iterates to build its
-///   import table.
-/// - `struct HostFnSpec`: private, one row of that metadata table. It exists only
-///   so those accessors read from a single `match` over the declarations, and
-///   never appears in a signature a caller can name.
-/// - `macro_rules! wasmi_glue`: the registration for a wasmi engine, emitted as a
-///   macro rather than as code because it names an engine this crate must not
-///   depend on. Inert until expanded — see its own documentation.
-///
-/// The wasm signature is derived from the declared types rather than stated a
-/// second time: `i32` and `i64` are the wasm scalars spelled as themselves, every
-/// other parameter type is marshalled through a `(ptr, len)` pair or an `i32`
-/// code, and the result comes from the `HostResult<T>` success type. The glue is
-/// generated from that same derivation, so the closure a guest links against and
-/// the signature it is screened by are one statement.
-///
-/// Outside the glue's body the expansion builds only `Self::Variant` and
-/// `WasmValType` paths, so the block compiles wherever the types it names —
-/// `HostResult` and `WasmValType` — resolve.
-///
-/// ```
-/// use xrpl_host_functions::{HostResult, WasmValType};
-/// use xrpl_host_functions_macros::host_functions;
-///
-/// host_functions! {
-///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
-///     #[gas = 60]
-///     #[wasm_name = "ldgr_index"]
-///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-///
-///     /// Writes `msg` to the trace log.
-///     #[gas = 500]
-///     #[wasm_name = "trace_num"]
-///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-/// }
-///
-/// // The trait's methods are the declarations, down to the `&self` receiver the
-/// // VM calls the host through.
-/// fn ledger_sqn(host: &dyn HostFunctions, out: &mut [u8]) -> HostResult<usize> {
-///     host.get_ledger_sqn(out)
-/// }
-///
-/// // The metadata is a `const` table, so gas and import names are available at
-/// // compile time rather than looked up at run time.
-/// const TRACE_GAS: u64 = HostFunctionSpec::TraceNum.gas();
-/// assert_eq!(TRACE_GAS, 500);
-///
-/// assert_eq!(HostFunctionSpec::GetLedgerSqn.wasm_name(), "ldgr_index");
-/// assert_eq!(
-///     HostFunctionSpec::ALL,
-///     &[HostFunctionSpec::GetLedgerSqn, HostFunctionSpec::TraceNum],
-/// );
-///
-/// // So is the wasm signature: `out: &mut [u8]` is the pair `(ptr, len)`, and
-/// // `HostResult<usize>` answers the length written to it.
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32],
-/// );
-/// assert_eq!(
-///     HostFunctionSpec::GetLedgerSqn.wasm_result(),
-///     Some(WasmValType::I32),
-/// );
-///
-/// // `trace_num` answers nothing at all, so its import has no result.
-/// assert_eq!(
-///     HostFunctionSpec::TraceNum.wasm_params(),
-///     &[WasmValType::I32, WasmValType::I32, WasmValType::I64],
-/// );
-/// assert_eq!(HostFunctionSpec::TraceNum.wasm_result(), None);
-/// ```
-///
-/// A declaration must be a plain `fn` taking `&self`, with no body and no
-/// generics: it maps to exactly one wasm import signature. Its parameters must be
-/// `i32`, `i64`, `u32`, `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`, and it
-/// must return `HostResult<usize>` if it writes an output region,
-/// `HostResult<i32>` or `HostResult<FloatOrdering>` if it answers a value directly,
-/// or `HostResult<()>` if it answers nothing. Two declarations may not share a
-/// `wasm_name`, nor collapse to the same PascalCase variant.
-#[proc_macro]
-pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
-    expand(input.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-/// Declares an enum of wire codes, together with the `ALL`, `code` and
-/// `from_code` set that must not fall behind its variants.
-///
-/// The enum is written as an ordinary one — its own doc comment, its own
-/// visibility, one `Variant = code,` per line — and the attribute supplies the
-/// derives and the `#[repr(i32)]` that `code` casts through. Rust cannot enumerate
-/// an enum's variants, so `ALL` is the only complete set a test can iterate.
-///
-/// A variant carries no data and states its code as an integer literal, since that
-/// literal is also the pattern `from_code` matches it by. What an unnamed code means
-/// is the caller's to decide, being a different condition per enum.
-///
-/// ```
-/// use xrpl_host_functions_macros::coded_enum;
-///
-/// /// How a trace buffer is to be read.
-/// #[coded_enum]
-/// pub enum TraceDataType {
-///     /// 8 little-endian bytes, rendered as a signed decimal.
-///     Int64 = 1,
-///     /// A 20-byte account ID, rendered as base58.
-///     Account = 4,
-/// }
-///
-/// assert_eq!(TraceDataType::Account.code(), 4);
-/// assert_eq!(TraceDataType::from_code(4), Some(TraceDataType::Account));
-/// assert_eq!(TraceDataType::from_code(2), None);
-/// assert_eq!(
-///     TraceDataType::ALL,
-///     &[TraceDataType::Int64, TraceDataType::Account],
-/// );
-/// ```
-#[proc_macro_attribute]
-pub fn coded_enum(
-    args: proc_macro::TokenStream,
-    item: proc_macro::TokenStream,
-) -> proc_macro::TokenStream {
-    enums::expand(args.into(), item.into())
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
-}
-
-fn expand(input: TokenStream) -> syn::Result<TokenStream> {
-    let functions = parse_block(input)?;
-    let abi = abi_items(&functions);
-    let glue = glue::wasmi_glue(&functions);
-
-    Ok(quote! {
-        #abi
-        #glue
-    })
-}
-
-/// Every declaration in the block, parsed and checked against each other, or
-/// every mistake in it.
-fn parse_block(input: TokenStream) -> syn::Result<Vec<ParsedHostFunction>> {
-    let HostFunctionsInput { functions } = parse2(input)?;
-
-    let mut parsed = Vec::with_capacity(functions.len());
-    let mut errors = Vec::new();
-    for function in functions {
-        match ParsedHostFunction::parse(function) {
-            Ok(function) => parsed.push(function),
-            Err(error) => errors.push(error),
-        }
-    }
-    if let Some(error) = errors::combine(errors) {
-        return Err(error);
-    }
-    if let Some(error) = errors::combine(collisions(&parsed)) {
-        return Err(error);
-    }
-
-    Ok(parsed)
-}
-
-/// Names two declarations may not share, because the generated code would then
-/// fail to compile at a span the caller cannot see.
-fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
-    let mut errors = Vec::new();
-    let mut variants = HashSet::new();
-    let mut wasm_names = HashSet::new();
-
-    for function in functions {
-        if !variants.insert(function.variant.to_string()) {
-            errors.push(syn::Error::new_spanned(
-                &function.variant,
-                format!(
-                    "another host function already becomes the `{}` variant",
-                    function.variant
-                ),
-            ));
-        }
-        if !wasm_names.insert(function.wasm_name.value()) {
-            errors.push(syn::Error::new_spanned(
-                &function.wasm_name,
-                format!(
-                    "another host function is already imported as `{}`",
-                    function.wasm_name.value()
-                ),
-            ));
-        }
-    }
-
-    errors
-}
-
-/// The ABI itself: the trait a host implements and the table everything else
-/// reads. `glue::wasmi_glue` is the other half of the expansion.
-fn abi_items(functions: &[ParsedHostFunction]) -> TokenStream {
-    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
-    let variants = functions
-        .iter()
-        .map(ParsedHostFunction::variant_declaration);
-    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
-    let all = functions.iter().map(|function| &function.variant);
-
-    quote! {
-        /// The host side of the wasm ABI: one method per function a guest may
-        /// import.
-        ///
-        /// Implement it once per execution environment — the ledger host, a test
-        /// double, a benchmark fake — and a guest module cannot tell them apart.
-        /// Each method is one declaration from the `host_functions!` block, as
-        /// written; its `&self` receiver is not part of the ABI the guest sees,
-        /// so a host that must mutate does so behind interior mutability.
-        ///
-        /// # The output contract
-        ///
-        /// A method handed an `out` buffer **writes into it only when the whole
-        /// value fits, and returns the value's true length whether it fitted or
-        /// not.**
-        ///
-        /// The length is the value's, not the number of bytes written, because it
-        /// is how a guest that asked with too small a buffer learns the size to
-        /// ask for next time. The engine turns a length past the buffer into
-        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
-        /// so a host needs to know neither.
-        ///
-        /// Writing nothing unless the value fits is the half only a host can hold
-        /// up. An engine can bound how many bytes are *writable* — and does, by
-        /// handing over a region clamped to the field cap — but it cannot take
-        /// back what a method already put there. A host that wrote a truncated
-        /// prefix and then reported the larger length would leave those bytes in
-        /// guest memory behind a refusal the guest is told to ignore.
-        pub trait HostFunctions {
-            #(#trait_methods)*
-        }
-
-        /// One row of the ABI table: what [`HostFunctionSpec`]'s accessors
-        /// read from.
-        ///
-        /// Private, and the only reason it exists is to keep all of them fed
-        /// from a single `match` over the declarations.
-        struct HostFnSpec {
-            name: &'static str,
-            gas: u64,
-            wasm_params: &'static [WasmValType],
-            wasm_result: Option<WasmValType>,
-        }
-
-        /// Identifies one host function, and is the compile-time source of its
-        /// ABI metadata.
-        ///
-        /// One variant per `host_functions!` declaration, named by converting the
-        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
-        /// what a wasm engine iterates to build its import table.
-        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-        pub enum HostFunctionSpec {
-            #(#variants,)*
-        }
-
-        impl HostFunctionSpec {
-            /// Every host function, in the order declared.
-            ///
-            /// This is the complete import surface a guest may link against: a
-            /// function absent here cannot be called, and one present here must
-            /// be registered for a module that imports it to instantiate.
-            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
-
-            /// This function's row of the ABI table.
-            const fn spec(self) -> HostFnSpec {
-                match self {
-                    #(#spec_arms,)*
-                }
-            }
-
-            /// The name a guest imports this function under.
-            ///
-            /// A guest's import name must match this exactly, or the module
-            /// fails to instantiate. Usable in `const` context, so import lists
-            /// can be built at compile time.
-            pub const fn wasm_name(self) -> &'static str {
-                self.spec().name
-            }
-
-            /// Gas charged before the call runs, independent of its arguments.
-            ///
-            /// Consensus-relevant: two nodes that disagree on this value
-            /// disagree on transaction outcomes. Usable in `const` context, so
-            /// gas tables can be built at compile time.
-            pub const fn gas(self) -> u64 {
-                self.spec().gas
-            }
-
-            /// The wasm parameters this function is imported with, in wire
-            /// order — the list a guest's import must match, which the
-            /// declaration's own parameter list is not: a declared parameter
-            /// marshalled through a `(ptr, len)` region is two of these.
-            ///
-            /// Usable in `const` context, so import lists can be built at
-            /// compile time.
-            pub const fn wasm_params(self) -> &'static [WasmValType] {
-                self.spec().wasm_params
-            }
-
-            /// The wasm result this function answers with, or `None` for the
-            /// one whose whole effect is on the host. An `i32` where there is
-            /// one, whether the host answered a value or the length of what it
-            /// wrote — the wire does not distinguish those.
-            pub const fn wasm_result(self) -> Option<WasmValType> {
-                self.spec().wasm_result
-            }
-        }
-    }
-}
-
-struct HostFunctionsInput {
-    functions: Vec<TraitItemFn>,
-}
-
-impl Parse for HostFunctionsInput {
-    fn parse(input: ParseStream) -> syn::Result<Self> {
-        let mut functions = Vec::new();
-        while !input.is_empty() {
-            functions.push(input.parse()?);
-        }
-        Ok(HostFunctionsInput { functions })
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn accepts_an_empty_block() {
-        expand(quote! {}).unwrap();
-    }
-
-    #[test]
-    fn reports_mistakes_from_every_function() {
-        let error = expand(quote! {
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 2000]
-            fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-        })
-        .expect_err("expected parsing to fail");
-
-        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
-        assert_eq!(messages.len(), 2, "{messages:?}");
-        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
-        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
-    }
-
-    #[test]
-    fn propagates_syntax_errors() {
-        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
-        assert!(!error.to_string().is_empty());
-    }
-
-    /// The messages of every diagnostic recorded by one failed `expand`.
-    fn messages(input: TokenStream) -> Vec<String> {
-        let Err(error) = expand(input) else {
-            panic!("expected expansion to fail");
-        };
-        error.into_iter().map(|error| error.to_string()).collect()
-    }
-
-    /// The ABI half of the expansion alone: the glue's body is written against
-    /// another crate entirely, so the tests below about what the expansion may
-    /// name are not about it.
-    fn abi_expansion(input: TokenStream) -> String {
-        abi_items(&parse_block(input).expect("the block should parse")).to_string()
-    }
-
-    #[test]
-    fn generates_the_trait_the_enum_and_the_table() {
-        let generated = expand(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-            #[gas = 500]
-            #[wasm_name = "trace_num"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        })
-        .unwrap()
-        .to_string();
-
-        for expected in [
-            "pub trait HostFunctions",
-            "fn get_ledger_sqn (& self , out : & mut [u8]) -> HostResult < usize > ;",
-            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
-            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
-            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
-            // The table's row type is generated too, and stays private.
-            "struct HostFnSpec { name : & 'static str , gas : u64 , \
-             wasm_params : & 'static [WasmValType] , wasm_result : Option < WasmValType > , }",
-            "const fn spec (self) -> HostFnSpec",
-            // Two wasm parameters for the one declared region, and a result for
-            // the length written to it.
-            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32] , \
-             wasm_result : Some (WasmValType :: I32) , }",
-            "Self :: TraceNum => HostFnSpec { name : \"trace_num\" , gas : 500u64 , \
-             wasm_params : & [WasmValType :: I32 , WasmValType :: I32 , WasmValType :: I64] , \
-             wasm_result : None , }",
-            "pub const fn wasm_name (self) -> & 'static str",
-            "pub const fn gas (self) -> u64",
-            "pub const fn wasm_params (self) -> & 'static [WasmValType]",
-            "pub const fn wasm_result (self) -> Option < WasmValType >",
-            // The fourth item; its contents are `glue`'s own tests.
-            "macro_rules ! wasmi_glue",
-        ] {
-            assert!(generated.contains(expected), "missing {expected:?}");
-        }
-    }
-
-    /// The ABI reaches for nothing outside the crate it lands in, which is what
-    /// lets that crate stay zero-dependency and link into the guest. The glue is
-    /// not held to this — its body names one engine throughout, and `glue`'s own
-    /// tests pin that instead.
-    #[test]
-    fn names_no_crate_of_its_own() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
-
-        // Two roots and no others: `Self::Variant` and `WasmValType::I32`.
-        // Doc comments spell paths without spaces (`Self::ALL`), so they do not
-        // match.
-        for (index, _) in generated.match_indices(" :: ") {
-            let prefix = &generated[..index];
-            assert!(
-                prefix.ends_with("Self") || prefix.ends_with("WasmValType"),
-                "path out of the expansion at {index}: {generated}"
-            );
-        }
-    }
-
-    /// `spec` is an implementation detail of the two accessors, so it must not
-    /// become part of the ABI crate's public surface.
-    #[test]
-    fn keeps_the_table_row_private() {
-        let generated = abi_expansion(quote! {
-            #[gas = 60]
-            #[wasm_name = "ldgr_index"]
-            fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-        });
-
-        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
-        assert!(!generated.contains("pub const fn spec"), "{generated}");
-    }
-
-    #[test]
-    fn rejects_two_functions_that_share_a_wasm_name() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "trace"]
-            fn trace(&self, msg: &str) -> HostResult<()>;
-
-            #[gas = 70]
-            #[wasm_name = "trace"]
-            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("already imported as `trace`"),
-            "{messages:?}"
-        );
-    }
-
-    /// Names that differ only in underscores collapse to one enum variant.
-    #[test]
-    fn rejects_two_functions_that_share_a_variant() {
-        let messages = messages(quote! {
-            #[gas = 60]
-            #[wasm_name = "a"]
-            fn get_ledger_sqn(&self) -> HostResult<i32>;
-
-            #[gas = 70]
-            #[wasm_name = "b"]
-            fn get_ledger__sqn(&self) -> HostResult<i32>;
-        });
-
-        assert_eq!(messages.len(), 1, "{messages:?}");
-        assert!(
-            messages[0].contains("`GetLedgerSqn` variant"),
-            "{messages:?}"
-        );
-    }
-}

crates/xrpl-host-functions-macros/src/lowering.rs

@@ -1,492 +0,0 @@
-//! The wire shape of a declaration: everything a declared Rust type decides — the
-//! wasm value types it lowers to, the names those wasm parameters take, the type a
-//! generated body is handed for it, and which of the ABI's two argument traits
-//! builds that type. Kept as one set of `match` arms because the four must agree.
-//!
-//! The whole mapping, and the only place it is written down: a type no arm here
-//! names is a type the ABI does not have, not one that falls back to something.
-//!
-//! Two rows are worth knowing before reading a declaration:
-//!
-//! - **`u32` is not a scalar.** It is a `(ptr, len)` region holding four
-//!   little-endian bytes, which is how the guest SDK passes a sequence number.
-//! - **`usize` and `i32` results are the same on the wire and not
-//!   interchangeable**: the first is the length of what was written to an output
-//!   region, the second the answer itself — as is `FloatOrdering`, a third spelling.
-//!
-//! Matching is on types as they are spelled — a proc macro resolves nothing, so
-//! `type Bytes = u32; … x: Bytes` is unrecognizable — but on a path's last
-//! segment, so any of these types may be spelled qualified.
-
-use proc_macro2::TokenStream;
-use quote::{ToTokens, format_ident, quote};
-use syn::{Ident, PathArguments, Type, TypePath, TypeReference};
-
-/// What a host function may be handed, and what each costs on the wire.
-///
-/// Declaration order is wasm parameter order, so a reader of a declaration is
-/// reading the import the guest links against.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ParamType {
-    /// `i32`, passed through as itself. Also the spelling for a raw scalar
-    /// whose signedness the ABI does not fix.
-    I32,
-    /// `i64`, passed through as itself.
-    I64,
-    /// `TraceDataType`: an `i32` code the engine resolves to the enum before a
-    /// host sees it.
-    TraceDataType,
-    /// `&[u8]`: a borrowed input region.
-    InBytes,
-    /// `&str`: an input region whose read is also the UTF-8 check.
-    InStr,
-    /// `u32`: an input region holding four little-endian bytes.
-    InU32,
-    /// `&mut [u8]`: the writable output region.
-    OutBytes,
-}
-
-/// The success type of the `HostResult<T>` every declaration returns. These three
-/// are what the ABI has; any other `T` is an error.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum ResultType {
-    /// `usize`: the true length of a value written to an output region, which
-    /// the engine turns into the wire's `i32` or into `BufferTooSmall` /
-    /// `DataFieldTooLarge`. Never itself the wire type.
-    BufferLength,
-    /// `i32` or `FloatOrdering`: the answer, from a function that writes no region.
-    /// One variant for both — one wire result, and the declared type still reaches the
-    /// trait verbatim.
-    Value,
-    /// `()`: no wasm result at all — the call's whole effect is on the host, and
-    /// an `Err` reaches the guest in no form.
-    Nothing,
-}
-
-/// The wasm value types this ABI uses, mirroring `xrpl_host_functions::WasmValType`.
-///
-/// Mirrored rather than shared because the dependency runs the other way: the ABI
-/// crate depends on this one, so nothing here can name its types. The [`ToTokens`]
-/// impl below is the whole of the crossing, and emits references to that enum's
-/// variants — so falling out of sync with it is a compile error at the
-/// `host_functions!` call site rather than drift.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum WasmValType {
-    I32,
-    I64,
-}
-
-impl ParamType {
-    /// Recognizes the declared type, or refuses it against its own span.
-    pub(crate) fn parse(ty: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function's parameter must be `i32`, `i64`, `u32`, \
-                               `&[u8]`, `&mut [u8]`, `&str` or `TraceDataType`";
-
-        let recognized = match ty {
-            // A lifetime on the reference changes nothing on the wire.
-            Type::Reference(TypeReference {
-                mutability, elem, ..
-            }) => match (mutability, &**elem) {
-                (None, Type::Slice(slice)) if is_named(&slice.elem, "u8") => Some(Self::InBytes),
-                (Some(_), Type::Slice(slice)) if is_named(&slice.elem, "u8") => {
-                    Some(Self::OutBytes)
-                }
-                (None, elem) if is_named(elem, "str") => Some(Self::InStr),
-                _ => None,
-            },
-            _ => match last_path_segment(ty) {
-                Some(name) if name == "i32" => Some(Self::I32),
-                Some(name) if name == "i64" => Some(Self::I64),
-                Some(name) if name == "u32" => Some(Self::InU32),
-                Some(name) if name == "TraceDataType" => Some(Self::TraceDataType),
-                _ => None,
-            },
-        };
-
-        recognized.ok_or_else(|| syn::Error::new_spanned(ty, ALLOWED))
-    }
-
-    /// The wasm parameters this declared type lowers to, in order. `InBytes` and
-    /// `OutBytes` lower alike, so a region's direction survives only in the
-    /// variant.
-    pub(crate) fn as_wasm_params(self) -> &'static [WasmValType] {
-        match self {
-            Self::I32 | Self::TraceDataType => &[WasmValType::I32],
-            Self::I64 => &[WasmValType::I64],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                &[WasmValType::I32, WasmValType::I32]
-            }
-        }
-    }
-
-    /// What a declaration calls each of those wasm parameters: the declared name
-    /// for a scalar, and `{name}_ptr`/`{name}_len` for the pair a region lowers
-    /// to.
-    ///
-    /// **It must answer as many names as [`Self::as_wasm_params`] answers types**,
-    /// since the generated closure declares them one against the other — hence the
-    /// matching arms, and `lowers_every_declared_parameter_type`'s row-by-row
-    /// length check.
-    pub(crate) fn wasm_names(self, name: &Ident) -> Vec<Ident> {
-        match self {
-            Self::I32 | Self::I64 | Self::TraceDataType => vec![name.clone()],
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                vec![format_ident!("{name}_ptr"), format_ident!("{name}_len")]
-            }
-        }
-    }
-
-    /// The type a generated body takes this parameter as: a wasm scalar spelled as
-    /// itself, everything else the argument type carrying its shape and direction —
-    /// which is what makes an input region used as an output one a compile error
-    /// naming both.
-    ///
-    /// The argument types are the engine's, so `vm` is the path they are reached
-    /// under; which types need it is decided here, a wasm scalar being `i32` under
-    /// every engine.
-    pub(crate) fn argument_type(self, vm: &TokenStream) -> TokenStream {
-        match self {
-            Self::I32 => quote!(i32),
-            Self::I64 => quote!(i64),
-            Self::TraceDataType => quote!(#vm::TraceCode),
-            Self::InBytes => quote!(#vm::InBytes),
-            Self::InStr => quote!(#vm::InStr),
-            Self::InU32 => quote!(#vm::InU32),
-            Self::OutBytes => quote!(#vm::OutBytes),
-        }
-    }
-
-    /// Which of the ABI's two argument traits builds this parameter's argument
-    /// type, or `None` for a wasm scalar, which reaches a body as itself.
-    ///
-    /// The arity is the whole of the distinction — `FromWasmRegion` takes the two
-    /// of a `(ptr, len)` pair, `FromWasmScalar` the one of a code — so this answers
-    /// alongside [`Self::as_wasm_params`] rather than from a predicate elsewhere.
-    pub(crate) fn argument_trait(self) -> Option<TokenStream> {
-        match self {
-            Self::I32 | Self::I64 => None,
-            Self::TraceDataType => Some(quote!(FromWasmScalar)),
-            Self::InBytes | Self::InStr | Self::InU32 | Self::OutBytes => {
-                Some(quote!(FromWasmRegion))
-            }
-        }
-    }
-
-    /// Whether this parameter is a region the host writes to — what
-    /// [`ResultType::BufferLength`] is the length *of*.
-    pub(crate) fn is_out_region(self) -> bool {
-        matches!(self, Self::OutBytes)
-    }
-}
-
-impl ResultType {
-    /// Recognizes the success type of a declaration's `HostResult<T>`, or
-    /// refuses it against its own span.
-    pub(crate) fn parse(success: &Type) -> syn::Result<Self> {
-        const ALLOWED: &str = "a host function must return `HostResult<usize>` for a value it \
-                               writes to an output region, `HostResult<i32>` or \
-                               `HostResult<FloatOrdering>` for one it answers directly, or \
-                               `HostResult<()>` for none at all";
-
-        if let Type::Tuple(tuple) = success
-            && tuple.elems.is_empty()
-        {
-            return Ok(Self::Nothing);
-        }
-
-        match last_path_segment(success) {
-            Some(name) if name == "usize" => Ok(Self::BufferLength),
-            Some(name) if name == "i32" || name == "FloatOrdering" => Ok(Self::Value),
-            _ => Err(syn::Error::new_spanned(success, ALLOWED)),
-        }
-    }
-
-    /// The generated table's `wasm_result` field: `Some(WasmValType::I32)`, or
-    /// `None` for the function that answers nothing.
-    ///
-    /// Spelled out here rather than left to `quote`'s `Option` impl, which emits
-    /// nothing at all for `None`.
-    pub(crate) fn wasm_result_tokens(self) -> TokenStream {
-        match self.as_wasm_result() {
-            Some(val_type) => quote! { Some(#val_type) },
-            None => quote! { None },
-        }
-    }
-
-    /// Whether the value reaches the guest as the length of what was written to
-    /// an output region.
-    pub(crate) fn is_buffer_length(self) -> bool {
-        matches!(self, Self::BufferLength)
-    }
-
-    /// The wasm result, which does not distinguish a length from a value.
-    fn as_wasm_result(self) -> Option<WasmValType> {
-        match self {
-            Self::BufferLength | Self::Value => Some(WasmValType::I32),
-            Self::Nothing => None,
-        }
-    }
-}
-
-/// `WasmValType::I32` — the ABI crate's variant, named but never defined here.
-impl ToTokens for WasmValType {
-    fn to_tokens(&self, tokens: &mut TokenStream) {
-        tokens.extend(match self {
-            Self::I32 => quote! { WasmValType::I32 },
-            Self::I64 => quote! { WasmValType::I64 },
-        });
-    }
-}
-
-/// The last segment of a plain path type, when it carries no generic arguments:
-/// `i32`, `core::primitive::i32` and `TraceDataType` all answer their own name,
-/// `Vec<u8>` and `[u8; 4]` nothing.
-fn last_path_segment(ty: &Type) -> Option<&Ident> {
-    let Type::Path(TypePath {
-        qself: None, path, ..
-    }) = ty
-    else {
-        return None;
-    };
-    let last = path.segments.last()?;
-    matches!(last.arguments, PathArguments::None).then_some(&last.ident)
-}
-
-/// Whether `ty` is the named primitive, however it is spelled.
-fn is_named(ty: &Type, name: &str) -> bool {
-    last_path_segment(ty).is_some_and(|segment| segment == name)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use syn::parse_quote;
-
-    use WasmValType::{I32, I64};
-
-    /// Every declared parameter type and everything it decides: what it costs on
-    /// the wire, what a body is handed for it, and which trait builds that.
-    ///
-    /// The names are asserted by length rather than spelling, since a type
-    /// answering fewer names than value types is the one way these answers can
-    /// contradict each other.
-    #[test]
-    fn lowers_every_declared_parameter_type() {
-        let mapping: [(Type, &[WasmValType], &str, Option<&str>); 7] = [
-            (parse_quote!(i32), &[I32], "i32", None),
-            (parse_quote!(i64), &[I64], "i64", None),
-            (
-                parse_quote!(TraceDataType),
-                &[I32],
-                "vm :: TraceCode",
-                Some("FromWasmScalar"),
-            ),
-            (
-                parse_quote!(&[u8]),
-                &[I32, I32],
-                "vm :: InBytes",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&str),
-                &[I32, I32],
-                "vm :: InStr",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(u32),
-                &[I32, I32],
-                "vm :: InU32",
-                Some("FromWasmRegion"),
-            ),
-            (
-                parse_quote!(&mut [u8]),
-                &[I32, I32],
-                "vm :: OutBytes",
-                Some("FromWasmRegion"),
-            ),
-        ];
-        let declared_name = format_ident!("seq");
-        let vm = quote!(vm);
-
-        for (declared, wasm, argument, argument_trait) in mapping {
-            let param = ParamType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a parameter type", quoted(&declared)));
-
-            assert_eq!(param.as_wasm_params(), wasm, "`{}`", quoted(&declared));
-            assert_eq!(
-                param.argument_type(&vm).to_string(),
-                argument,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param
-                    .argument_trait()
-                    .map(|name| name.to_string())
-                    .as_deref(),
-                argument_trait,
-                "`{}`",
-                quoted(&declared)
-            );
-            assert_eq!(
-                param.wasm_names(&declared_name).len(),
-                wasm.len(),
-                "one name per wasm parameter: `{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A region's two wasm parameters are named off the declaration, so the
-    /// generated closure reads as the declaration does.
-    #[test]
-    fn names_a_region_s_pair_after_the_declared_parameter() {
-        let seq = format_ident!("seq");
-
-        let names = |declared: Type| {
-            ParamType::parse(&declared)
-                .expect("a parameter type")
-                .wasm_names(&seq)
-                .iter()
-                .map(Ident::to_string)
-                .collect::<Vec<_>>()
-        };
-
-        assert_eq!(names(parse_quote!(u32)), ["seq_ptr", "seq_len"]);
-        assert_eq!(names(parse_quote!(i32)), ["seq"]);
-    }
-
-    /// The two `(ptr, len)` pairs lower alike but are told apart, since only the
-    /// direction says who may write to the region.
-    #[test]
-    fn keeps_the_regions_apart() {
-        let input: Type = parse_quote!(&[u8]);
-        let output: Type = parse_quote!(&mut [u8]);
-
-        assert!(!ParamType::parse(&input).unwrap().is_out_region());
-        assert!(ParamType::parse(&output).unwrap().is_out_region());
-    }
-
-    /// A type outside the mapping is refused rather than lowered to a guess.
-    #[test]
-    fn refuses_parameter_types_outside_the_mapping() {
-        let outside: [Type; 11] = [
-            parse_quote!(u64),
-            parse_quote!(u8),
-            parse_quote!(usize),
-            parse_quote!(bool),
-            parse_quote!(Vec<u8>),
-            parse_quote!([u8; 4]),
-            parse_quote!(&mut str),
-            parse_quote!(&i32),
-            parse_quote!(&[i32]),
-            parse_quote!(&Foo),
-            parse_quote!(()),
-        ];
-
-        for declared in outside {
-            let Err(error) = ParamType::parse(&declared) else {
-                panic!("`{}` should not be a parameter type", quoted(&declared));
-            };
-            assert!(
-                error.to_string().contains("must be `i32`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The declared success types, and the wasm result each becomes. `usize` and `i32`
-    /// agree on the wire and are separate rows; `FloatOrdering` shares `i32`'s.
-    #[test]
-    fn lowers_every_success_type() {
-        let mapping: [(Type, ResultType, Option<WasmValType>); 4] = [
-            (parse_quote!(usize), ResultType::BufferLength, Some(I32)),
-            (parse_quote!(i32), ResultType::Value, Some(I32)),
-            (parse_quote!(FloatOrdering), ResultType::Value, Some(I32)),
-            (parse_quote!(()), ResultType::Nothing, None),
-        ];
-
-        for (declared, expected, wasm_result) in mapping {
-            let result = ResultType::parse(&declared)
-                .unwrap_or_else(|_| panic!("`{}` should be a success type", quoted(&declared)));
-
-            assert_eq!(result, expected, "`{}`", quoted(&declared));
-            assert_eq!(
-                result.as_wasm_result(),
-                wasm_result,
-                "`{}`",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// The distinction the wasm result loses: which of the two `i32` results was
-    /// declared decides how the value reaches the guest.
-    #[test]
-    fn tells_a_length_from_a_value() {
-        assert!(ResultType::BufferLength.is_buffer_length());
-        assert!(!ResultType::Value.is_buffer_length());
-        assert!(!ResultType::Nothing.is_buffer_length());
-    }
-
-    #[test]
-    fn refuses_success_types_outside_the_mapping() {
-        let outside: [Type; 6] = [
-            parse_quote!(u32),
-            parse_quote!(i64),
-            parse_quote!(bool),
-            parse_quote!([u8; 32]),
-            parse_quote!(Vec<u8>),
-            parse_quote!((usize, i32)),
-        ];
-
-        for declared in outside {
-            let Err(error) = ResultType::parse(&declared) else {
-                panic!("`{}` should not be a success type", quoted(&declared));
-            };
-            assert!(
-                error
-                    .to_string()
-                    .contains("must return `HostResult<usize>`"),
-                "`{}`: {error}",
-                quoted(&declared)
-            );
-        }
-    }
-
-    /// A qualified spelling is the same type, matching how the return type finds
-    /// `HostResult`.
-    #[test]
-    fn accepts_qualified_spellings() {
-        let qualified: Type = parse_quote!(core::primitive::i32);
-        assert_eq!(ParamType::parse(&qualified).unwrap(), ParamType::I32);
-
-        let qualified: Type = parse_quote!(xrpl_host_functions::TraceDataType);
-        assert_eq!(
-            ParamType::parse(&qualified).unwrap(),
-            ParamType::TraceDataType
-        );
-    }
-
-    /// The emitted tokens name the ABI crate's variants, which is the whole of
-    /// what crosses out of this crate. Pinned here so a break in the mirror is a
-    /// failure with a span rather than a rustc error at the call site.
-    #[test]
-    fn emits_references_to_the_hand_written_variants() {
-        assert_eq!(I32.to_token_stream().to_string(), "WasmValType :: I32");
-        assert_eq!(I64.to_token_stream().to_string(), "WasmValType :: I64");
-
-        assert_eq!(
-            ResultType::BufferLength.wasm_result_tokens().to_string(),
-            "Some (WasmValType :: I32)"
-        );
-        assert_eq!(ResultType::Nothing.wasm_result_tokens().to_string(), "None");
-    }
-
-    fn quoted(ty: &Type) -> String {
-        ty.to_token_stream().to_string()
-    }
-}

