Fix clippy and doc test errors

chore: Fix clang version in devshell

.codecov.yml

@@ -1,10 +1,32 @@
 codecov:
   require_ci_to_pass: true
+  # The C++ and Rust uploads land minutes apart; without this gate Codecov
+  # publishes a near-zero total from whichever one arrives first.
+  notify:
+    after_n_builds: 2
+    wait_for_ci: true
 
 comment:
   behavior: default
   layout: reach,diff,flags,tree,reach
-  show_carryforward_flags: false
+  show_carryforward_flags: true
+  after_n_builds: 2
+
+# C++ and Rust coverage upload from independent workflows under the `cpp` and
+# `rust` flags; carryforward keeps one language's total when only the other reran.
+flag_management:
+  default_rules:
+    carryforward: true
+  individual_flags:
+    - name: cpp
+      carryforward: true
+      paths:
+        - include/
+        - src/
+    - name: rust
+      carryforward: true
+      paths:
+        - crates/
 
 coverage:
   range: "70..85"

.cspell.config.yaml

@@ -7,8 +7,6 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
-  - src/test/app/wasm_fixtures/**/*.wat
-  - src/test/app/wasm_fixtures/*.c
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -106,6 +104,7 @@ words:
   - deleteme
   - demultiplexer
   - deserializaton
+  - desugars
   - desync
   - desynced
   - determ
@@ -114,7 +113,7 @@ words:
   - doxyfile
   - dxrpl
   - elgamal
-  - emittance
+  - enabled
   - enablerepo
   - endmacro
   - envrc
@@ -131,6 +130,7 @@ words:
   - gcov
   - gcovr
   - ghead
+  - gmock
   - Gnutella
   - godexsoft
   - gpgcheck
@@ -140,7 +140,9 @@ words:
   - hwaddress
   - hwrap
   - ifndef
+  - impls
   - inequation
+  - initialiser
   - insuf
   - insuff
   - invasively
@@ -248,6 +250,7 @@ words:
   - pyparsing
   - qalloc
   - qbsprofile
+  - qself
   - queuable
   - Raphson
   - rcflags
@@ -299,7 +302,6 @@ words:
   - statsd
   - STATSDCOLLECTOR
   - stissue
-  - stjson
   - stnum
   - stnumber
   - stobj
@@ -313,6 +315,7 @@ words:
   - summands
   - superpeer
   - superpeers
+  - Swatinem
   - takergets
   - takerpays
   - ters
@@ -341,6 +344,7 @@ words:
   - unflatten
   - unfund
   - unimpair
+  - unmetered
   - unroutable
   - unscalable
   - unserviced
@@ -361,6 +365,7 @@ words:
   - vfalco
   - vinnie
   - wasmi
+  - Werror
   - wextra
   - wptr
   - writeme

.github/CODEOWNERS

@@ -1,2 +0,0 @@
-# Allow anyone to review any change by default.
-*

.github/dependabot.yml

@@ -19,3 +19,20 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  - package-ecosystem: cargo
+    directory: /crates
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Etc/GMT
+    commit-message:
+      prefix: "ci: [DEPENDABOT] "
+    target-branch: develop
+    open-pull-requests-limit: 10
+    # Bundle all Rust dependency bumps into a single PR per run to reduce noise.
+    groups:
+      rust-dependencies:
+        patterns:
+          - "*"

.github/scripts/levelization/results/ordering.txt

@@ -19,7 +19,6 @@ libxrpl.ledger > xrpl.json
 libxrpl.ledger > xrpl.ledger
 libxrpl.ledger > xrpl.nodestore
 libxrpl.ledger > xrpl.protocol
-libxrpl.ledger > xrpl.server
 libxrpl.ledger > xrpl.shamap
 libxrpl.net > xrpl.basics
 libxrpl.net > xrpl.net
@@ -207,7 +206,6 @@ xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
 xrpl.json > xrpl.basics
 xrpl.ledger > xrpl.basics
-xrpl.ledger > xrpl.core
 xrpl.ledger > xrpl.json
 xrpl.ledger > xrpl.nodestore
 xrpl.ledger > xrpl.protocol

.github/workflows/cargo-audit.yml

@@ -0,0 +1,84 @@
+# This workflow audits the Rust dependencies in crates/ for known security
+# advisories using cargo-audit. It runs on a weekly schedule, whenever the
+# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
+# scheduled run, a failure opens a tracking issue (matching the clang-tidy
+# workflow's behavior); on push/PR it simply fails the check.
+name: Cargo audit
+
+on:
+  schedule:
+    # 06:32 UTC every Monday.
+    - cron: "32 6 * * 1"
+  push:
+    branches:
+      - "develop"
+      - "release*"
+    paths:
+      - "crates/**/Cargo.toml"
+      - "crates/Cargo.lock"
+      - ".github/workflows/cargo-audit.yml"
+  pull_request:
+    paths:
+      - "crates/**/Cargo.toml"
+      - "crates/Cargo.lock"
+      - ".github/workflows/cargo-audit.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+    working-directory: crates
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435
+    permissions:
+      contents: read
+      # Needed to open an issue on scheduled failures.
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Run cargo audit
+        id: audit
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          cargo audit | tee /tmp/cargo-audit.txt
+
+      - name: Prepare issue body
+        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
+        run: |
+          {
+              echo "## \`cargo audit\` found advisories"
+              echo
+              echo '```'
+              cat /tmp/cargo-audit.txt
+              echo '```'
+              echo
+              echo "---"
+              echo "*This issue was automatically created by the cargo-audit workflow.*"
+          } >/tmp/cargo-audit-issue.md
+
+      - name: Create issue
+        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
+        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
+        with:
+          title: "cargo audit found vulnerabilities"
+          body_file: /tmp/cargo-audit-issue.md
+          labels: "Bug,Security"
+
+      - name: Fail if advisories were found
+        if: ${{ steps.audit.outcome != 'success' }}
+        run: |
+          echo "cargo audit found advisories!"
+          exit 1

.github/workflows/on-pr.yml

@@ -85,6 +85,7 @@ jobs:
             .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
             .github/workflows/reusable-package.yml
+            .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
             .github/workflows/reusable-upload-recipe.yml
@@ -95,6 +96,7 @@ jobs:
             cfg/**
             cmake/**
             conan/**
+            crates/**
             external/**
             include/**
             src/**
@@ -168,6 +170,13 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  rust:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.go == 'true' }}
+    uses: ./.github/workflows/reusable-rust.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
   package:
     needs: [should-run, build-test]
     # Packaging consumes the debian/rhel release binaries, which are only built
@@ -211,6 +220,7 @@ jobs:
       - check-rename
       - clang-tidy
       - build-test
+      - rust
       - package
       - upload-recipe
       - notify-clio

.github/workflows/on-trigger.yml

@@ -23,6 +23,7 @@ on:
       - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
       - ".github/workflows/reusable-package.yml"
+      - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
       - ".github/workflows/reusable-upload-recipe.yml"
@@ -33,6 +34,7 @@ on:
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
+      - "crates/**"
       - "external/**"
       - "include/**"
       - "src/**"
@@ -96,6 +98,11 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  rust:
+    uses: ./.github/workflows/reusable-rust.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
   upload-recipe:
     needs: build-test
     # Only run when pushing to the develop branch.

.github/workflows/reusable-build-test-config.yml

@@ -276,7 +276,7 @@ jobs:
         working-directory: ${{ env.BUILD_DIR }}
         run: |
           ldd ./xrpld
-          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+|libgcc)' | wc -l)" -eq 0 ]; then
+          if [ "$(ldd ./xrpld | grep -E '(libstdc\+\+)' | wc -l)" -eq 0 ]; then
               echo 'The binary is statically linked.'
           else
               echo 'The binary is dynamically linked.'
@@ -289,6 +289,14 @@ jobs:
         run: |
           ./xrpld --version | grep libvoidstar
 
+      - name: Run Rust tests
+        if: ${{ !inputs.build_only }}
+        working-directory: crates
+        # `xrpl-wasm-vm-ffi` is left out on Windows: its tests link as an executable, and
+        # MSVC - unlike the Unix linkers - will not dead-strip the never-called cxx wrappers
+        # whose C++ shims only the CMake build defines. The other runners cover these tests.
+        run: cargo nextest run --workspace --all-features --locked --no-tests=warn ${{ runner.os == 'Windows' && '--exclude xrpl-wasm-vm-ffi' || '' }}
+
       - name: Run the separate tests
         if: ${{ !inputs.build_only }}
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}
@@ -394,6 +402,7 @@ jobs:
           disable_telem: true
           fail_ci_if_error: true
           files: ${{ env.BUILD_DIR }}/coverage.xml
+          flags: cpp
           plugins: noop
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true

.github/workflows/reusable-clang-tidy.yml

@@ -88,6 +88,12 @@ jobs:
         run: |
           ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
 
+      # clang-tidy needs cxxbridge headers generated from Rust crates
+      - name: Build xrpl_crates
+        working-directory: ${{ env.BUILD_DIR }}
+        run: |
+          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl_crates
+
       - name: Run clang tidy
         id: run_clang_tidy
         continue-on-error: true

.github/workflows/reusable-rust.yml

@@ -0,0 +1,86 @@
+# Clippy, coverage and documentation for the Rust crates in crates/. Each runs
+# as an independent job on a GitHub-hosted runner, but inside the same container
+# image used to build the crates in the C++/Corrosion path, so the toolchain
+# (and therefore the lints, coverage instrumentation and the cargo cache) matches
+# what production builds use.
+#
+# Rust unit tests are deliberately NOT run here. They run as part of the C++
+# build (reusable-build-test-config.yml), which already compiles the crates on a
+# self-hosted runner, so there is no need to provision a toolchain again.
+name: Rust
+
+on:
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        description: "The Codecov token to use for uploading coverage reports."
+        required: false
+
+defaults:
+  run:
+    shell: bash
+    working-directory: crates
+
+permissions:
+  contents: read
+
+jobs:
+  clippy:
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: crates
+
+      - name: Run clippy
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+  coverage:
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: crates
+
+      - name: Generate coverage report
+        run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
+
+      - name: Upload coverage report
+        if: ${{ github.repository == 'XRPLF/rippled' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          disable_search: true
+          disable_telem: true
+          fail_ci_if_error: true
+          files: crates/lcov.info
+          flags: rust
+          plugins: noop
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+
+  doc:
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: crates
+
+      - name: Build documentation
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+        run: cargo doc --workspace --no-deps --all-features --locked

.gitignore

@@ -89,3 +89,6 @@ target/
 
 # clangd cache
 /.cache
+
+# Rust build directory
+crates/target

.pre-commit-config.yaml

@@ -62,6 +62,15 @@ repos:
         types_or: [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
+  - repo: local
+    hooks:
+      - id: cargo-fmt
+        name: cargo fmt
+        entry: cargo fmt --manifest-path crates/Cargo.toml --all
+        language: system
+        types: [rust]
+        pass_filenames: false # rustfmt formats the whole workspace
+
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
     hooks:

CMakeLists.txt

@@ -114,7 +114,6 @@ find_package(OpenSSL REQUIRED)
 find_package(secp256k1 REQUIRED)
 find_package(SOCI REQUIRED)
 find_package(SQLite3 REQUIRED)
-find_package(wasmi REQUIRED)
 find_package(xxHash REQUIRED)
 
 target_link_libraries(
@@ -159,6 +158,7 @@ if(coverage)
     include(XrplCov)
 endif()
 
+add_subdirectory(crates)
 include(XrplCore)
 include(XrplProtocolAutogen)
 include(XrplInstall)

cfg/xrpld-example.cfg

@@ -1348,39 +1348,6 @@
 #       Example:
 #           owner_reserve = 200000      # 0.2 XRP
 #
-#   gas_limit = <gas>
-#
-#       The gas limit is the maximum amount of gas that can be
-#       consumed by a single transaction. The gas limit is used to prevent
-#       transactions from consuming too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_limit = 1000000      # 1 million gas
-#
-#   bytecode_size_limit = <bytes>
-#
-#       The bytecode size limit is the maximum size of a WASM extension in
-#       bytes. The size limit is used to prevent extensions from consuming
-#       too many resources.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           bytecode_size_limit = 100000      # 100 kb
-#
-#   gas_price = <micro-drops>
-#
-#       The gas price is the conversion between WASM gas and its price in drops.
-#
-#       If this parameter is unspecified, xrpld will use an internal
-#       default. Don't change this without understanding the consequences.
-#
-#       Example:
-#           gas_price = 1000000      # 1 drop per gas
 #-------------------------------------------------------------------------------
 #
 # 9. Misc Settings

cmake/XrplCore.cmake

@@ -67,7 +67,6 @@ target_link_libraries(
         Xrpl::opts
         Xrpl::syslibs
         secp256k1::secp256k1
-        wasmi::wasmi
         xrpl.libpb
         xxHash::xxhash
         $<$<BOOL:${voidstar}>:antithesis-sdk-cpp>
@@ -206,7 +205,17 @@ target_link_libraries(
 )
 
 add_module(xrpl tx)
-target_link_libraries(xrpl.libxrpl.tx PUBLIC xrpl.libxrpl.ledger)
+# The wasm engine is a Rust crate reached over cxx: the bridge target supplies the
+# generated `lib.h` and `rust/cxx.h` that `tx/wasm` compiles against, and the Rust
+# static library everything downstream links. PUBLIC because the include path travels
+# with the module's own public headers.
+target_link_libraries(
+    xrpl.libxrpl.tx
+    PUBLIC xrpl.libxrpl.ledger xrpl_wasm_vm_ffi_cxxbridge
+)
+# Those headers do not exist at configure time, and the header-verification target
+# compiles this module's headers on their own, so both need the crates built first.
+add_dependencies(xrpl.libxrpl.tx xrpl_crates)
 
 add_module(xrpl consensus)
 target_link_libraries(

conan.lock

@@ -3,7 +3,6 @@
     "requires": [
         "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
         "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "wasmi/1.0.9#1fecdab9b90c96698eb35ea99ca4f5cb%1782307153.343419",
         "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
         "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
         "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",

conanfile.py

@@ -35,7 +35,6 @@ class Xrpl(ConanFile):
         "nudb/2.0.9",
         "openssl/3.6.3",
         "soci/4.0.3",
-        "wasmi/1.0.9",
         "zlib/1.3.2",
     ]
 