crates/xrpl-host-functions/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "xrpl-host-functions"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
-
-# `wasmi_glue!` and the two argument traits it marshals through are a host's
-# business, and this crate is what a contract links against — so the feature is
-# what keeps `cargo doc` here showing a contract developer only the ABI. It costs
-# nothing either way: a `macro_rules!` is inert and a trait with no impls emits
-# nothing.
-#
-# `xrpl-wasm-vm` enables it and features unify across the graph, so the off
-# configuration is only ever checked by `cargo check -p xrpl-host-functions`,
-# which is in the loop in `tmp/notes/wasm-vm/testing.md` for that reason.
-[features]
-default = []
-wasmi_glue = []
-
-[lints]
-workspace = true

crates/xrpl-host-functions/src/lib.rs

@@ -1,586 +0,0 @@
-//! The wasm host ABI: the one place it is declared.
-//!
-//! `host_functions!` turns the declaration block at the bottom of this file into the
-//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
-//! wasm engine registers from.
-//!
-//! The split: hand-written here is the vocabulary the declarations are written in —
-//! [`HostError`], [`TraceDataType`], [`FloatOrdering`], [`HostResult`], [`HASH_LEN`] —
-//! and everything derived from the declarations is generated. The expansion names
-//! nothing this file does not, so the two sides meet only in the block below.
-//!
-//! Three items cross that split the other way, named by the expansion but by no
-//! declaration: [`WasmValType`], which the derived wasm signatures are spelled in,
-//! and `FromWasmRegion`/`FromWasmScalar`, which `wasmi_glue!` builds a marshalled
-//! argument through.
-
-#![no_std]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-// Not re-exported: the ABI is declared once, here, and this is the only call site.
-use xrpl_host_functions_macros::{coded_enum, host_functions};
-
-/// Error codes a host function may return. Every code is negative, which is what lets
-/// a failure and an answer share one `i32` on the wire.
-#[coded_enum]
-pub enum HostError {
-    Unimplemented = -1,
-    FieldNotFound = -2,
-    BufferTooSmall = -3,
-    NoArray = -4,
-    NotLeafField = -5,
-    LocatorMalformed = -6,
-    SlotOutRange = -7,
-    SlotsFull = -8,
-    EmptySlot = -9,
-    LedgerObjNotFound = -10,
-    OutOfTransferLimit = -11,
-    DataFieldTooLarge = -12,
-    PointerOutOfBounds = -13,
-    NoMemExported = -14,
-    InvalidParams = -15,
-    InvalidAccount = -16,
-    InvalidField = -17,
-    IndexOutOfBounds = -18,
-    FloatInputMalformed = -19,
-    FloatComputationError = -20,
-    /// Internal fatal error.
-    /// User code will never see this error but keep it reserved to not rely on the value.
-    InternalFatal = -2147483648,
-}
-
-/// Convenience alias for the trait's fallible returns.
-pub type HostResult<T> = Result<T, HostError>;
-
-/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
-pub const HASH_LEN: usize = 32;
-
-/// How [`HostFunctions::trace`] is to read its data buffer. Wire values shared with the
-/// guest stdlib: append only, never renumber, and starting at 1 so a zeroed argument
-/// names no type. `xrpl-wasm-vm-ffi` holds the second declaration, the one C++ compiles
-/// against — this crate links into the guest too, so it cannot depend on `cxx`.
-#[coded_enum]
-pub enum TraceDataType {
-    /// 8 little-endian bytes, rendered as a signed decimal.
-    Int64 = 1,
-    /// 8 little-endian bytes, rendered as an unsigned decimal.
-    Uint64 = 2,
-    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
-    Xfloat = 3,
-    /// A 20-byte account ID, rendered as base58.
-    Account = 4,
-    /// A serialized `STAmount`.
-    Amount = 5,
-    /// Raw bytes, hex-encoded.
-    AsHex = 6,
-    /// Bytes rendered verbatim as text.
-    AsText = 7,
-}
-
-/// The verdict [`HostFunctions::float_compare`] answers, read as the placing of `x`
-/// against `y`. **Not C's `memcmp` convention**: the wire's negative range belongs to
-/// [`HostError`], so every code here is non-negative — append only, never renumber.
-/// `WasmCommon.h` holds the second declaration, as [`TraceDataType`] has one.
-#[coded_enum]
-pub enum FloatOrdering {
-    Equal = 0,
-    Greater = 1,
-    Less = 2,
-}
-
-/// The wasm module name a guest imports these functions under:
-/// `(import "host_lib" "ldgr_index" …)`.
-pub const HOST_MODULE: &str = "host_lib";
-
-/// A wasm value type, as many of them as this ABI uses — the vocabulary the
-/// generated wasm signatures are spelled in, which an engine maps to its own value
-/// types once.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum WasmValType {
-    I32,
-    I64,
-}
-
-/// Builds the argument an engine marshals a `(ptr, len)` region into: a declared
-/// `&[u8]`, `&str`, `u32` or `&mut [u8]`. Nothing is checked here — the pair
-/// arrives as the guest sent it, and refusing a malformed region is the engine's
-/// business.
-///
-/// **Kept apart from [`FromWasmScalar`]** rather than folded into one trait with
-/// an associated wasm type, for the diagnostic: the mistake worth catching is an
-/// arity one — a declared `u32` is a region, not a code — and as two traits that
-/// lands as an unsatisfied bound at the offending argument type rather than an
-/// `i32`-against-`(i32, i32)` mismatch at the macro call.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmRegion {
-    fn from_wasm(ptr: i32, len: i32) -> Self;
-}
-
-/// Builds the argument an engine marshals a single `i32` code into: the declared
-/// `TraceDataType`. [`FromWasmRegion`] says why the two are separate traits.
-#[cfg(feature = "wasmi_glue")]
-pub trait FromWasmScalar {
-    fn from_wasm(code: i32) -> Self;
-}
-
-// Two rules hold over every declaration below, and neither is visible at any one of
-// them. They are what lets the wasm signature be read off the declaration.
-//
-// **Declaration order is wasm parameter order.** So `mode` comes after `out` in the
-// float functions, and `data_type` between `trace`'s two regions: the wire's order,
-// not the one a Rust signature would choose.
-//
-// **`i32` and `i64` are the wasm scalars, spelled as themselves; every other type is
-// marshalled.** `&[u8]`/`&str` and `&mut [u8]` are `(ptr, len)` pairs, `TraceDataType`
-// is an `i32` code the engine names before a host sees it, and **`u32` is four
-// little-endian bytes in a region**, not a scalar, which is how the guest SDK passes a
-// sequence number. A result is `usize` for the length of what was written to an output
-// region, `i32` or `FloatOrdering` for the answer itself, or `()` for none.
-host_functions! {
-    /// The sequence number of the ledger being built, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "ldgr_index"]
-    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_time"]
-    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The hash of the parent (last-closed) ledger, as 32 bytes.
-    #[gas = 60]
-    #[wasm_name = "parent_ldgr_hash"]
-    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "base_fee"]
-    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
-
-    /// Whether an amendment is enabled. The input is either its 32-byte id or its name;
-    /// the answer is `1` if enabled and `0` if not.
-    #[gas = 100]
-    #[wasm_name = "amendment_enabled"]
-    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
-
-    /// Load the ledger object with the given 32-byte id into a cache slot, so later
-    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
-    /// host to assign a free one. Answers the slot used.
-    #[gas = 5000]
-    #[wasm_name = "cache_le"]
-    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
-
-    /// The serialized bytes of one field of the transaction being executed, selected
-    /// by its `SField` code.
-    #[gas = 70]
-    #[wasm_name = "tx_field"]
-    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of the current (escrow) ledger object.
-    #[gas = 70]
-    #[wasm_name = "home_le_field"]
-    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of one field of a previously cached ledger object,
-    /// selected by its cache slot and the field's `SField` code.
-    #[gas = 70]
-    #[wasm_name = "le_field"]
-    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the transaction, reached by a
-    /// `locator`: a path of little-endian `i32` steps (so its byte length is a non-zero
-    /// multiple of 4).
-    #[gas = 110]
-    #[wasm_name = "tx_inner"]
-    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of the current (escrow) ledger object,
-    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
-    #[gas = 110]
-    #[wasm_name = "home_le_inner"]
-    fn get_current_ledger_obj_nested_field(
-        &self,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The serialized bytes of a nested field of a previously cached ledger object,
-    /// selected by its cache slot and reached by a `locator`.
-    #[gas = 110]
-    #[wasm_name = "le_inner"]
-    fn get_ledger_obj_nested_field(
-        &self,
-        cache_idx: i32,
-        locator: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The number of elements in an array field of the transaction, selected by its
-    /// `SField` code. Answers the count directly; `NoArray` if the field is not an array.
-    #[gas = 40]
-    #[wasm_name = "tx_arr_len"]
-    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of the current (escrow) ledger
-    /// object, as with [`HostFunctions::get_tx_array_len`].
-    #[gas = 40]
-    #[wasm_name = "home_le_arr_len"]
-    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in an array field of a previously cached ledger object,
-    /// selected by its cache slot and `SField` code.
-    #[gas = 40]
-    #[wasm_name = "le_arr_len"]
-    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the transaction, reached by a
-    /// `locator`.
-    #[gas = 70]
-    #[wasm_name = "tx_inner_arr_len"]
-    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of the current (escrow) ledger
-    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
-    #[gas = 70]
-    #[wasm_name = "home_le_inner_arr_len"]
-    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
-
-    /// The number of elements in a nested array field of a previously cached ledger
-    /// object, selected by its cache slot and reached by a `locator`.
-    #[gas = 70]
-    #[wasm_name = "le_inner_arr_len"]
-    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
-
-    /// Verify `signature` over `message` under `pubkey`. Answers `1` if the signature
-    /// is valid, `0` if not, or a negative error.
-    #[gas = 35000]
-    #[wasm_name = "check_sig"]
-    fn check_signature(
-        &self,
-        message: &[u8],
-        signature: &[u8],
-        pubkey: &[u8],
-    ) -> HostResult<i32>;
-
-    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
-    /// 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "accountroot_id"]
-    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a byte
-    /// slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued currency +
-    /// issuer).
-    #[gas = 450]
-    #[wasm_name = "amm_id"]
-    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "check_id"]
-    fn check_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
-    /// issuer account ids and a credential-type byte string.
-    #[gas = 350]
-    #[wasm_name = "credential_id"]
-    fn credential_keylet(
-        &self,
-        subject: &[u8],
-        issuer: &[u8],
-        credential_type: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account and
-    /// the account it authorizes.
-    #[gas = 350]
-    #[wasm_name = "delegate_id"]
-    fn delegate_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
-    /// the account it authorizes to deposit.
-    #[gas = 350]
-    #[wasm_name = "deposit_preauth_id"]
-    fn deposit_preauth_keylet(
-        &self,
-        account: &[u8],
-        authorize: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
-    #[gas = 350]
-    #[wasm_name = "did_id"]
-    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "escrow_id"]
-    fn escrow_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
-    /// account ids and a 20-byte currency.
-    #[gas = 400]
-    #[wasm_name = "trustline_id"]
-    fn trust_line_keylet(
-        &self,
-        account1: &[u8],
-        account2: &[u8],
-        currency: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "mpt_issuance_id"]
-    fn mptoken_issuance_keylet(
-        &self,
-        issuer: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
-    /// the 20-byte holder account.
-    #[gas = 500]
-    #[wasm_name = "mptoken_id"]
-    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
-    /// and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "nft_offer_id"]
-    fn nftoken_offer_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "offer_id"]
-    fn offer_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
-    /// its document id.
-    #[gas = 350]
-    #[wasm_name = "oracle_id"]
-    fn oracle_keylet(&self, account: &[u8], doc_id: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
-    /// the 20-byte destination account, and the channel's sequence number.
-    #[gas = 350]
-    #[wasm_name = "paychan_id"]
-    fn paychannel_keylet(
-        &self,
-        account: &[u8],
-        destination: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
-    /// account and its sequence number.
-    #[gas = 350]
-    #[wasm_name = "permissioned_domain_id"]
-    fn permissioned_domain_keylet(
-        &self,
-        account: &[u8],
-        seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
-    #[gas = 350]
-    #[wasm_name = "signers_id"]
-    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and
-    /// its ticket sequence number.
-    #[gas = 350]
-    #[wasm_name = "ticket_id"]
-    fn ticket_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
-    /// sequence number.
-    #[gas = 350]
-    #[wasm_name = "vault_id"]
-    fn vault_keylet(&self, account: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Sponsorship`, computed from the 20-byte sponsor account
-    /// and the 20-byte sponsee account.
-    #[gas = 350]
-    #[wasm_name = "sponsorship_id"]
-    fn sponsorship_keylet(
-        &self,
-        sponsor: &[u8],
-        sponsee: &[u8],
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `LoanBroker`, computed from the 20-byte owner account and
-    /// its sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_broker_id"]
-    fn loan_broker_keylet(&self, owner: &[u8], seq: u32, out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 32-byte keylet of a `Loan`, computed from the 32-byte id of its `LoanBroker`
-    /// and the loan's sequence number.
-    #[gas = 350]
-    #[wasm_name = "loan_id"]
-    fn loan_keylet(
-        &self,
-        loan_broker_id: &[u8],
-        loan_seq: u32,
-        out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
-    #[gas = 2000]
-    #[wasm_name = "sha512_half"]
-    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
-    ///
-    /// The one declaration whose wasm function has **no result**: this node's own log
-    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
-    /// reaches it in no form, and only the host-fatal ones do anything at all.
-    #[gas = 30]
-    #[wasm_name = "trace"]
-    fn trace(&self, msg: &str, data_type: TraceDataType, data: &[u8]) -> HostResult<()>;
-
-    /// Stores `data` as the current object's data field, replacing whatever was there,
-    /// and returns the number of bytes stored; `DataFieldTooLarge` if it exceeds the
-    /// host's limit.
-    #[gas = 1000]
-    #[wasm_name = "set_data"]
-    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
-
-    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
-    /// `account`.
-    #[gas = 5000]
-    #[wasm_name = "nft_uri"]
-    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 70]
-    #[wasm_name = "nft_issuer"]
-    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes), as four little-endian
-    /// bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_taxon"]
-    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_flags"]
-    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes).
-    #[gas = 60]
-    #[wasm_name = "nft_xfer_fee"]
-    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
-
-    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes), as four
-    /// little-endian bytes.
-    #[gas = 60]
-    #[wasm_name = "nft_serial"]
-    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
-
-    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
-    // holds opaquely and hands back to these functions. Inputs and outputs that are
-    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
-
-    /// A float built from the signed integer `x` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_int"]
-    fn float_from_int(&self, x: i64, out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
-    /// `mode`.
-    #[gas = 130]
-    #[wasm_name = "float_from_uint"]
-    fn float_from_uint(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stamount"]
-    fn float_from_stamount(&self, amount: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
-    #[gas = 150]
-    #[wasm_name = "float_from_stnumber"]
-    fn float_from_stnumber(&self, number: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` rounded to a signed integer under rounding `mode`, as eight
-    /// little-endian bytes.
-    #[gas = 130]
-    #[wasm_name = "float_to_int"]
-    fn float_to_int(&self, x: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` split into its mantissa (eight little-endian bytes) and its exponent
-    /// (four little-endian bytes), each written to its own output region.
-    #[gas = 130]
-    #[wasm_name = "float_to_mant_exp"]
-    fn float_to_mant_exp(
-        &self,
-        x: &[u8],
-        mantissa_out: &mut [u8],
-        exponent_out: &mut [u8],
-    ) -> HostResult<usize>;
-
-    /// A float built from `mantissa` and `exponent` under rounding `mode`.
-    #[gas = 100]
-    #[wasm_name = "float_from_mant_exp"]
-    fn float_from_mant_exp(
-        &self,
-        mantissa: i64,
-        exponent: i32,
-        out: &mut [u8],
-        mode: i32,
-    ) -> HostResult<usize>;
-
-    /// Compares floats `x` and `y`, answering the [`FloatOrdering`] that places `x`
-    /// against `y`. Reaches the guest as that variant's code, **not `memcmp`'s sign**.
-    #[gas = 80]
-    #[wasm_name = "float_cmp"]
-    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<FloatOrdering>;
-
-    /// The float sum `x + y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_add"]
-    fn float_add(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float difference `x - y` under rounding `mode`.
-    #[gas = 160]
-    #[wasm_name = "float_sub"]
-    fn float_subtract(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float product `x * y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_mult"]
-    fn float_multiply(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float quotient `x / y` under rounding `mode`.
-    #[gas = 300]
-    #[wasm_name = "float_div"]
-    fn float_divide(&self, x: &[u8], y: &[u8], out: &mut [u8], mode: i32) -> HostResult<usize>;
-
-    /// The float `x` raised to the power `n` under rounding `mode`.
-    #[gas = 5500]
-    #[wasm_name = "float_pow"]
-    fn float_power(&self, x: &[u8], n: i32, out: &mut [u8], mode: i32) -> HostResult<usize>;
-}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -1,41 +0,0 @@
-//! `host_functions!` must work outside the crate that declares the ABI: the only
-//! names its expansion needs are `WasmValType` and the ones the declarations
-//! themselves spell.
-//!
-//! That this crate compiles is also what shows the emitted `wasmi_glue!` costs
-//! nothing to carry: its body names an engine throughout, there is no engine
-//! here, and nobody here expands it.
-
-use xrpl_host_functions::{HostResult, WasmValType};
-use xrpl_host_functions_macros::host_functions;
-
-host_functions! {
-    /// Answers with the number it was given.
-    #[gas = 7]
-    #[wasm_name = "ping"]
-    fn ping(&self, number: i32) -> HostResult<i32>;
-}
-
-struct Host;
-
-impl HostFunctions for Host {
-    fn ping(&self, number: i32) -> HostResult<i32> {
-        Ok(number)
-    }
-}
-
-#[test]
-fn the_generated_table_stands_on_its_own() {
-    assert_eq!(HostFunctionSpec::ALL.len(), 1);
-    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
-    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
-    assert_eq!(HostFunctionSpec::Ping.wasm_params(), &[WasmValType::I32]);
-    assert_eq!(HostFunctionSpec::Ping.wasm_result(), Some(WasmValType::I32));
-}
-
-/// The generated trait is implementable from another crate, which is the point of
-/// declaring the ABI in a library at all.
-#[test]
-fn the_generated_trait_is_implementable_here() {
-    assert_eq!(Host.ping(3), Ok(3));
-}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -1,95 +0,0 @@
-//! Exercises what `#[coded_enum]` generates for [`HostError`]: the wire codes, the
-//! set [`HostError::ALL`] names, and the round trip between them.
-//!
-//! The codes are consensus input — they are what a guest reads off a failed host
-//! call — so they are pinned here as literals and derived everywhere else.
-
-use xrpl_host_functions::HostError;
-
-/// The whole set, written out in the order `ALL` gives it: the one place the wire
-/// codes appear as literals, and a deliberate change-detector, since a code that
-/// moves changes what every deployed guest is told.
-#[test]
-fn the_error_table_matches_the_declarations() {
-    let table: Vec<(HostError, i32)> = HostError::ALL
-        .iter()
-        .map(|&error| (error, error.code()))
-        .collect();
-
-    assert_eq!(
-        table,
-        [
-            (HostError::Unimplemented, -1),
-            (HostError::FieldNotFound, -2),
-            (HostError::BufferTooSmall, -3),
-            (HostError::NoArray, -4),
-            (HostError::NotLeafField, -5),
-            (HostError::LocatorMalformed, -6),
-            (HostError::SlotOutRange, -7),
-            (HostError::SlotsFull, -8),
-            (HostError::EmptySlot, -9),
-            (HostError::LedgerObjNotFound, -10),
-            (HostError::OutOfTransferLimit, -11),
-            (HostError::DataFieldTooLarge, -12),
-            (HostError::PointerOutOfBounds, -13),
-            (HostError::NoMemExported, -14),
-            (HostError::InvalidParams, -15),
-            (HostError::InvalidAccount, -16),
-            (HostError::InvalidField, -17),
-            (HostError::IndexOutOfBounds, -18),
-            (HostError::FloatInputMalformed, -19),
-            (HostError::FloatComputationError, -20),
-            (HostError::InternalFatal, i32::MIN),
-        ]
-    );
-}
-
-/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
-/// `HostFunctionError`, and each is a code some contract may read.
-///
-/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
-/// widening the range: a condition with no number a contract can act on needs no number
-/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
-/// ever colliding with a code appended to xrpld's list.
-#[test]
-fn every_code_but_the_sentinel_is_in_the_shared_range() {
-    let shared: Vec<HostError> = HostError::ALL
-        .iter()
-        .copied()
-        .filter(|&error| error != HostError::InternalFatal)
-        .collect();
-
-    let outside: Vec<HostError> = shared
-        .iter()
-        .copied()
-        .filter(|error| !(-20..=-1).contains(&error.code()))
-        .collect();
-
-    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
-    assert_eq!(shared.len(), 20);
-    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
-    assert_eq!(HostError::ALL.len(), 21);
-}
-
-/// Every code a guest can be handed comes back as the error that produced it, so a
-/// caller reading a negative return value recovers the condition and not a
-/// neighbouring one. The table above pins the numbers; this adds only the round
-/// trip.
-#[test]
-fn every_wire_code_round_trips_back_to_its_error() {
-    for &error in HostError::ALL {
-        assert_eq!(HostError::from_code(error.code()), Some(error), "{error:?}");
-    }
-}
-
-/// A code from outside the set names no error and is not rounded to a neighbouring one;
-/// what it means instead is the crossing's to decide, in `xrpl-wasm-vm-ffi`'s `host_error`.
-///
-/// `-21` is the code xrpld would append next; `i32::MIN + 1` is next to the sentinel and
-/// unassigned, which is what makes the sentinel a value rather than a range.
-#[test]
-fn a_code_outside_the_set_names_no_error() {
-    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
-        assert_eq!(HostError::from_code(code), None, "{code}");
-    }
-}

crates/xrpl-wasm-testkit/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-testkit"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-wat = "1"
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-
-[lints]
-workspace = true

crates/xrpl-wasm-testkit/src/lib.rs

@@ -1,109 +0,0 @@
-//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
-//!
-//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
-//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
-//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
-//! makes `Module::new` accept text as readily as binary, which would make a transaction's
-//! validity a build flag. Putting `compile_wat` on the production bridge would link `wat`
-//! into xrpld even if nothing called it.
-//!
-//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
-//! shipped node" is a property of the link graph rather than a flag someone can flip.
-#![deny(rustdoc::broken_intra_doc_links)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-#[cxx::bridge(namespace = "rs::wasm_testkit")]
-mod ffi {
-    extern "Rust" {
-        /// Assemble `wat` to a wasm module.
-        ///
-        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
-        /// fixture should fail the test that holds it, at the line that holds it.
-        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
-
-        /// The gas a host function is charged before it runs, by its guest import name.
-        ///
-        /// For the C++ gas benchmarks, which measure what a host call actually costs and
-        /// report it against what the table says it costs. Reading the declaration through
-        /// here rather than copying the numbers into C++ is the point: 61 transcribed
-        /// constants would drift from `lib.rs` the first time a price changed, and drift
-        /// silently, because a benchmark has nothing to fail.
-        ///
-        /// Throws `rust::Error` on an unknown name — a typo should fail loudly rather than
-        /// quietly compare against zero.
-        fn host_function_gas(wasm_name: &str) -> Result<u64>;
-    }
-}
-
-fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
-    wat::parse_str(wat)
-}
-
-fn host_function_gas(wasm_name: &str) -> Result<u64, UnknownHostFunction> {
-    xrpl_host_functions::HostFunctionSpec::ALL
-        .iter()
-        .find(|op| op.wasm_name() == wasm_name)
-        .map(|op| op.gas())
-        .ok_or_else(|| UnknownHostFunction(wasm_name.to_owned()))
-}
-
-#[derive(Debug)]
-struct UnknownHostFunction(String);
-
-impl std::fmt::Display for UnknownHostFunction {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "no host function is imported as `{}`", self.0)
-    }
-}
-
-impl std::error::Error for UnknownHostFunction {}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
-        let wasm = compile_wat("(module)").expect("assembles");
-
-        assert_eq!(&wasm[..4], b"\0asm");
-    }
-
-    #[test]
-    fn a_host_function_reports_the_gas_its_declaration_gives_it() {
-        // `trace` is the cheapest declaration in the table; the point is not the number but
-        // that the lookup reaches the same constant the engine charges from.
-        assert_eq!(
-            host_function_gas("trace").expect("trace is a host function"),
-            xrpl_host_functions::HostFunctionSpec::Trace.gas()
-        );
-    }
-
-    #[test]
-    fn every_host_function_is_reachable_by_its_import_name() {
-        for op in xrpl_host_functions::HostFunctionSpec::ALL {
-            assert_eq!(
-                host_function_gas(op.wasm_name()).expect("declared"),
-                op.gas(),
-                "{} must be reachable by name",
-                op.wasm_name()
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_an_error_rather_than_zero_gas() {
-        host_function_gas("not_a_host_function").expect_err("must not resolve");
-    }
-
-    #[test]
-    fn a_typo_is_an_error_rather_than_a_module() {
-        let error = compile_wat("(module (func (export").expect_err("must not assemble");
-
-        assert!(
-            !error.to_string().is_empty(),
-            "the error has to say something"
-        );
-    }
-}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "xrpl-wasm-vm-ffi"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib", "rlib"]
-
-[dependencies]
-cxx.workspace = true
-xrpl-host-functions = { path = "../xrpl-host-functions" }
-xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }
-
-[lints]
-workspace = true

crates/xrpl-wasm-vm/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "xrpl-wasm-vm"
-version = "0.1.0"
-edition.workspace = true
-
-[dependencies]
-wasmi = { version = "2.0.0", default-features = false, features = ["std", "validate", "portable-dispatch"] }
-xrpl-host-functions = { path = "../xrpl-host-functions", features = ["wasmi_glue"] }
-
-[dev-dependencies]
-wat = "1"
-
-[lints]
-workspace = true

crates/xrpl-wasm-vm/src/abi.rs

@@ -1,838 +0,0 @@
-use crate::args::OutBytes;
-use crate::vm::{MAX_FIELD_BYTES, VmState};
-use core::ops::Range;
-use wasmi::{Caller, Memory};
-use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
-
-/// A condition that stops the run. It is a property of the run rather than an answer
-/// to a call, so it reaches no guest and carries no wire code — which is why it is
-/// not a [`HostError`]: no host can report one and no contract can read one.
-///
-/// The three are the outcomes a host call can end a run with, and
-/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Fault {
-    /// This call's charge would take the meter below zero. The guest exhausting the
-    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
-    /// wasmi's `OutOfFuel` trap instead, never through here.
-    OutOfGas,
-    /// The call could not be served: either the host said so, or this engine's own
-    /// fuel meter did not answer.
-    Internal,
-    /// There is no linear memory to work in — the module exports none, or the call
-    /// came from a start section, which runs before there is an instance.
-    NoMemory,
-}
-
-/// How a host call fails: with a code the guest reads off the return value, or with a
-/// [`Fault`] that stops the run.
-///
-/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
-/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
-/// around something a guest was supposed to see.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum CallError {
-    Code(HostError),
-    Fatal(Fault),
-}
-
-/// A host call's result inside the engine: [`HostResult`] plus the faults only the
-/// engine can raise.
-pub(crate) type CallResult<T> = Result<T, CallError>;
-
-/// Which channel a host's answer takes, decided once, here.
-///
-/// Three codes stop the run instead of reaching the contract that asked. Each says the
-/// call was not served at all — the host could not do it, it has not been wired, or
-/// there is nowhere to put the answer — and a contract has no business interpreting
-/// any of them, so it is told nothing and the run ends. Every other code is the
-/// contract's to read.
-impl From<HostError> for CallError {
-    fn from(error: HostError) -> CallError {
-        match error {
-            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
-            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
-            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
-            code => CallError::Code(code),
-        }
-    }
-}
-
-/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
-/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
-/// leave through this channel.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) struct FatalHostError(pub(crate) Fault);
-
-impl wasmi::errors::HostError for FatalHostError {}
-
-impl core::fmt::Display for FatalHostError {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "host call refused: {:?}", self.0)
-    }
-}
-
-/// Charge the call's gas, run its body, put the result on the wire. The one path
-/// every registered closure takes, so gas cannot be forgotten.
-pub(crate) fn charged(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
-) -> Result<i32, wasmi::Error> {
-    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`charged`] for a call the guest gets no answer from: its wasm function has no
-/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
-/// and charged whatever happens after, so the cost is all such a call leaves behind.
-///
-/// Only `trace` takes this path.
-pub(crate) fn charged_unreported(
-    caller: &mut Caller<'_, VmState<'_>>,
-    op: HostFunctionSpec,
-    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
-) -> Result<(), wasmi::Error> {
-    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
-}
-
-/// [`to_wire`] for a call with no result: there is no return value to encode a code
-/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
-/// run, not an answer to the call.
-fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
-    match result {
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-        _ => Ok(()),
-    }
-}
-
-fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
-    match result {
-        Ok(value) => Ok(value),
-        Err(CallError::Code(error)) => Ok(error.code()),
-        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
-    }
-}
-
-/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
-///
-/// A meter that will not answer is this crate's own defect, not the contract's, so it
-/// is [`Fault::Internal`] rather than a number a guest could act on.
-fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
-    let remaining = caller
-        .get_fuel()
-        .map_err(|_| CallError::Fatal(Fault::Internal))?;
-    match remaining.checked_sub(cost) {
-        Some(left) => caller
-            .set_fuel(left)
-            .map_err(|_| CallError::Fatal(Fault::Internal)),
-        None => {
-            let _ = caller.set_fuel(0);
-            Err(CallError::Fatal(Fault::OutOfGas))
-        }
-    }
-}
-
-pub(crate) fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
-    let n = n as u64;
-    let remaining = state.transfer_budget.get();
-    match remaining.checked_sub(n) {
-        Some(left) => {
-            state.transfer_budget.set(left);
-            Ok(())
-        }
-        None => Err(HostError::OutOfTransferLimit),
-    }
-}
-
-fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
-    caller
-        .data()
-        .memory
-        .ok_or(CallError::Fatal(Fault::NoMemory))
-}
-
-/// The guest's memory, for a call that reads its inputs and writes nothing back.
-/// An argument read out of the slice is borrowed rather than copied.
-///
-/// A call that also writes takes both borrows at once, so [`write_buffered`] and
-/// [`write_mant_exp`] hand over the same slice themselves.
-pub(crate) fn guest_memory<'a>(caller: &'a Caller<'_, VmState<'_>>) -> CallResult<&'a [u8]> {
-    let mem = memory(caller)?;
-    Ok(mem.data(caller))
-}
-
-/// Service a call whose answer is bytes, written straight into the guest's output
-/// region.
-///
-/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
-/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
-/// guest learns the size to ask for. So `n` is bounded by neither the region, the
-/// cap, nor the budget, and all three checks below are reachable.
-pub(crate) fn write_into(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let range = out.range()?;
-    let cap = range.len();
-    let mem = memory(caller)?;
-    let host: &dyn HostFunctions = caller.data().host;
-    let budget = usize::try_from(caller.data().transfer_budget.get()).unwrap_or(usize::MAX);
-    let buf = mem
-        .data_mut(&mut *caller)
-        .get_mut(range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES).min(budget)];
-
-    let n = fill(host, buf)?;
-
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(caller.data(), n)?;
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// Service a call that reads guest memory and writes bytes back to it: the host
-/// fills the run's output buffer, which is copied to the guest once every rule has
-/// passed.
-///
-/// `call` gets the guest's whole memory, so it can read any number of input
-/// arguments out of it — which a `&mut` view of that memory would forbid. That is
-/// why the answer goes through a buffer instead of straight into the guest as
-/// [`write_into`]'s does.
-///
-/// **The host is never told the guest's capacity**: it is offered the whole buffer
-/// and reports the value's true length, so the fit is decided here, with nothing yet
-/// in guest memory. A refused value therefore reaches it in no part.
-///
-/// The output is judged after the inputs, so a call with both bad reports the
-/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
-/// region against.
-pub(crate) fn write_buffered(
-    caller: &mut Caller<'_, VmState<'_>>,
-    out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    // One borrow split in two: the guest's bytes for the inputs, the store data for
-    // the output buffer. Taking them together is what keeps the inputs borrowed
-    // rather than copied out.
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    let n = call(host, data, &mut state.out_buffer[..])?;
-
-    // `out` is checked here rather than before the call: the inputs are judged
-    // first, so a call with both malformed reports the input's verdict.
-    let range = out.range()?;
-    let cap = range.len();
-    if n > MAX_FIELD_BYTES {
-        return Err(HostError::DataFieldTooLarge.into());
-    }
-    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
-    if n > cap {
-        return Err(HostError::BufferTooSmall.into());
-    }
-    charge_transfer(state, n)?;
-    buf[..n].copy_from_slice(&state.out_buffer[..n]);
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
-    )]
-    let n = n as i32;
-    Ok(n)
-}
-
-/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
-/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
-/// length.
-const MANTISSA_BYTES: usize = 8;
-const EXPONENT_BYTES: usize = 4;
-
-fn check_fits(data: &[u8], range: &Range<usize>, width: usize) -> HostResult<()> {
-    let region = data
-        .get(range.clone())
-        .ok_or(HostError::PointerOutOfBounds)?;
-    if region.len() < width {
-        return Err(HostError::BufferTooSmall);
-    }
-    Ok(())
-}
-
-/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
-/// fills the run's output buffer with the mantissa followed by the exponent, and each
-/// is copied to its own guest region once every rule has passed.
-///
-/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
-/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
-/// regions are judged after the input, and the mantissa's region before the exponent's,
-/// so the first fault reported is the leftmost.
-///
-/// The two widths are the ABI's rather than the guest's, so the length the host reports
-/// is checked against their sum for equality rather than as a bound, and ahead of the
-/// output regions: a wrong total means there is no answer to place, whatever the guest
-/// declared. That is a fatal error and not a status, since the guest asked for nothing
-/// wrong.
-pub(crate) fn write_mant_exp(
-    caller: &mut Caller<'_, VmState<'_>>,
-    mantissa_out: OutBytes,
-    exponent_out: OutBytes,
-    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
-) -> CallResult<i32> {
-    let mem = memory(caller)?;
-    let (data, state) = mem.data_and_store_mut(&mut *caller);
-    let host: &dyn HostFunctions = state.host;
-
-    // The scratch buffer is split at the fixed mantissa width: the host fills the first
-    // eight bytes with the mantissa and the next four with the exponent.
-    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
-    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
-    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
-
-    let total = call(host, data, mant_buf, exp_buf)?;
-
-    // Both buffers are fixed-width and were offered whole, so the only length the host
-    // can correctly report is their sum. Anything else is the host contradicting the
-    // ABI: with the widths in doubt, part of what would be copied out is whatever the
-    // previous call left in the buffer, so none of it is copied.
-    if total != MANTISSA_BYTES + EXPONENT_BYTES {
-        return Err(HostError::InternalFatal.into());
-    }
-
-    let mant_range = mantissa_out.range()?;
-    check_fits(data, &mant_range, MANTISSA_BYTES)?;
-    let exp_range = exponent_out.range()?;
-    check_fits(data, &exp_range, EXPONENT_BYTES)?;
-
-    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
-
-    let mant_dst = data
-        .get_mut(mant_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
-    let exp_dst = data
-        .get_mut(exp_range)
-        .ok_or(HostError::PointerOutOfBounds)?;
-    exp_dst[..EXPONENT_BYTES]
-        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
-
-    #[expect(
-        clippy::cast_possible_truncation,
-        clippy::cast_possible_wrap,
-        reason = "a total other than 12 returned above, and 12 is far inside i32"
-    )]
-    let total = total as i32;
-    Ok(total)
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-    use crate::vm::TRANSFER_LIMIT_BYTES;
-    use std::cell::Cell;
-    use wasmi::StoreLimitsBuilder;
-    use xrpl_host_functions::{FloatOrdering, TraceDataType};
-
-    /// `charge_transfer` takes the store data, which has to hold a host.
-    struct UncalledHost;
-
-    impl HostFunctions for UncalledHost {
-        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_field(
-            &self,
-            _cache_idx: i32,
-            _field: i32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_field(
-            &self,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_field(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_ledger_obj_nested_array_len(
-            &self,
-            _cache_idx: i32,
-            _locator: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_signature(
-            &self,
-            _message: &[u8],
-            _signature: &[u8],
-            _pubkey: &[u8],
-        ) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn check_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn credential_keylet(
-            &self,
-            _subject: &[u8],
-            _issuer: &[u8],
-            _credential_type: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn delegate_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn deposit_preauth_keylet(
-            &self,
-            _account: &[u8],
-            _authorize: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn escrow_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trust_line_keylet(
-            &self,
-            _account1: &[u8],
-            _account2: &[u8],
-            _currency: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_issuance_keylet(
-            &self,
-            _issuer: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn mptoken_keylet(
-            &self,
-            _mptid: &[u8],
-            _holder: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn nftoken_offer_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn offer_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn oracle_keylet(
-            &self,
-            _account: &[u8],
-            _doc_id: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn paychannel_keylet(
-            &self,
-            _account: &[u8],
-            _destination: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn permissioned_domain_keylet(
-            &self,
-            _account: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn ticket_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn vault_keylet(&self, _account: &[u8], _seq: u32, _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sponsorship_keylet(
-            &self,
-            _sponsor: &[u8],
-            _sponsee: &[u8],
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_broker_keylet(
-            &self,
-            _owner: &[u8],
-            _seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn loan_keylet(
-            &self,
-            _loan_broker_id: &[u8],
-            _loan_seq: u32,
-            _out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn trace(&self, _msg: &str, _data_type: TraceDataType, _data: &[u8]) -> HostResult<()> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_int(&self, _x: i64, _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_uint(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stamount(
-            &self,
-            _amount: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_stnumber(
-            &self,
-            _number: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_int(&self, _x: &[u8], _out: &mut [u8], _mode: i32) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_to_mant_exp(
-            &self,
-            _x: &[u8],
-            _mantissa_out: &mut [u8],
-            _exponent_out: &mut [u8],
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_from_mant_exp(
-            &self,
-            _mantissa: i64,
-            _exponent: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<FloatOrdering> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_add(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_subtract(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_multiply(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_divide(
-            &self,
-            _x: &[u8],
-            _y: &[u8],
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-        fn float_power(
-            &self,
-            _x: &[u8],
-            _n: i32,
-            _out: &mut [u8],
-            _mode: i32,
-        ) -> HostResult<usize> {
-            unreachable!("no unit test in this module calls the host")
-        }
-    }
-
-    fn state(budget: u64) -> VmState<'static> {
-        VmState {
-            host: &UncalledHost,
-            mem_limits: StoreLimitsBuilder::new().build(),
-            transfer_budget: Cell::new(budget),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        }
-    }
-
-    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
-    /// channel says so by going through here.
-    fn wire(result: CallResult<i32>) -> i32 {
-        to_wire(result)
-            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
-    }
-
-    #[test]
-    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
-        assert_eq!(wire(Ok(0)), 0);
-        assert_eq!(wire(Ok(32)), 32);
-        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
-    }
-
-    /// The codes a host may answer that a contract must not see, and the fault each
-    /// becomes. Written out rather than derived from `From<HostError>`, which is what
-    /// they are asserting.
-    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
-        (HostError::InternalFatal, Fault::Internal),
-        (HostError::Unimplemented, Fault::Internal),
-        (HostError::NoMemExported, Fault::NoMemory),
-    ];
-
-    /// Every fault, so the two tests below are the whole set and not a sample.
-    /// `From<Fault> for RunError` is what forces a fault added later to be
-    /// considered; this is what forces it to be tested.
-    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
-
-    #[test]
-    fn a_code_that_stops_the_run_converts_to_its_fault() {
-        for (error, fault) in STOPS_THE_RUN {
-            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
-        }
-    }
-
-    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
-    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
-    /// the run on it is then a change someone has to come and make.
-    ///
-    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
-    /// contract can be expected to handle, so it is told no rather than killed.
-    #[test]
-    fn every_other_code_reaches_the_guest_as_itself() {
-        for &error in HostError::ALL {
-            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
-                continue;
-            }
-            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
-            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
-        }
-    }
-
-    /// The trap carries the fault, so `run` can name the outcome without parsing a
-    /// message.
-    #[test]
-    fn a_fault_becomes_a_trap_carrying_it() {
-        for fault in ALL_FAULTS {
-            let trap = to_wire(Err(CallError::Fatal(fault)))
-                .expect_err("a fault must not reach the guest as a code");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    /// The result-less path splits the same two channels differently: a fault still
-    /// stops the run, and every code is dropped, since `trace` has no return value to
-    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
-    /// arrives asserted against both paths.
-    #[test]
-    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
-        assert!(dropped(Ok(())).is_ok());
-
-        for &error in HostError::ALL {
-            if let CallError::Code(code) = CallError::from(error) {
-                assert!(
-                    dropped(Err(CallError::Code(code))).is_ok(),
-                    "{error:?} has no channel to the guest and must be dropped"
-                );
-            }
-        }
-
-        for fault in ALL_FAULTS {
-            let trap =
-                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
-            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
-                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
-            });
-            assert_eq!(*payload, FatalHostError(fault));
-        }
-    }
-
-    #[test]
-    fn a_transfer_spends_the_budget() {
-        let state = state(100);
-
-        assert_eq!(charge_transfer(&state, 30), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 70);
-        assert_eq!(charge_transfer(&state, 70), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The budget bounds the total, so the transfer that would overrun it is
-    /// refused whole rather than partially charged.
-    #[test]
-    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
-        let state = state(100);
-
-        assert_eq!(
-            charge_transfer(&state, 101),
-            Err(HostError::OutOfTransferLimit)
-        );
-        assert_eq!(
-            state.transfer_budget.get(),
-            100,
-            "a refusal must not charge"
-        );
-        assert_eq!(charge_transfer(&state, 100), Ok(()));
-        assert_eq!(
-            charge_transfer(&state, 1),
-            Err(HostError::OutOfTransferLimit)
-        );
-    }
-
-    #[test]
-    fn transferring_nothing_costs_nothing() {
-        let state = state(0);
-
-        assert_eq!(charge_transfer(&state, 0), Ok(()));
-        assert_eq!(state.transfer_budget.get(), 0);
-    }
-
-    /// The field cap holds one call to a small share of the run's budget, so the
-    /// budget bounds a run rather than a call. An inequality, not the two values:
-    /// those are pinned in `vm.rs`.
-    #[test]
-    fn no_single_value_can_exhaust_the_run_budget() {
-        assert!(
-            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
-            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/args.rs

@@ -1,244 +0,0 @@
-//! A host call's arguments as they arrive: one type per declared parameter the
-//! ABI marshals, built by `register.rs`'s generated closures and read by its
-//! bodies. A wasm scalar (`i32`, `i64`) is passed through as itself and has no
-//! type here.
-//!
-//! What the types buy is that **a body cannot mistake one argument for another**:
-//! an input region offered where an output one belongs is a compile error naming
-//! both, where two loose `i32`s would let a rounding mode be read as a buffer
-//! length. A derived signature cannot catch that, every one of these being
-//! `i32, i32` on the wire.
-//!
-//! The arguments arrive unchecked and are judged where they are read — `InU32`'s
-//! region must hold exactly four bytes, `InStr`'s must be UTF-8, a [`TraceCode`]
-//! must name a rendering — so they are refused in the order the body reads them.
-//!
-//! **The `from_wasm` impls below are half of `wasmi_glue!`'s contract** and the
-//! only construction these types have; `register.rs`'s `glue_env` is where the
-//! macro is told which type marshals which declared one. Which of the two traits
-//! a type takes is the ABI's decision, so `InU32` is a region rather than the
-//! scalar its declared `u32` reads like.
-
-use crate::vm::MAX_FIELD_BYTES;
-use core::ops::Range;
-use xrpl_host_functions::{FromWasmRegion, FromWasmScalar, HostError, HostResult, TraceDataType};
-
-/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
-/// yet checked.
-///
-/// The shared half of the four region types below, which differ in what reading
-/// one means. The fields being out of reach makes [`range`](Region::range) the
-/// only way to indices, so the check can be deferred but not skipped — and
-/// construction is infallible so that a malformed region is refused in the order
-/// the call's own helper chooses.
-#[derive(Copy, Clone)]
-struct Region {
-    ptr: i32,
-    len: i32,
-}
-
-impl Region {
-    fn new(ptr: i32, len: i32) -> Region {
-        Region { ptr, len }
-    }
-
-    /// `start..end` as indices. The conversion is the negativity check, and the
-    /// checked addition guards a 32-bit `usize`, where two `i32`s can sum past the
-    /// end.
-    fn range(self) -> HostResult<Range<usize>> {
-        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
-            return Err(HostError::InvalidParams);
-        };
-        let end = start
-            .checked_add(len)
-            .ok_or(HostError::PointerOutOfBounds)?;
-        Ok(start..end)
-    }
-
-    /// The region's bytes, refused past the field cap. The slice aliases `data`.
-    fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        let range = self.range()?;
-        if range.len() > MAX_FIELD_BYTES {
-            return Err(HostError::DataFieldTooLarge);
-        }
-        data.get(range).ok_or(HostError::PointerOutOfBounds)
-    }
-}
-
-/// A declared `&[u8]`: an input region the host borrows.
-#[derive(Copy, Clone)]
-pub(crate) struct InBytes(Region);
-
-impl FromWasmRegion for InBytes {
-    fn from_wasm(ptr: i32, len: i32) -> InBytes {
-        InBytes(Region::new(ptr, len))
-    }
-}
-
-impl InBytes {
-    /// The region's bytes, aliasing the guest's memory rather than copied out of it.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
-        self.0.read(data)
-    }
-}
-
-/// A declared `&str`: an input region whose bytes are text.
-#[derive(Copy, Clone)]
-pub(crate) struct InStr(Region);
-
-impl FromWasmRegion for InStr {
-    fn from_wasm(ptr: i32, len: i32) -> InStr {
-        InStr(Region::new(ptr, len))
-    }
-}
-
-impl InStr {
-    /// The region's bytes as text. The read is also the UTF-8 check, so a host is
-    /// never the one to validate them.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<&str> {
-        core::str::from_utf8(self.0.read(data)?).map_err(|_| HostError::InvalidParams)
-    }
-}
-
-/// A declared `u32`: an input region holding the number as four little-endian
-/// bytes, which is how the guest SDK passes a sequence number.
-#[derive(Copy, Clone)]
-pub(crate) struct InU32(Region);
-
-impl FromWasmRegion for InU32 {
-    fn from_wasm(ptr: i32, len: i32) -> InU32 {
-        InU32(Region::new(ptr, len))
-    }
-}
-
-impl InU32 {
-    /// The number the region holds. The width is the ABI's, so any length but four
-    /// is `InvalidParams`.
-    pub(crate) fn read(self, data: &[u8]) -> HostResult<u32> {
-        let bytes: [u8; 4] = self
-            .0
-            .read(data)?
-            .try_into()
-            .map_err(|_| HostError::InvalidParams)?;
-        Ok(u32::from_le_bytes(bytes))
-    }
-}
-
-/// A declared `&mut [u8]`: the region the host's answer is written to.
-///
-/// It has no `read`: what a call may put here is decided by the `abi.rs` helper
-/// serving it, against the value's length and the run's budget, and the host is
-/// never handed the guest's capacity.
-#[derive(Copy, Clone)]
-pub(crate) struct OutBytes(Region);
-
-impl FromWasmRegion for OutBytes {
-    fn from_wasm(ptr: i32, len: i32) -> OutBytes {
-        OutBytes(Region::new(ptr, len))
-    }
-}
-
-impl OutBytes {
-    pub(crate) fn range(self) -> HostResult<Range<usize>> {
-        self.0.range()
-    }
-}
-
-/// A declared `TraceDataType`: the `i32` code naming how `trace` is to render its
-/// data. The one marshalled argument that is not a region, so reading it needs no
-/// guest memory.
-#[derive(Copy, Clone)]
-pub(crate) struct TraceCode(i32);
-
-impl FromWasmScalar for TraceCode {
-    fn from_wasm(code: i32) -> TraceCode {
-        TraceCode(code)
-    }
-}
-
-impl TraceCode {
-    /// The type the code names, or `InvalidParams`: a rendering the guest did not
-    /// ask for is not one to guess at.
-    pub(crate) fn read(self) -> HostResult<TraceDataType> {
-        TraceDataType::from_code(self.0).ok_or(HostError::InvalidParams)
-    }
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The guest memory these tests read out of: sixteen bytes at index 0.
-    const MEMORY: [u8; 16] = [
-        0x78, 0x56, 0x34, 0x12, b'h', b'i', 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-    ];
-
-    #[test]
-    fn a_u32_argument_is_four_little_endian_bytes() {
-        assert_eq!(InU32::from_wasm(0, 4).read(&MEMORY), Ok(0x1234_5678));
-    }
-
-    /// A longer region is refused too, rather than its first four bytes read as
-    /// the answer.
-    #[test]
-    fn a_u32_argument_of_any_other_width_is_refused() {
-        for len in [0, 1, 3, 5, 8] {
-            assert_eq!(
-                InU32::from_wasm(0, len).read(&MEMORY),
-                Err(HostError::InvalidParams),
-                "{len} bytes"
-            );
-        }
-    }
-
-    /// The read is the UTF-8 check, so a host implementing `trace` has nothing
-    /// left to validate.
-    #[test]
-    fn a_str_argument_is_checked_where_it_is_read() {
-        assert_eq!(InStr::from_wasm(4, 2).read(&MEMORY), Ok("hi"));
-        assert_eq!(
-            InStr::from_wasm(6, 1).read(&MEMORY),
-            Err(HostError::InvalidParams),
-            "0xff is not UTF-8"
-        );
-    }
-
-    /// A region past the end of guest memory is refused rather than clamped, and
-    /// one past the field cap is refused before the memory is consulted at all.
-    #[test]
-    fn a_region_is_held_to_the_memory_and_to_the_field_cap() {
-        assert_eq!(
-            InBytes::from_wasm(8, 16).read(&MEMORY),
-            Err(HostError::PointerOutOfBounds)
-        );
-
-        let past_the_cap = i32::try_from(MAX_FIELD_BYTES).expect("the cap is a small constant") + 1;
-        assert_eq!(
-            InBytes::from_wasm(0, past_the_cap).read(&MEMORY),
-            Err(HostError::DataFieldTooLarge)
-        );
-
-        assert_eq!(
-            InBytes::from_wasm(-1, 4).read(&MEMORY),
-            Err(HostError::InvalidParams)
-        );
-    }
-
-    /// Every code the ABI has, and nothing else: an unknown one is refused rather
-    /// than rendered some other way.
-    #[test]
-    fn a_trace_code_names_a_rendering_or_none() {
-        for &data_type in TraceDataType::ALL {
-            assert_eq!(TraceCode::from_wasm(data_type.code()).read(), Ok(data_type));
-        }
-
-        for code in [0, -1, i32::MAX] {
-            assert_eq!(
-                TraceCode::from_wasm(code).read(),
-                Err(HostError::InvalidParams),
-                "{code}"
-            );
-        }
-    }
-}

crates/xrpl-wasm-vm/src/lib.rs

@@ -1,29 +0,0 @@
-//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
-//!
-//! Every guest access goes through `abi.rs` and reaches linear memory only by
-//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
-//! property rather than a claim. The cast lints are on for the same reason — on a
-//! consensus path a truncating or sign-losing cast changes what a contract is
-//! charged or told, so each one is argued for at its site.
-#![forbid(unsafe_code)]
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unreachable_pub)]
-#![deny(
-    clippy::cast_possible_truncation,
-    clippy::cast_possible_wrap,
-    clippy::cast_sign_loss,
-    clippy::cast_lossless
-)]
-#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
-
-mod abi;
-mod args;
-mod preflight;
-mod register;
-mod vm;
-
-pub use preflight::{CheckError, check, check_all};
-pub use vm::{
-    MAX_EXPORTS, MAX_FIELD_BYTES, MAX_IMPORTS, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, MAX_NAME_BYTES,
-    MAX_TABLE_ELEMENTS, MAX_TYPES, RunError, RunFailure, RunOutcome, TRANSFER_LIMIT_BYTES, run,
-};