@@ -224,7 +223,6 @@ class Xrpl(ConanFile):
             "soci::soci",
             "secp256k1::secp256k1",
             "sqlite3::sqlite",
-            "wasmi::wasmi",
             "xxhash::xxhash",
             "zlib::zlib",
         ]

crates/.cargo/config.toml

@@ -0,0 +1,5 @@
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "link-args=-static-libgcc"]
+
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -0,0 +1,59 @@
+set(CORROSION_VERSION 0.6.1)
+
+find_package(Corrosion ${CORROSION_VERSION} QUIET)
+if(NOT Corrosion_FOUND)
+    include(FetchContent)
+    FetchContent_Declare(
+        Corrosion
+        GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
+        GIT_TAG v${CORROSION_VERSION}
+    )
+    FetchContent_MakeAvailable(Corrosion)
+endif()
+
+corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
+
+file(
+    WRITE "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
+    "# Auto-generated by crates/CMakeLists.txt. Do not edit.\n"
+    "# Neutralizes clang-tidy for corrosion/cxxbridge-generated C++.\n"
+    "# One check kept enabled to avoid clang-tidy's \"no checks enabled\" error.\n"
+    "Checks: '-*,google-readability-todo'\n"
+    "WarningsAsErrors: ''\n"
+    "HeaderFilterRegex: ''\n"
+    "InheritParentConfig: false\n"
+)
+
+# Umbrella target that aggregates all crate-generated code (cxxbridge headers,
+# etc.). Build this before running clang-tidy so generated headers are present.
+add_custom_target(xrpl_crates)
+
+# add_xrpl_crate(<name> CRATE <crate> FILES <file>...) Creates a cxxbridge
+# target <name>_cxxbridge and registers it with xrpl_crates.
+function(add_xrpl_crate name)
+    cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
+    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
+                            ${ARG_FILES}
+    )
+    # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
+    # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
+    # existence check — build-time ordering is enforced by the custom commands.
+    set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
+    add_dependencies(xrpl_crates ${name}_cxxbridge)
+endfunction()
+
+add_xrpl_crate(xrpl_wasm_vm_ffi CRATE xrpl_wasm_vm_ffi FILES lib.rs)
+
+# Test-only, and deliberately not part of xrpl_wasm_vm_ffi: it carries the `wat` assembler,
+# which the engine's `wasmi default-features = false` exists to keep out of the consensus
+# path. Linked from src/tests/libxrpl only, so the shipped node cannot contain it.
+add_xrpl_crate(xrpl_wasm_testkit CRATE xrpl_wasm_testkit FILES lib.rs)
+
+# The wasm bridge `include!`s a project header, so its generated translation unit needs
+# the project's include root. Deliberately only that: a header reached from here must
+# stay light enough to compile without the Boost paths this target does not get, which
+# is why `HostContext.h` forward-declares `xrpl::HostFunctions` instead of including it.
+target_include_directories(
+    xrpl_wasm_vm_ffi_cxxbridge
+    PRIVATE ${CMAKE_SOURCE_DIR}/include
+)

crates/Cargo.lock

@@ -0,0 +1,497 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "cc"
+version = "1.2.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "codespan-reporting"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
+dependencies = [
+ "serde",
+ "termcolor",
+ "unicode-width",
+]
+
+[[package]]
+name = "cxx"
+version = "1.0.198"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+dependencies = [
+ "cc",
+ "cxx-build",
+ "cxxbridge-cmd",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "foldhash 0.2.0",
+ "link-cplusplus",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.198"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "indexmap",
+ "proc-macro2",
+ "quote",
+ "scratch",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "cxxbridge-cmd"
+version = "1.0.198"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+dependencies = [
+ "clap",
+ "codespan-reporting",
+ "indexmap",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.198"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.198"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+dependencies = [
+ "indexmap",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.0",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "link-cplusplus"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f78c730aaa7d0b9336a299029ea49f9ee53b0ed06e9202e8cb7db9bae7b8c82"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "scratch"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+
+[[package]]
+name = "string-interner"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23de088478b31c349c9ba67816fa55d9355232d63c3afea8bf513e31f0f1d2c0"
+dependencies = [
+ "hashbrown 0.15.5",
+ "serde",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "wasm-encoder"
+version = "0.254.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.254.0",
+]
+
+[[package]]
+name = "wasmi"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2300d0f78cba12f14e29e8dd157ea64050c0a688179aefdb2050105805594a0c"
+dependencies = [
+ "spin",
+ "wasmi_collections",
+ "wasmi_core",
+ "wasmi_ir",
+ "wasmparser 0.239.0",
+]
+
+[[package]]
+name = "wasmi_collections"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a8c42a2a76148d43097b1d7cc2a5bf33d5c23bd4dd69015fc887e311767884"
+dependencies = [
+ "string-interner",
+]
+
+[[package]]
+name = "wasmi_core"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9013136083d988725953390bf668b64b7a218fabf26f8b913bbc59546b97ee27"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "wasmi_ir"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1fa003f79156f406d62ef0e1464dc03e11ace37170e9fa7524299a75ad8f68"
+dependencies = [
+ "wasmi_core",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.239.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9d90bb93e764f6beabf1d02028c70a2156a6583e63ac4218dd07ef733368b0"
+dependencies = [
+ "bitflags",
+ "indexmap",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.254.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
+dependencies = [
+ "bitflags",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "wast"
+version = "254.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
+dependencies = [
+ "bumpalo",
+ "leb128fmt",
+ "memchr",
+ "unicode-width",
+ "wasm-encoder",
+]
+
+[[package]]
+name = "wat"
+version = "1.254.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
+dependencies = [
+ "wast",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "xrpl-host-functions"
+version = "0.1.0"
+dependencies = [
+ "xrpl-host-functions-macros",
+]
+
+[[package]]
+name = "xrpl-host-functions-macros"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+ "xrpl-host-functions",
+]
+
+[[package]]
+name = "xrpl-wasm-testkit"
+version = "0.1.0"
+dependencies = [
+ "cxx",
+ "wat",
+]
+
+[[package]]
+name = "xrpl-wasm-vm"
+version = "0.1.0"
+dependencies = [
+ "wasmi",
+ "wat",
+ "xrpl-host-functions",
+]
+
+[[package]]
+name = "xrpl-wasm-vm-ffi"
+version = "0.1.0"
+dependencies = [
+ "cxx",
+ "xrpl-host-functions",
+ "xrpl-wasm-vm",
+]

crates/Cargo.toml

@@ -0,0 +1,15 @@
+[workspace]
+members = ["xrpl-wasm-vm-ffi", "xrpl-wasm-vm", "xrpl-wasm-testkit", "xrpl-host-functions", "xrpl-host-functions-macros"]
+resolver = "3"
+
+[workspace.dependencies]
+cxx = { version = "1.0.198", features = ["c++20"] }
+
+[workspace.package]
+edition = "2024"
+
+[profile.release]
+opt-level = 3
+overflow-checks = true
+lto = true
+debug = true

crates/xrpl-host-functions-macros/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "xrpl-host-functions-macros"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+proc-macro = true
+
+[dependencies]
+syn = { version = "3", features = ["full"] }
+quote = "1"
+proc-macro2 = "1"
+
+# The expansion names `::xrpl_host_functions::HostFnSpec`, so the doctest needs the
+# facade crate. Cargo allows this cycle because dev-dependencies are outside the
+# library build graph.
+[dev-dependencies]
+xrpl-host-functions.path = "../xrpl-host-functions"

crates/xrpl-host-functions-macros/src/errors.rs

@@ -0,0 +1,12 @@
+/// Folds accumulated diagnostics into the single error a macro can return.
+///
+/// `syn::Error` is itself a collection: `combine` appends, and
+/// `into_compile_error` emits one `compile_error!` per recorded span. Folding
+/// instead of returning the first error means every mistake in a
+/// `host_functions!` block surfaces in one build rather than one per rebuild.
+pub(crate) fn combine(errors: Vec<syn::Error>) -> Option<syn::Error> {
+    errors.into_iter().reduce(|mut first, next| {
+        first.combine(next);
+        first
+    })
+}