crates/xrpl-wasm-vm/src/preflight/mod.rs

@@ -1,521 +0,0 @@
-//! Screening a contract before it reaches the ledger.
-//!
-//! [`check`] answers whether [`crate::run`] would refuse a module before the
-//! guest's first instruction — the stages a caller maps to a malformed
-//! transaction rather than to a failed one. It needs **no host, no store and no
-//! gas**: everything it reads is a property of the compiled module. That is what
-//! makes it callable from a transaction's preflight, which has no ledger to serve
-//! host calls from.
-//!
-//! Two entry points over one pass: [`check`] stops at the first refusal, which is
-//! all a consensus path can act on, and [`check_all`] reports every one. Both draw
-//! from [`check_error_iter`], so they cannot disagree about which refusal is first.
-//!
-//! One thing it deliberately does not screen: a module exporting **no** linear
-//! memory passes, since a contract that makes no host call needs none, and one that
-//! does is refused at the call and charged for what it burned. A start section needs
-//! no rule of its own — the engine forbids one, so such a module fails to compile.
-//!
-//! Two things it screens that a run can only discover: a memory, or a table, larger
-//! than the engine grants — exported or not. Both are read from the module's own
-//! declarations in one pass, [`check_declared_resources_iter`].
-//!
-//! Every rule is here but one: [`signature`] holds the comparison of an import's
-//! type against the ABI's, which needs machinery the rest of the stage does not.
-
-mod signature;
-
-use std::fmt;
-use wasmi::{ExternType, FuncType, Module, ValType};
-use xrpl_host_functions::{HOST_MODULE, HostFunctionSpec};
-
-use crate::vm::{CompileError, MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, Screen, compile, wasm_engine};
-use signature::check_signature;
-
-/// Why a module cannot be run. One variant per stage, since the caller maps the
-/// stages separately.
-#[derive(Debug)]
-pub enum CheckError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// A type, import or export section, or an import or export name, is past its
-    /// cap. Apart from [`CheckError::Compile`] because no contract reaches a cap by
-    /// accident, so a caller may want to count these as deliberate.
-    Limit(String),
-    /// An import no engine of this ABI defines: another module namespace, a name
-    /// that is not a host function, or one imported as something other than a
-    /// function.
-    Import(String),
-    /// An import of a host function typed as something other than what the engine
-    /// registers it as. Apart from [`CheckError::Import`] because the ABI does
-    /// have the function the guest asked for.
-    Signature(String),
-    /// No export named `function_name` with signature `() -> i32`.
-    EntryPoint(String),
-    /// The module asks for more linear memory than the engine grants.
-    Memory(String),
-    /// The module asks for a larger table than the engine grants.
-    Table(String),
-}
-
-impl fmt::Display for CheckError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
-            CheckError::Limit(detail) => write!(f, "limit: {detail}"),
-            CheckError::Import(detail) => write!(f, "import: {detail}"),
-            CheckError::Signature(detail) => write!(f, "signature: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
-            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
-            CheckError::Table(detail) => write!(f, "table: {detail}"),
-        }
-    }
-}
-
-impl From<CompileError> for CheckError {
-    fn from(error: CompileError) -> CheckError {
-        match error {
-            CompileError::Invalid(detail) => CheckError::Compile(detail),
-            CompileError::Limit(detail) => CheckError::Limit(detail),
-        }
-    }
-}
-
-/// Screen `wasm`: it must compile, import only what the engine serves, export
-/// `function_name` as `() -> i32`, and ask for no more memory or table than it may
-/// have.
-pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
-    let compiled = compile(&wasm_engine(), wasm).map_err(CheckError::from)?;
-    check_error_iter(&compiled.module, &compiled.screen, function_name)
-        .next()
-        .map_or(Ok(()), Err)
-}
-
-/// [`check`], reporting every error found rather than stopping at the first.
-pub fn check_all(wasm: &[u8], function_name: &str) -> Result<(), Vec<CheckError>> {
-    let compiled = compile(&wasm_engine(), wasm).map_err(|e| vec![CheckError::from(e)])?;
-    let refusals: Vec<CheckError> =
-        check_error_iter(&compiled.module, &compiled.screen, function_name).collect();
-    if refusals.is_empty() {
-        return Ok(());
-    }
-    Err(refusals)
-}
-
-/// `screen` is what compiling `module` recorded of its memory and table, which the
-/// module itself shows only through its exports.
-fn check_error_iter<'a>(
-    module: &'a Module,
-    screen: &'a Screen,
-    function_name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    check_imports_iter(module)
-        .chain(check_entry_point_iter(module, function_name))
-        .chain(check_declared_resources_iter(screen))
-}
-
-fn check_imports_iter(module: &Module) -> impl Iterator<Item = CheckError> + '_ {
-    module
-        .imports()
-        .filter_map(|import| check_import(import.module(), import.name(), import.ty()).err())
-}
-
-/// Whether the engine defines this one import, as the guest declares it.
-///
-/// Names and signatures both come from the declarations
-/// [`crate::register::register_host_functions`] registers from, so a check and a
-/// run cannot disagree about which imports exist or what they look like.
-///
-/// The rules are ordered, each presuming the ones before it held: a guest
-/// importing `env::malloc` is told about the namespace, which explains every other
-/// import it has too, and only an import that names a real host function as a
-/// function has a signature worth comparing.
-fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), CheckError> {
-    let function = host_function(module, name).map_err(CheckError::Import)?;
-    let imported = imported_function(name, ty).map_err(CheckError::Import)?;
-    check_signature(function, imported).map_err(CheckError::Signature)
-}
-
-/// Which host function this import names: its namespace must be the engine's, and
-/// its name one the ABI declares.
-fn host_function(module: &str, name: &str) -> Result<HostFunctionSpec, String> {
-    if module != HOST_MODULE {
-        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
-    }
-    HostFunctionSpec::ALL
-        .iter()
-        .find(|function| function.wasm_name() == name)
-        .copied()
-        .ok_or_else(|| format!("no host function '{name}'"))
-}
-
-/// The function type the guest declared. The engine defines these names as
-/// functions and as nothing else, so an import of any other kind does not link.
-fn imported_function<'ty>(name: &str, ty: &'ty ExternType) -> Result<&'ty FuncType, String> {
-    match ty {
-        ExternType::Func(ty) => Ok(ty),
-        _ => Err(format!("'{HOST_MODULE}::{name}' is not a function")),
-    }
-}
-
-fn check_entry_point_iter<'a>(
-    module: &'a Module,
-    name: &'a str,
-) -> impl Iterator<Item = CheckError> + 'a {
-    std::iter::once_with(move || match module.get_export(name) {
-        Some(ExternType::Func(ty)) if is_entry_point(&ty) => None,
-        found => Some(CheckError::EntryPoint(entry_point_fault(found, name))),
-    })
-    .flatten()
-}
-
-/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
-/// `get_typed_func::<(), i32>` accepts.
-fn is_entry_point(ty: &FuncType) -> bool {
-    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
-}
-
-/// A module may declare no more linear memory, and no larger a table, than the
-/// engine grants — whether it exports them or keeps them to itself.
-///
-/// Read from what [`compile`] recorded, not from [`Module`]: wasmi shows a module's
-/// memories and tables only through its exports, and a table is *normally*
-/// unexported — Rust exports `__indirect_function_table` only under
-/// `--export-table`. Screening the exports alone would pass such a module to the
-/// ledger, where the store's limiter refuses it at every finish. The limiter stays,
-/// for a module that reaches a run unscreened.
-///
-/// A module faulting on both yields both, in section order — the table section
-/// precedes the memory section. Neither fault explains the other, so there is no
-/// precedence to preserve — only the need for every node to reach the same verdict,
-/// which the binary's own order already gives.
-fn check_declared_resources_iter(screen: &Screen) -> impl Iterator<Item = CheckError> {
-    let table = screen
-        .table_elements()
-        .and_then(|elements| check_initial_elements(elements).err())
-        .map(CheckError::Table);
-    let memory = screen
-        .memory_pages()
-        .and_then(|pages| check_initial_pages(pages).err())
-        .map(CheckError::Memory);
-    table.into_iter().chain(memory)
-}
-
-/// Whether the engine will grant a memory of this declared initial size.
-///
-/// The *minimum* only: a declared maximum past the cap is legal and simply
-/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
-/// unreachable` pins on the run side. Refusing it here would turn a runnable
-/// contract away.
-fn check_initial_pages(pages: u64) -> Result<(), String> {
-    if pages > u64::from(MAX_MEMORY_PAGES) {
-        return Err(format!(
-            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
-        ));
-    }
-    Ok(())
-}
-
-/// Whether the engine will grant a table of this declared initial size.
-///
-/// The *minimum* is the whole question: `table.grow` belongs to the reference-types
-/// proposal, which [`crate::vm`]'s engine turns off, so a table never becomes larger
-/// than it was declared and a declared maximum past the cap is simply unreachable.
-fn check_initial_elements(elements: u64) -> Result<(), String> {
-    let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("the cap is a small constant");
-    if elements > cap {
-        return Err(format!(
-            "initial table of {elements} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-        ));
-    }
-    Ok(())
-}
-
-/// How an entry-point lookup failed, in the words both stages use: a check and a
-/// run describe the same module the same way, and "no entry point" would send a
-/// contract author looking for a function they already have.
-pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
-    match found {
-        Some(ExternType::Func(_)) => {
-            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
-        }
-        Some(_) => format!("export '{name}' is not a function"),
-        None => format!("no entry point '{name}'"),
-    }
-}
-
-/// The rules, one by one, on inputs built directly rather than parsed out of a
-/// module. `tests/preflight.rs` runs real modules through [`check`] and
-/// [`check_all`]; what is here is what a module cannot state precisely — which rule
-/// fires and in what words the caller logs it. The signature rule's derivation is
-/// tested beside it, in [`signature`].
-///
-/// `wat` is a dev-dependency, so the one test here that does need a module writes it
-/// as text like every other test in the crate. What the library must not gain is a
-/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
-/// cannot give it one.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::signature::registered_type;
-    use super::*;
-    use wasmi::{GlobalType, MemoryType, Mutability};
-
-    /// The type an import of `function` must declare.
-    fn registered(function: HostFunctionSpec) -> ExternType {
-        ExternType::Func(registered_type(function))
-    }
-
-    /// A name every one of these tests can use, taken from the ABI rather than
-    /// spelled, so it stays a real host function as the ABI changes.
-    fn a_host_function_name() -> &'static str {
-        HostFunctionSpec::ALL[0].wasm_name()
-    }
-
-    // -----------------------------------------------------------------------
-    // Imports
-    // -----------------------------------------------------------------------
-
-    /// Every name the ABI declares is served, at the signature derived from its
-    /// declaration. Derived from `ALL` rather than listed, so a host function added
-    /// to the ABI is covered the day it lands.
-    ///
-    /// Both sides come from the table, so this pins that no declaration is refused,
-    /// not that the table is right. `tests/preflight.rs`'s
-    /// `every_declared_host_function_may_be_imported` and
-    /// `the_derived_signatures_are_what_the_linker_registers` are what compare it
-    /// against hand-written imports and against the real linker.
-    #[test]
-    fn every_declared_host_function_is_served() {
-        for &function in HostFunctionSpec::ALL {
-            let name = function.wasm_name();
-            if let Err(refusal) = check_import(HOST_MODULE, name, &registered(function)) {
-                panic!("'{name}' is declared but not served: {refusal}");
-            }
-        }
-    }
-
-    #[test]
-    fn an_import_from_another_namespace_is_refused() {
-        for namespace in ["env", "host", "host_lib2", ""] {
-            let refusal = host_function(namespace, a_host_function_name()).expect_err(namespace);
-            assert!(
-                refusal.contains("is not from 'host_lib'"),
-                "{namespace}: {refusal}"
-            );
-        }
-    }
-
-    #[test]
-    fn an_unknown_name_is_refused() {
-        let refusal = host_function(HOST_MODULE, "no_such_function").expect_err("unknown name");
-        assert_eq!(refusal, "no host function 'no_such_function'");
-    }
-
-    /// The engine defines these names as functions and as nothing else, so a module
-    /// importing one as a global or a memory does not link either.
-    #[test]
-    fn a_host_function_imported_as_anything_else_is_refused() {
-        for ty in [
-            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
-            ExternType::Memory(MemoryType::new(1, None)),
-        ] {
-            let name = a_host_function_name();
-            let refusal = imported_function(name, &ty).expect_err("not a function");
-            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
-        }
-    }
-
-    /// The rules are ordered. An import that breaks two of them is reported by the
-    /// first, so the message a contract author reads is the one that explains the
-    /// rest of their imports too.
-    #[test]
-    fn the_namespace_is_reported_before_the_name() {
-        let refusal = host_function("env", "no_such_function")
-            .expect_err("neither the namespace nor the name is served");
-
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-        assert!(
-            !refusal.contains("no host function"),
-            "the namespace explains it: {refusal}"
-        );
-    }
-
-    /// The signature is the last rule, so an import wrong about the namespace, the
-    /// name or the kind is not told about a signature instead, and the two kinds of
-    /// fault reach the caller as different stages.
-    #[test]
-    fn the_signature_is_the_last_rule() {
-        let name = a_host_function_name();
-        let mistyped = ExternType::Func(FuncType::new([ValType::F32], []));
-        let not_a_function = ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const));
-
-        for (rule, refusal) in [
-            ("the namespace", check_import("env", name, &mistyped)),
-            (
-                "the name",
-                check_import(HOST_MODULE, "no_such_function", &mistyped),
-            ),
-            ("the kind", check_import(HOST_MODULE, name, &not_a_function)),
-        ] {
-            assert!(
-                matches!(refusal, Err(CheckError::Import(_))),
-                "{rule} explains this import, not its signature: {refusal:?}"
-            );
-        }
-
-        assert!(
-            matches!(
-                check_import(HOST_MODULE, name, &mistyped),
-                Err(CheckError::Signature(_))
-            ),
-            "an import that breaks nothing but the signature is a signature fault"
-        );
-    }
-
-    /// Both halves of the type are load-bearing, and neither is checked anywhere
-    /// a module cannot reach.
-    #[test]
-    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
-        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
-
-        for wrong in [
-            FuncType::new([], []),
-            FuncType::new([], [ValType::I64]),
-            FuncType::new([ValType::I32], [ValType::I32]),
-            FuncType::new([], [ValType::I32, ValType::I32]),
-        ] {
-            assert!(!is_entry_point(&wrong), "{wrong:?}");
-        }
-    }
-
-    /// Three faults, three descriptions. A run reports these too, with wasmi's own
-    /// error appended, so a swapped arm would mislead at both stages at once.
-    #[test]
-    fn each_entry_point_fault_is_described_as_itself() {
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Func(FuncType::new(
-                    [ValType::I32],
-                    [ValType::I32]
-                ))),
-                "finish"
-            ),
-            "entry point 'finish' has the wrong signature, expected '() -> i32'"
-        );
-        assert_eq!(
-            entry_point_fault(
-                Some(ExternType::Global(GlobalType::new(
-                    ValType::I32,
-                    Mutability::Const
-                ))),
-                "finish"
-            ),
-            "export 'finish' is not a function"
-        );
-        assert_eq!(
-            entry_point_fault(None, "finish"),
-            "no entry point 'finish'",
-            "an absent export must not be reported as a wrong signature"
-        );
-    }
-
-    /// The cap itself is granted; one page past it is not. The boundary is the whole
-    /// rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
-        assert_eq!(check_initial_pages(0), Ok(()));
-        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
-
-        let past = u64::from(MAX_MEMORY_PAGES) + 1;
-        let refusal = check_initial_pages(past).expect_err("one page past the cap");
-        assert_eq!(
-            refusal,
-            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
-        );
-    }
-
-    /// The cap itself is granted; one element past it is not. The boundary is the
-    /// whole rule, and it is the same boundary the store's limiter applies at
-    /// instantiation.
-    #[test]
-    fn the_initial_table_may_reach_the_cap_but_not_pass_it() {
-        let cap = u64::try_from(MAX_TABLE_ELEMENTS).expect("fits");
-        assert_eq!(check_initial_elements(0), Ok(()));
-        assert_eq!(check_initial_elements(cap), Ok(()));
-
-        let past = cap + 1;
-        let refusal = check_initial_elements(past).expect_err("one element past the cap");
-        assert_eq!(
-            refusal,
-            format!(
-                "initial table of {past} elements is past the {MAX_TABLE_ELEMENTS}-element cap"
-            )
-        );
-    }
-
-    /// The bridge logs this string and the C++ tests match on it, so the stage's
-    /// prefix is part of the interface rather than a debugging aid.
-    #[test]
-    fn a_refusal_names_its_stage() {
-        assert_eq!(
-            CheckError::Compile("bad magic".to_string()).to_string(),
-            "compile: bad magic"
-        );
-        assert_eq!(
-            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
-            "memory: initial memory of 129 pages"
-        );
-        assert_eq!(
-            CheckError::Table("initial table of 1025 elements".to_string()).to_string(),
-            "table: initial table of 1025 elements"
-        );
-        assert_eq!(
-            CheckError::Import("no host function 'x'".to_string()).to_string(),
-            "import: no host function 'x'"
-        );
-        // The stage is the prefix, so the detail must not say "signature" again.
-        assert_eq!(
-            CheckError::Signature(
-                "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'".to_string()
-            )
-            .to_string(),
-            "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-        // The entry point's detail already says which of its three faults it is,
-        // so a prefix would only repeat it.
-        assert_eq!(
-            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
-            "no entry point 'finish'"
-        );
-    }
-
-    #[test]
-    fn the_stages_run_in_order() {
-        assert!(
-            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
-            "nothing is screened until the module compiles"
-        );
-
-        // A module that compiles and imports nothing, so it reaches the entry point.
-        let empty = wat::parse_str("(module)").expect("assembles");
-        assert!(
-            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
-            "a module that compiles and imports nothing reaches the entry point"
-        );
-    }
-
-    /// Compiling is the one stage that ends the walk for [`check_all`] too: there is
-    /// no module to read the other rules off.
-    #[test]
-    fn a_failed_compile_is_reported_alone() {
-        let refusals = check_all(b"not wasm", "finish").expect_err("not a module");
-        assert!(
-            matches!(refusals.as_slice(), [CheckError::Compile(_)]),
-            "{refusals:?}"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/preflight/signature.rs

@@ -1,154 +0,0 @@
-//! The last rule on an import: an import that names a host function must also
-//! declare the type the engine registers it as.
-//!
-//! A file of its own because it is the one import rule with machinery to carry:
-//! the ABI's derived signature, its map into wasmi's value types, and a rendering
-//! of a function type for the refusal.
-//!
-//! **Arity and value types are the whole of it** — an `i64` in an `i32`'s place, or
-//! a `u32` parameter read as one wasm parameter rather than two. **Parameter order
-//! is invisible**: nearly everything lowers to `i32`, so two swapped parameters of
-//! the same type leave the function type identical.
-
-use wasmi::{FuncType, ValType};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-
-/// Whether this import declares the type the engine registers — one that does not
-/// is what a module parts from the linker over at instantiation.
-pub(super) fn check_signature(
-    function: HostFunctionSpec,
-    imported: &FuncType,
-) -> Result<(), String> {
-    let registered = registered_type(function);
-    if *imported == registered {
-        return Ok(());
-    }
-    Err(format!(
-        "'{}' expected '{}', found '{}'",
-        function.wasm_name(),
-        signature(&registered),
-        signature(imported)
-    ))
-}
-
-/// The type the engine registers `function` as: the wasm signature derived from its
-/// declaration, in wasmi's own vocabulary.
-///
-/// Building one to compare against costs nothing — `FuncType` holds up to 21 value
-/// types inline on a 64-bit target and the ABI's widest signature is nine, so this
-/// is a stack value and the comparison above is one `==`.
-pub(super) fn registered_type(function: HostFunctionSpec) -> FuncType {
-    FuncType::new(
-        function.wasm_params().iter().copied().map(val_type),
-        function.wasm_result().map(val_type),
-    )
-}
-
-/// The one place the ABI's value types become the engine's.
-fn val_type(declared: WasmValType) -> ValType {
-    match declared {
-        WasmValType::I32 => ValType::I32,
-        WasmValType::I64 => ValType::I64,
-    }
-}
-
-/// A function type as `(i32, i32) -> i32`, and as `(i32, i32)` for a function
-/// answering nothing — the spelling [`super::entry_point_fault`] uses, so the two
-/// stages describe a signature the same way.
-fn signature(ty: &FuncType) -> String {
-    let params = to_string(ty.params());
-    match ty.results() {
-        [] => format!("({params})"),
-        results => format!("({params}) -> {}", to_string(results)),
-    }
-}
-
-/// The types of one position, as a signature lists them.
-fn to_string(types: &[ValType]) -> String {
-    types
-        .iter()
-        .copied()
-        .map(as_str)
-        .collect::<Vec<_>>()
-        .join(", ")
-}
-
-/// A wasm value type as the text format spells it. Total over [`ValType`] because a
-/// refusal renders the found side too, which is whatever the module declared.
-fn as_str(val_type: ValType) -> &'static str {
-    match val_type {
-        ValType::I32 => "i32",
-        ValType::I64 => "i64",
-        ValType::F32 => "f32",
-        ValType::F64 => "f64",
-        ValType::V128 => "v128",
-        ValType::FuncRef => "funcref",
-        ValType::ExternRef => "externref",
-    }
-}
-
-/// The rule and the derivation under it, on function types built directly. Which
-/// `CheckError` a refusal becomes and where this rule sits among the other three
-/// are the parent's tests.
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// The three ways an import's type can differ from the one registered, each
-    /// against a real declaration: a wrong value type, a wrong arity, and a result
-    /// where the ABI answers nothing.
-    ///
-    /// The arity case is the one that matters in practice — a guest that reads
-    /// `check_keylet`'s `seq: u32` as a scalar writes exactly that signature.
-    #[test]
-    fn an_import_of_the_wrong_type_is_refused() {
-        let refusal = check_signature(
-            HostFunctionSpec::GetLedgerSqn,
-            &FuncType::new([ValType::I64, ValType::I64], [ValType::I32]),
-        )
-        .expect_err("i64 where i32 belongs");
-        assert_eq!(
-            refusal,
-            "'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::CheckKeylet,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a u32 read as one parameter rather than two");
-        assert_eq!(
-            refusal,
-            "'check_id' expected '(i32, i32, i32, i32, i32, i32) -> i32', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-
-        let refusal = check_signature(
-            HostFunctionSpec::Trace,
-            &FuncType::new([ValType::I32; 5], [ValType::I32]),
-        )
-        .expect_err("a result from the one function that answers nothing");
-        assert_eq!(
-            refusal,
-            "'trace' expected '(i32, i32, i32, i32, i32)', \
-             found '(i32, i32, i32, i32, i32) -> i32'"
-        );
-    }
-
-    /// Both of the ABI's value types survive the map to the engine's vocabulary:
-    /// an `i64` collapsed to an `i32` would make the check accept what the linker
-    /// refuses, and a result invented for `trace` would make it refuse what the
-    /// linker accepts.
-    #[test]
-    fn the_derived_type_keeps_i64_and_the_absent_result() {
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::FloatFromInt)),
-            "(i64, i32, i32, i32) -> i32"
-        );
-        assert_eq!(
-            signature(&registered_type(HostFunctionSpec::Trace)),
-            "(i32, i32, i32, i32, i32)"
-        );
-    }
-}

crates/xrpl-wasm-vm/src/register.rs

@@ -1,717 +0,0 @@
-//! What this engine does with each host call, once the ABI's own machinery has
-//! taken the call apart.
-//!
-//! `wasmi_glue!` expands to the [`HostFunctionBodies`] trait and
-//! [`register_host_functions`], both generated from the declarations in
-//! `xrpl-host-functions` — so the wasm signature every closure is registered at is
-//! the one [`crate::check`] screens an import by. Hand-written here is one body per
-//! declaration, and the compiler will not accept the `impl` without all of them.
-//! [`glue_env`] is this engine's side of that macro's contract.
-//!
-//! **A body charges no gas and touches no wire encoding.** The generated closure
-//! does both, around the call, so a body says only what the call *is*.
-//!
-//! Four shapes cover 59 of the 60, each decided by the declaration's own types:
-//!
-//! - a value the host answers directly — read the arguments, call the host;
-//! - [`write_into`], for a value written straight to the guest's output region:
-//!   the call reads no guest memory, so the host can be handed a `&mut` view of it;
-//! - [`write_buffered`], for one that also reads: the host fills the run's scratch
-//!   buffer, and it is copied out once every rule has passed, which is what lets
-//!   the inputs stay borrowed rather than copied;
-//! - [`write_mant_exp`], for the one call that writes two regions.
-//!
-//! `trace` is the sixtieth: its declared `HostResult<()>` gives it a
-//! `CallResult<()>` body and the `charged_unreported` helper.
-
-use crate::abi::{
-    CallResult, charge_transfer, guest_memory, write_buffered, write_into, write_mant_exp,
-};
-use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-use crate::vm::VmState;
-use wasmi::Caller;
-
-/// Everything `wasmi_glue!` names on this side, gathered where the macro can be
-/// handed it — so a rename in `abi.rs` or `args.rs` is an unresolved import here
-/// rather than a name resolved against whatever the call site has in scope.
-///
-/// The shapes are elsewhere and cannot be stated here: `args.rs` implements
-/// `FromWasmRegion`/`FromWasmScalar`, and the expansion pins each charging
-/// helper's signature itself.
-mod glue_env {
-    pub(crate) use crate::abi::{CallResult, charged, charged_unreported};
-    pub(crate) use crate::args::{InBytes, InStr, InU32, OutBytes, TraceCode};
-    pub(crate) use crate::vm::VmState;
-}
-
-xrpl_host_functions::wasmi_glue!(glue_env);
-
-/// The bodies this engine registers, named as one type so
-/// [`register_host_functions`] can be given them. Never built: every body is an
-/// associated function and the host it calls comes from the store.
-pub(crate) struct Bodies {}
-
-impl HostFunctionBodies for Bodies {
-    fn get_ledger_sqn(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_ledger_sqn(out))
-    }
-
-    fn get_parent_ledger_time(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_time(out))
-    }
-
-    fn get_parent_ledger_hash(
-        caller: &mut Caller<'_, VmState<'_>>,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_parent_ledger_hash(out))
-    }
-
-    fn get_base_fee(caller: &mut Caller<'_, VmState<'_>>, out: OutBytes) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_base_fee(out))
-    }
-
-    fn is_amendment_enabled(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amendment: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.is_amendment_enabled(amendment.read(memory)?)?)
-    }
-
-    fn cache_ledger_obj(
-        caller: &mut Caller<'_, VmState<'_>>,
-        obj_id: InBytes,
-        cache_idx: i32,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.cache_ledger_obj(obj_id.read(memory)?, cache_idx)?)
-    }
-
-    fn get_tx_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.get_tx_field(field, out))
-    }
-
-    fn get_current_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_current_ledger_obj_field(field, out)
-        })
-    }
-
-    fn get_ledger_obj_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.get_ledger_obj_field(cache_idx, field, out)
-        })
-    }
-
-    fn get_tx_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_tx_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_current_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_current_ledger_obj_nested_field(locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_ledger_obj_nested_field(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_ledger_obj_nested_field(cache_idx, locator.read(memory)?, buf)
-        })
-    }
-
-    fn get_tx_array_len(caller: &mut Caller<'_, VmState<'_>>, field: i32) -> CallResult<i32> {
-        Ok(caller.data().host.get_tx_array_len(field)?)
-    }
-
-    fn get_current_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller.data().host.get_current_ledger_obj_array_len(field)?)
-    }
-
-    fn get_ledger_obj_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        field: i32,
-    ) -> CallResult<i32> {
-        Ok(caller
-            .data()
-            .host
-            .get_ledger_obj_array_len(cache_idx, field)?)
-    }
-
-    fn get_tx_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_tx_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_current_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_current_ledger_obj_nested_array_len(locator.read(memory)?)?)
-    }
-
-    fn get_ledger_obj_nested_array_len(
-        caller: &mut Caller<'_, VmState<'_>>,
-        cache_idx: i32,
-        locator: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_ledger_obj_nested_array_len(cache_idx, locator.read(memory)?)?)
-    }
-
-    fn check_signature(
-        caller: &mut Caller<'_, VmState<'_>>,
-        message: InBytes,
-        signature: InBytes,
-        pubkey: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.check_signature(
-            message.read(memory)?,
-            signature.read(memory)?,
-            pubkey.read(memory)?,
-        )?)
-    }
-
-    fn account_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.account_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn amm_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        asset1: InBytes,
-        asset2: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.amm_keylet(asset1.read(memory)?, asset2.read(memory)?, buf)
-        })
-    }
-
-    fn check_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.check_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn credential_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        subject: InBytes,
-        issuer: InBytes,
-        credential_type: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.credential_keylet(
-                subject.read(memory)?,
-                issuer.read(memory)?,
-                credential_type.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn delegate_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.delegate_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn deposit_preauth_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        authorize: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.deposit_preauth_keylet(account.read(memory)?, authorize.read(memory)?, buf)
-        })
-    }
-
-    fn did_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.did_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn escrow_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.escrow_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn trust_line_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account1: InBytes,
-        account2: InBytes,
-        currency: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.trust_line_keylet(
-                account1.read(memory)?,
-                account2.read(memory)?,
-                currency.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn mptoken_issuance_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        issuer: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_issuance_keylet(issuer.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn mptoken_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mptid: InBytes,
-        holder: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.mptoken_keylet(mptid.read(memory)?, holder.read(memory)?, buf)
-        })
-    }
-
-    fn nftoken_offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.nftoken_offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn offer_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.offer_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn oracle_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        doc_id: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.oracle_keylet(account.read(memory)?, doc_id.read(memory)?, buf)
-        })
-    }
-
-    fn paychannel_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        destination: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.paychannel_keylet(
-                account.read(memory)?,
-                destination.read(memory)?,
-                seq.read(memory)?,
-                buf,
-            )
-        })
-    }
-
-    fn permissioned_domain_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.permissioned_domain_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn signer_list_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.signer_list_keylet(account.read(memory)?, buf)
-        })
-    }
-
-    fn ticket_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.ticket_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn vault_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.vault_keylet(account.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn sponsorship_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        sponsor: InBytes,
-        sponsee: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sponsorship_keylet(sponsor.read(memory)?, sponsee.read(memory)?, buf)
-        })
-    }
-
-    fn loan_broker_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        owner: InBytes,
-        seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_broker_keylet(owner.read(memory)?, seq.read(memory)?, buf)
-        })
-    }
-
-    fn loan_keylet(
-        caller: &mut Caller<'_, VmState<'_>>,
-        loan_broker_id: InBytes,
-        loan_seq: InU32,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.loan_keylet(loan_broker_id.read(memory)?, loan_seq.read(memory)?, buf)
-        })
-    }
-
-    fn sha512_half(
-        caller: &mut Caller<'_, VmState<'_>>,
-        data: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.sha512_half(data.read(memory)?, buf)
-        })
-    }
-
-    /// The one body with nothing to answer: the wasm function has no result to
-    /// carry a code, so a malformed argument leaves the guest none the wiser and
-    /// the host uncalled.
-    fn trace(
-        caller: &mut Caller<'_, VmState<'_>>,
-        msg: InStr,
-        data_type: TraceCode,
-        data: InBytes,
-    ) -> CallResult<()> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.trace(msg.read(memory)?, data_type.read()?, data.read(memory)?)?)
-    }
-
-    fn update_data(caller: &mut Caller<'_, VmState<'_>>, data: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let bytes = data.read(memory)?;
-        charge_transfer(caller.data(), bytes.len())?;
-        Ok(caller.data().host.update_data(bytes)?)
-    }
-
-    fn get_nft(
-        caller: &mut Caller<'_, VmState<'_>>,
-        account: InBytes,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft(account.read(memory)?, nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_issuer(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_issuer(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_taxon(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_taxon(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn get_nft_flags(caller: &mut Caller<'_, VmState<'_>>, nft_id: InBytes) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_flags(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_transfer_fee(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        Ok(host.get_nft_transfer_fee(nft_id.read(memory)?)?)
-    }
-
-    fn get_nft_sequence(
-        caller: &mut Caller<'_, VmState<'_>>,
-        nft_id: InBytes,
-        out: OutBytes,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.get_nft_sequence(nft_id.read(memory)?, buf)
-        })
-    }
-
-    fn float_from_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: i64,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| host.float_from_int(x, out, mode))
-    }
-
-    fn float_from_uint(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_uint(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stamount(
-        caller: &mut Caller<'_, VmState<'_>>,
-        amount: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stamount(amount.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_from_stnumber(
-        caller: &mut Caller<'_, VmState<'_>>,
-        number: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_from_stnumber(number.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_int(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_to_int(x.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_to_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        mantissa_out: OutBytes,
-        exponent_out: OutBytes,
-    ) -> CallResult<i32> {
-        write_mant_exp(
-            caller,
-            mantissa_out,
-            exponent_out,
-            |host, memory, mantissa, exponent| {
-                host.float_to_mant_exp(x.read(memory)?, mantissa, exponent)
-            },
-        )
-    }
-
-    fn float_from_mant_exp(
-        caller: &mut Caller<'_, VmState<'_>>,
-        mantissa: i64,
-        exponent: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_into(caller, out, |host, out| {
-            host.float_from_mant_exp(mantissa, exponent, out, mode)
-        })
-    }
-
-    fn float_compare(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-    ) -> CallResult<i32> {
-        let memory = guest_memory(caller)?;
-        let host = caller.data().host;
-        // `FloatOrdering`'s codes are non-negative, which is what lets the verdict share
-        // this `i32` with a negative `HostError`.
-        Ok(host.float_compare(x.read(memory)?, y.read(memory)?)?.code())
-    }
-
-    fn float_add(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_add(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_subtract(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_subtract(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_multiply(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_multiply(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_divide(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        y: InBytes,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_divide(x.read(memory)?, y.read(memory)?, buf, mode)
-        })
-    }
-
-    fn float_power(
-        caller: &mut Caller<'_, VmState<'_>>,
-        x: InBytes,
-        n: i32,
-        out: OutBytes,
-        mode: i32,
-    ) -> CallResult<i32> {
-        write_buffered(caller, out, |host, memory, buf| {
-            host.float_power(x.read(memory)?, n, buf, mode)
-        })
-    }
-}

crates/xrpl-wasm-vm/src/vm.rs

@@ -1,623 +0,0 @@
-use std::cell::Cell;
-use std::fmt;
-use wasmi::errors::HostError;
-use wasmi::{
-    CompilationMode, Config, CustomFuelCosts, EnforcedLimits, Engine, Export, ExternKind,
-    ImportKind, Linker, Memory, MemoryType, Module, ModuleInspector, SectionKind, Store,
-    StoreLimits, StoreLimitsBuilder, TableType, TrapCode,
-};
-use xrpl_host_functions::HostFunctions;
-
-use crate::abi::{FatalHostError, Fault};
-use crate::preflight::entry_point_fault;
-use crate::register::{Bodies, register_host_functions};
-
-/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
-const WASM_PAGE_BYTES: u32 = 64 * 1024;
-
-/// Linear-memory page cap.
-pub const MAX_MEMORY_PAGES: u32 = 128;
-
-/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
-pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
-
-/// Cap on a table's element count.
-///
-/// A table entry is 8 bytes and wasmi materializes every one of them inside
-/// `instantiate_and_start` — before the guest's first instruction, so no gas charge
-/// can reach the cost. Without this cap the ceiling is the validator's, `u32::MAX`
-/// entries, which a module asks for in five bytes of LEB128 and pays for in ~34 GiB.
-pub const MAX_TABLE_ELEMENTS: usize = 1024;
-
-/// Cap on a module's type section entries. The example contracts declare under ten.
-pub const MAX_TYPES: u32 = 2048;
-
-/// Cap on a module's import section entries. Every import must name a host
-/// function, so a module needs no more than the ABI has — well under this.
-pub const MAX_IMPORTS: u32 = 256;
-
-/// Cap on a module's export section entries. The example contracts export under ten.
-pub const MAX_EXPORTS: u32 = 256;
-
-/// Cap on the bytes in any one import's module or field name, or export's name.
-/// Host function names run to tens of bytes.
-pub const MAX_NAME_BYTES: usize = 256;
-
-/// Total bytes the host may write into guest memory in one [`run`], separate from
-/// gas.
-///
-/// One direction only. What the guest passes in is not charged: it reaches the host
-/// as a borrowed slice of guest memory, capped per value at [`MAX_FIELD_BYTES`] by
-/// `Region::read` and in number by gas, and a host that keeps a copy (`update_data`)
-/// bounds it on its own side.
-pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
-
-/// Size cap on any single value crossing the boundary, in either direction; over
-/// it is `DataFieldTooLarge`.
-///
-/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
-pub const MAX_FIELD_BYTES: usize = 1024;
-
-/// State threaded through every host call, stored in the wasmi [`Store`].
-pub(crate) struct VmState<'h> {
-    pub(crate) host: &'h dyn HostFunctions,
-    /// Enforces [`store_limits`] via `Store::limiter`, which needs a `&mut` into it
-    /// from `&mut VmState` — hence a field rather than a local.
-    pub(crate) mem_limits: StoreLimits,
-    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
-    ///
-    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
-    /// invocation touches the store, so the lack of `Sync` costs nothing.
-    ///
-    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
-    /// until this ABI gains a `FieldLocator` host function.
-    pub(crate) transfer_budget: Cell<u64>,
-    /// The guest's linear memory, resolved once by [`run`] after instantiation so
-    /// no host call pays for an export lookup.
-    ///
-    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
-    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
-    /// re-derive the slice per call.
-    ///
-    /// The handle is scoped to one store, so this assumes **one module, one
-    /// instance, one store per `run`**. Module linking or nested execution would
-    /// have to resolve per instance: a cached handle would serve a call against the
-    /// wrong instance's memory, which is a wrong answer rather than an error.
-    pub(crate) memory: Option<Memory>,
-    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
-    /// to the guest. One buffer per run, so no call zero-fills one of its own.
-    ///
-    /// Inline rather than boxed: the store's data is built once and then only
-    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
-    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
-    /// stack buffer is zero-filled — per call, which is the cost this removes.
-    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
-}
-
-/// Outcome of running an escrow contract to completion.
-#[derive(Debug)]
-pub struct RunOutcome {
-    /// The value returned by the exported entry point (`finish`): `> 0` means
-    /// allow the escrow to finish.
-    pub result: i32,
-    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
-    /// the per-call host charges.
-    pub fuel_used: u64,
-}
-
-/// Why a run produced no result. Each variant is one outcome for the caller to
-/// map to a TER.
-#[derive(Debug)]
-pub enum RunError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Compile(String),
-    /// A type, import or export section, or an import or export name, is past its
-    /// cap. Refused before compiling, and apart from [`RunError::Compile`] because
-    /// no contract reaches a cap by accident.
-    Limit(String),
-    /// The module compiled but the engine would not accept it: an import the
-    /// linker does not define, or an initial memory past the page cap. Not guest
-    /// code failing — a start section that traps is [`RunError::Trap`].
-    Instantiate(String),
-    /// No export named `function_name` with signature `() -> i32`: absent, not a
-    /// function, or a function of another type — which the detail tells apart.
-    EntryPoint(String),
-    /// Gas exhausted — by the guest's own instructions or by a host call's
-    /// charge. [`RunFailure::fuel_used`] is the whole limit.
-    OutOfGas,
-    /// The host could not serve a call.
-    Internal,
-    /// A host call had no linear memory to work in: the module exports none, or
-    /// the call came from a start section, which runs before there is an instance
-    /// to resolve the memory from.
-    NoMemory,
-    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
-    /// access, or `memory.grow` past the page cap. Wherever the guest was
-    /// executing, including a start section during instantiation.
-    Trap(String),
-}
-
-impl fmt::Display for RunError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            RunError::Compile(detail) => write!(f, "compile: {detail}"),
-            RunError::Limit(detail) => write!(f, "limit: {detail}"),
-            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
-            // The detail says which of the entry point's failures this is, since
-            // "no entry point" would be wrong for an export of the wrong type.
-            RunError::EntryPoint(detail) => write!(f, "{detail}"),
-            RunError::OutOfGas => write!(f, "out of gas"),
-            RunError::Internal => write!(f, "internal error"),
-            RunError::NoMemory => write!(f, "no exported memory"),
-            RunError::Trap(detail) => write!(f, "trap: {detail}"),
-        }
-    }
-}
-
-/// A failed run, with the gas it still owes: a contract that traps or exhausts
-/// its gas is charged for what it burned.
-#[derive(Debug)]
-pub struct RunFailure {
-    pub error: RunError,
-    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
-    /// when the module never ran.
-    pub fuel_used: u64,
-}
-
-impl fmt::Display for RunFailure {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
-    }
-}
-
-impl RunFailure {
-    /// A failure with no fuel accounted: it stopped the run at or before the guest's
-    /// first instruction, or under a store with no meter to read.
-    fn owing_nothing(error: RunError) -> RunFailure {
-        RunFailure {
-            error,
-            fuel_used: 0,
-        }
-    }
-}
-
-/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
-/// trap and refusal all report it the same way.
-///
-/// `Store::get_fuel` fails only on a store without fuel metering, which
-/// [`wasm_engine`] rules out and `run`'s `set_fuel` would already have
-/// caught — so a failure here is a defect in this crate. It must not become a
-/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
-/// everything. [`RunError::Internal`] instead.
-fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
-    store
-        .get_fuel()
-        .map(|remaining| gas.saturating_sub(remaining))
-        .map_err(|_| RunError::Internal)
-}
-
-/// Report `error` with the run's cost attached. A cost that cannot be read replaces
-/// the outcome rather than being invented — see [`fuel_used`].
-fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
-    match fuel_used(store, gas) {
-        Ok(fuel_used) => RunFailure { error, fuel_used },
-        Err(unmetered) => RunFailure::owing_nothing(unmetered),
-    }
-}
-
-/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
-/// the stage that raised it.
-///
-/// Two ways a run halts mid-flight: a host call that could not be served, which
-/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
-/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
-///
-/// Both can happen anywhere the guest executes — including a start section, which
-/// is guest code running during instantiation — so every stage from there on asks
-/// this before naming a failure after itself.
-fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
-    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
-        return Some(fatal.0.into());
-    }
-    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
-}
-
-/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
-/// that can arise anywhere.
-///
-/// A start section is guest code, so it can trap on its own — `unreachable`, a
-/// division by zero, an out-of-bounds access — and a trap is the guest's fault
-/// wherever it happens. Naming that after the *stage* would file it beside the
-/// module faults a caller treats as its own defect, and charge nothing for
-/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
-/// module the linker or the store would not accept at all.
-fn instantiation_failure(error: &wasmi::Error) -> RunError {
-    match error.as_trap_code() {
-        Some(_) => RunError::Trap(error.to_string()),
-        None => RunError::Instantiate(error.to_string()),
-    }
-}
-
-/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
-///
-/// Total and one arm each, because a `Fault` is only ever a condition that stops the
-/// run — the guest-visible codes cannot reach here, which is what
-/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
-/// compile.
-impl From<Fault> for RunError {
-    fn from(fault: Fault) -> RunError {
-        match fault {
-            Fault::OutOfGas => RunError::OutOfGas,
-            Fault::Internal => RunError::Internal,
-            Fault::NoMemory => RunError::NoMemory,
-        }
-    }
-}
-
-/// A fresh wasmi engine for one caller's use: deterministic, minimal features,
-/// fuel metering on.
-///
-/// The configuration is consensus-fixed and identical for every invocation, so any
-/// two engines from here accept exactly the same modules. Each is nonetheless a
-/// distinct engine with its own compiled-code and type registries, and wasmi ties a
-/// [`Module`] to the engine that compiled it — a module cannot be instantiated in a
-/// [`Store`] built on another. A caller that compiles and runs must therefore hold
-/// one engine across both steps, which is why [`compile`] takes the engine rather
-/// than reaching for its own.
-pub(crate) fn wasm_engine() -> Engine {
-    let mut config = Config::default();
-    config.consume_fuel(true);
-    config.ignore_custom_sections(true);
-    config.wasm_mutable_global(false);
-    config.wasm_multi_value(false);
-    config.wasm_sign_extension(false);
-    config.wasm_saturating_float_to_int(false);
-    config.wasm_bulk_memory(false);
-    config.wasm_reference_types(false);
-    config.wasm_tail_call(false);
-    config.wasm_extended_const(false);
-    config.floats(false);
-    config.wasm_multi_memory(false);
-    config.wasm_custom_page_sizes(false);
-    // Disabled through the crate feature flag.
-    // config.wasm_memory64(false);
-    config.wasm_wide_arithmetic(false);
-    config.allow_start_fn(false);
-    config.enforced_limits(EnforcedLimits::strict());
-
-    let fuel_costs = CustomFuelCosts {
-        bytes_copied_per_fuel: 64,
-        fuel_per_bytes_translated: 7,
-        fuel_per_bytes_validated: 2,
-    };
-    config.fuel_cost(fuel_costs);
-    // config.operator_costs is already guarded by the probe_fuel test under budgets.rs
-    // in that a change to operator costs in a future version will be a loud failure.
-
-    config.compilation_mode(CompilationMode::LazyTranslation);
-    Engine::new(&config)
-}
-
-/// Every resource ceiling a run is given, in one place.
-///
-/// The two *size* caps are what a contract can reach today. The three *count* caps
-/// are set to 1 although [`wasm_engine`] already forces each: turning
-/// `wasm_reference_types` on would let a module declare up to
-/// `wasmparser::MAX_WASM_TABLES` tables, `wasm_multi_memory` likewise for memories,
-/// and both size caps are **per table and per memory, not aggregate** — so a feature
-/// flag flipped in isolation would multiply the ceiling by a hundred rather than
-/// leave it be. The counts are what keeps those two decisions independent.
-///
-/// wasmi enforces the counts by asking the limiter before it allocates
-/// (`can_create_more_instances`/`_memories`/`_tables`); they default to 10000, so
-/// leaving them unset is not the same as their being unreachable.
-fn store_limits() -> StoreLimits {
-    StoreLimitsBuilder::new()
-        .memory_size(MAX_MEMORY_BYTES)
-        .table_elements(MAX_TABLE_ELEMENTS)
-        .instances(1)
-        .tables(1)
-        .memories(1)
-        .trap_on_grow_failure(true)
-        .build()
-}
-
-/// Compile `wasm` for `engine`.
-///
-/// The one path to a [`Module`]: the configuration is what decides whether a
-/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
-/// compile against different ones. The engine is the caller's because the module it
-/// returns may only be instantiated in a [`Store`] built on that same engine.
-pub(crate) fn compile(engine: &Engine, wasm: &[u8]) -> Result<Compiled, CompileError> {
-    let mut screen = Screen::default();
-    let module = Module::new_with_inspector(engine, wasm, &mut screen).map_err(|e| match e
-        .downcast_ref::<PastCap>()
-    {
-        Some(PastCap(detail)) => CompileError::Limit(detail.clone()),
-        None => CompileError::Invalid(e.to_string()),
-    })?;
-    Ok(Compiled { module, screen })
-}
-
-/// What [`compile`] produced: the module, and the [`Screen`] that inspected it.
-pub(crate) struct Compiled {
-    pub(crate) module: Module,
-    /// What the parse recorded that [`Module`] cannot say. Read by [`crate::check`];
-    /// a run ignores it.
-    pub(crate) screen: Screen,
-}
-
-/// Why [`compile`] produced no module.
-///
-/// Two variants rather than one string because a caller counts them apart: a module
-/// the engine rejects is usually a toolchain mistake, while one past a section cap
-/// was almost certainly built to be — no contract comes near the caps by accident.
-#[derive(Debug)]
-pub(crate) enum CompileError {
-    /// `wasm` is not a valid module under this engine's configuration.
-    Invalid(String),
-    /// A section or a name is past its cap — see [`Screen`].
-    Limit(String),
-}
-
-/// Refuse a module whose type, import or export section, or any import or export
-/// name, is past its cap, and record the memories and tables it defines — all from
-/// inside [`Module::new_with_inspector`]'s own parse, so the bytes are walked once.
-///
-/// Left to wasmi, the ceilings are wasmparser's — a million entries per section and
-/// 100 000 bytes per name — and [`EnforcedLimits`] has no knob for any of them.
-///
-/// The section caps are checked **before** wasmi validates the section: a count is in
-/// the section's header, so a module past one is refused before any of its entries
-/// is read. The name caps, and the record, come **after** the section is validated,
-/// as wasmi reads its entries — so the validator has read a long name by the time it
-/// is refused. That cost is bounded by the module's size, which the transaction
-/// already caps.
-///
-/// One field each for the memory and the table is enough: a module that compiles
-/// defines at most one of each, since the engine disables multi-memory and reference
-/// types, and a [`Screen`] is only read once [`compile`] has succeeded. An imported
-/// memory or table is not recorded — an import that is not a host function is
-/// refused anyway.
-#[derive(Default)]
-pub(crate) struct Screen {
-    memory_pages: Option<u64>,
-    table_elements: Option<u64>,
-}
-
-impl Screen {
-    /// The initial pages of the memory the module defines, if it defines one —
-    /// exported or not, which [`Module`] cannot say: it shows a memory only through
-    /// its exports. A run leaves the size to the store's limiter.
-    pub(crate) fn memory_pages(&self) -> Option<u64> {
-        self.memory_pages
-    }
-
-    /// The initial elements of the table the module defines, if it defines one, as
-    /// [`Screen::memory_pages`] is for a memory.
-    pub(crate) fn table_elements(&self) -> Option<u64> {
-        self.table_elements
-    }
-}
-
-impl ModuleInspector for Screen {
-    fn section(&mut self, kind: SectionKind, count: u32) -> Result<(), wasmi::Error> {
-        let (section, cap) = match kind {
-            SectionKind::Type => ("type", MAX_TYPES),
-            SectionKind::Import => ("import", MAX_IMPORTS),
-            SectionKind::Export => ("export", MAX_EXPORTS),
-            _ => return Ok(()),
-        };
-        check_count(section, count, cap).map_err(past_cap)
-    }
-
-    fn import(&mut self, module: &str, name: &str, _: &ImportKind) -> Result<(), wasmi::Error> {
-        check_name("import module", module)
-            .and_then(|()| check_name("import", name))
-            .map_err(past_cap)
-    }
-
-    fn export(&mut self, name: &str, _: ExternKind, _: u32) -> Result<(), wasmi::Error> {
-        check_name("export", name).map_err(past_cap)
-    }
-
-    fn table(&mut self, ty: &TableType) -> Result<(), wasmi::Error> {
-        self.table_elements = Some(ty.minimum());
-        Ok(())
-    }
-
-    fn memory(&mut self, ty: &MemoryType) -> Result<(), wasmi::Error> {
-        self.memory_pages = Some(ty.minimum());
-        Ok(())
-    }
-}
-
-/// A [`Screen`] refusal, carried through wasmi's error so [`compile`] can tell it
-/// from a module wasmi itself rejects.
-#[derive(Debug)]
-struct PastCap(String);
-
-impl fmt::Display for PastCap {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.0)
-    }
-}
-
-impl HostError for PastCap {}
-
-fn past_cap(detail: String) -> wasmi::Error {
-    wasmi::Error::host(PastCap(detail))
-}
-
-fn check_count(section: &str, count: u32, cap: u32) -> Result<(), String> {
-    if count > cap {
-        return Err(format!(
-            "{count} {section} entries is past the {cap}-entry cap"
-        ));
-    }
-    Ok(())
-}
-
-fn check_name(kind: &str, name: &str) -> Result<(), String> {
-    if name.len() > MAX_NAME_BYTES {
-        return Err(format!(
-            "{kind} name of {} bytes is past the {MAX_NAME_BYTES}-byte cap",
-            name.len()
-        ));
-    }
-    Ok(())
-}
-
-/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
-/// calls through `host`, and call the exported `function_name`.
-pub fn run<'h>(
-    wasm: &[u8],
-    gas: u64,
-    host: &'h dyn HostFunctions,
-    function_name: &str,
-) -> Result<RunOutcome, RunFailure> {
-    let engine = wasm_engine();
-    let Compiled { module, .. } = compile(&engine, wasm).map_err(|e| {
-        RunFailure::owing_nothing(match e {
-            CompileError::Invalid(detail) => RunError::Compile(detail),
-            CompileError::Limit(detail) => RunError::Limit(detail),
-        })
-    })?;
-
-    let mut store = Store::new(
-        &engine,
-        VmState {
-            host,
-            mem_limits: store_limits(),
-            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
-            memory: None,
-            out_buffer: [0u8; MAX_FIELD_BYTES],
-        },
-    );
-
-    store
-        .set_fuel(gas)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-    store.limiter(|state| &mut state.mem_limits);
-
-    let mut linker = Linker::<VmState<'h>>::new(&engine);
-    register_host_functions::<Bodies>(&mut linker)
-        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
-
-    let instance = match linker.instantiate_and_start(&mut store, &module) {
-        Ok(instance) => instance,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
-            return Err(failed(&store, gas, error));
-        }
-    };
-    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
-
-    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
-        Ok(function) => function,
-        Err(e) => {
-            let found = instance
-                .get_export(&store, function_name)
-                .map(|export| export.ty(&store));
-            let error =
-                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let result = match function.call(&mut store, ()) {
-        Ok(result) => result,
-        Err(e) => {
-            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
-            return Err(failed(&store, gas, error));
-        }
-    };
-
-    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
-    Ok(RunOutcome { result, fuel_used })
-}
-
-#[cfg(test)]
-#[cfg_attr(coverage_nightly, coverage(off))]
-mod tests {
-    use super::*;
-
-    /// Each call is its own engine, which is what makes the engine a caller's to
-    /// hold: a module compiled through one may not be instantiated in a store built
-    /// on another, so `run` must pass the engine it made to [`compile`] rather than
-    /// let it call here a second time.
-    #[test]
-    fn each_call_is_a_new_engine() {
-        assert!(!Engine::same(&wasm_engine(), &wasm_engine()));
-    }
-
-    /// One instance, one table, one memory — asserted here rather than through a
-    /// module, because no module can reach these. `wasm_reference_types(false)` and
-    /// `wasm_multi_memory(false)` make a module declaring a second table or memory
-    /// fail *validation*, so a run never gets far enough to consult the limiter.
-    /// That is exactly why the counts are worth pinning: they are the ceiling that
-    /// survives one of those flags being turned on, and nothing else would fail if
-    /// they were silently dropped.
-    #[test]
-    fn the_store_grants_one_of_each_thing_a_module_can_own() {
-        use wasmi::ResourceLimiter;
-
-        let limits = store_limits();
-        assert_eq!(limits.instances(), 1);
-        assert_eq!(limits.tables(), 1);
-        assert_eq!(limits.memories(), 1);
-    }
-
-    /// The three size-proportional fuel rates, read back off the engine. wasmi
-    /// takes its own defaults for these unless told otherwise, so an upgrade that
-    /// changed one would retune our gas silently. `Config` keeps them
-    /// `pub(crate)` and exposes them only through `Debug`.
-    #[test]
-    fn the_dynamic_fuel_costs_are_pinned() {
-        let config = format!("{:?}", wasm_engine().config());
-        for rate in [
-            "bytes_copied_per_fuel: 64",
-            "fuel_per_bytes_translated: 7",
-            "fuel_per_bytes_validated: 2",
-        ] {
-            assert!(config.contains(rate), "expected `{rate}` in {config}");
-        }
-    }
-
-    /// [`EnforcedLimits::strict`] is the one line in [`wasm_engine`] that takes a
-    /// value rather than stating one — the fields are `pub(crate)`, so the preset is
-    /// the only way to set them.
-    #[test]
-    fn the_enforced_limits_are_pinned() {
-        const EXPECTED: &str = concat!(
-            "EnforcedLimits { ",
-            "max_globals: Some(1000), ",
-            "max_functions: Some(10000), ",
-            "max_tables: Some(100), ",
-            "max_element_segments: Some(1000), ",
-            "max_memories: Some(1), ",
-            "max_data_segments: Some(1000), ",
-            "max_params: Some(32), ",
-            "max_results: Some(32), ",
-            "min_avg_bytes_per_function: Some(AvgBytesPerFunctionLimit { ",
-            "req_funcs_bytes: 1000, min_avg_bytes_per_function: 40 }) }",
-        );
-
-        let config = format!("{:?}", wasm_engine().config());
-        assert!(
-            config.contains(EXPECTED),
-            "expected `{EXPECTED}` in {config}"
-        );
-    }
-
-    /// The only place these numbers appear as literals; every other test derives
-    /// them from the constants.
-    #[test]
-    fn the_limits_are_the_protocol_limits() {
-        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
-        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
-        assert_eq!(MAX_TABLE_ELEMENTS, 1024, "table-element cap");
-        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
-        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
-    }
-}