crates/xrpl-host-functions-macros/src/lib.rs

@@ -0,0 +1,384 @@
+mod errors;
+mod parsed_host_function;
+
+use std::collections::HashSet;
+
+use proc_macro2::TokenStream;
+use quote::quote;
+use syn::{
+    TraitItemFn,
+    parse::{Parse, ParseStream},
+    parse2,
+};
+
+use parsed_host_function::ParsedHostFunction;
+
+/// Declares the wasm host ABI once, and generates everything that follows from it.
+///
+/// The input is a block of `fn` declarations, each carrying the gas cost the host
+/// charges before the call and the name the guest imports it under. Doc comments
+/// are kept and appear on the generated items.
+///
+/// This crate is an implementation detail of `xrpl-host-functions`, which
+/// hand-writes the types the expansion refers to and holds the one declaration
+/// block. The expansion names those types by absolute path, so a call site needs
+/// `xrpl-host-functions` as a dependency but no imports from it.
+///
+/// ```
+/// use xrpl_host_functions::HostResult;
+/// use xrpl_host_functions_macros::host_functions;
+///
+/// host_functions! {
+///     /// The sequence number of the ledger being built, as 4 little-endian bytes.
+///     #[gas = 60]
+///     #[wasm_name = "ldgr_index"]
+///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
+///
+///     /// Writes `msg` to the trace log.
+///     #[gas = 500]
+///     #[wasm_name = "trace_num"]
+///     fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
+/// }
+///
+/// // A `HostFunctions` trait, holding the declarations verbatim:
+/// struct Host;
+/// impl HostFunctions for Host {
+///     fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize> {
+///         out[..4].copy_from_slice(&7u32.to_le_bytes());
+///         Ok(4)
+///     }
+///     fn trace_num(&self, _msg: &str, _number: i64) -> HostResult<()> { Ok(()) }
+/// }
+///
+/// // A `HostFunctionSpec` enum carrying the ABI metadata as a `const` table:
+/// assert_eq!(HostFunctionSpec::GetLedgerSqn.gas(), 60);
+/// assert_eq!(HostFunctionSpec::TraceNum.wasm_name(), "trace_num");
+/// assert_eq!(HostFunctionSpec::ALL.len(), 2);
+/// ```
+///
+/// A declaration must be a plain `fn` taking `&self` and returning
+/// `HostResult<T>`, with no body and no generics: it maps to exactly one wasm
+/// import signature. Two declarations may not share a `wasm_name`, nor collapse to
+/// the same PascalCase variant.
+#[proc_macro]
+pub fn host_functions(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
+    expand(input.into())
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
+}
+
+fn expand(input: TokenStream) -> syn::Result<TokenStream> {
+    let HostFunctionsInput { functions } = parse2(input)?;
+
+    let mut parsed = Vec::with_capacity(functions.len());
+    let mut errors = Vec::new();
+    for function in functions {
+        match ParsedHostFunction::parse(function) {
+            Ok(function) => parsed.push(function),
+            Err(error) => errors.push(error),
+        }
+    }
+    if let Some(error) = errors::combine(errors) {
+        return Err(error);
+    }
+    if let Some(error) = errors::combine(collisions(&parsed)) {
+        return Err(error);
+    }
+
+    Ok(generate(&parsed))
+}
+
+/// Names two declarations may not share, because the generated code would then
+/// fail to compile at a span the caller cannot see.
+fn collisions(functions: &[ParsedHostFunction]) -> Vec<syn::Error> {
+    let mut errors = Vec::new();
+    let mut variants = HashSet::new();
+    let mut wasm_names = HashSet::new();
+
+    for function in functions {
+        if !variants.insert(function.variant.to_string()) {
+            errors.push(syn::Error::new_spanned(
+                &function.variant,
+                format!(
+                    "another host function already becomes the `{}` variant",
+                    function.variant
+                ),
+            ));
+        }
+        if !wasm_names.insert(function.wasm_name.value()) {
+            errors.push(syn::Error::new_spanned(
+                &function.wasm_name,
+                format!(
+                    "another host function is already imported as `{}`",
+                    function.wasm_name.value()
+                ),
+            ));
+        }
+    }
+
+    errors
+}
+
+fn generate(functions: &[ParsedHostFunction]) -> TokenStream {
+    let trait_methods = functions.iter().map(ParsedHostFunction::trait_method);
+    let variants = functions
+        .iter()
+        .map(ParsedHostFunction::variant_declaration);
+    let spec_arms = functions.iter().map(ParsedHostFunction::spec_arm);
+    let all = functions.iter().map(|function| &function.variant);
+
+    quote! {
+        /// The host side of the wasm ABI: one method per function a guest may
+        /// import.
+        ///
+        /// Implement it once per execution environment — the ledger host, a test
+        /// double, a benchmark fake — and a guest module cannot tell them apart.
+        /// Each method is one declaration from the `host_functions!` block, as
+        /// written; its `&self` receiver is not part of the ABI the guest sees,
+        /// so a host that must mutate does so behind interior mutability.
+        ///
+        /// # The output contract
+        ///
+        /// A method handed an `out` buffer **writes into it only when the whole
+        /// value fits, and returns the value's true length whether it fitted or
+        /// not.**
+        ///
+        /// The length is the value's, not the number of bytes written, because it
+        /// is how a guest that asked with too small a buffer learns the size to
+        /// ask for next time. The engine turns a length past the buffer into
+        /// `BufferTooSmall`, and one past the field cap into `DataFieldTooLarge`,
+        /// so a host needs to know neither.
+        ///
+        /// Writing nothing unless the value fits is the half only a host can hold
+        /// up. An engine can bound how many bytes are *writable* — and does, by
+        /// handing over a region clamped to the field cap — but it cannot take
+        /// back what a method already put there. A host that wrote a truncated
+        /// prefix and then reported the larger length would leave those bytes in
+        /// guest memory behind a refusal the guest is told to ignore. C++'s
+        /// `setData` is the reference point: it wrote only on a value that fit.
+        pub trait HostFunctions {
+            #(#trait_methods)*
+        }
+
+        /// One row of the ABI table: what [`HostFunctionSpec::wasm_name`] and
+        /// [`HostFunctionSpec::gas`] read from.
+        ///
+        /// Private, and the only reason it exists is to keep both of them fed
+        /// from a single `match` over the declarations.
+        struct HostFnSpec {
+            name: &'static str,
+            gas: u64,
+        }
+
+        /// Identifies one host function, and is the compile-time source of its
+        /// ABI metadata.
+        ///
+        /// One variant per `host_functions!` declaration, named by converting the
+        /// function name to PascalCase. [`Self::ALL`] is the whole ABI, which is
+        /// what a wasm engine iterates to build its import table.
+        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+        pub enum HostFunctionSpec {
+            #(#variants,)*
+        }
+
+        impl HostFunctionSpec {
+            /// Every host function, in the order declared.
+            ///
+            /// This is the complete import surface a guest may link against: a
+            /// function absent here cannot be called, and one present here must
+            /// be registered for a module that imports it to instantiate.
+            pub const ALL: &'static [Self] = &[#(Self::#all,)*];
+
+            /// This function's row of the ABI table.
+            const fn spec(self) -> HostFnSpec {
+                match self {
+                    #(#spec_arms,)*
+                }
+            }
+
+            /// The name a guest imports this function under.
+            ///
+            /// A guest's import name must match this exactly, or the module
+            /// fails to instantiate. Usable in `const` context, so import lists
+            /// can be built at compile time.
+            pub const fn wasm_name(self) -> &'static str {
+                self.spec().name
+            }
+
+            /// Gas charged before the call runs, independent of its arguments.
+            ///
+            /// Consensus-relevant: two nodes that disagree on this value
+            /// disagree on transaction outcomes. Usable in `const` context, so
+            /// gas tables can be built at compile time.
+            pub const fn gas(self) -> u64 {
+                self.spec().gas
+            }
+        }
+    }
+}
+
+struct HostFunctionsInput {
+    functions: Vec<TraitItemFn>,
+}
+
+impl Parse for HostFunctionsInput {
+    fn parse(input: ParseStream) -> syn::Result<Self> {
+        let mut functions = Vec::new();
+        while !input.is_empty() {
+            functions.push(input.parse()?);
+        }
+        Ok(HostFunctionsInput { functions })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn accepts_an_empty_block() {
+        expand(quote! {}).unwrap();
+    }
+
+    #[test]
+    fn reports_mistakes_from_every_function() {
+        let error = expand(quote! {
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+
+            #[gas = 2000]
+            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
+        })
+        .expect_err("expected parsing to fail");
+
+        let messages: Vec<_> = error.into_iter().map(|error| error.to_string()).collect();
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
+        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
+    }
+
+    #[test]
+    fn propagates_syntax_errors() {
+        let error = expand(quote! { fn missing_semicolon() }).expect_err("expected a syntax error");
+        assert!(!error.to_string().is_empty());
+    }
+
+    /// The messages of every diagnostic recorded by one failed `expand`.
+    fn messages(input: TokenStream) -> Vec<String> {
+        let Err(error) = expand(input) else {
+            panic!("expected expansion to fail");
+        };
+        error.into_iter().map(|error| error.to_string()).collect()
+    }
+
+    #[test]
+    fn generates_the_trait_the_enum_and_the_table() {
+        let generated = expand(quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+
+            #[gas = 500]
+            #[wasm_name = "trace_num"]
+            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
+        })
+        .unwrap()
+        .to_string();
+
+        for expected in [
+            "pub trait HostFunctions",
+            "fn get_ledger_sqn (& self) -> HostResult < [u8 ; 4] > ;",
+            "fn trace_num (& self , msg : & str , number : i64) -> HostResult < () > ;",
+            "pub enum HostFunctionSpec { GetLedgerSqn , TraceNum , }",
+            "pub const ALL : & 'static [Self] = & [Self :: GetLedgerSqn , Self :: TraceNum ,]",
+            // The table's row type is generated too, and stays private.
+            "struct HostFnSpec { name : & 'static str , gas : u64 , }",
+            "const fn spec (self) -> HostFnSpec",
+            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }",
+            "pub const fn wasm_name (self) -> & 'static str",
+            "pub const fn gas (self) -> u64",
+        ] {
+            assert!(generated.contains(expected), "missing {expected:?}");
+        }
+    }
+
+    /// The expansion stands alone: every name in it is either generated here or
+    /// written in the declarations, so it cannot depend on the crate it lands in.
+    #[test]
+    fn names_no_crate_of_its_own() {
+        let generated = expand(quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        })
+        .unwrap()
+        .to_string();
+
+        assert!(!generated.contains("xrpl_host_functions"), "{generated}");
+
+        // `Self::Variant` is the only path the expansion may build: anything else
+        // would reach out of the generated code. Doc comments spell paths without
+        // spaces (`Self::ALL`), so they do not match.
+        for (index, _) in generated.match_indices(" :: ") {
+            assert!(
+                generated[..index].ends_with("Self"),
+                "path out of the expansion at {index}: {generated}"
+            );
+        }
+    }
+
+    /// `spec` is an implementation detail of the two accessors, so it must not
+    /// become part of the ABI crate's public surface.
+    #[test]
+    fn keeps_the_table_row_private() {
+        let generated = expand(quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        })
+        .unwrap()
+        .to_string();
+
+        assert!(!generated.contains("pub struct HostFnSpec"), "{generated}");
+        assert!(!generated.contains("pub const fn spec"), "{generated}");
+    }
+
+    #[test]
+    fn rejects_two_functions_that_share_a_wasm_name() {
+        let messages = messages(quote! {
+            #[gas = 60]
+            #[wasm_name = "trace"]
+            fn trace(&self, msg: &str) -> HostResult<()>;
+
+            #[gas = 70]
+            #[wasm_name = "trace"]
+            fn trace_num(&self, msg: &str, number: i64) -> HostResult<()>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("already imported as `trace`"),
+            "{messages:?}"
+        );
+    }
+
+    /// Names that differ only in underscores collapse to one enum variant.
+    #[test]
+    fn rejects_two_functions_that_share_a_variant() {
+        let messages = messages(quote! {
+            #[gas = 60]
+            #[wasm_name = "a"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+
+            #[gas = 70]
+            #[wasm_name = "b"]
+            fn get_ledger__sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("`GetLedgerSqn` variant"),
+            "{messages:?}"
+        );
+    }
+}

crates/xrpl-host-functions-macros/src/parsed_host_function.rs

@@ -0,0 +1,871 @@
+use proc_macro2::TokenStream;
+use quote::{format_ident, quote};
+use syn::{
+    Attribute, Expr, ExprLit, Ident, Lit, LitStr, PathArguments, ReceiverKind, ReturnType, Safety,
+    Signature, TraitItemFn, Type, TypePath,
+};
+
+use crate::errors;
+
+/// `#[gas = N]`: the base gas charged before the call runs.
+const GAS: &str = "gas";
+/// `#[wasm_name = "..."]`: the name the guest imports the function under.
+const WASM_NAME: &str = "wasm_name";
+/// `///` desugars to `#[doc = "..."]` before macro expansion.
+const DOC: &str = "doc";
+/// The alias every declaration returns its success type through.
+const HOST_RESULT: &str = "HostResult";
+
+/// One entry of a `host_functions!` block: its ABI metadata and its signature.
+pub(crate) struct ParsedHostFunction {
+    pub(crate) gas: u64,
+    /// Kept as the literal the user wrote, so diagnostics and the generated
+    /// string both carry that span.
+    pub(crate) wasm_name: LitStr,
+    /// Doc comments, in source order, to re-emit on the generated items.
+    pub(crate) docs: Vec<Attribute>,
+    /// The enum variant this declaration becomes, spanned at the function name.
+    pub(crate) variant: Ident,
+    pub(crate) signature: Signature,
+}
+
+impl ParsedHostFunction {
+    /// `#[doc …] fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;`
+    pub(crate) fn trait_method(&self) -> TokenStream {
+        let docs = &self.docs;
+        // The declaration is already a trait method: emitted verbatim, so what
+        // the block reads like is what the trait is.
+        let signature = &self.signature;
+
+        quote! {
+            #(#docs)*
+            #signature;
+        }
+    }
+
+    /// `#[doc …] GetLedgerSqn`
+    pub(crate) fn variant_declaration(&self) -> TokenStream {
+        let docs = &self.docs;
+        let variant = &self.variant;
+        quote! {
+            #(#docs)*
+            #variant
+        }
+    }
+
+    /// `Self::GetLedgerSqn => HostFnSpec { name: "ldgr_index", gas: 60u64 }`
+    pub(crate) fn spec_arm(&self) -> TokenStream {
+        let Self {
+            gas,
+            wasm_name,
+            variant,
+            ..
+        } = self;
+        quote! {
+            Self::#variant => HostFnSpec { name: #wasm_name, gas: #gas }
+        }
+    }
+
+    pub(crate) fn parse(function: TraitItemFn) -> syn::Result<Self> {
+        let mut gas = None;
+        let mut wasm_name = None;
+        let mut docs = Vec::new();
+        let mut errors = Vec::new();
+
+        // Tracked separately from `gas`/`wasm_name` so a malformed attribute is
+        // not also reported as a missing one.
+        let mut saw_gas = false;
+        let mut saw_wasm_name = false;
+
+        for attr in function.attrs {
+            if attr.path().is_ident(GAS) {
+                saw_gas = true;
+                if let Err(error) = int_value(&attr).and_then(|v| set_once(&mut gas, v, &attr)) {
+                    errors.push(error);
+                }
+            } else if attr.path().is_ident(WASM_NAME) {
+                saw_wasm_name = true;
+                if let Err(error) =
+                    string_value(&attr).and_then(|v| set_once(&mut wasm_name, v, &attr))
+                {
+                    errors.push(error);
+                }
+            } else if attr.path().is_ident(DOC) {
+                docs.push(attr);
+            } else {
+                errors.push(syn::Error::new_spanned(
+                    &attr,
+                    format!("unexpected attribute `{}`", path_name(&attr)),
+                ));
+            }
+        }
+
+        if !saw_gas {
+            errors.push(syn::Error::new_spanned(
+                &function.sig.ident,
+                format!("missing `#[{GAS} = ...]` attribute"),
+            ));
+        }
+        if !saw_wasm_name {
+            errors.push(syn::Error::new_spanned(
+                &function.sig.ident,
+                format!("missing `#[{WASM_NAME} = \"...\"]` attribute"),
+            ));
+        }
+        if let Some(body) = &function.default {
+            errors.push(syn::Error::new_spanned(
+                body,
+                "a host function is implemented by the host, so it must not have a body",
+            ));
+        }
+        if !function.sig.generics.params.is_empty() || function.sig.generics.where_clause.is_some()
+        {
+            errors.push(syn::Error::new_spanned(
+                &function.sig.ident,
+                "a host function must not be generic: it maps to one wasm import signature",
+            ));
+        }
+        errors.extend(check_receiver(&function.sig).err());
+        errors.extend(check_return_type(&function.sig).err());
+        if let Some(name) = &wasm_name {
+            errors.extend(check_wasm_name(name).err());
+        }
+        reject_modifiers(&function.sig, &mut errors);
+
+        // A name whose PascalCase form is not a legal variant is reported here
+        // rather than emitted, which would either panic or fail downstream.
+        let variant = match variant_ident(&function.sig.ident) {
+            Ok(variant) => Some(variant),
+            Err(error) => {
+                errors.push(error);
+                None
+            }
+        };
+
+        if let Some(error) = errors::combine(errors) {
+            return Err(error);
+        }
+
+        let (Some(gas), Some(wasm_name), Some(variant)) = (gas, wasm_name, variant) else {
+            unreachable!("every absent field is reported above");
+        };
+
+        Ok(Self {
+            gas,
+            wasm_name,
+            docs,
+            variant,
+            signature: function.sig,
+        })
+    }
+}
+
+/// Every declaration carries a receiver, and it is always `&self`.
+///
+/// `&self` is the only receiver that can work: the VM reaches the host through a
+/// shared `&dyn HostFunctions` stored in the wasmi `Store`, and a host that needs
+/// to mutate does so behind interior mutability. The receiver is not part of the
+/// wasm ABI — the guest passes no `self` — so it is uniform across the block.
+fn check_receiver(signature: &Signature) -> syn::Result<()> {
+    let Some(receiver) = signature.receiver() else {
+        return Err(syn::Error::new_spanned(
+            &signature.ident,
+            format!(
+                "a host function must declare its receiver: `fn {}(&self, ...)`",
+                signature.ident
+            ),
+        ));
+    };
+
+    // `&self` and nothing else: not `&mut self`, not `self`/`mut self`, not a
+    // typed `self: Box<Self>`, and not a spelled-out lifetime.
+    if !matches!(receiver.kind, ReceiverKind::Reference(_, None, None)) {
+        return Err(syn::Error::new_spanned(
+            receiver,
+            "a host function's receiver must be exactly `&self`: the VM calls the host \
+             through a shared `&dyn HostFunctions`",
+        ));
+    }
+    Ok(())
+}
+
+/// Every declaration returns `HostResult<T>`, including the ones that yield
+/// nothing (`HostResult<()>`).
+///
+/// One shape for every function is what lets a single dispatch adapter lower them
+/// all: lift the arguments out of guest memory, call the host, then turn `Ok(T)`
+/// into the wire's non-negative `i32` and `Err(e)` into a negative code or a trap.
+/// A function returning a bare `T` would need its own arm.
+fn check_return_type(signature: &Signature) -> syn::Result<()> {
+    const SHAPE: &str = "a host function must return `HostResult<T>` — \
+                         `HostResult<()>` if it yields nothing";
+
+    let ReturnType::Type(_, returned) = &signature.output else {
+        return Err(syn::Error::new_spanned(&signature.ident, SHAPE));
+    };
+
+    let Type::Path(TypePath {
+        qself: None, path, ..
+    }) = &**returned
+    else {
+        return Err(syn::Error::new_spanned(returned, SHAPE));
+    };
+    // The last segment only, so `HostResult<T>` may be written qualified.
+    let Some(last) = path.segments.last() else {
+        return Err(syn::Error::new_spanned(returned, SHAPE));
+    };
+    if last.ident != HOST_RESULT {
+        return Err(syn::Error::new_spanned(returned, SHAPE));
+    }
+
+    // `HostResult` without its success type is `HostResult` the alias, which names
+    // no type; rustc's own message for that is unhelpfully far from the cause.
+    let PathArguments::AngleBracketed(arguments) = &last.arguments else {
+        return Err(syn::Error::new_spanned(
+            returned,
+            format!("`{HOST_RESULT}` needs its success type: `{HOST_RESULT}<T>`"),
+        ));
+    };
+    if arguments.args.len() != 1 {
+        return Err(syn::Error::new_spanned(
+            arguments,
+            format!("`{HOST_RESULT}` takes exactly one type: `{HOST_RESULT}<T>`"),
+        ));
+    }
+    Ok(())
+}
+
+/// `const`, `async`, `unsafe`/`safe` and `extern "…"` have no meaning in the
+/// wasm ABI, and would otherwise pass silently into the generated trait.
+fn reject_modifiers(signature: &Signature, errors: &mut Vec<syn::Error>) {
+    const PLAIN: &str =
+        "a host function must be a plain `fn`: this modifier is not part of the wasm ABI";
+
+    if let Some(constness) = &signature.constness {
+        errors.push(syn::Error::new_spanned(constness, PLAIN));
+    }
+    if let Some(asyncness) = &signature.asyncness {
+        errors.push(syn::Error::new_spanned(asyncness, PLAIN));
+    }
+    match &signature.safety {
+        Safety::Default => {}
+        Safety::Safe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
+        Safety::Unsafe(token) => errors.push(syn::Error::new_spanned(token, PLAIN)),
+    }
+    if let Some(abi) = &signature.abi {
+        errors.push(syn::Error::new_spanned(abi, PLAIN));
+    }
+}
+
+/// The wasm import name reaches the engine's import table verbatim, so it is
+/// held to what an import name can sanely be rather than to any string.
+fn check_wasm_name(name: &LitStr) -> syn::Result<()> {
+    let value = name.value();
+    if value.is_empty() {
+        return Err(syn::Error::new_spanned(
+            name,
+            "the wasm name must not be empty",
+        ));
+    }
+    if let Some(character) = value
+        .chars()
+        .find(|c| !c.is_ascii_alphanumeric() && *c != '_')
+    {
+        return Err(syn::Error::new_spanned(
+            name,
+            format!(
+                "a wasm name may only contain `A-Za-z0-9_`, but this one contains {character:?}"
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// The enum variant a declaration becomes: `get_ledger_sqn` -> `GetLedgerSqn`.
+///
+/// The result carries `ident`'s span, so anything the compiler says about the
+/// variant points at the declaration that produced it.
+fn variant_ident(ident: &Ident) -> syn::Result<Ident> {
+    // `to_string` spells raw identifiers `r#type`; the `r#` is not part of the name.
+    let name = ident.to_string();
+    let name = name.strip_prefix("r#").unwrap_or(&name);
+
+    let mut pascal = String::with_capacity(name.len());
+    let mut capitalize = true;
+    for character in name.chars() {
+        if character == '_' {
+            capitalize = true;
+        } else if capitalize {
+            pascal.extend(character.to_uppercase());
+            capitalize = false;
+        } else {
+            pascal.push(character);
+        }
+    }
+
+    // A name of nothing but underscores leaves `pascal` empty; the original is
+    // already a legal identifier, so keep it.
+    if pascal.is_empty() {
+        return Ok(ident.clone());
+    }
+
+    // `Ident::new` panics on a leading digit (`_2fa` -> `2fa`) and silently
+    // accepts keyword spellings (`self_` -> `Self`), which then fails to parse
+    // where the variant is emitted. Parsing rejects both, without panicking.
+    if let Err(error) = syn::parse_str::<Ident>(&pascal) {
+        return Err(syn::Error::new_spanned(
+            ident,
+            format!(
+                "this name becomes the enum variant `{pascal}`, which is not a valid \
+                 variant name ({error}); rename the host function"
+            ),
+        ));
+    }
+    Ok(format_ident!("{pascal}", span = ident.span()))
+}
+
+/// Records `value`, or reports that the attribute appeared more than once.
+fn set_once<T>(slot: &mut Option<T>, value: T, attr: &Attribute) -> syn::Result<()> {
+    if slot.replace(value).is_some() {
+        return Err(syn::Error::new_spanned(
+            attr,
+            format!("duplicate `{}` attribute", path_name(attr)),
+        ));
+    }
+    Ok(())
+}
+
+fn int_value(attr: &Attribute) -> syn::Result<u64> {
+    match &attr.meta.require_name_value()?.value {
+        Expr::Lit(ExprLit {
+            lit: Lit::Int(int), ..
+        }) => {
+            // `LitInt` keeps the sign in its digits, so `base10_parse::<u64>`
+            // would report a negative value as "invalid digit found in string".
+            if int.base10_digits().starts_with('-') {
+                return Err(syn::Error::new_spanned(
+                    int,
+                    format!("`{}` must not be negative", path_name(attr)),
+                ));
+            }
+            int.base10_parse()
+        }
+        other => Err(syn::Error::new_spanned(
+            other,
+            format!("`{}` expects an integer literal", path_name(attr)),
+        )),
+    }
+}
+
+fn string_value(attr: &Attribute) -> syn::Result<LitStr> {
+    match &attr.meta.require_name_value()?.value {
+        Expr::Lit(ExprLit {
+            lit: Lit::Str(string),
+            ..
+        }) => Ok(string.clone()),
+        other => Err(syn::Error::new_spanned(
+            other,
+            format!("`{}` expects a string literal", path_name(attr)),
+        )),
+    }
+}
+
+/// The attribute's path as written, for diagnostics: `gas`, or `foo::bar`.
+fn path_name(attr: &Attribute) -> String {
+    attr.path()
+        .segments
+        .iter()
+        .map(|segment| segment.ident.to_string())
+        .collect::<Vec<_>>()
+        .join("::")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use quote::ToTokens;
+    use syn::parse_quote;
+
+    /// The message of every diagnostic recorded by one failed `parse`.
+    ///
+    /// `expect_err` is unavailable here: it needs `T: Debug`, and syn only