crates/xrpl-wasm-vm/tests/memory_policy.rs

@@ -1,709 +0,0 @@
-//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
-//! crossing the boundary. This is the policy the guest observes, so each rule is
-//! pinned to the code it answers with.
-
-mod support;
-
-use support::{
-    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
-    traced,
-};
-use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
-use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
-
-/// One page, so anything at or past 65536 is out of bounds.
-const PAGE: i64 = 64 * 1024;
-
-/// The per-field size cap, as a wasm operand.
-const CAP: i64 = MAX_FIELD_BYTES as i64;
-/// One byte over the cap: the smallest value the engine must refuse.
-const OVER_CAP: i64 = CAP + 1;
-
-// ---------------------------------------------------------------------------
-// Output regions (`write_into`)
-// ---------------------------------------------------------------------------
-
-/// The whole output region must be in bounds, not merely its start — the engine
-/// checks `[dst, dst + cap)` before the host is allowed to write.
-#[test]
-fn an_output_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// A region ending exactly at the last byte of memory is in bounds.
-#[test]
-fn an_output_region_ending_at_the_last_byte_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
-    );
-    assert_eq!(status(&wat, &host), 4);
-}
-
-/// The wire carries `i32`, so a guest can present a negative pointer or length.
-#[test]
-fn a_negative_output_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
-        let wat = module(
-            &[import::LDGR_INDEX, ONE_PAGE],
-            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "dst {dst} cap {cap}"
-        );
-    }
-}
-
-/// The host reports a value's true length whether or not it fitted; a value that
-/// did not fit is the guest's error, not the host's.
-#[test]
-fn a_value_larger_than_the_buffer_is_refused() {
-    let host = FakeHost::new().answering_field(1, Answer::filler(64));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
-}
-
-/// A zero-length output region is in bounds and simply cannot hold anything.
-#[test]
-fn a_zero_length_output_region_is_in_bounds_but_too_small() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 0))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-}
-
-/// A host that reports more than the per-field cap is refused even when the
-/// guest offered room for it: the cap is the engine's rule, not the buffer's.
-#[test]
-fn a_value_past_the_field_cap_is_refused() {
-    let host = FakeHost::new()
-        .answering_field(1, Answer::claiming(OVER_CAP as usize))
-        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
-    );
-    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
-}
-
-/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
-/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
-/// declared, so a value past the cap does not fit the region it is offered and no
-/// prefix of it can reach guest memory either.
-///
-/// The host answers with a real over-cap value: [`Answer::claiming`] writes
-/// nothing whatever the engine does, so it could not tell the two apart. The
-/// second module folds the *whole* declared buffer rather than one byte, so the
-/// claim is about the region and not about its first byte.
-#[test]
-fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
-    /// The buffer the guest declares: well over the cap, so the clamp bites.
-    const BUFFER: usize = 4096;
-
-    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
-    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
-    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
-
-    // The status the guest sees, from a module that returns it directly.
-    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
-    assert_eq!(
-        status(&refusing, &host),
-        code(HostError::DataFieldTooLarge),
-        "the value is refused"
-    );
-
-    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
-    // so any byte the host wrote shows up here.
-    let reading = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        &format!(
-            "(local $i i32)
-             (local $seen i32)
-             (drop {call})
-             (loop $l
-               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
-               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
-             (local.get $seen)"
-        ),
-    );
-    assert_eq!(
-        status(&reading, &host),
-        0,
-        "and not one of its bytes is in the guest's buffer"
-    );
-}
-
-/// The field cap is checked before the buffer-fit rule, so a value that breaks both
-/// is reported as over-cap. The guest branches on the code, and the two rules
-/// answer different questions, so the order is worth pinning.
-#[test]
-fn the_field_cap_precedes_the_buffer_fit_check() {
-    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
-
-    // A 63-byte buffer: the value is both over the cap and far too big to fit.
-    let wat = module(
-        &[import::HOME_LE_FIELD, ONE_PAGE],
-        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
-}
-
-// ---------------------------------------------------------------------------
-// Input regions (`Region::read`, via `sha512_half`)
-//
-// `sha512_half`'s first pair is an input region like any other, and it is the
-// input the guest gets a status back from: `trace`, the other reader, answers
-// nothing at all. So the codes are pinned here and the silence below.
-// ---------------------------------------------------------------------------
-
-/// An input region is bounds-checked the same way an output region is. Every case
-/// here stays within the field cap, which on an input is checked first.
-#[test]
-fn an_input_region_running_past_memory_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::PointerOutOfBounds),
-            "ptr {ptr} len {len}"
-        );
-        assert!(host.digested.borrow().is_empty(), "the host is not called");
-    }
-}
-
-#[test]
-fn a_negative_input_pointer_or_length_is_refused() {
-    let host = FakeHost::new();
-
-    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
-        let wat = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
-                                    (i32.const 0) (i32.const {HASH_LEN}))"
-            ),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(HostError::InvalidParams),
-            "ptr {ptr} len {len}"
-        );
-    }
-}
-
-/// The field cap bounds what the guest may hand *in*, too.
-#[test]
-fn an_input_past_the_field_cap_is_refused() {
-    let host = FakeHost::new();
-    let digest = |len: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const 0) (i32.const {len})
-                                    (i32.const 2048) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    assert_eq!(
-        status(&digest(OVER_CAP), &host),
-        code(HostError::DataFieldTooLarge)
-    );
-    assert!(host.digested.borrow().is_empty());
-
-    assert_eq!(
-        status(&digest(CAP), &host),
-        HASH_LEN as i32,
-        "the cap itself is allowed"
-    );
-}
-
-/// The two directions check in opposite orders: an input's length is known before
-/// the read, so the cap comes first, while an output's region has to be resolved
-/// before the host can produce a value, so bounds come first there.
-#[test]
-fn the_field_cap_precedes_the_bounds_check_on_an_input() {
-    let host = FakeHost::new();
-
-    let reading = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {})
-                                (i32.const 0) (i32.const {HASH_LEN}))",
-            PAGE + 1
-        ),
-    );
-    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
-
-    let writing = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
-    );
-    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
-}
-
-// ---------------------------------------------------------------------------
-// The reader with no result (`read_borrowed`, via `trace`)
-// ---------------------------------------------------------------------------
-
-/// `trace` reads two regions and either one being bad refuses the call. The same
-/// rule as above, and the guest is told nothing: the refusal is the host not being
-/// called, and the run carries on to the constant that follows.
-#[test]
-fn both_of_traces_regions_are_checked_silently() {
-    let host = FakeHost::new();
-    let regions = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-            EMPTY_REGION.to_owned(),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 1)"),
-        ),
-        (
-            EMPTY_REGION.to_owned(),
-            format!("(i32.const 0) (i32.const {OVER_CAP})"),
-        ),
-        (
-            "(i32.const -1) (i32.const 1)".to_owned(),
-            EMPTY_REGION.to_owned(),
-        ),
-    ];
-
-    for (msg, data) in regions {
-        let wat = module(
-            &[import::TRACE, ONE_PAGE],
-            &traced(TraceDataType::AsHex, &msg, &data),
-        );
-        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
-        assert!(
-            host.traces().is_empty(),
-            "msg {msg} data {data}: the host must not be called"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Both at once (`write_buffered`, via `sha512_half`)
-// ---------------------------------------------------------------------------
-
-/// A call with an input and an output region decides everything about the input
-/// before anything about the output, so a bad input is reported however the output
-/// region is wrong — out of bounds, or a pointer that is not one at all.
-///
-/// The whole output region, params included, is judged after the host has answered.
-/// Hoisting any part of that above the call would put the output's verdict first for
-/// these cases, and there is no half of it that can be hoisted on a principle the
-/// other half shares.
-#[test]
-fn a_read_write_checks_its_input_before_its_output() {
-    let host = FakeHost::new();
-    let digest = |src: i64, src_len: i64, dst: i64| {
-        module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!(
-                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
-                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
-            ),
-        )
-    };
-
-    let over_cap = digest(0, OVER_CAP, 0);
-    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
-
-    let out_of_bounds = digest(PAGE, 4, 0);
-    assert_eq!(
-        status(&out_of_bounds, &host),
-        code(HostError::PointerOutOfBounds)
-    );
-
-    // A bad input against each way the output can be wrong: the input's verdict is
-    // the one reported, and the host is never asked for a value nobody can take.
-    for dst in [PAGE, -1] {
-        let both_bad = digest(0, OVER_CAP, dst);
-        assert_eq!(
-            status(&both_bad, &host),
-            code(HostError::DataFieldTooLarge),
-            "dst {dst}"
-        );
-    }
-    assert!(host.digested.borrow().is_empty(), "the host is not reached");
-}
-
-/// The output half of a read-write call obeys the same rules as a plain write.
-#[test]
-fn a_read_write_output_obeys_the_write_rules() {
-    let host = FakeHost::new().answering_digest(Answer::filler(32));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
-    );
-    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
-
-    let wat = module(
-        &[import::SHA512_HALF, ONE_PAGE],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// A refused value reaches guest memory in no part, however much of it the host
-/// wrote. The host answers with 32 bytes it did write and a length it did not, so
-/// the refusal happens with the value sitting in the run's output buffer — and the
-/// guest's buffer has to come back untouched.
-///
-/// Stronger than the contract asks for: a guest must not read its buffer on a
-/// negative status. It holds because the buffer is copied to the guest only after
-/// the length, the bounds, the fit and the budget have all passed, so there is no
-/// window in which a refused value is in guest memory.
-#[test]
-fn a_refused_value_leaves_nothing_in_guest_memory() {
-    const MARKER: u8 = 77;
-
-    // The two refusals a value can meet after the host has produced it: longer
-    // than the field cap, and longer than the buffer the guest offered.
-    let refusals = [
-        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
-        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
-    ];
-
-    for (claimed, cap, expected) in refusals {
-        let host =
-            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
-        let call = format!(
-            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
-        );
-
-        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
-        assert_eq!(
-            status(&refused, &host),
-            code(expected),
-            "claiming {claimed}"
-        );
-
-        // The same call, reporting what is at the output region afterwards.
-        let inspect = module(
-            &[import::SHA512_HALF, ONE_PAGE],
-            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
-        );
-        assert_eq!(
-            status(&inspect, &host),
-            0,
-            "claiming {claimed}: the refused value must not have been written"
-        );
-    }
-}
-
-/// An input region may overlap the output region: the host is served the input as
-/// it stands and its answer lands afterwards, so the two cannot interfere. The
-/// marker is any byte distinct from the input's first (`a`), so `finish` returning
-/// it proves the write landed.
-#[test]
-fn an_input_may_overlap_the_output() {
-    const MARKER: u8 = 99;
-
-    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
-
-    let wat = module(
-        &[
-            import::SHA512_HALF,
-            ONE_PAGE,
-            r#"(data (i32.const 0) "abcd")"#,
-        ],
-        &format!(
-            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
-                                      (i32.const 0) (i32.const {HASH_LEN})))
-             (i32.load8_u (i32.const 0))"
-        ),
-    );
-    assert_eq!(
-        status(&wat, &host),
-        i32::from(MARKER),
-        "the output overwrote the input"
-    );
-    assert_eq!(
-        *host.digested.borrow(),
-        vec![b"abcd".to_vec()],
-        "the host saw the input as it was"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The memory export itself
-// ---------------------------------------------------------------------------
-
-/// A host call with no memory to work in ends the run instead of answering the
-/// guest: there is no buffer for a status to describe, and nothing the guest could
-/// do about the answer — which is what puts this beside out-of-gas on the fatal
-/// channel. What the guest burned getting there is still charged.
-fn assert_no_memory(wat: &str, host: &FakeHost) {
-    let failure = failure(wat, host);
-    assert!(
-        matches!(failure.error, RunError::NoMemory),
-        "expected the run to end for want of a memory export, got: {failure}"
-    );
-    assert!(failure.fuel_used > 0, "{failure}");
-}
-
-/// Every region is relative to the guest's exported memory, so a module without
-/// one cannot make a host call at all.
-#[test]
-fn a_module_that_exports_no_memory_cannot_call_the_host() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, "(memory 1)"],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// Having no memory is answered before anything about a call's arguments, so a
-/// module without one ends the run even when its arguments would have earned a
-/// guest-visible code of their own (here an input over the field cap).
-///
-/// The order is deliberate: no memory is a fact about the instance, not about this
-/// call, and a region cannot be validated against a memory that is not there. It
-/// costs the guest nothing — every call such a module makes ends the run anyway.
-#[test]
-fn no_memory_is_answered_before_a_calls_arguments_are() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::SHA512_HALF, "(memory 1)"],
-        &format!(
-            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
-                                (i32.const 0) (i32.const {HASH_LEN}))"
-        ),
-    );
-    assert_no_memory(&wat, &host);
-}
-
-/// The memory's export *name* is not part of the contract: the engine takes the
-/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
-/// to `"memory"` — it is a toolchain convention, so the kind decides.
-#[test]
-fn a_memory_exported_under_any_name_is_the_guests_memory() {
-    let host = FakeHost::new();
-
-    for name in ["mem", "linear", "the memory"] {
-        let wat = module(
-            &[
-                import::LDGR_INDEX,
-                &format!(r#"(memory (export "{name}") 1)"#),
-            ],
-            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-             (i32.load (i32.const 64))",
-        );
-        assert_eq!(
-            status(&wat, &host),
-            7,
-            "the host wrote into the memory exported as '{name}'"
-        );
-    }
-}
-
-/// One memory exported under several names is one memory. The engine resolves the
-/// first export of kind memory, and with at most one memory per module every such
-/// export is that memory, so the order the exports are walked in cannot change the
-/// answer.
-#[test]
-fn one_memory_exported_under_several_names_is_still_that_memory() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
-        ],
-        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
-         (i32.load (i32.const 64))",
-    );
-    assert_eq!(status(&wat, &host), 7);
-}
-
-/// The export has to *be* a memory: a global named `memory` is not one, and it
-/// neither serves as the guest's memory nor hides the memory the module really
-/// exports. The kind decides, so the conventional name carries no weight on
-/// either side.
-#[test]
-fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
-    let host = FakeHost::new();
-
-    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
-
-    let wrong_kind = module(
-        &[
-            import::LDGR_INDEX,
-            "(memory 1)",
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_no_memory(&wrong_kind, &host);
-
-    let shadowed = module(
-        &[
-            import::LDGR_INDEX,
-            r#"(memory (export "mem") 1)"#,
-            r#"(global (export "memory") i32 (i32.const 0))"#,
-        ],
-        call,
-    );
-    assert_eq!(
-        status(&shadowed, &host),
-        4,
-        "the real memory is found past the global that took its name"
-    );
-}
-
-/// Bounds follow the memory the module actually declared, not a fixed page.
-#[test]
-fn bounds_follow_the_declared_memory_size() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
-        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
-    );
-    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
-}
-
-// ---------------------------------------------------------------------------
-// Two output regions (`write_mant_exp`)
-// ---------------------------------------------------------------------------
-
-/// `float_to_mant_exp` is the only call with two output regions, so none of the
-/// single-output rules above reach it.
-#[test]
-fn either_output_region_out_of_bounds_is_refused() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    // Mantissa, then exponent, each as a `(ptr, len)` pair.
-    let cases = [
-        (
-            format!("(i32.const {PAGE}) (i32.const 8)"),
-            "(i32.const 80) (i32.const 4)".to_owned(),
-            HostError::PointerOutOfBounds,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            format!("(i32.const {PAGE}) (i32.const 4)"),
-            HostError::PointerOutOfBounds,
-        ),
-        (
-            "(i32.const -1) (i32.const 8)".to_owned(),
-            "(i32.const 80) (i32.const 4)".to_owned(),
-            HostError::InvalidParams,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            "(i32.const -1) (i32.const 4)".to_owned(),
-            HostError::InvalidParams,
-        ),
-        (
-            "(i32.const 64) (i32.const 8)".to_owned(),
-            "(i32.const 0) (i32.const -1)".to_owned(),
-            HostError::InvalidParams,
-        ),
-    ];
-
-    for (mantissa, exponent, expected) in cases {
-        let wat = module(
-            &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-            &format!("(call $float_to_mant_exp (i32.const 0) (i32.const 8) {mantissa} {exponent})"),
-        );
-        assert_eq!(
-            status(&wat, &host),
-            code(expected),
-            "mantissa {mantissa} exponent {exponent}"
-        );
-    }
-}
-
-/// The mantissa's region is judged first, so a call with both wrong reports its verdict.
-#[test]
-fn the_mantissa_region_is_judged_before_the_exponents() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    // The mantissa is unreachable and the exponent is not a pointer at all; the two
-    // answer differently, which is what makes the order observable here.
-    let wat = module(
-        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-        &format!(
-            "(call $float_to_mant_exp (i32.const 0) (i32.const 8) \
-             (i32.const {PAGE}) (i32.const 8) (i32.const -1) (i32.const 4))"
-        ),
-    );
-    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
-}
-
-/// The two regions are one answer, so a call that cannot place all of it places none.
-#[test]
-fn an_unreachable_exponent_region_leaves_the_mantissa_unwritten() {
-    let host =
-        FakeHost::new().answering_float_mant_exp(vec![1, 2, 3, 4, 5, 6, 7, 8], vec![9, 10, 11, 12]);
-
-    let call = format!(
-        "(call $float_to_mant_exp (i32.const 0) (i32.const 8) \
-         (i32.const 64) (i32.const 8) (i32.const {PAGE}) (i32.const 4))"
-    );
-    let wat = module(
-        &[import::FLOAT_TO_MANT_EXP, ONE_PAGE],
-        &format!("(drop {call})\n    (i32.load8_u (i32.const 64))"),
-    );
-    assert_eq!(status(&wat, &host), 0, "the mantissa region must be clean");
-}