+    /// implements `Debug` for its AST types under the `extra-traits` feature.
+    fn messages(function: TraitItemFn) -> Vec<String> {
+        let Err(error) = ParsedHostFunction::parse(function) else {
+            panic!("expected parsing to fail");
+        };
+        error.into_iter().map(|error| error.to_string()).collect()
+    }
+
+    fn doc_text(attr: &Attribute) -> String {
+        match &attr.meta.require_name_value().unwrap().value {
+            Expr::Lit(ExprLit {
+                lit: Lit::Str(text),
+                ..
+            }) => text.value(),
+            _ => panic!("doc attribute is not a string literal"),
+        }
+    }
+
+    #[test]
+    fn reads_gas_and_wasm_name() {
+        let parsed = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        })
+        .unwrap();
+
+        assert_eq!(parsed.gas, 60);
+        assert_eq!(parsed.wasm_name.value(), "ldgr_index");
+        assert_eq!(parsed.signature.ident.to_string(), "get_ledger_sqn");
+        assert_eq!(parsed.variant.to_string(), "GetLedgerSqn");
+        assert!(parsed.docs.is_empty());
+    }
+
+    #[test]
+    fn derives_variant_names_from_function_names() {
+        for (function, variant) in [
+            ("get_ledger_sqn", "GetLedgerSqn"),
+            ("sha512_half", "Sha512Half"),
+            ("trace", "Trace"),
+            ("get_current_ledger_obj_field", "GetCurrentLedgerObjField"),
+            ("r#type", "Type"),
+            ("trace2", "Trace2"),
+            // Pathological, but must not panic: no letters to capitalize.
+            ("__", "__"),
+        ] {
+            let ident = format_ident!("{function}");
+            assert_eq!(
+                variant_ident(&ident).map(|v| v.to_string()).ok(),
+                Some(variant.to_owned()),
+                "{function}"
+            );
+        }
+    }
+
+    /// `_2fa` would PascalCase to `2fa`; building that `Ident` panics, and a
+    /// panic in a proc macro is reported with no useful span at all.
+    #[test]
+    fn rejects_a_name_that_becomes_a_leading_digit() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "two_factor"]
+            fn _2fa(&self) -> HostResult<()>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("becomes the enum variant `2fa`"),
+            "{messages:?}"
+        );
+    }
+
+    /// `self_` PascalCases to `Self`, which `Ident::new` accepts and rustc then
+    /// rejects where the variant is emitted. `r#Self` is not a legal escape.
+    #[test]
+    fn rejects_a_name_that_becomes_a_keyword() {
+        for function in ["self_", "_self"] {
+            let ident = format_ident!("{function}");
+            let Err(error) = variant_ident(&ident) else {
+                panic!("expected `{function}` to be rejected");
+            };
+            assert!(
+                error.to_string().contains("variant `Self`"),
+                "{}",
+                error.to_string()
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_negative_gas() {
+        let messages = messages(parse_quote! {
+            #[gas = -5]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert_eq!(messages[0], "`gas` must not be negative");
+    }
+
+    #[test]
+    fn rejects_unusable_wasm_names() {
+        let empty = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = ""]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(empty.len(), 1, "{empty:?}");
+        assert_eq!(empty[0], "the wasm name must not be empty");
+
+        let spaced = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(spaced.len(), 1, "{spaced:?}");
+        assert!(spaced[0].contains("may only contain"), "{spaced:?}");
+    }
+
+    #[test]
+    fn rejects_signature_modifiers() {
+        for declaration in [
+            quote! { unsafe fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
+            quote! { async fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
+            quote! { const fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
+            quote! { extern "C" fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>; },
+        ] {
+            let function: TraitItemFn = syn::parse2(quote! {
+                #[gas = 60]
+                #[wasm_name = "ldgr_index"]
+                #declaration
+            })
+            .unwrap();
+
+            let messages = messages(function);
+            assert_eq!(messages.len(), 1, "{messages:?}");
+            assert!(messages[0].contains("must be a plain `fn`"), "{messages:?}");
+        }
+    }
+
+    #[test]
+    fn trait_method_keeps_the_declared_receiver_and_ends_in_a_semicolon() {
+        let parsed = ParsedHostFunction::parse(parse_quote! {
+            /// Hashes `data`.
+            #[gas = 2000]
+            #[wasm_name = "sha512_half"]
+            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; 32]>;
+        })
+        .unwrap();
+
+        // `///` reaches the macro as `#[doc = r"..."]`: rustc's lexer spells doc
+        // comments as raw string literals.
+        let method = parsed.trait_method().to_string();
+        assert!(
+            method.starts_with("# [doc = r\" Hashes `data`.\"]"),
+            "{method}"
+        );
+        assert!(
+            method
+                .contains("fn sha512_half (& self , data : & [u8]) -> HostResult < [u8 ; 32] > ;"),
+            "{method}"
+        );
+    }
+
+    #[test]
+    fn spec_arm_carries_the_name_and_the_gas() {
+        let parsed = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        })
+        .unwrap();
+
+        assert_eq!(
+            parsed.spec_arm().to_string(),
+            "Self :: GetLedgerSqn => HostFnSpec { name : \"ldgr_index\" , gas : 60u64 }"
+        );
+    }
+
+    #[test]
+    fn keeps_doc_comments_in_source_order() {
+        let parsed = ParsedHostFunction::parse(parse_quote! {
+            /// First line.
+            ///
+            /// Third line.
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        })
+        .unwrap();
+
+        let docs: Vec<_> = parsed.docs.iter().map(doc_text).collect();
+        assert_eq!(docs, vec![" First line.", "", " Third line."]);
+    }
+
+    #[test]
+    fn preserves_parameters_and_return_type() {
+        let traced = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 500]
+            #[wasm_name = "trace"]
+            fn trace(&self, msg: &str, data: &[u8], as_hex: bool) -> HostResult<()>;
+        })
+        .unwrap();
+        // The receiver is `inputs[0]`; the three wasm parameters follow it.
+        assert_eq!(traced.signature.inputs.len(), 4);
+        assert_eq!(
+            traced.signature.output.to_token_stream().to_string(),
+            "-> HostResult < () >"
+        );
+
+        let hashed = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 2000]
+            #[wasm_name = "sha512_half"]
+            fn sha512_half(&self, data: &[u8]) -> HostResult<[u8; HASH_LEN]>;
+        })
+        .unwrap();
+        assert_eq!(
+            hashed.signature.output.to_token_stream().to_string(),
+            "-> HostResult < [u8 ; HASH_LEN] >"
+        );
+    }
+
+    #[test]
+    fn reports_both_missing_attributes_at_once() {
+        let messages = messages(parse_quote! {
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 2);
+        assert!(messages[0].contains("missing `#[gas"), "{messages:?}");
+        assert!(messages[1].contains("missing `#[wasm_name"), "{messages:?}");
+    }
+
+    #[test]
+    fn names_the_unexpected_attribute() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wsam_name = "typo"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        // The typo'd attribute, plus the `wasm_name` it failed to be.
+        assert_eq!(messages.len(), 2);
+        assert!(
+            messages.iter().any(|m| m.contains("`wsam_name`")),
+            "{messages:?}"
+        );
+    }
+
+    #[test]
+    fn rejects_wrong_literal_types() {
+        let gas = messages(parse_quote! {
+            #[gas = "60"]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(gas.len(), 1, "{gas:?}");
+        assert!(
+            gas[0].contains("`gas` expects an integer literal"),
+            "{gas:?}"
+        );
+
+        let name = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = 7]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(name.len(), 1, "{name:?}");
+        assert!(
+            name[0].contains("`wasm_name` expects a string literal"),
+            "{name:?}"
+        );
+    }
+
+    #[test]
+    fn rejects_gas_that_does_not_fit_in_u64() {
+        let messages = messages(parse_quote! {
+            #[gas = 99999999999999999999999]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(messages[0].contains("number too large"), "{messages:?}");
+    }
+
+    #[test]
+    fn rejects_attribute_shapes_other_than_name_value() {
+        let bare = messages(parse_quote! {
+            #[gas]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(bare.len(), 1, "{bare:?}");
+        assert!(bare[0].contains("gas = ..."), "{bare:?}");
+
+        let list = messages(parse_quote! {
+            #[gas(60)]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+        assert_eq!(list.len(), 1, "{list:?}");
+    }
+
+    #[test]
+    fn rejects_duplicate_attributes() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[gas = 70]
+            #[wasm_name = "ldgr_index"]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        assert!(messages[0].contains("duplicate `gas`"), "{messages:?}");
+        assert!(
+            messages[1].contains("duplicate `wasm_name`"),
+            "{messages:?}"
+        );
+    }
+
+    /// A malformed attribute must not also be reported as an absent one.
+    #[test]
+    fn does_not_report_a_malformed_attribute_as_missing() {
+        let messages = messages(parse_quote! {
+            #[gas = "60"]
+            #[wasm_name = 7]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 2, "{messages:?}");
+        assert!(
+            !messages.iter().any(|m| m.contains("missing")),
+            "{messages:?}"
+        );
+    }
+
+    #[test]
+    fn rejects_a_body() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> { Ok([0; 4]) }
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(messages[0].contains("must not have a body"), "{messages:?}");
+    }
+
+    #[test]
+    fn rejects_generics() {
+        let parameter = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn<T>(&self) -> HostResult<T>;
+        });
+        assert_eq!(parameter.len(), 1, "{parameter:?}");
+        assert!(
+            parameter[0].contains("must not be generic"),
+            "{parameter:?}"
+        );
+
+        let clause = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult<[u8; 4]> where Self: Sized;
+        });
+        assert_eq!(clause.len(), 1, "{clause:?}");
+    }
+
+    #[test]
+    fn requires_a_receiver() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn() -> HostResult<[u8; 4]>;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("must declare its receiver: `fn get_ledger_sqn(&self, ...)`"),
+            "{messages:?}"
+        );
+    }
+
+    /// Anything but `&self` would need a host the VM cannot hand out: it holds
+    /// one shared `&dyn HostFunctions` for the whole run.
+    #[test]
+    fn rejects_receivers_other_than_shared_self() {
+        for receiver in [
+            quote! { &mut self },
+            quote! { self },
+            quote! { mut self },
+            quote! { self: Box<Self> },
+            quote! { &'a self },
+        ] {
+            let function: TraitItemFn = syn::parse2(quote! {
+                #[gas = 60]
+                #[wasm_name = "ldgr_index"]
+                fn get_ledger_sqn(#receiver) -> HostResult<[u8; 4]>;
+            })
+            .unwrap_or_else(|_| panic!("`{receiver}` should parse"));
+
+            let messages = messages(function);
+            assert_eq!(messages.len(), 1, "`{receiver}`: {messages:?}");
+            assert!(
+                messages[0].contains("must be exactly `&self`"),
+                "`{receiver}`: {messages:?}"
+            );
+        }
+    }
+
+    /// A bare `T` return would need its own lowering arm, so the uniform shape is
+    /// required rather than inferred.
+    #[test]
+    fn rejects_returns_that_are_not_host_result() {
+        for output in [
+            quote! {},
+            quote! { -> () },
+            quote! { -> [u8; 4] },
+            quote! { -> i32 },
+            quote! { -> Result<[u8; 4], HostError> },
+            quote! { -> impl Iterator<Item = u8> },
+        ] {
+            let function: TraitItemFn = syn::parse2(quote! {
+                #[gas = 60]
+                #[wasm_name = "ldgr_index"]
+                fn get_ledger_sqn(&self) #output;
+            })
+            .unwrap_or_else(|_| panic!("`{output}` should parse"));
+
+            let messages = messages(function);
+            assert_eq!(messages.len(), 1, "`{output}`: {messages:?}");
+            assert!(
+                messages[0].contains("must return `HostResult<T>`"),
+                "`{output}`: {messages:?}"
+            );
+        }
+    }
+
+    /// `HostResult` may be written qualified, since the trait method keeps whatever
+    /// path resolves where the block is written.
+    #[test]
+    fn accepts_a_qualified_host_result() {
+        let parsed = ParsedHostFunction::parse(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> xrpl_host_functions::HostResult<[u8; 4]>;
+        })
+        .unwrap();
+
+        assert!(
+            parsed
+                .trait_method()
+                .to_string()
+                .contains("xrpl_host_functions :: HostResult < [u8 ; 4] >"),
+            "{}",
+            parsed.trait_method()
+        );
+    }
+
+    /// `HostResult` with no success type names no type at all; rustc's own error
+    /// for that lands on the generated trait, far from the declaration.
+    #[test]
+    fn rejects_host_result_without_a_success_type() {
+        let messages = messages(parse_quote! {
+            #[gas = 60]
+            #[wasm_name = "ldgr_index"]
+            fn get_ledger_sqn(&self) -> HostResult;
+        });
+
+        assert_eq!(messages.len(), 1, "{messages:?}");
+        assert!(
+            messages[0].contains("needs its success type"),
+            "{messages:?}"
+        );
+    }
+}

crates/xrpl-host-functions/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "xrpl-host-functions"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"

crates/xrpl-host-functions/src/lib.rs

@@ -0,0 +1,539 @@
+//! The wasm host ABI: the one place it is declared.
+//!
+//! `host_functions!` turns the declaration block at the bottom of this file into the
+//! [`HostFunctions`] trait a host implements and the [`HostFunctionSpec`] table a
+//! wasm engine registers from.
+//!
+//! The split: hand-written here is the vocabulary the declarations are written in —
+//! [`HostError`], [`TraceDataType`], [`HostResult`], [`HASH_LEN`] — and everything
+//! derived from the declarations is generated. The expansion names nothing this file
+//! does not, so the two sides meet only in the block below.
+//!
+//! So this file is lists — error codes, trace data types, functions. The `macro_rules!`
+//! that expand the first two into enums live in `macros.rs`.
+
+#![no_std]
+
+#[macro_use]
+mod macros;
+
+// Not re-exported: the ABI is declared once, here, and this is the only call site.
+use xrpl_host_functions_macros::host_functions;
+
+host_errors! {
+    Unimplemented = -1,
+    FieldNotFound = -2,
+    BufferTooSmall = -3,
+    NoArray = -4,
+    NotLeafField = -5,
+    LocatorMalformed = -6,
+    SlotOutRange = -7,
+    SlotsFull = -8,
+    EmptySlot = -9,
+    LedgerObjNotFound = -10,
+    OutOfTransferLimit = -11,
+    DataFieldTooLarge = -12,
+    PointerOutOfBounds = -13,
+    NoMemExported = -14,
+    InvalidParams = -15,
+    InvalidAccount = -16,
+    InvalidField = -17,
+    IndexOutOfBounds = -18,
+    FloatInputMalformed = -19,
+    FloatComputationError = -20,
+    /// Internal fatal error.
+    /// User code will never see this error but keep it reserved to not rely on the value.
+    InternalFatal = -2147483648,
+}
+
+/// Convenience alias for the trait's fallible returns.
+pub type HostResult<T> = Result<T, HostError>;
+
+/// A `sha512Half` digest: the first 32 bytes of a SHA-512, as XRPL uses it.
+pub const HASH_LEN: usize = 32;
+
+trace_data_types! {
+    /// 8 little-endian bytes, rendered as a signed decimal.
+    Int64 = 1,
+    /// 8 little-endian bytes, rendered as an unsigned decimal.
+    Uint64 = 2,
+    /// A serialized XRPL float: 12 bytes, mantissa then exponent.
+    Xfloat = 3,
+    /// A 20-byte account ID, rendered as base58.
+    Account = 4,
+    /// A serialized `STAmount`.
+    Amount = 5,
+    /// Raw bytes, hex-encoded.
+    AsHex = 6,
+    /// Bytes rendered verbatim as text.
+    AsText = 7,
+}
+
+host_functions! {
+    /// The sequence number of the ledger being built, as 4 little-endian bytes.
+    #[gas = 60]
+    #[wasm_name = "ldgr_index"]
+    fn get_ledger_sqn(&self, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The close time of the parent (last-closed) ledger, as 4 little-endian bytes.
+    #[gas = 60]
+    #[wasm_name = "parent_ldgr_time"]
+    fn get_parent_ledger_time(&self, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The hash of the parent (last-closed) ledger, as 32 bytes.
+    #[gas = 60]
+    #[wasm_name = "parent_ldgr_hash"]
+    fn get_parent_ledger_hash(&self, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The base fee of the ledger being built, in drops, as 4 little-endian bytes.
+    #[gas = 60]
+    #[wasm_name = "base_fee"]
+    fn get_base_fee(&self, out: &mut [u8]) -> HostResult<usize>;
+
+    /// Whether an amendment is enabled. The input is either its 32-byte id or its
+    /// name; the answer is `1` if enabled and `0` if not. Unlike the getters, this
+    /// reads an input region and returns the flag directly rather than writing bytes.
+    #[gas = 100]
+    #[wasm_name = "amendment_enabled"]
+    fn is_amendment_enabled(&self, amendment: &[u8]) -> HostResult<i32>;
+
+    /// Load the ledger object with the given 32-byte id into a cache slot, so later
+    /// calls can read its fields. `cache_idx` selects the slot (1-based); `0` asks the
+    /// host to assign a free one. Returns the slot used, or a negative error.
+    #[gas = 5000]
+    #[wasm_name = "cache_le"]
+    fn cache_ledger_obj(&self, obj_id: &[u8], cache_idx: i32) -> HostResult<i32>;
+
+    /// The serialized bytes of one field of the transaction being executed, selected
+    /// by its `SField` code.
+    #[gas = 70]
+    #[wasm_name = "tx_field"]
+    fn get_tx_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The serialized bytes of one field of the current (escrow) ledger object.
+    #[gas = 70]
+    #[wasm_name = "home_le_field"]
+    fn get_current_ledger_obj_field(&self, field: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The serialized bytes of one field of a previously cached ledger object,
+    /// selected by its cache slot and the field's `SField` code.
+    #[gas = 70]
+    #[wasm_name = "le_field"]
+    fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The serialized bytes of a nested field of the transaction, reached by a
+    /// `locator`: a path of little-endian `i32` steps (so its byte length is a
+    /// non-zero multiple of 4). Reads the locator region and writes the field bytes.
+    #[gas = 110]
+    #[wasm_name = "tx_inner"]
+    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The serialized bytes of a nested field of the current (escrow) ledger object,
+    /// reached by a `locator`, as with [`HostFunctions::get_tx_nested_field`].
+    #[gas = 110]
+    #[wasm_name = "home_le_inner"]
+    fn get_current_ledger_obj_nested_field(
+        &self,
+        locator: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The serialized bytes of a nested field of a previously cached ledger object,
+    /// selected by its cache slot and reached by a `locator`.
+    #[gas = 110]
+    #[wasm_name = "le_inner"]
+    fn get_ledger_obj_nested_field(
+        &self,
+        cache_idx: i32,
+        locator: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The number of elements in an array field of the transaction, selected by its
+    /// `SField` code. Answers the count directly, or a negative error (`NoArray` if
+    /// the field is not an array). Reads and writes no memory.
+    #[gas = 40]
+    #[wasm_name = "tx_arr_len"]
+    fn get_tx_array_len(&self, field: i32) -> HostResult<i32>;
+
+    /// The number of elements in an array field of the current (escrow) ledger
+    /// object, as with [`HostFunctions::get_tx_array_len`].
+    #[gas = 40]
+    #[wasm_name = "home_le_arr_len"]
+    fn get_current_ledger_obj_array_len(&self, field: i32) -> HostResult<i32>;
+
+    /// The number of elements in an array field of a previously cached ledger object,
+    /// selected by its cache slot and `SField` code.
+    #[gas = 40]
+    #[wasm_name = "le_arr_len"]
+    fn get_ledger_obj_array_len(&self, cache_idx: i32, field: i32) -> HostResult<i32>;
+
+    /// The number of elements in a nested array field of the transaction, reached by a
+    /// `locator`. Reads the locator region and answers the count directly.
+    #[gas = 70]
+    #[wasm_name = "tx_inner_arr_len"]
+    fn get_tx_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
+
+    /// The number of elements in a nested array field of the current (escrow) ledger
+    /// object, reached by a `locator`, as with [`HostFunctions::get_tx_nested_array_len`].
+    #[gas = 70]
+    #[wasm_name = "home_le_inner_arr_len"]
+    fn get_current_ledger_obj_nested_array_len(&self, locator: &[u8]) -> HostResult<i32>;
+
+    /// The number of elements in a nested array field of a previously cached ledger
+    /// object, selected by its cache slot and reached by a `locator`.
+    #[gas = 70]
+    #[wasm_name = "le_inner_arr_len"]
+    fn get_ledger_obj_nested_array_len(&self, cache_idx: i32, locator: &[u8]) -> HostResult<i32>;
+
+    /// Verify `signature` over `message` under `pubkey`. Reads the three regions and
+    /// answers `1` if the signature is valid, `0` if not, or a negative error.
+    ///
+    /// GAS DISCREPANCY: this 300 is the value the C-ABI fork registered
+    /// (`rippled-wasm-host-functions`, WasmVM.cpp), which this port follows. The
+    /// prior C++ integration in this tree charged 35000 for the same call — 100x
+    /// more, and closer to the real cost of signature verification. The value is
+    /// consensus-critical, so confirm which is intended before this ships.
+    #[gas = 300]
+    #[wasm_name = "check_sig"]
+    fn check_signature(
+        &self,
+        message: &[u8],
+        signature: &[u8],
+        pubkey: &[u8],
+    ) -> HostResult<i32>;
+
+    /// The 32-byte ledger key (keylet) of an account's `AccountRoot`, computed from a
+    /// 20-byte account id. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "accountroot_id"]
+    fn account_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an AMM, computed from its two assets. Each asset is a
+    /// byte slice whose length selects its kind (24 = MPT, 20 = XRP, 40 = issued
+    /// currency + issuer). Reads both asset regions and writes the keylet.
+    #[gas = 450]
+    #[wasm_name = "amm_id"]
+    fn amm_keylet(&self, asset1: &[u8], asset2: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `Check`, computed from a 20-byte account id and its
+    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
+    /// Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "check_id"]
+    fn check_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `Credential`, computed from the 20-byte subject and
+    /// issuer account ids and a credential-type byte string. Reads all three regions
+    /// and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "credential_id"]
+    fn credential_keylet(
+        &self,
+        subject: &[u8],
+        issuer: &[u8],
+        credential_type: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `Delegate` object, computed from the 20-byte account
+    /// and the account it authorizes. Reads both account regions and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "delegate_id"]
+    fn delegate_keylet(
+        &self,
+        account: &[u8],
+        authorize: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `DepositPreauth`, computed from the 20-byte account and
+    /// the account it authorizes to deposit. Reads both account regions and writes the
+    /// keylet.
+    #[gas = 350]
+    #[wasm_name = "deposit_preauth_id"]
+    fn deposit_preauth_keylet(
+        &self,
+        account: &[u8],
+        authorize: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an account's `DID`, computed from its 20-byte account id.
+    /// Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "did_id"]
+    fn did_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `Escrow`, computed from the 20-byte owner account and
+    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
+    /// pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "escrow_id"]
+    fn escrow_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `RippleState` (trust line), computed from two 20-byte
+    /// account ids and a 20-byte currency. Reads all three regions and writes the
+    /// keylet.
+    #[gas = 400]
+    #[wasm_name = "trustline_id"]
+    fn trust_line_keylet(
+        &self,
+        account1: &[u8],
+        account2: &[u8],
+        currency: &[u8],
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `MPTokenIssuance`, computed from the 20-byte issuer
+    /// account and its sequence number. `seq` is the guest's `u32` carried as its
+    /// `i32` bit pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "mpt_issuance_id"]
+    fn mptoken_issuance_keylet(
+        &self,
+        issuer: &[u8],
+        seq: i32,
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `MPToken`, computed from a 24-byte MPT issuance id and
+    /// the 20-byte holder account. Reads both regions and writes the keylet.
+    #[gas = 500]
+    #[wasm_name = "mptoken_id"]
+    fn mptoken_keylet(&self, mptid: &[u8], holder: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `NFTokenOffer`, computed from the 20-byte owner account
+    /// and its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
+    /// pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "nft_offer_id"]
+    fn nftoken_offer_keylet(
+        &self,
+        account: &[u8],
+        seq: i32,
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `Offer`, computed from the 20-byte owner account and
+    /// its sequence number. `seq` is the guest's `u32` carried as its `i32` bit
+    /// pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "offer_id"]
+    fn offer_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of an `Oracle`, computed from the 20-byte owner account and
+    /// its document id. `doc_id` is the guest's `u32` carried as its `i32` bit pattern.
+    /// Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "oracle_id"]
+    fn oracle_keylet(&self, account: &[u8], doc_id: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `PayChannel`, computed from the 20-byte source account,
+    /// the 20-byte destination account, and the channel's sequence number. `seq` is the
+    /// guest's `u32` carried as its `i32` bit pattern. Reads both account regions and
+    /// writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "paychan_id"]
+    fn paychannel_keylet(
+        &self,
+        account: &[u8],
+        destination: &[u8],
+        seq: i32,
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `PermissionedDomain`, computed from the 20-byte owner
+    /// account and its sequence number. `seq` is the guest's `u32` carried as its `i32`
+    /// bit pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "permissioned_domain_id"]
+    fn permissioned_domain_keylet(
+        &self,
+        account: &[u8],
+        seq: i32,
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `SignerList`, computed from its 20-byte owner account.
+    /// Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "signers_id"]
+    fn signer_list_keylet(&self, account: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `Ticket`, computed from the 20-byte owner account and its
+    /// ticket sequence number. `seq` is the guest's `u32` carried as its `i32` bit
+    /// pattern. Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "ticket_id"]
+    fn ticket_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 32-byte keylet of a `Vault`, computed from the 20-byte owner account and its
+    /// sequence number. `seq` is the guest's `u32` carried as its `i32` bit pattern.
+    /// Reads the account region and writes the keylet.
+    #[gas = 350]
+    #[wasm_name = "vault_id"]
+    fn vault_keylet(&self, account: &[u8], seq: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
+    #[gas = 2000]
+    #[wasm_name = "sha512_half"]
+    fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// Writes `msg` to the trace log, followed by `data` rendered as `data_type` says.
+    ///
+    /// The one declaration whose wasm function has **no result**: this node's own log
+    /// is its only effect, so a guest is told nothing. An `Err` from a host therefore
+    /// reaches it in no form, and only the host-fatal ones do anything at all.
+    ///
+    /// It is also the one declaration that is **not** the wasm parameter order.
+    /// `data_type` is the third wasm parameter, between the two regions, because that
+    /// is where xrpld's `trace_proto` and the guest stdlib put it; `register.rs` takes
+    /// the arguments in wasm order and calls this in declaration order.
+    #[gas = 30]
+    #[wasm_name = "trace"]
+    fn trace(&self, msg: &str, data: &[u8], data_type: TraceDataType) -> HostResult<()>;
+
+    /// Stores `data` as the current object's data field, replacing whatever was there,
+    /// and returns the number of bytes stored. Reads the data region; `DataFieldTooLarge`
+    /// if it exceeds the host's limit.
+    #[gas = 1000]
+    #[wasm_name = "set_data"]
+    fn update_data(&self, data: &[u8]) -> HostResult<i32>;
+
+    /// The URI of the `NFToken` with id `nft_id` (32 bytes) held by the 20-byte
+    /// `account`. Reads both regions and writes the URI bytes.
+    #[gas = 5000]
+    #[wasm_name = "nft_uri"]
+    fn get_nft(&self, account: &[u8], nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The 20-byte issuer account encoded in the `NFToken` id `nft_id` (32 bytes).
+    /// Reads the id region and writes the issuer bytes.
+    #[gas = 70]
+    #[wasm_name = "nft_issuer"]
+    fn get_nft_issuer(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The taxon encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
+    /// and writes the taxon as its four little-endian bytes.
+    #[gas = 60]
+    #[wasm_name = "nft_taxon"]
+    fn get_nft_taxon(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    /// The flags encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id region
+    /// and returns the flags as the call's scalar result.
+    #[gas = 60]
+    #[wasm_name = "nft_flags"]
+    fn get_nft_flags(&self, nft_id: &[u8]) -> HostResult<i32>;
+
+    /// The transfer fee encoded in the `NFToken` id `nft_id` (32 bytes). Reads the id
+    /// region and returns the fee as the call's scalar result.
+    #[gas = 60]
+    #[wasm_name = "nft_xfer_fee"]
+    fn get_nft_transfer_fee(&self, nft_id: &[u8]) -> HostResult<i32>;
+
+    /// The sequence number encoded in the `NFToken` id `nft_id` (32 bytes). Reads the
+    /// id region and writes the sequence as its four little-endian bytes.
+    #[gas = 60]
+    #[wasm_name = "nft_serial"]
+    fn get_nft_sequence(&self, nft_id: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
+    // A "float" here is an XRPL `Number` in its serialized form: a byte blob the guest
+    // holds opaquely and hands back to these functions. Inputs and outputs that are
+    // floats are byte regions; `mode` is the rounding mode, a scalar the guest chooses.
+
+    /// A float built from the signed integer `x` under rounding `mode`. Writes the
+    /// float bytes; no input region.
+    #[gas = 100]
+    #[wasm_name = "float_from_int"]
+    fn float_from_int(&self, x: i64, mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// A float built from the unsigned integer in the 8-byte region `x` under rounding
+    /// `mode`. Reads the integer region and writes the float bytes.
+    #[gas = 130]
+    #[wasm_name = "float_from_uint"]
+    fn float_from_uint(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// A float built from the serialized `STAmount` in `amount` under rounding `mode`.
+    /// Reads the amount region and writes the float bytes.
+    #[gas = 150]
+    #[wasm_name = "float_from_stamount"]
+    fn float_from_stamount(&self, amount: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// A float built from the serialized `STNumber` in `number` under rounding `mode`.
+    /// Reads the number region and writes the float bytes.
+    #[gas = 150]
+    #[wasm_name = "float_from_stnumber"]
+    fn float_from_stnumber(&self, number: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float `x` rounded to a signed integer under rounding `mode`. Reads the float
+    /// region and writes the integer as its eight little-endian bytes.
+    #[gas = 130]
+    #[wasm_name = "float_to_int"]
+    fn float_to_int(&self, x: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float `x` split into its mantissa and exponent. Reads the float region and
+    /// writes the mantissa (eight little-endian bytes) and the exponent (four little-
+    /// endian bytes) to two separate output regions.
+    #[gas = 130]
+    #[wasm_name = "float_to_mant_exp"]
+    fn float_to_mant_exp(
+        &self,
+        x: &[u8],
+        mantissa_out: &mut [u8],
+        exponent_out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// A float built from `mantissa` and `exponent` under rounding `mode`. Writes the
+    /// float bytes; no input region.
+    #[gas = 100]
+    #[wasm_name = "float_from_mant_exp"]
+    fn float_from_mant_exp(
+        &self,
+        mantissa: i64,
+        exponent: i32,
+        mode: i32,
+        out: &mut [u8],
+    ) -> HostResult<usize>;
+
+    /// Compares floats `x` and `y`, returning a negative, zero, or positive scalar as
+    /// `x` is less than, equal to, or greater than `y`. Reads both float regions.
+    #[gas = 80]
+    #[wasm_name = "float_cmp"]
+    fn float_compare(&self, x: &[u8], y: &[u8]) -> HostResult<i32>;
+
+    /// The float sum `x + y` under rounding `mode`. Reads both float regions and writes
+    /// the result bytes.
+    #[gas = 160]
+    #[wasm_name = "float_add"]
+    fn float_add(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float difference `x - y` under rounding `mode`. Reads both float regions and
+    /// writes the result bytes.
+    #[gas = 160]
+    #[wasm_name = "float_sub"]
+    fn float_subtract(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float product `x * y` under rounding `mode`. Reads both float regions and
+    /// writes the result bytes.
+    #[gas = 300]
+    #[wasm_name = "float_mult"]
+    fn float_multiply(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float quotient `x / y` under rounding `mode`. Reads both float regions and
+    /// writes the result bytes.
+    #[gas = 300]
+    #[wasm_name = "float_div"]
+    fn float_divide(&self, x: &[u8], y: &[u8], mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The `n`-th root of the float `x` under rounding `mode`. Reads the float region
+    /// and writes the result bytes.
+    #[gas = 5500]
+    #[wasm_name = "float_root"]
+    fn float_root(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
+
+    /// The float `x` raised to the power `n` under rounding `mode`. Reads the float
+    /// region and writes the result bytes.
+    #[gas = 5500]
+    #[wasm_name = "float_pow"]
+    fn float_power(&self, x: &[u8], n: i32, mode: i32, out: &mut [u8]) -> HostResult<usize>;
+}