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -1,928 +0,0 @@
-//! What screening refuses, and that it refuses nothing a run would have served.
-//!
-//! `check` reaches its verdict from the compiled module alone, so these tests take
-//! no host — except the ones that put the same module through `run` to compare the
-//! two.
-//!
-//! These screen with `check`, which reports the earliest refusal; the last section
-//! is what `check_all` adds.
-
-mod support;
-
-use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
-use xrpl_host_functions::{HostFunctionSpec, WasmValType};
-use xrpl_wasm_vm::{
-    CheckError, MAX_EXPORTS, MAX_IMPORTS, MAX_MEMORY_PAGES, MAX_NAME_BYTES, MAX_TABLE_ELEMENTS,
-    MAX_TYPES, RunError,
-};
-
-/// Assert which stage screening refused a module at, because the caller maps the
-/// stages separately. The error comes back out for the tests that also read its
-/// message.
-macro_rules! assert_stage {
-    ($refusal:expr, $stage:pat) => {{
-        let refusal = $refusal;
-        assert!(
-            matches!(refusal, $stage),
-            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
-            refusal
-        );
-        refusal
-    }};
-}
-
-/// Screens `wat`, which must assemble.
-fn check(wat: &str) -> Result<(), CheckError> {
-    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
-}
-
-fn refusal(wat: &str) -> CheckError {
-    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
-}
-
-fn passes(wat: &str) {
-    if let Err(refusal) = check(wat) {
-        panic!("expected this module to pass, but: {refusal}\n{wat}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Compiling
-// ---------------------------------------------------------------------------
-
-/// A contract that imports a host function, exports its memory and exports the
-/// entry point is what screening is looking for.
-#[test]
-fn a_runnable_contract_passes() {
-    passes(&module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    ));
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_pass() {
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// Screening takes wasm binaries, and text is not one — the same rule the VM
-/// applies, from the same `wasmi` built without its `wat` feature. Turning that
-/// feature on would make this transaction blob valid at both ends.
-#[test]
-fn a_text_format_module_does_not_pass() {
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let refusal =
-        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
-    assert_stage!(refusal, CheckError::Compile(_));
-
-    // The same module, assembled first, passes: the text is sound and only the
-    // format was refused.
-    passes(&text);
-}
-
-/// A feature the engine disables is refused here too, because both stages compile
-/// against engines built from the same configuration. `vm_limits.rs` walks every
-/// disabled feature; this pins that screening sees that configuration.
-#[test]
-fn a_disabled_feature_does_not_pass() {
-    let refusal = refusal(&module(
-        &[ONE_PAGE],
-        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-}
-
-// ---------------------------------------------------------------------------
-// Section counts and names
-// ---------------------------------------------------------------------------
-
-/// `n` copies of `part`, each given its index through `{i}`.
-fn repeated(part: &str, n: usize) -> String {
-    (0..n)
-        .map(|i| part.replace("{i}", &i.to_string()))
-        .collect::<Vec<_>>()
-        .join("\n  ")
-}
-
-/// A count at its cap passes and one past it is refused as a limit, not as a module
-/// that fails to compile — and by a run too, since both go through the same scan
-/// ahead of `Module::new`.
-fn assert_capped(at_cap: &str, past_cap: &str, needle: &str) {
-    passes(at_cap);
-
-    let refusal = assert_stage!(refusal(past_cap), CheckError::Limit(_)).to_string();
-    assert!(refusal.starts_with("limit: "), "{refusal}");
-    assert!(refusal.contains(needle), "{refusal}");
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(past_cap), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a module past a section cap must not run");
-    assert!(matches!(failure.error, RunError::Limit(_)), "{failure}");
-    assert_eq!(failure.fuel_used, 0, "{failure}");
-}
-
-#[test]
-fn the_type_section_is_capped() {
-    let types = |n| module(&[&repeated("(type (func))", n), ONE_PAGE], "(i32.const 0)");
-    // The entry point's own `() -> i32` is one more type.
-    let cap = MAX_TYPES as usize - 1;
-    assert_capped(&types(cap), &types(cap + 1), "type entries");
-}
-
-/// Importing one host function under many ids is legal wasm, so the count is
-/// reachable without the ABI having that many functions.
-#[test]
-fn the_import_section_is_capped() {
-    let imports = |n| {
-        let import =
-            r#"(import "host_lib" "ldgr_index" (func $f{i} (param i32 i32) (result i32)))"#;
-        module(&[&repeated(import, n), ONE_PAGE], "(i32.const 0)")
-    };
-    let cap = MAX_IMPORTS as usize;
-    assert_capped(&imports(cap), &imports(cap + 1), "import entries");
-}
-
-#[test]
-fn the_export_section_is_capped() {
-    let exports = |n| {
-        module(
-            &[
-                &repeated(r#"(global (export "g{i}") i32 (i32.const 0))"#, n),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        )
-    };
-    // The entry point and the memory are two more exports.
-    let cap = MAX_EXPORTS as usize - 2;
-    assert_capped(&exports(cap), &exports(cap + 1), "export entries");
-}
-
-#[test]
-fn an_export_name_is_capped() {
-    let named = |len| {
-        let name = "e".repeat(len);
-        module(
-            &[
-                &format!(r#"(global (export "{name}") i32 (i32.const 0))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        )
-    };
-    assert_capped(
-        &named(MAX_NAME_BYTES),
-        &named(MAX_NAME_BYTES + 1),
-        "export name",
-    );
-}
-
-/// Both halves of an import's name are capped. Past the cap is refused as a limit,
-/// ahead of the import rules that would otherwise refuse the unknown name.
-#[test]
-fn an_import_name_is_capped() {
-    let long = "i".repeat(MAX_NAME_BYTES + 1);
-    for (wat, needle) in [
-        (
-            module(
-                &[
-                    &format!(r#"(import "{long}" "ldgr_index" (func))"#),
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-            "import module name",
-        ),
-        (
-            module(
-                &[&format!(r#"(import "host_lib" "{long}" (func))"#), ONE_PAGE],
-                "(i32.const 0)",
-            ),
-            "import name",
-        ),
-    ] {
-        let refusal = assert_stage!(refusal(&wat), CheckError::Limit(_)).to_string();
-        assert!(refusal.contains(needle), "{refusal}");
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// Every host function the ABI declares, spelled as a guest imports it, full
-/// signatures and hand-written. The count is asserted against the ABI so a
-/// function added to it cannot be left out here.
-///
-/// Hand-written is the point: these are a statement of the wire the ABI's derived
-/// table did not produce, so putting them through `check` compares the two rather
-/// than comparing the table with itself.
-const ALL_IMPORTS: [&str; 63] = [
-    import::LDGR_INDEX,
-    import::PARENT_LDGR_TIME,
-    import::PARENT_LDGR_HASH,
-    import::BASE_FEE,
-    import::AMENDMENT_ENABLED,
-    import::CACHE_LE,
-    import::TX_FIELD,
-    import::HOME_LE_FIELD,
-    import::LE_FIELD,
-    import::TX_INNER,
-    import::HOME_LE_INNER,
-    import::LE_INNER,
-    import::TX_ARR_LEN,
-    import::HOME_LE_ARR_LEN,
-    import::LE_ARR_LEN,
-    import::TX_INNER_ARR_LEN,
-    import::HOME_LE_INNER_ARR_LEN,
-    import::LE_INNER_ARR_LEN,
-    import::CHECK_SIG,
-    import::ACCOUNTROOT_ID,
-    import::AMM_ID,
-    import::CHECK_ID,
-    import::CREDENTIAL_ID,
-    import::DELEGATE_ID,
-    import::DEPOSIT_PREAUTH_ID,
-    import::DID_ID,
-    import::ESCROW_ID,
-    import::TRUSTLINE_ID,
-    import::MPT_ISSUANCE_ID,
-    import::MPTOKEN_ID,
-    import::NFT_OFFER_ID,
-    import::OFFER_ID,
-    import::ORACLE_ID,
-    import::PAYCHAN_ID,
-    import::PERMISSIONED_DOMAIN_ID,
-    import::SIGNERS_ID,
-    import::TICKET_ID,
-    import::VAULT_ID,
-    import::SPONSORSHIP_ID,
-    import::LOAN_BROKER_ID,
-    import::LOAN_ID,
-    import::SHA512_HALF,
-    import::TRACE,
-    import::SET_DATA,
-    import::NFT_URI,
-    import::NFT_ISSUER,
-    import::NFT_TAXON,
-    import::NFT_FLAGS,
-    import::NFT_XFER_FEE,
-    import::NFT_SERIAL,
-    import::FLOAT_FROM_INT,
-    import::FLOAT_FROM_UINT,
-    import::FLOAT_FROM_STAMOUNT,
-    import::FLOAT_FROM_STNUMBER,
-    import::FLOAT_TO_INT,
-    import::FLOAT_TO_MANT_EXP,
-    import::FLOAT_FROM_MANT_EXP,
-    import::FLOAT_CMP,
-    import::FLOAT_ADD,
-    import::FLOAT_SUB,
-    import::FLOAT_MULT,
-    import::FLOAT_DIV,
-    import::FLOAT_POW,
-];
-
-#[test]
-fn every_declared_host_function_may_be_imported() {
-    assert_eq!(
-        ALL_IMPORTS.len(),
-        HostFunctionSpec::ALL.len(),
-        "the ABI gained a host function with no import declaration in this test"
-    );
-
-    let mut parts = ALL_IMPORTS.to_vec();
-    parts.push(ONE_PAGE);
-    passes(&module(&parts, "(i32.const 0)"));
-}
-
-/// A module may import fewer host functions than are registered, but not more.
-#[test]
-fn an_unknown_host_function_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("no host function 'no_such_function'"),
-        "{refusal}"
-    );
-}
-
-/// Host functions live under one module name — `host_lib` — and an import naming
-/// another is refused even when the function name is real. `env` is in the list
-/// because that is what plain clang emits.
-#[test]
-fn an_import_from_another_module_does_not_pass() {
-    for module_name in ["host", "env", ""] {
-        let refusal = refusal(&module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        ));
-        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
-    }
-}
-
-/// A host function's name imported as something other than a function. The engine
-/// defines it as a function and nothing else, so this does not link either.
-#[test]
-fn a_host_function_imported_as_a_global_does_not_pass() {
-    let refusal = refusal(&module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
-            ONE_PAGE,
-        ],
-        "(global.get $g)",
-    ));
-    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
-    assert!(
-        refusal.contains("'host_lib::ldgr_index' is not a function"),
-        "{refusal}"
-    );
-}
-
-/// A module faulty at two stages is refused by the earlier one — it imports what no
-/// engine serves *and* exports no entry point. The imports are what the rest of the
-/// module depends on, so that is the message worth having.
-#[test]
-fn the_earlier_stage_is_the_one_reported() {
-    let refusal = refusal(
-        r#"(module
-             (import "host_lib" "no_such_function" (func $f (result i32)))
-             (memory (export "memory") 1)
-             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
-    );
-
-    assert_stage!(refusal, CheckError::Import(_));
-}
-
-/// An import naming a real host function with the wrong type is refused, at a
-/// stage of its own since the ABI does have the function the guest asked for.
-///
-/// The run half is what the refusal is worth: without it this module reaches the
-/// engine and parts from the linker at instantiation, which is a fault a node
-/// discovers rather than one a transaction is turned away for.
-#[test]
-fn an_import_with_the_wrong_signature_does_not_pass() {
-    let wat = module(
-        &[
-            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(i32.const 0)",
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Signature(_)).to_string();
-    assert_eq!(
-        refusal,
-        "signature: 'ldgr_index' expected '(i32, i32) -> i32', found '(i64, i64) -> i32'"
-    );
-
-    let host = FakeHost::new();
-    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
-        .expect_err("a mistyped import must not link");
-    assert!(
-        matches!(failure.error, RunError::Instantiate(_)),
-        "{failure}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1)
-                              (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "no entry point 'finish'");
-}
-
-/// The entry point is looked up by the name the caller asks for, as a run looks it
-/// up: screening a contract for one entry point says nothing about another.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let wasm = assemble(
-        r#"(module (memory (export "memory") 1)
-             (func (export "other") (result i32) (i32.const 0)))"#,
-    );
-
-    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
-    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
-}
-
-/// Both halves of the entry point's type are screened: a module returning the
-/// wrong thing, or taking anything at all, would fail the run's typed lookup.
-#[test]
-fn an_entry_point_of_the_wrong_type_does_not_pass() {
-    for (signature, body) in [
-        ("(result i64)", "(i64.const 0)"),
-        ("(param i32) (result i32)", "(i32.const 0)"),
-        ("", "(nop)"),
-    ] {
-        let refusal = refusal(&format!(
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") {signature} {body}))"#
-        ));
-        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-        assert_eq!(
-            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
-            "{signature}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_does_not_pass() {
-    let refusal = refusal(
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
-    );
-    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
-    assert_eq!(refusal, "export 'finish' is not a function");
-}
-
-// ---------------------------------------------------------------------------
-// Agreement with a run
-// ---------------------------------------------------------------------------
-
-/// A module with no linear memory to export passes. A contract that makes no host
-/// call needs none, and one that does is refused at the call and charged — a
-/// runtime fault, not a malformed module.
-#[test]
-fn a_module_exporting_no_memory_passes() {
-    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
-    passes(wat);
-
-    let host = FakeHost::new();
-    assert_eq!(
-        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
-            .expect("a module that calls no host function needs no memory")
-            .result,
-        0
-    );
-}
-
-/// Modules spanning what screening decides, each also put through a run.
-fn modules() -> Vec<(&'static str, String)> {
-    vec![
-        (
-            "a runnable contract",
-            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
-        ),
-        (
-            "a contract that traps",
-            module(&[ONE_PAGE], "(unreachable)"),
-        ),
-        (
-            "a disabled feature",
-            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
-        ),
-        (
-            "an unknown host function",
-            module(
-                &[
-                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(call $f)",
-            ),
-        ),
-        (
-            "an import from another module",
-            module(
-                &[
-                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "a host function imported as a global",
-            module(
-                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
-                "(global.get $g)",
-            ),
-        ),
-        (
-            "an import with the wrong signature",
-            module(
-                &[
-                    r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
-                    ONE_PAGE,
-                ],
-                "(i32.const 0)",
-            ),
-        ),
-        (
-            "no entry point",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "other") (result i32) (i32.const 0)))"#
-                .to_string(),
-        ),
-        (
-            "an entry point of the wrong type",
-            r#"(module (memory (export "memory") 1)
-                 (func (export "finish") (result i64) (i64.const 0)))"#
-                .to_string(),
-        ),
-    ]
-}
-
-/// Screening refuses a module exactly when a run would refuse it at one of the
-/// stages screening covers — nothing it rejects would have run, and nothing
-/// it passes stops before the entry point is called.
-#[test]
-fn screening_and_a_run_agree() {
-    let host = FakeHost::new();
-
-    for (label, wat) in modules() {
-        let wasm = assemble(&wat);
-        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => matches!(
-                failure.error,
-                RunError::Compile(_)
-                    | RunError::Limit(_)
-                    | RunError::Instantiate(_)
-                    | RunError::EntryPoint(_)
-            ),
-            Ok(_) => false,
-        };
-
-        assert_eq!(
-            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
-            refused_early,
-            "{label}"
-        );
-    }
-}
-
-/// The signatures screening derives are the ones the linker registers: a module
-/// importing all 60 host functions at the type `HostFunctionSpec` derives must
-/// instantiate.
-///
-/// Unlike [`ALL_IMPORTS`], the other side of this is live code — the registration
-/// as it is rather than a description of it — so it is what a changed engine has to
-/// answer to. **What it cannot see is the table and the linker being wrong the same
-/// way**, the closures being generated from this very table; that is what
-/// [`ALL_IMPORTS`] and `generated_abi.rs`'s 60 literals are for.
-#[test]
-fn the_derived_signatures_are_what_the_linker_registers() {
-    let declarations: Vec<String> = HostFunctionSpec::ALL
-        .iter()
-        .copied()
-        .map(derived_import)
-        .collect();
-    let mut parts: Vec<&str> = declarations.iter().map(String::as_str).collect();
-    parts.push(ONE_PAGE);
-
-    let host = FakeHost::new();
-    let wasm = assemble(&module(&parts, "(i32.const 0)"));
-    let outcome = xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY)
-        .expect("every import built from the ABI's table must link");
-
-    assert_eq!(outcome.result, 0);
-}
-
-/// One `(import …)` declaration, spelled out of the ABI's derived signature rather
-/// than by hand — the opposite of [`ALL_IMPORTS`].
-fn derived_import(function: HostFunctionSpec) -> String {
-    let types: Vec<&str> = function
-        .wasm_params()
-        .iter()
-        .copied()
-        .map(spelled)
-        .collect();
-    let params = match types.as_slice() {
-        [] => String::new(),
-        types => format!(" (param {})", types.join(" ")),
-    };
-    let result = match function.wasm_result() {
-        Some(result) => format!(" (result {})", spelled(result)),
-        None => String::new(),
-    };
-
-    format!(
-        r#"(import "host_lib" "{}" (func{params}{result}))"#,
-        function.wasm_name()
-    )
-}
-
-fn spelled(declared: WasmValType) -> &'static str {
-    match declared {
-        WasmValType::I32 => "i32",
-        WasmValType::I64 => "i64",
-    }
-}
-
-/// A module asking for more memory than the engine grants is refused, so the
-/// contract that could never run does not reach the ledger. The cap itself passes.
-#[test]
-fn an_exported_memory_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
-    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    ));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, so screening
-/// must not turn it away: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(memory (export "memory") 1 {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// A module asking for more table than the engine grants is refused for the same
-/// reason a memory is. The cap itself passes.
-#[test]
-fn an_exported_table_past_the_cap_does_not_pass() {
-    let wat = module(
-        &[&format!(
-            r#"(table (export "t") {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    );
-    let refusal = assert_stage!(refusal(&wat), CheckError::Table(_)).to_string();
-    assert!(refusal.contains("past the 1024-element cap"), "{refusal}");
-
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") {MAX_TABLE_ELEMENTS} funcref)"#
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// Both caps are applied in one pass over the declarations, so neither may end the walk
-/// early: a passing memory must not hide a failing table declared after it, and a
-/// passing table must not hide a failing memory.
-#[test]
-fn one_pass_screens_both_resources() {
-    let after_a_passing_memory = refusal(&module(
-        &[
-            ONE_PAGE,
-            &format!(r#"(table (export "t") {} funcref)"#, MAX_TABLE_ELEMENTS + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_memory, CheckError::Table(_));
-
-    let after_a_passing_table = refusal(&module(
-        &[
-            r#"(table (export "t") 1 funcref)"#,
-            &format!(r#"(memory (export "memory") {})"#, MAX_MEMORY_PAGES + 1),
-        ],
-        "(i32.const 0)",
-    ));
-    assert_stage!(after_a_passing_table, CheckError::Memory(_));
-}
-
-/// As with memory, a declared *maximum* past the cap is unreachable rather than
-/// wrong: `vm_limits` runs this very module to completion.
-#[test]
-fn a_declared_table_maximum_past_the_cap_still_passes() {
-    passes(&module(
-        &[&format!(
-            r#"(table (export "t") 1 {} funcref)"#,
-            MAX_TABLE_ELEMENTS + 1
-        )],
-        "(i32.const 0)",
-    ));
-}
-
-/// A memory or a table the module keeps to itself is screened as an exported one
-/// is: the caps read the module's declarations, not its exports. The table row is the
-/// one that matters — Rust exports `__indirect_function_table` only under
-/// `--export-table`, so unexported is a table's normal shape, and a contract with
-/// more indirect-call targets than the cap would otherwise reach the ledger and fail
-/// every finish.
-///
-/// The store's limiter still refuses both at instantiation, for a module that
-/// reaches a run unscreened.
-#[test]
-fn a_memory_or_table_kept_to_itself_is_still_screened() {
-    let private = |declaration: String| {
-        format!(
-            r#"(module {declaration}
-                 (func (export "finish") (result i32) (i32.const 0)))"#
-        )
-    };
-    let memory = private(format!("(memory {})", MAX_MEMORY_PAGES + 1));
-    let table = private(format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1));
-
-    assert_stage!(refusal(&memory), CheckError::Memory(_));
-    assert_stage!(refusal(&table), CheckError::Table(_));
-
-    let host = FakeHost::new();
-    for (label, wat) in [("memory", &memory), ("table", &table)] {
-        let failure = match xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY) {
-            Err(failure) => failure,
-            Ok(outcome) => panic!(
-                "the store's limiter must refuse the {label}, but the module returned {}",
-                outcome.result
-            ),
-        };
-        assert!(
-            matches!(failure.error, RunError::Instantiate(_)),
-            "{label}: {failure}"
-        );
-    }
-}
-
-/// A start section runs guest code at instantiation, before the entry point. The
-/// engine disallows it, so screening refuses the module outright rather than letting
-/// any code run ahead of the entry point.
-#[test]
-fn a_start_section_is_refused_by_screening() {
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-
-    let refusal = assert_stage!(refusal(&wat), CheckError::Compile(_)).to_string();
-    assert!(refusal.contains("start"), "{refusal}");
-}
-
-#[test]
-fn a_memory64_memory_is_refused_by_screening() {
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let refusal = assert_stage!(refusal(wat), CheckError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("memory64") || refusal.contains("i64"),
-        "{refusal}"
-    );
-}
-
-/// The corruption fixtures below are written as hex strings, which is how the old Beast suite
-/// carried them — the bytes are deliberately malformed, so there is nothing to assemble them
-/// from.
-fn hex(s: &str) -> Vec<u8> {
-    (0..s.len())
-        .step_by(2)
-        .map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap())
-        .collect()
-}
-
-/// Malformed modules crafted to abuse the parser rather than merely be invalid — a vector
-/// length that lies about its size, a section that overruns its payload, a locals-count bomb,
-/// and a non-terminating LEB128 — are refused before they reach the ledger. These guard
-/// the parser against resource-exhaustion shapes (ported from the old Beast section-corruption
-/// fixtures); the plainer "bad magic / wrong version" shapes are covered by `garbage_does_not_pass`.
-///
-/// The lying vector length is a type section claiming `u32::MAX` entries, which the
-/// section-count scan reads from the header before anything notices the entries are not
-/// there — so it is refused as a limit, the deliberate shape it is. The rest fail to parse
-/// at all, and are refused at compile like any other garbage.
-#[test]
-fn parser_abuse_shapes_are_refused() {
-    let lying_length = xrpl_wasm_vm::check(&hex("0061736d010000000105ffffffff0f"), ENTRY)
-        .expect_err("vector length lies");
-    assert_stage!(lying_length, CheckError::Limit(_));
-
-    let cases = [
-        ("section overruns its payload", "0061736d01000000010a0160"),
-        (
-            "locals-count bomb",
-            "0061736d01000000010401600000030201000a0f010d01ffffffff0f7f0b",
-        ),
-        (
-            "non-terminating LEB128",
-            "0061736d0100000001058080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080",
-        ),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-/// The plain structurally-malformed modules from the old section-corruption fixtures — a
-/// corrupt magic, a wrong version, a lying section length, sections out of order, junk after
-/// the last section, an unknown section id — are all refused at compile. Belt-and-suspenders
-/// alongside `garbage_does_not_pass`: guards against a wasmi upgrade loosening the validator.
-#[test]
-fn structurally_malformed_modules_are_refused() {
-    let cases = [
-        ("corrupt magic number", "0161736d01000000"),
-        ("wrong version", "0061736d02000000"),
-        ("lying section length", "0061736d01000000018080808008"),
-        ("sections out of order", "0061736d010000000a02000b03020000"),
-        (
-            "junk after last section",
-            "0061736d01000000010a01600000000000000000",
-        ),
-        ("unknown section id", "0061736d01000000ff0100"),
-    ];
-    for (label, h) in cases {
-        let refusal = xrpl_wasm_vm::check(&hex(h), ENTRY).expect_err(label);
-        assert_stage!(refusal, CheckError::Compile(_));
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Reporting every refusal
-// ---------------------------------------------------------------------------
-
-/// A module that breaks every rule past compiling, once each.
-fn a_module_faulting_at_every_stage() -> String {
-    format!(
-        r#"(module
-             (import "host_lib" "no_such_function" (func (param i32) (result i32)))
-             (import "host_lib" "ldgr_index" (func (param i64 i64) (result i32)))
-             (memory (export "memory") {pages})
-             (table (export "t") {elements} funcref)
-             (func (export "{ENTRY}") (result i64) (i64.const 0)))"#,
-        pages = MAX_MEMORY_PAGES + 1,
-        elements = MAX_TABLE_ELEMENTS + 1,
-    )
-}
-
-#[test]
-fn check_all_reports_a_refusal_from_every_stage() {
-    let refusals = xrpl_wasm_vm::check_all(&assemble(&a_module_faulting_at_every_stage()), ENTRY)
-        .expect_err("this module breaks every rule past compiling");
-
-    assert!(
-        matches!(
-            refusals.as_slice(),
-            [
-                CheckError::Import(_),
-                CheckError::Signature(_),
-                CheckError::EntryPoint(_),
-                // Section order, not declaration order: the table section precedes
-                // the memory section in the binary.
-                CheckError::Table(_),
-                CheckError::Memory(_),
-            ]
-        ),
-        "{refusals:?}"
-    );
-}
-
-/// What lets the consensus path keep fail-fast without a second implementation of
-/// the stage order to drift from.
-#[test]
-fn check_reports_what_check_all_reports_first() {
-    let wasm = assemble(&a_module_faulting_at_every_stage());
-
-    let first = xrpl_wasm_vm::check(&wasm, ENTRY).expect_err("five faults");
-    let all = xrpl_wasm_vm::check_all(&wasm, ENTRY).expect_err("five faults");
-
-    assert_eq!(first.to_string(), all[0].to_string());
-}
-
-/// Nothing to report is `Ok`, never an empty `Vec`.
-#[test]
-fn check_all_passes_a_runnable_contract() {
-    let wat = module(
-        &[import::LDGR_INDEX, ONE_PAGE],
-        "(call $ldgr_index (i32.const 0) (i32.const 4))",
-    );
-
-    if let Err(refusals) = xrpl_wasm_vm::check_all(&assemble(&wat), ENTRY) {
-        panic!("expected this module to pass, but: {refusals:?}\n{wat}");
-    }
-}

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -1,737 +0,0 @@
-//! What the engine refuses outright: modules it will not compile, will not
-//! instantiate, or cannot find an entry point in — plus the memory and table caps.
-//!
-//! These are the sandbox's outer wall. Everything here fails the run rather than
-//! returning a code to the guest, so each test reads the failure's message.
-
-mod support;
-
-use support::{
-    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
-};
-use xrpl_wasm_vm::{MAX_MEMORY_PAGES, MAX_TABLE_ELEMENTS, RunError};
-
-/// Assert which stage a run failed at, because the caller maps the stages to
-/// different outcomes. A stage is one `RunError` variant, so the expectation is a
-/// pattern; the failure comes back out for the tests that also read its message.
-macro_rules! assert_stage {
-    ($failure:expr, $stage:pat) => {{
-        let failure = $failure;
-        assert!(
-            matches!(failure.error, $stage),
-            concat!("expected a ", stringify!($stage), " failure, got: {}"),
-            failure
-        );
-        failure
-    }};
-}
-
-// ---------------------------------------------------------------------------
-// Linear memory
-// ---------------------------------------------------------------------------
-
-/// A module declaring more than the cap fails to instantiate — the limit applies
-/// to the initial memory, not only to growth.
-#[test]
-fn an_initial_memory_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            r#"(memory (export "memory") {})"#,
-            MAX_MEMORY_PAGES + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_memory_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
-/// `memory.grow` otherwise would, because the engine's limiter sets
-/// `trap_on_grow_failure(true)`.
-#[test]
-fn growth_stops_at_the_cap() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
-    );
-    assert_eq!(
-        run(&wat, &host).expect("should run").result,
-        1,
-        "growing to exactly the cap answers the previous size"
-    );
-
-    let wat = module(
-        &[ONE_PAGE],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// A module may declare a maximum above the cap: the cap is enforced on the initial
-/// memory and on growth, not on the memory type's declared bound.
-#[test]
-fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
-
-    let wat = module(&[&memory], "(i32.const 0)");
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    let wat = module(
-        &[&memory],
-        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-// ---------------------------------------------------------------------------
-// Tables
-// ---------------------------------------------------------------------------
-
-/// A table's whole cost is paid at instantiation: wasmi writes all 8 bytes of every
-/// element before the guest's first instruction, so a module declaring more than the
-/// cap must be refused there rather than charged for it.
-#[test]
-fn an_initial_table_past_the_cap_is_refused() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", MAX_TABLE_ELEMENTS + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// The cap itself is allowed.
-#[test]
-fn an_initial_table_at_the_cap_is_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {MAX_TABLE_ELEMENTS} funcref)")],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-/// The cap binds a table the module keeps to itself, which is the case that matters:
-/// a contract has no reason to export its table. Screening refuses this module too;
-/// the limiter is what stops one that reaches a run unscreened.
-#[test]
-fn the_table_cap_binds_an_unexported_table() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!("(table {} funcref)", u32::from(u16::MAX) * 100)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// A declared *maximum* past the cap is legal and simply unreachable, mirroring what
-/// linear memory allows. Nothing can reach it: `table.grow` is a reference-types
-/// instruction and the engine turns that feature off, so a table's declared minimum
-/// is also its final size.
-#[test]
-fn a_declared_table_maximum_past_the_cap_is_allowed_but_unreachable() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[&format!(
-            "(table 1 {} funcref)",
-            u64::try_from(MAX_TABLE_ELEMENTS).expect("fits") + 1
-        )],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Engine configuration
-// ---------------------------------------------------------------------------
-
-/// One row per feature `wasm_engine` turns off: the smallest module that uses
-/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
-/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
-/// instead — except `wasm_multi_memory`, where two memories are the point and one
-/// of them has to be imported to reach the feature check at all.
-fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
-    vec![
-        (
-            "wasm_multi_value",
-            vec![
-                ONE_PAGE,
-                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
-            ],
-            "(call $two) (drop) (drop) (i32.const 0)",
-            "multi-value",
-        ),
-        (
-            "wasm_sign_extension",
-            vec![ONE_PAGE],
-            "(i32.extend8_s (i32.const 1))",
-            "sign extension",
-        ),
-        (
-            "wasm_bulk_memory",
-            vec![ONE_PAGE],
-            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
-            "bulk memory",
-        ),
-        (
-            "wasm_reference_types",
-            vec![ONE_PAGE, "(table 1 externref)"],
-            "(i32.const 0)",
-            "reference types",
-        ),
-        // The proposal covers mutable globals crossing the module boundary; an
-        // internal one is core wasm and stays allowed — see the test below.
-        (
-            "wasm_mutable_global",
-            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
-            "(i32.const 0)",
-            "mutable global",
-        ),
-        (
-            "wasm_tail_call",
-            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
-            "(return_call $f)",
-            "tail call",
-        ),
-        // Arithmetic in a constant initialiser. wasmi names the operator rather
-        // than the proposal here.
-        (
-            "wasm_extended_const",
-            vec![
-                ONE_PAGE,
-                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
-            ],
-            "(global.get $g)",
-            "non-constant operator",
-        ),
-        // One memory imported, one defined. `EnforcedLimits::strict()` caps memories
-        // at one and checks the memory *section* before the validator sees it
-        // (`module/parser/mod.rs`, `process_memories`), so two *defined* memories are
-        // refused for exceeding the cap and never reach the feature check. An import
-        // is not in that section, so this is the shape that names the proposal.
-        (
-            "wasm_multi_memory",
-            vec![r#"(import "host_lib" "mem" (memory 1))"#, ONE_PAGE],
-            "(i32.const 0)",
-            "multiple memories",
-        ),
-        (
-            "wasm_memory64",
-            vec![r#"(memory (export "memory") i64 1)"#],
-            "(i32.const 0)",
-            "memory64",
-        ),
-        (
-            "wasm_custom_page_sizes",
-            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
-            "(i32.const 0)",
-            "custom page sizes",
-        ),
-        (
-            "wasm_wide_arithmetic",
-            vec![ONE_PAGE],
-            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
-             (i32.const 0)",
-            "wide arithmetic",
-        ),
-        // Determinism across nodes is the reason floats are off.
-        (
-            "floats",
-            vec![ONE_PAGE],
-            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
-            "floating-point",
-        ),
-    ]
-}
-
-/// Every feature the engine disables is refused, and refused for that reason.
-///
-/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
-/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
-/// default rather than against this engine's own config.
-#[test]
-fn every_disabled_feature_is_refused_by_name() {
-    let host = FakeHost::new();
-
-    for (knob, parts, body, expected) in disabled_features() {
-        let wat = module(&parts, body);
-        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-
-        assert!(
-            failure.contains(expected),
-            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
-        );
-    }
-}
-
-/// The knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
-/// configuration is the same for every engine `wasm_engine` builds, so a test
-/// observes the one `wasm_engine` makes: a knob masked by another, or with no
-/// caller-visible effect, has no distinguishing module.
-#[test]
-fn the_knobs_without_a_module_of_their_own() {
-    let host = FakeHost::new();
-
-    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
-    // float operand, so `floats(false)` refuses it first, as the message shows.
-    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
-    let refusal = failure(&wat, &host).to_string();
-    assert!(refusal.contains("floating-point"), "{refusal}");
-    assert!(!refusal.contains("saturating"), "{refusal}");
-
-    // `EnforcedLimits::strict()`'s `max_memories: Some(1)`, which masks
-    // `wasm_multi_memory(false)` for every module that defines its two memories
-    // rather than importing one — the case a real contract would hit. The feature
-    // flag itself is covered by name in [`disabled_features`].
-    let wat = module(&[ONE_PAGE, "(memory 1)"], "(i32.const 0)");
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 1 memories"), "{refusal}");
-
-    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
-    // sections, not accept/reject, so this pins only that one is harmless.
-    let wat = module(
-        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-
-    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
-    // before instantiating, so every test in the suite fails.
-    let wat = module(&[ONE_PAGE], "(i32.const 0)");
-    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
-}
-
-/// A mutable global the module keeps to itself is core wasm, so the disabled
-/// proposal does not reach it: a guest can still have mutable state.
-#[test]
-fn an_internal_mutable_global_is_still_allowed() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
-        "(global.set $g (i32.const 7)) (global.get $g)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 7);
-}
-
-/// Bytes that are not a wasm module at all.
-#[test]
-fn garbage_does_not_compile() {
-    let host = FakeHost::new();
-
-    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
-        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
-            .expect_err("garbage must not compile");
-        assert_stage!(failure, RunError::Compile(_));
-    }
-}
-
-/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
-/// default and would have `Module::new` assemble text too, so the crate builds
-/// wasmi without it; turning it back on would make this transaction blob valid.
-#[test]
-fn the_vm_refuses_a_text_format_module() {
-    let host = FakeHost::new();
-    let text = module(&[ONE_PAGE], "(i32.const 0)");
-
-    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
-        .expect_err("text must not compile as a module");
-    assert_stage!(failure, RunError::Compile(_));
-
-    // The same module, assembled first, runs: the text is sound and only the
-    // format was refused.
-    assert_eq!(run(&text, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// Imports
-// ---------------------------------------------------------------------------
-
-/// A module may import fewer host functions than are registered, but not more:
-/// an import the linker does not define fails instantiation.
-#[test]
-fn an_unknown_import_fails_instantiation() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f (i32.const 0))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-/// Host functions are registered under one module name — `host_lib`, the name the
-/// guest SDK and this repo's fixtures import from — and a guest naming a different
-/// one does not link. `env` is in the list because that is what plain clang emits.
-#[test]
-fn the_import_module_name_must_match() {
-    let host = FakeHost::new();
-
-    for module_name in ["host", "env", ""] {
-        let wat = module(
-            &[
-                &format!(
-                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
-                ),
-                ONE_PAGE,
-            ],
-            "(call $f (i32.const 0) (i32.const 4))",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// An import spelled with the wrong signature does not link even under the right
-/// name, which is what makes the registered signatures load-bearing.
-#[test]
-fn an_import_with_the_wrong_signature_fails_instantiation() {
-    let host = FakeHost::new();
-
-    for signature in [
-        "(param i32) (result i32)",         // too few parameters
-        "(param i32 i32 i32) (result i32)", // too many
-        "(param i64 i64) (result i32)",     // wrong parameter types
-        "(param i32 i32) (result i64)",     // wrong result type
-        "(param i32 i32)",                  // no result
-    ] {
-        let wat = module(
-            &[
-                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
-                ONE_PAGE,
-            ],
-            "(i32.const 0)",
-        );
-        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-    }
-}
-
-/// A module that imports a host function it never calls still has to link.
-#[test]
-fn an_unused_import_is_still_linked() {
-    let host = FakeHost::new();
-
-    let wat = module(
-        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
-        "(i32.const 0)",
-    );
-    assert_eq!(run(&wat, &host).expect("should run").result, 0);
-}
-
-// ---------------------------------------------------------------------------
-// The start section
-// ---------------------------------------------------------------------------
-
-/// The engine disallows start sections, so a module carrying one is rejected at
-/// compile and never runs. No guest code executes ahead of the entry point, whatever
-/// that code would have done — trap, loop, or call the host — so nothing is metered
-/// and no fuel is burned. Screening catches the same module up front
-/// (`preflight::a_start_section_is_refused_by_screening`); this pins that `run`
-/// refuses it the same way rather than instantiating it.
-#[test]
-fn a_start_section_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-
-    let wat = format!(
-        r#"(module {ONE_PAGE}
-             (func $init (unreachable))
-             (start $init)
-             (func (export "finish") (result i32) (i32.const 0)))"#
-    );
-    let failure = assert_stage!(
-        run_with_gas(&wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module with a start section must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "no guest code runs, so nothing is charged: {failure}"
-    );
-}
-
-/// What `RunError::Instantiate` is left to mean: a module the linker or the store
-/// would not accept, rather than one whose guest code failed. Its two shapes, so the
-/// variant is not left standing for nothing.
-#[test]
-fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
-    let host = FakeHost::new();
-
-    // The linker defines no such import.
-    let wat = module(
-        &[
-            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
-            ONE_PAGE,
-        ],
-        "(call $f)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-
-    // The store's limiter will not grant the memory, and does not trap to say so.
-    let wat = module(
-        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
-        "(i32.const 0)",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
-}
-
-// ---------------------------------------------------------------------------
-// The entry point
-// ---------------------------------------------------------------------------
-
-#[test]
-fn a_missing_entry_point_fails() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module without the entry point must not run"),
-        RunError::EntryPoint(_)
-    );
-    assert!(
-        failure.to_string().contains("no entry point 'finish'"),
-        "{failure}"
-    );
-}
-
-/// The entry point is looked up by the name the caller asks for.
-#[test]
-fn the_entry_point_is_the_name_the_caller_gives() {
-    let host = FakeHost::new();
-
-    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
-    let outcome = run_entry(wat, &host, "other").expect("should run");
-    assert_eq!(outcome.result, 9);
-}
-
-/// The entry point must take nothing and return an `i32`. A module that exports the
-/// name with another signature is told so, rather than being told the export is
-/// missing: wasmi answers both cases with one error, and "no entry point" would send
-/// a contract author looking for a function they already have.
-#[test]
-fn an_entry_point_of_the_wrong_type_fails() {
-    let host = FakeHost::new();
-
-    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
-        let body = if signature.contains("result i64") {
-            "(i64.const 0)"
-        } else if signature.is_empty() {
-            "(nop)"
-        } else {
-            "(i32.const 0)"
-        };
-        let wat = format!(
-            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
-        );
-        let failure = assert_stage!(
-            run_with_gas(&wat, PLENTY_OF_GAS, &host)
-                .expect_err("a wrongly-typed entry point must not run"),
-            RunError::EntryPoint(_)
-        )
-        .to_string();
-        assert!(
-            failure.contains("entry point 'finish' has the wrong signature"),
-            "{signature}: {failure}"
-        );
-        assert!(
-            !failure.contains("no entry point"),
-            "a present export must not be reported as absent — {signature}: {failure}"
-        );
-    }
-}
-
-/// An export of the entry point's name that is not a function at all is a third
-/// case, and named as such: nothing is missing and no signature is wrong.
-#[test]
-fn an_entry_point_that_is_not_a_function_fails() {
-    let host = FakeHost::new();
-
-    let wat =
-        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
-        RunError::EntryPoint(_)
-    )
-    .to_string();
-    assert!(
-        failure.contains("export 'finish' is not a function"),
-        "{failure}"
-    );
-}
-
-/// A guest that traps fails the run rather than returning a value.
-#[test]
-fn a_trapping_guest_fails_the_run() {
-    let host = FakeHost::new();
-
-    let wat = module(&[ONE_PAGE], "(unreachable)");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-
-    // An out-of-bounds guest access is a trap too, caught by the engine rather
-    // than anything the host is asked about.
-    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_memory64_module_is_rejected_at_compile() {
-    let host = FakeHost::new();
-    let wat = r#"(module
-        (memory i64 1)
-        (func (export "finish") (result i32) (i32.const 0)))"#;
-
-    let failure = assert_stage!(
-        run_with_gas(wat, PLENTY_OF_GAS, &host)
-            .expect_err("a module using 64-bit memory must not run"),
-        RunError::Compile(_)
-    );
-    assert_eq!(
-        failure.fuel_used, 0,
-        "rejected before instantiation, so nothing is charged: {failure}"
-    );
-}
-
-/// A function declaring more parameters than wasm allows (1000) is refused at compile, so a
-/// contract cannot smuggle an unbounded signature past screening.
-#[test]
-fn a_function_with_too_many_params_is_refused() {
-    let host = FakeHost::new();
-    let params = " i32".repeat(1001);
-    let wat = format!(
-        "(module {ONE_PAGE} (func (param{params}) (result i32) (i32.const 0)) \
-         (func (export \"finish\") (result i32) (i32.const 0)))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// A function declaring more locals than wasm allows (50 000) is refused at compile.
-#[test]
-fn a_function_with_too_many_locals_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(50_001));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Compile(_));
-}
-
-/// Below the compile cap but past the engine's register frame, a locals-heavy function is
-/// refused when the frame is built rather than at compile — still refused, just later.
-#[test]
-fn a_function_past_the_register_frame_is_refused() {
-    let host = FakeHost::new();
-    let locals = format!("(local{})", " i32".repeat(40_000));
-    let wat = module(&[ONE_PAGE], &format!("{locals} (i32.const 0)"));
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// Unbounded recursion is stopped by the engine's call-stack limit — it traps rather than
-/// running the host's native stack off the end (the portable dispatcher makes loops safe;
-/// this pins that guest *calls* are bounded too).
-#[test]
-fn unbounded_recursion_is_stopped_by_the_call_stack_limit() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} \
-          (func $rec (param i32) (result i32) \
-            (if (result i32) (i32.eqz (local.get 0)) (then (i32.const 0)) \
-              (else (call $rec (i32.sub (local.get 0) (i32.const 1)))))) \
-          (func (export \"finish\") (result i32) (call $rec (i32.const 1000000))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-/// The CodeMap-DoS defense, from the guest's side: a module of thousands of tiny
-/// functions is refused in `Module::new`, before anything is translated.
-///
-/// Both of `EnforcedLimits::strict()`'s function rules are load-bearing here, which
-/// is why the second half exists — dropping under the count cap does not get a
-/// module past the defense, because the bodies then fail the minimum average. The
-/// values themselves are pinned in `vm.rs`'s `the_enforced_limits_are_pinned`.
-#[test]
-fn a_module_of_too_many_functions_is_refused() {
-    let host = FakeHost::new();
-
-    let tiny_funcs = |count: usize| {
-        let funcs: String = (0..count)
-            .map(|i| format!("(func $f{i} (result i32) (i32.const {}))", i % 7))
-            .collect();
-        format!("(module {ONE_PAGE} {funcs} (func (export \"finish\") (result i32) (call $f0)))")
-    };
-
-    // `max_functions: Some(10000)`, checked before the bodies are looked at.
-    let wat = tiny_funcs(10_001);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(refusal.contains("limit of 10000 functions"), "{refusal}");
-
-    // `min_avg_bytes_per_function: 40`, enforced once the bodies total 1 KiB. These
-    // average five bytes, so the count cap is not the only thing holding.
-    let wat = tiny_funcs(9_999);
-    let refusal = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
-    assert!(
-        refusal.contains("minimum average bytes per function of 40"),
-        "{refusal}"
-    );
-}
-
-/// The trap *kinds* wasmi distinguishes all reach the caller identically — a guest trap
-/// charged as the contract's fault — so the `unreachable` representative pins the mapping.
-/// These pin the individual kinds too, guarding against a wasmi upgrade reclassifying any of
-/// them as something other than a trap.
-#[test]
-fn a_division_by_zero_traps() {
-    let host = FakeHost::new();
-    let wat = module(&[ONE_PAGE], "(i32.div_s (i32.const 1) (i32.const 0))");
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn a_signed_integer_overflow_traps() {
-    let host = FakeHost::new();
-    let wat = module(
-        &[ONE_PAGE],
-        "(i32.div_s (i32.const 0x80000000) (i32.const -1))",
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_to_a_null_table_entry_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $t (func (result i32))) (table 1 funcref) \
-          (func (export \"finish\") (result i32) (call_indirect (type $t) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}
-
-#[test]
-fn an_indirect_call_with_a_mismatched_signature_traps() {
-    let host = FakeHost::new();
-    let wat = format!(
-        "(module {ONE_PAGE} (type $void (func)) (type $i32 (func (result i32))) \
-          (table 1 funcref) (elem (i32.const 0) $f) (func $f (type $void)) \
-          (func (export \"finish\") (result i32) (call_indirect (type $i32) (i32.const 0))))"
-    );
-    assert_stage!(failure(&wat, &host), RunError::Trap(_));
-}

docs/build/environment.md

@@ -1,5 +1,5 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
-environment complete with Git, Python, Conan, CMake, Rust, and a C++ compiler.
+environment complete with Git, Python, Conan, CMake, and a C++ compiler.
 This document explains how to set one up.
 
 [BUILD.md]: ../../BUILD.md
@@ -10,15 +10,14 @@ This document explains how to set one up.
 support it — see [compiler support for C++23][cpp23-support].
 The versions currently tested in CI are:
 
-| Compiler    | Version                         |
-| ----------- | ------------------------------- |
-| GCC         | `gccVersion` in [packages.nix]  |
-| Clang       | `llvmVersion` in [packages.nix] |
-| Apple Clang | 21                              |
-| MSVC        | Visual Studio 2026              |
+| Compiler    | Version            |
+| ----------- | ------------------ |
+| GCC         | 15.2               |
+| Clang       | 22                 |
+| Apple Clang | 21                 |
+| MSVC        | Visual Studio 2026 |
 
-LLVM tools (`clang-tidy` and `clang-format`)
-come from the same LLVM release as Clang.
+LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
 
 ### Older compilers
 
@@ -37,17 +36,19 @@ compiler building. Treat support for anything outside the table as best-effort.
 
 Besides a compiler, building `xrpld` requires:
 
-| Tool                                        | Minimum version          |
-| ------------------------------------------- | ------------------------ |
-| [Git](https://git-scm.com/downloads)        | any recent               |
-| [Python](https://www.python.org/downloads/) | 3.11                     |
-| [Conan](https://conan.io/downloads.html)    | 2.17                     |
-| [CMake](https://cmake.org/download/)        | 3.16                     |
-| [Rust](https://rustup.rs)                   | 1.95 (see [Rust](#rust)) |
+| Tool                                        | Minimum version |
+| ------------------------------------------- | --------------- |
+| [Git](https://git-scm.com/downloads)        | any recent      |
+| [Python](https://www.python.org/downloads/) | 3.11            |
+| [Conan](https://conan.io/downloads.html)    | 2.17            |
+| [CMake](https://cmake.org/download/)        | 3.16            |
 
 On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
 (see below). On Windows they have to be installed manually.
 
+Building with `-Drust=ON` additionally requires a Rust toolchain, see
+[Rust](#rust). A default build does not, so it is not in the table above.
+
 Once they are in place, verify that everything is installed and runnable with:
 
 ```bash
@@ -121,14 +122,18 @@ manually:
   "x64 Native Tools Command Prompt". CI configures CMake with the
   `Visual Studio 18 2026` generator.
 - [Git for Windows](https://git-scm.com/download/win)
-- Python, Conan, CMake, and Rust, at the versions listed in
+- Python, Conan, and CMake, at the versions listed in
   [Required tools](#required-tools).
+- a [Rust toolchain](https://rustup.rs) — only needed to build with
+  `-Drust=ON`, see [Rust](#rust)
 
 ## Rust
 
 The repository contains a Rust workspace in [`crates/`](../../crates), whose
-crates are exposed to C++ through [cxx](https://cxx.rs) bindings and compiled by
-the CMake build, so a Rust toolchain is required.
+crates are exposed to C++ through [cxx](https://cxx.rs) bindings. It is **not**
+part of a default build: the CMake `rust` option is OFF by default, and with it
+off no Rust toolchain is needed. It is only required when configuring with
+`-Drust=ON` (which is what CI does), see [Options](../../BUILD.md#options).
 
 The toolchain (`cargo`, `rustc`) is pinned to the channel in
 [`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If
@@ -151,4 +156,3 @@ version out of the box — run it via `run-clang-tidy`. No separate installation
 is needed.
 
 [cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
-[packages.nix]: ../../nix/packages.nix

docs/build/nix.md

@@ -128,8 +128,9 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
-The Rust toolchain the build needs is included too: every shell provides the
-channel pinned in [`rust-toolchain.toml`](../../rust-toolchain.toml) (see
+Builds of the Rust crates (`-Drust=ON`) also work out of the box: every shell
+provides the Rust toolchain pinned in
+[`rust-toolchain.toml`](../../rust-toolchain.toml) (see
 [Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
 `cargo-nextest` plugins.
 
@@ -182,36 +183,24 @@ at link or run time.
 > configuration CI covers, and no dependency binaries are published for it.
 
 This is checked rather than assumed.
-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) takes one
-file or directory and fails if a binary under it resolves a store path at run time.
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
+or directory and fails if a binary under it resolves a store path at run time.
 CI runs it over the build output and the Conan cache, and again in the upload job
 before anything is published. You can run it yourself:
 
 ```bash
-bin/nix/check-nix-store-refs.sh build
-bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+bin/check-nix-store-refs.sh build
+bin/check-nix-store-refs.sh ~/.conan2-nix
 ```
 
 It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`. That is fine for the pinned
-glibc, whose path does not move, but not for the GCC runtime, which moves with
-every GCC update. So [`conan/profiles/default`](../../conan/profiles/default)
-links build-context packages, whose executables run during the build, with
-`-static-libstdc++ -static-libgcc -Wl,--as-needed`, and
-[`conan/profiles/sanitizers`](../../conan/profiles/sanitizers) does not
-instrument them. CI checks that they load nothing from the store but glibc, from
-the graph `conan install --format=json` writes:
+writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
+whose store is fixed for its lifetime, so that is fine. Only the binaries
+[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
+system loader have to be clean, and those are what CI checks:
 
 ```bash
-bin/nix/check-build-context-runtime.sh graph.json
-```
-
-Only the binaries [`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake)
-retargets to the system loader have to be fully clean, and those are what CI
-checks:
-
-```bash
-bin/nix/check-nix-store-refs.sh build/xrpld
+bin/check-nix-store-refs.sh build/xrpld
 ```
 
 ### The libresolv stub

docs/build/nix_troubleshooting.md

@@ -178,11 +178,11 @@ A binary stops starting after a `nix flake update`, or after
 dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
 ```
 
-[`bin/nix/check-nix-store-refs.sh`](../../bin/nix/check-nix-store-refs.sh) finds the
-same thing without having to run anything, and names the file:
+[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
+thing without having to run anything, and names the file:
 
 ```
-$ bin/nix/check-nix-store-refs.sh ~/.conan2-nix
+$ bin/check-nix-store-refs.sh ~/.conan2-nix
 ::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
 /Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
     /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib

external/antithesis-sdk/CMakeLists.txt

@@ -6,7 +6,7 @@ project(antithesis-sdk-cpp VERSION 0.4.4 LANGUAGES CXX)
 add_library(antithesis-sdk-cpp INTERFACE antithesis_sdk.h)
 
 # Note, both sections below created by xrpld project
-target_include_directories(antithesis-sdk-cpp SYSTEM INTERFACE
+target_include_directories(antithesis-sdk-cpp INTERFACE
   $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
 )

include/xrpl/basics/CompressionAlgorithms.h

@@ -34,7 +34,7 @@ lz4Compress(void const* in, std::size_t inSize, BufferFactory&& bf)
     // data
     auto compressed = bf(outCapacity);
 
-    auto const compressedSize = LZ4_compress_default(
+    auto compressedSize = LZ4_compress_default(
         reinterpret_cast<char const*>(in),
         reinterpret_cast<char*>(compressed),
         inSize,

include/xrpl/basics/IntrusivePointer.ipp

@@ -20,14 +20,12 @@ SharedIntrusive<T>::SharedIntrusive(T* p, TAdoptTag) noexcept : ptr_{p}
 
 template <class T>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }
 
@@ -35,14 +33,12 @@ template <class T>
 template <class TT>
     requires std::convertible_to<TT*, T*>
 SharedIntrusive<T>::SharedIntrusive(SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = rhs.unsafeGetRawPtr();
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = rhs.unsafeGetRawPtr();
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }
 
@@ -144,14 +140,12 @@ SharedIntrusive<T>::~SharedIntrusive()
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = static_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }
 
@@ -165,14 +159,12 @@ SharedIntrusive<T>::SharedIntrusive(StaticCastTagSharedIntrusive, SharedIntrusiv
 template <class T>
 template <class TT>
 SharedIntrusive<T>::SharedIntrusive(DynamicCastTagSharedIntrusive, SharedIntrusive<TT> const& rhs)
-    : ptr_{
-          [&] {
-              auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
-              if (p)
-                  p->addStrongRef();
-              return p;
-          }(),
-      }
+    : ptr_{[&] {
+        auto p = dynamic_cast<T*>(rhs.unsafeGetRawPtr());
+        if (p)
+            p->addStrongRef();
+        return p;
+    }()}
 {
 }
 
@@ -268,7 +260,7 @@ SharedIntrusive<T>::unsafeReleaseAndStore(T* next)
         return;
 
     using enum ReleaseStrongRefAction;
-    auto const action = prev->releaseStrongRef();
+    auto action = prev->releaseStrongRef();
     switch (action)
     {
         case NoOp:
@@ -369,7 +361,7 @@ WeakIntrusive<T>::unsafeReleaseNoStore()
         return;
 
     using enum ReleaseWeakRefAction;
-    auto const action = ptr_->releaseWeakRef();
+    auto action = ptr_->releaseWeakRef();
     switch (action)
     {
         case NoOp:
@@ -588,7 +580,7 @@ SharedWeakUnion<T>::convertToStrong()
     auto p = unsafeGetRawPtr();
     if (p && p->checkoutStrongRefFromWeak())
     {
-        [[maybe_unused]] auto const action = p->releaseWeakRef();
+        [[maybe_unused]] auto action = p->releaseWeakRef();
         XRPL_ASSERT(
             (action == ReleaseWeakRefAction::NoOp),
             "xrpl::SharedWeakUnion::convertToStrong : "
@@ -611,7 +603,7 @@ SharedWeakUnion<T>::convertToWeak()
         return false;
 
     using enum ReleaseStrongRefAction;
-    auto const action = p->addWeakReleaseStrongRef();
+    auto action = p->addWeakReleaseStrongRef();
     switch (action)
     {
         case NoOp:
@@ -678,7 +670,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
     if (isStrong())
     {
         using enum ReleaseStrongRefAction;
-        auto const strongAction = p->releaseStrongRef();
+        auto strongAction = p->releaseStrongRef();
         switch (strongAction)
         {
             case NoOp:
@@ -696,7 +688,7 @@ SharedWeakUnion<T>::unsafeReleaseNoStore()
     else
     {
         using enum ReleaseWeakRefAction;
-        auto const weakAction = p->releaseWeakRef();
+        auto weakAction = p->releaseWeakRef();
         switch (weakAction)
         {
             case NoOp:

include/xrpl/basics/IntrusiveRefCounts.h

@@ -406,10 +406,10 @@ IntrusiveRefCounts::useCount() const noexcept
 inline IntrusiveRefCounts::~IntrusiveRefCounts() noexcept
 {
 #ifndef NDEBUG
-    auto const v = refCounts_.load(std::memory_order_acquire);
+    auto v = refCounts_.load(std::memory_order_acquire);
     XRPL_ASSERT(
         (!(v & kValueMask)), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : count must be zero");
-    auto const t = v & kTagMask;
+    auto t = v & kTagMask;
     XRPL_ASSERT((!t || t == kTagMask), "xrpl::IntrusiveRefCounts::~IntrusiveRefCounts : valid tag");
 #endif
 }

include/xrpl/basics/MathUtilities.h

@@ -3,84 +3,9 @@
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
-#include <cstdint>
-#include <limits>
-#include <optional>
 
 namespace xrpl {
 
-/**
- * Add two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical sum is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedAdd(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a > L::max() - b) || (b < 0 && a < L::min() - b))
-        return std::nullopt;
-
-    return a + b;
-}
-
-/**
- * Subtract two signed 64-bit integers, returning std::nullopt when the exact
- * mathematical difference is not representable in std::int64_t.
- */
-[[nodiscard]] constexpr std::optional<std::int64_t>
-checkedSub(std::int64_t a, std::int64_t b) noexcept
-{
-    using L = std::numeric_limits<std::int64_t>;
-
-    if ((b > 0 && a < L::min() + b) || (b < 0 && a > L::max() + b))
-        return std::nullopt;
-
-    return a - b;
-}
-
-static_assert(checkedAdd(0, 0) == 0);
-static_assert(checkedAdd(1, -1) == 0);
-static_assert(checkedAdd(-5, 2) == -3);
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::max(), 1).has_value());
-static_assert(!checkedAdd(std::numeric_limits<std::int64_t>::min(), -1).has_value());
-static_assert(
-    checkedAdd(std::numeric_limits<std::int64_t>::max() - 1, 1) ==
-    std::numeric_limits<std::int64_t>::max());
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::min(),
-        std::numeric_limits<std::int64_t>::max()) == -1);
-static_assert(
-    checkedAdd(
-        std::numeric_limits<std::int64_t>::max(),
-        std::numeric_limits<std::int64_t>::min()) == -1);
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-static_assert(
-    !checkedAdd(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-
-static_assert(checkedSub(0, 0) == 0);
-static_assert(checkedSub(1, 1) == 0);
-static_assert(checkedSub(-5, 2) == -7);
-static_assert(checkedSub(-5, -2) == -3);
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::min(), 1).has_value());
-static_assert(!checkedSub(std::numeric_limits<std::int64_t>::max(), -1).has_value());
-static_assert(
-    checkedSub(std::numeric_limits<std::int64_t>::min() + 1, 1) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    checkedSub(-1, std::numeric_limits<std::int64_t>::max()) ==
-    std::numeric_limits<std::int64_t>::min());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::min())
-         .has_value());
-static_assert(
-    !checkedSub(std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max())
-         .has_value());
-
 /**
  * Calculate one number divided by another number in percentage.
  * The result is rounded up to the next integer, and capped in the range [0,100]

include/xrpl/basics/Number.h

@@ -543,21 +543,8 @@ public:
     setround(RoundingMode inMode);
 
     /**
-     * Convert an integer to a RoundingMode, validating that it is in range.
+     * Returns which mantissa scale is currently in use for normalization.
      *
-     * Returns std::nullopt if the value does not correspond to a valid
-     * RoundingMode.
-     */
-    static std::optional<RoundingMode>
-    checkedRoundingMode(int mode) noexcept
-    {
-        if (mode < static_cast<int>(RoundingMode::ToNearest) ||
-            mode > static_cast<int>(RoundingMode::Upward))
-            return std::nullopt;
-        return static_cast<RoundingMode>(mode);
-    }
-
-    /**
      * If you think you need to call this outside of unit tests, no you don't.
      */
     static MantissaRange::MantissaScale

include/xrpl/basics/SlabAllocator.h

@@ -340,7 +340,7 @@ public:
 
         for (auto const& c : cfg)
         {
-            auto const& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);
+            auto& a = allocators_.emplace_back(c.extra_, c.alloc_, c.align_);
 
             if (a.size() > maxSize_)
                 maxSize_ = a.size();

include/xrpl/basics/StringUtilities.h

@@ -36,7 +36,7 @@ template <typename T>
 concept SomeChar = std::same_as<std::remove_cvref_t<T>, int8_t> ||
     std::same_as<std::remove_cvref_t<T>, char> || std::same_as<std::remove_cvref_t<T>, uint8_t>;
 
-inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = [] {
+inline constexpr std::array<std::optional<int>, 256> const kDigitLookupTable = []() {
     std::array<std::optional<int>, 256> t{};
 
     for (int i = 0; i < 10; ++i)

include/xrpl/basics/TaggedCache.ipp

@@ -300,7 +300,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     // Remove from cache, if !valid, remove from map too. Returns true if removed from cache
     std::scoped_lock const lock(mutex_);
 
-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);
 
     if (cit == cache_.end())
         return false;
@@ -356,7 +356,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 
     std::scoped_lock const lock(mutex_);
 
-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);
 
     if (cit == cache_.end())
     {
@@ -371,7 +371,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     Entry& entry = cit->second;
     entry.touch(clock_.now());
 
-    auto const shouldReplaceCached = [&] {
+    auto shouldReplaceCached = [&] {
         if constexpr (replaceCached)
         {
             return true;
@@ -400,7 +400,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         return true;
     }
 
-    auto const cachedData = entry.lock();
+    auto cachedData = entry.lock();
 
     if (cachedData)
     {
@@ -563,7 +563,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     retrieve(key_type const& key, T& data)
 {
     // retrieve the value of the stored data
-    auto const entry = fetch(key);
+    auto entry = fetch(key);
 
     if (!entry)
         return false;
@@ -687,7 +687,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
             return ret;
     }
 
-    auto const sle = h();
+    auto sle = h();
     if (!sle)
         return {};
 
@@ -713,7 +713,7 @@ inline SharedPointerType
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
     initialFetch(key_type const& key, std::scoped_lock<MutexType> const& l)
 {
-    auto const cit = cache_.find(key);
+    auto cit = cache_.find(key);
     if (cit == cache_.end())
         return {};
 
@@ -783,7 +783,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
         int cacheRemovals = 0;
         int mapRemovals = 0;
 
@@ -863,7 +863,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
 {
-    return std::thread([&, this] {
+    return std::thread([&, this]() {
         // NOLINTBEGIN https://github.com/XRPLF/rippled/issues/7056
         int cacheRemovals = 0;
         int mapRemovals = 0;

include/xrpl/basics/base_uint.h

@@ -195,8 +195,7 @@ private:
     {
         // Local lambda that converts a single hex char to four bits and
         // ORs those bits into a uint32_t.
-        auto const hexCharToUInt =
-            [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
+        auto hexCharToUInt = [](char c, std::uint32_t shift, std::uint32_t& accum) -> ParseResult {
             std::uint32_t nibble = 0xFFu;
             if (c < '0' || c > 'f')
                 return ParseResult::BadChar;
@@ -454,7 +453,7 @@ public:
     {
         for (int i = kWidth - 1; i >= 0; --i)
         {
-            auto const prev = data_[i];
+            auto prev = data_[i];
             data_[i] = boost::endian::native_to_big(boost::endian::big_to_native(data_[i]) - 1);
 
             if (prev != 0)

include/xrpl/basics/enum_bitops.h

@@ -0,0 +1,200 @@
+#pragma once
+
+#include <concepts>
+#include <type_traits>
+#include <utility>
+
+namespace xrpl {
+
+/**
+ * Opt-in bitwise operators for scoped enumerations.
+ *
+ * Provides `&`, `|`, `^`, `~` and the corresponding compound assignment forms
+ * for any scoped enumeration with an unsigned underlying type that opts in by
+ * specializing @ref OptIn:
+ *
+ * @code
+ * namespace xrpl {
+ *
+ * enum class MyFlags : std::uint32_t { a = 1, b = 2, c = 4 };
+ *
+ * template <>
+ * struct enum_bitops::OptIn<MyFlags> : std::true_type {};
+ *
+ * }  // namespace xrpl
+ * @endcode
+ *
+ * The operators are constexpr and noexcept, and return the enumeration type.
+ *
+ * @par Where the specialization may be declared
+ *   In namespace xrpl, or at global scope with full qualification, and after
+ *   the enumeration is defined but before the operators are first used. This
+ *   cannot be done in a nested namespace or at class scope; for enumerations
+ *   nested in a class this means after the class definition.
+ *
+ * @par Where the operators are found
+ *   The operators are declared in namespace xrpl, so argument-dependent lookup
+ *   will find them only for enumerations declared in xrpl or nested in a class
+ *   declared directly in xrpl. Enumerations in a nested namespace will only be
+ *   found from code inside xrpl, and only if no enclosing scope declares an
+ *   operator of the same name; elsewhere they require using-declarations.
+ */
+namespace enum_bitops {
+
+/**
+ * Types that may be opted in to the bitwise operators.
+ *
+ * Satisfied by a scoped enumeration whose underlying type is an unsigned
+ * integer type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Eligible = std::is_scoped_enum_v<T> && std::unsigned_integral<std::underlying_type_t<T>>;
+
+/**
+ * Opt-in switch for the bitwise operators.
+ *
+ * The primary template derives from std::false_type. Specialize it to derive
+ * from std::true_type to enable the operators for an @ref Eligible enumeration.
+ *
+ * @tparam T The scoped enumeration to opt in.
+ */
+template <Eligible T>
+struct OptIn : std::false_type
+{
+};
+
+/**
+ * Enumerations for which the bitwise operators are enabled.
+ *
+ * Satisfied when @p T satisfies @ref Eligible and @ref OptIn has been
+ * specialized for it to derive from std::true_type.
+ *
+ * @tparam T The type to test.
+ */
+template <typename T>
+concept Candidate = Eligible<T> && OptIn<T>::value;
+
+}  // namespace enum_bitops
+
+// These are declared in xrpl, not in enum_bitops, so that argument-dependent
+// lookup finds them for enumerations whose associated namespace is xrpl.
+
+/**
+ * @name Bitwise operators for opted-in scoped enumerations
+ *
+ * Each operator applies the corresponding built-in operator to the
+ * underlying values and converts the result back to the enumeration type.
+ * Both operands must have the same enumeration type; there is no implicit
+ * conversion to or from the underlying type.
+ */
+/** @{ */
+
+/**
+ * Bitwise AND.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in both @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator&(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) & std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in @p lhs, in @p rhs, or in both.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator|(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) | std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise exclusive OR.
+ *
+ * @param lhs The left operand.
+ * @param rhs The right operand.
+ * @return The bits set in exactly one of @p lhs and @p rhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator^(T lhs, T rhs) noexcept
+{
+    return static_cast<T>(std::to_underlying(lhs) ^ std::to_underlying(rhs));
+}
+
+/**
+ * Bitwise complement.
+ *
+ * The result has every bit of the underlying type that is clear in
+ * @p val, including bits that no enumerator names. It is intended for
+ * clearing flags, as in `flags & ~flag`.
+ *
+ * @param val The operand.
+ * @return The complement of @p val.
+ */
+template <enum_bitops::Candidate T>
+constexpr T
+operator~(T val) noexcept
+{
+    return static_cast<T>(~std::to_underlying(val));
+}
+
+/**
+ * Bitwise AND assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator&=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs & rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator|=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs | rhs;
+    return lhs;
+}
+
+/**
+ * Bitwise exclusive OR assignment.
+ *
+ * @param lhs The value to modify.
+ * @param rhs The right operand.
+ * @return A reference to @p lhs.
+ */
+template <enum_bitops::Candidate T>
+constexpr T&
+operator^=(T& lhs, T rhs) noexcept
+{
+    lhs = lhs ^ rhs;
+    return lhs;
+}
+
+/** @} */
+
+}  // namespace xrpl

include/xrpl/basics/partitioned_unordered_map.h

@@ -17,7 +17,7 @@
 namespace xrpl {
 
 template <typename Key>
-std::size_t
+static std::size_t
 extract(Key const& key)
 {
     return key;
@@ -365,7 +365,7 @@ public:
     size() const
     {
         std::size_t ret = 0;
-        for (auto const& p : map_)
+        for (auto& p : map_)
             ret += p.size();
         return ret;
     }