crates/xrpl-host-functions/src/macros.rs

@@ -0,0 +1,102 @@
+//! The `macro_rules!` behind the two hand-listed enums, [`crate::HostError`] and
+//! [`crate::TraceDataType`].
+//!
+//! Each takes one list of `Variant = code,` and expands the enum together with the
+//! `ALL`/`code`/`from_code` set that must not fall behind it. The lists themselves stay
+//! in `lib.rs`, beside the `host_functions!` block.
+
+/// Declares [`crate::HostError`] from one list: the variants, `HostError::ALL` and
+/// `HostError::from_code`'s table all expand from the codes given.
+///
+/// One list is what makes `ALL` complete. Rust cannot enumerate an enum's
+/// variants — an exhaustive `match` forces an arm per variant but gives nothing to
+/// iterate — so a hand-written `ALL` beside a hand-written enum could only be kept
+/// in step by review, and `ALL`'s whole purpose is to be the set a test can trust.
+/// A code added to the list gains its `ALL` entry and its `from_code` arm by
+/// construction. `HostFunctionSpec::ALL` is complete the same way, from the
+/// `host_functions!` block.
+macro_rules! host_errors {
+    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
+        /// Error codes a host function may return.
+        ///
+        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+        #[repr(i32)]
+        pub enum HostError {
+            $($(#[$doc])* $variant = $code,)+
+        }
+
+        impl HostError {
+            /// Every error a host function may return, in code order.
+            ///
+            /// The complete set, and complete by construction: a wasm engine's
+            /// split between the codes it hands the guest and the conditions it
+            /// traps on is a decision per variant, so the test that checks the
+            /// split iterates this and a code added to the ABI cannot slip past it.
+            pub const ALL: &'static [HostError] = &[$(HostError::$variant,)+];
+
+            /// The negative wire value a failed call returns. Every code but
+            /// `InternalFatal` is one a guest reads off that value.
+            #[inline]
+            pub const fn code(self) -> i32 {
+                self as i32
+            }
+
+            /// Reconstruct a `HostError` from its wire code.
+            ///
+            /// A code this ABI does not define is `InternalFatal`: an answer the
+            /// caller cannot act on is the call not having been served, and that is
+            /// the variant which says so. Positive values are not errors at all and go
+            /// the same way, since this is reached only once a negative return has
+            /// been read as a failure.
+            pub const fn from_code(code: i32) -> HostError {
+                match code {
+                    $($code => HostError::$variant,)+
+                    _ => HostError::InternalFatal,
+                }
+            }
+        }
+    };
+}
+
+/// Declares [`crate::TraceDataType`] from one list, so `TraceDataType::ALL`,
+/// `TraceDataType::code` and `TraceDataType::from_code` cannot fall behind the
+/// variants — the reason `host_errors!` above is written this way.
+macro_rules! trace_data_types {
+    ($($(#[$doc:meta])* $variant:ident = $code:literal,)+) => {
+        /// How [`HostFunctions::trace`] is to read its data buffer.
+        ///
+        /// The discriminants are wire values shared with the guest stdlib: append only,
+        /// never renumber. They start at 1, so a zeroed argument names no type rather
+        /// than the first one.
+        ///
+        /// This is the declaration a guest and a host both compile against. The host
+        /// side needs a second one — `cxx` cannot be a dependency here, since this
+        /// crate also links into the guest — so `xrpl-wasm-vm-ffi` declares a shared
+        /// enum for C++ and converts, exhaustively, from this.
+        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+        #[repr(i32)]
+        pub enum TraceDataType {
+            $($(#[$doc])* $variant = $code,)+
+        }
+
+        impl TraceDataType {
+            /// Every data type a guest may name, in code order.
+            pub const ALL: &'static [TraceDataType] = &[$(TraceDataType::$variant,)+];
+
+            /// The wire value a guest passes to name this type.
+            #[inline]
+            pub const fn code(self) -> i32 {
+                self as i32
+            }
+
+            /// The type `code` names, or `None`: the engine drops a call it cannot
+            /// read rather than guessing at a rendering the guest did not ask for.
+            pub const fn from_code(code: i32) -> Option<TraceDataType> {
+                match code {
+                    $($code => Some(TraceDataType::$variant),)+
+                    _ => None,
+                }
+            }
+        }
+    };
+}

crates/xrpl-host-functions/tests/expansion_hygiene.rs

@@ -0,0 +1,34 @@
+//! `host_functions!` must work outside the crate that declares the ABI: the only
+//! names its expansion needs are the ones the declarations themselves spell.
+
+use xrpl_host_functions::HostResult;
+use xrpl_host_functions_macros::host_functions;
+
+host_functions! {
+    /// Answers with the number it was given.
+    #[gas = 7]
+    #[wasm_name = "ping"]
+    fn ping(&self, number: i32) -> HostResult<i32>;
+}
+
+struct Host;
+
+impl HostFunctions for Host {
+    fn ping(&self, number: i32) -> HostResult<i32> {
+        Ok(number)
+    }
+}
+
+#[test]
+fn the_generated_table_stands_on_its_own() {
+    assert_eq!(HostFunctionSpec::ALL.len(), 1);
+    assert_eq!(HostFunctionSpec::Ping.wasm_name(), "ping");
+    assert_eq!(HostFunctionSpec::Ping.gas(), 7);
+}
+
+/// The generated trait is implementable from another crate, which is the point of
+/// declaring the ABI in a library at all.
+#[test]
+fn the_generated_trait_is_implementable_here() {
+    assert_eq!(Host.ping(3), Ok(3));
+}

crates/xrpl-host-functions/tests/host_errors.rs

@@ -0,0 +1,102 @@
+//! Exercises what `host_errors!` generates: the wire codes, the set
+//! [`HostError::ALL`] names, and the round trip between them.
+//!
+//! The codes are consensus input — they are what a guest reads off a failed host
+//! call — so they are pinned here as literals and derived everywhere else.
+
+use xrpl_host_functions::HostError;
+
+/// The whole set, written out in the order `ALL` gives it: the one place the wire
+/// codes appear as literals, and a deliberate change-detector, since a code that
+/// moves changes what every deployed guest is told.
+#[test]
+fn the_error_table_matches_the_declarations() {
+    let table: Vec<(HostError, i32)> = HostError::ALL
+        .iter()
+        .map(|&error| (error, error.code()))
+        .collect();
+
+    assert_eq!(
+        table,
+        [
+            (HostError::Unimplemented, -1),
+            (HostError::FieldNotFound, -2),
+            (HostError::BufferTooSmall, -3),
+            (HostError::NoArray, -4),
+            (HostError::NotLeafField, -5),
+            (HostError::LocatorMalformed, -6),
+            (HostError::SlotOutRange, -7),
+            (HostError::SlotsFull, -8),
+            (HostError::EmptySlot, -9),
+            (HostError::LedgerObjNotFound, -10),
+            (HostError::OutOfTransferLimit, -11),
+            (HostError::DataFieldTooLarge, -12),
+            (HostError::PointerOutOfBounds, -13),
+            (HostError::NoMemExported, -14),
+            (HostError::InvalidParams, -15),
+            (HostError::InvalidAccount, -16),
+            (HostError::InvalidField, -17),
+            (HostError::IndexOutOfBounds, -18),
+            (HostError::FloatInputMalformed, -19),
+            (HostError::FloatComputationError, -20),
+            (HostError::InternalFatal, i32::MIN),
+        ]
+    );
+}
+
+/// The guest-facing set is `-1 ..= -20` and nothing else: those entries are xrpld's
+/// `HostFunctionError`, and each is a code some contract may read.
+///
+/// `InternalFatal` is the one deliberate exception, exempted by name rather than by
+/// widening the range: a condition with no number a contract can act on needs no number
+/// in the range a contract reads, and holding it at `i32::MIN` is what keeps it from
+/// ever colliding with a code appended to xrpld's list.
+#[test]
+fn every_code_but_the_sentinel_is_in_the_shared_range() {
+    let shared: Vec<HostError> = HostError::ALL
+        .iter()
+        .copied()
+        .filter(|&error| error != HostError::InternalFatal)
+        .collect();
+
+    let outside: Vec<HostError> = shared
+        .iter()
+        .copied()
+        .filter(|error| !(-20..=-1).contains(&error.code()))
+        .collect();
+
+    assert!(outside.is_empty(), "outside -1..=-20: {outside:?}");
+    assert_eq!(shared.len(), 20);
+    assert_eq!(HostError::InternalFatal.code(), i32::MIN);
+    assert_eq!(HostError::ALL.len(), 21);
+}
+
+/// Every code a guest can be handed comes back as the error that produced it, so a
+/// caller reading a negative return value recovers the condition and not a
+/// neighbouring one. The table above pins the numbers; this adds only the round
+/// trip.
+#[test]
+fn every_wire_code_round_trips_back_to_its_error() {
+    for &error in HostError::ALL {
+        assert_eq!(HostError::from_code(error.code()), error, "{error:?}");
+    }
+}
+
+/// A code from outside the set is `InternalFatal`: a host answering something this ABI
+/// does not define has not served the call, whatever it meant by it, and success is not
+/// an error at all.
+///
+/// `-21` is the code xrpld would append next, so it is the one that decides whether a
+/// list this crate has not caught up with reaches a guest or stops the run. `i32::MIN +
+/// 1` is next to the sentinel and unassigned, which is what makes the sentinel a value
+/// rather than a range.
+#[test]
+fn a_code_outside_the_set_is_internal_fatal() {
+    for code in [-21, i32::MIN + 1, 0, 1, i32::MAX] {
+        assert_eq!(
+            HostError::from_code(code),
+            HostError::InternalFatal,
+            "{code}"
+        );
+    }
+}

crates/xrpl-wasm-testkit/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "xrpl-wasm-testkit"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+crate-type = ["staticlib", "rlib"]
+
+[dependencies]
+cxx.workspace = true
+wat = "1"

crates/xrpl-wasm-testkit/src/lib.rs

@@ -0,0 +1,49 @@
+//! Assembles WebAssembly text for the C++ test suite. **Test-only.**
+//!
+//! A crate of its own rather than an entry on `xrpl-wasm-vm-ffi`, and the separation is the
+//! point. The engine pins `wasmi = { default-features = false }` precisely so a text
+//! assembler cannot reach the consensus path — wasmi's `wat` feature is on by default and
+//! makes `Module::new` accept text as readily as binary, which would make a transaction's
+//! validity a build flag (review finding A5). Putting `compile_wat` on the production bridge
+//! would link `wat` into xrpld even if nothing called it.
+//!
+//! Linked only into `xrpl_tests`, never into `libxrpl` or `xrpld`, so "no assembler in the
+//! shipped node" is a property of the link graph rather than a flag someone can flip.
+#![deny(rustdoc::broken_intra_doc_links)]
+
+#[cxx::bridge(namespace = "rs::wasm_testkit")]
+mod ffi {
+    extern "Rust" {
+        /// Assemble `wat` to a wasm module.
+        ///
+        /// Throws `rust::Error` on invalid input, which is what a test wants: a typo in a
+        /// fixture should fail the test that holds it, at the line that holds it.
+        fn compile_wat(wat: &str) -> Result<Vec<u8>>;
+    }
+}
+
+fn compile_wat(wat: &str) -> Result<Vec<u8>, wat::Error> {
+    wat::parse_str(wat)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::compile_wat;
+
+    #[test]
+    fn a_module_assembles_to_something_beginning_with_the_wasm_magic() {
+        let wasm = compile_wat("(module)").expect("assembles");
+
+        assert_eq!(&wasm[..4], b"\0asm");
+    }
+
+    #[test]
+    fn a_typo_is_an_error_rather_than_a_module() {
+        let error = compile_wat("(module (func (export").expect_err("must not assemble");
+
+        assert!(
+            !error.to_string().is_empty(),
+            "the error has to say something"
+        );
+    }
+}

crates/xrpl-wasm-vm-ffi/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "xrpl-wasm-vm-ffi"
+version = "0.1.0"
+edition.workspace = true
+
+[lib]
+crate-type = ["staticlib", "rlib"]
+
+[dependencies]
+cxx.workspace = true
+xrpl-host-functions = { path = "../xrpl-host-functions" }
+xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }

crates/xrpl-wasm-vm/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "xrpl-wasm-vm"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+wasmi = { version = "1.1.0", default-features = false, features = ["std"] }
+xrpl-host-functions = { path = "../xrpl-host-functions" }
+
+[dev-dependencies]
+wat = "1"

crates/xrpl-wasm-vm/src/abi.rs

@@ -0,0 +1,824 @@
+use crate::region::Region;
+use crate::vm::{MAX_FIELD_BYTES, VmState};
+use wasmi::{Caller, Memory};
+use xrpl_host_functions::{HostError, HostFunctionSpec, HostFunctions, HostResult};
+
+/// A condition that stops the run. It is a property of the run rather than an answer
+/// to a call, so it reaches no guest and carries no wire code — which is why it is
+/// not a [`HostError`]: no host can report one and no contract can read one.
+///
+/// The three are the outcomes a host call can end a run with, and
+/// `From<Fault> for RunError` in `vm.rs` is where each gets its name.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Fault {
+    /// This call's charge would take the meter below zero. The guest exhausting the
+    /// meter with its own instructions reaches [`crate::vm::RunError::OutOfGas`] by
+    /// wasmi's `OutOfFuel` trap instead, never through here.
+    OutOfGas,
+    /// The call could not be served: either the host said so, or this engine's own
+    /// fuel meter did not answer.
+    Internal,
+    /// There is no linear memory to work in — the module exports none, or the call
+    /// came from a start section, which runs before there is an instance.
+    NoMemory,
+}
+
+/// How a host call fails: with a code the guest reads off the return value, or with a
+/// [`Fault`] that stops the run.
+///
+/// **The variant picks the channel.** [`to_wire`] reads it rather than asking a
+/// predicate, so the two cannot disagree, and a [`FatalHostError`] cannot be built
+/// around something a guest was supposed to see.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum CallError {
+    Code(HostError),
+    Fatal(Fault),
+}
+
+/// A host call's result inside the engine: [`HostResult`] plus the faults only the
+/// engine can raise.
+pub(crate) type CallResult<T> = Result<T, CallError>;
+
+/// Which channel a host's answer takes, decided once, here.
+///
+/// Three codes stop the run instead of reaching the contract that asked. Each says the
+/// call was not served at all — the host could not do it, it has not been wired, or
+/// there is nowhere to put the answer — and a contract has no business interpreting
+/// any of them, so it is told nothing and the run ends. Every other code is the
+/// contract's to read.
+impl From<HostError> for CallError {
+    fn from(error: HostError) -> CallError {
+        match error {
+            HostError::InternalFatal => CallError::Fatal(Fault::Internal),
+            HostError::Unimplemented => CallError::Fatal(Fault::Internal),
+            HostError::NoMemExported => CallError::Fatal(Fault::NoMemory),
+            code => CallError::Code(code),
+        }
+    }
+}
+
+/// The payload a trap carries so [`crate::vm::run`] can name the outcome without
+/// parsing a message. Holds a [`Fault`], so by construction no guest-visible code can
+/// leave through this channel.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct FatalHostError(pub(crate) Fault);
+
+impl wasmi::errors::HostError for FatalHostError {}
+
+impl core::fmt::Display for FatalHostError {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "host call refused: {:?}", self.0)
+    }
+}
+
+/// Charge the call's gas, run its body, put the result on the wire. The one path
+/// every registered closure takes, so gas cannot be forgotten.
+pub(crate) fn charged(
+    caller: &mut Caller<'_, VmState<'_>>,
+    op: HostFunctionSpec,
+    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<i32>,
+) -> Result<i32, wasmi::Error> {
+    to_wire(charge(caller, op.gas()).and_then(|()| body(caller)))
+}
+
+/// [`charged`] for a call the guest gets no answer from: its wasm function has no
+/// result, so a soft error has nowhere to go and is dropped. The gas is charged first
+/// and charged whatever happens after, so the cost is all such a call leaves behind.
+///
+/// Only `trace` takes this path.
+pub(crate) fn charged_unreported(
+    caller: &mut Caller<'_, VmState<'_>>,
+    op: HostFunctionSpec,
+    body: impl FnOnce(&mut Caller<'_, VmState<'_>>) -> CallResult<()>,
+) -> Result<(), wasmi::Error> {
+    dropped(charge(caller, op.gas()).and_then(|()| body(caller)))
+}
+
+/// [`to_wire`] for a call with no result: there is no return value to encode a code
+/// in, so it is dropped. A [`Fault`] still stops the run — that is a property of the
+/// run, not an answer to the call.
+fn dropped(result: CallResult<()>) -> Result<(), wasmi::Error> {
+    match result {
+        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
+        _ => Ok(()),
+    }
+}
+
+fn to_wire(result: CallResult<i32>) -> Result<i32, wasmi::Error> {
+    match result {
+        Ok(value) => Ok(value),
+        Err(CallError::Code(error)) => Ok(error.code()),
+        Err(CallError::Fatal(fault)) => Err(wasmi::Error::host(FatalHostError(fault))),
+    }
+}
+
+/// Deduct `cost` fuel; [`Fault::OutOfGas`] if it would go negative.
+///
+/// A meter that will not answer is this crate's own defect, not the contract's, so it
+/// is [`Fault::Internal`] rather than a number a guest could act on.
+fn charge<T>(caller: &mut Caller<'_, T>, cost: u64) -> CallResult<()> {
+    let remaining = caller
+        .get_fuel()
+        .map_err(|_| CallError::Fatal(Fault::Internal))?;
+    match remaining.checked_sub(cost) {
+        Some(left) => caller
+            .set_fuel(left)
+            .map_err(|_| CallError::Fatal(Fault::Internal)),
+        None => {
+            let _ = caller.set_fuel(0);
+            Err(CallError::Fatal(Fault::OutOfGas))
+        }
+    }
+}
+
+fn charge_transfer(state: &VmState<'_>, n: usize) -> Result<(), HostError> {
+    let n = n as u64;
+    let remaining = state.transfer_budget.get();
+    match remaining.checked_sub(n) {
+        Some(left) => {
+            state.transfer_budget.set(left);
+            Ok(())
+        }
+        None => Err(HostError::OutOfTransferLimit),
+    }
+}
+
+fn memory(caller: &Caller<'_, VmState<'_>>) -> CallResult<Memory> {
+    caller
+        .data()
+        .memory
+        .ok_or(CallError::Fatal(Fault::NoMemory))
+}
+
+/// [`Region::read`] of the guest's memory, for a call that reads and writes nothing
+/// back (`trace`).
+pub(crate) fn read_borrowed<'a>(
+    caller: &'a Caller<'_, VmState<'_>>,
+    input: Region,
+) -> CallResult<&'a [u8]> {
+    let mem = memory(caller)?;
+    Ok(input.read(mem.data(caller))?)
+}
+
+/// Decode a guest `u32` argument — a keylet's sequence number or document id — from
+/// its four little-endian bytes, carried on to the host as its `i32` bit pattern.
+///
+/// The ABI transports these as a 4-byte region rather than a wasm scalar (the guest
+/// SDK passes `seq.to_le_bytes()`), so the region must be exactly four bytes;
+/// `InvalidParams` otherwise, matching the C-ABI wrapper's `getDataUInt32`.
+pub(crate) fn read_u32_arg(bytes: &[u8]) -> HostResult<i32> {
+    let arr: [u8; 4] = bytes.try_into().map_err(|_| HostError::InvalidParams)?;
+    Ok(i32::from_le_bytes(arr))
+}
+
+/// Service a call whose answer is bytes, written straight into the guest's output
+/// region.
+///
+/// **`fill` returns the value's true length, not what it wrote**: a host holding 64
+/// bytes and offered room for 4 writes nothing and answers `64`, which is how the
+/// guest learns the size to ask for. So `n` is bounded by neither the region nor the
+/// cap, and both checks below are reachable.
+pub(crate) fn write_into(
+    caller: &mut Caller<'_, VmState<'_>>,
+    out: Region,
+    fill: impl FnOnce(&dyn HostFunctions, &mut [u8]) -> HostResult<usize>,
+) -> CallResult<i32> {
+    let range = out.range()?;
+    let cap = range.len();
+    let mem = memory(caller)?;
+    let host: &dyn HostFunctions = caller.data().host;
+    // Bounds-checked over the guest's whole declared region, so a buffer running
+    // past memory is a wrong pointer rather than a truncated prefix being served…
+    let buf = mem
+        .data_mut(&mut *caller)
+        .get_mut(range)
+        .ok_or(HostError::PointerOutOfBounds)?;
+    // …of which only the field cap is writable, so no call can exceed it whatever
+    // the guest declared.
+    let buf = &mut buf[..cap.min(MAX_FIELD_BYTES)];
+
+    let n = fill(host, buf)?;
+
+    if n > MAX_FIELD_BYTES {
+        return Err(HostError::DataFieldTooLarge.into());
+    }
+    if n > cap {
+        return Err(HostError::BufferTooSmall.into());
+    }
+    charge_transfer(caller.data(), n)?;
+    #[expect(
+        clippy::cast_possible_truncation,
+        clippy::cast_possible_wrap,
+        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
+    )]
+    let n = n as i32;
+    Ok(n)
+}
+
+/// Service a call that reads guest memory and writes bytes back to it: the host
+/// fills the run's output buffer, which is copied to the guest once every rule has
+/// passed.
+///
+/// `call` gets the guest's whole memory, so it can borrow any number of input
+/// regions with [`Region::read`] — which a `&mut` view of that memory would forbid.
+/// That is why the answer goes through a buffer instead of straight into the guest
+/// as [`write_into`]'s does.
+///
+/// **The host is never told the guest's capacity**: it is offered the whole buffer
+/// and reports the value's true length, so the fit is decided here, with nothing yet
+/// in guest memory. A refused value therefore reaches it in no part.
+///
+/// The output is judged after the inputs, so a call with both bad reports the
+/// input's verdict. `NoMemExported` precedes both: there is no memory to validate a
+/// region against.
+pub(crate) fn write_buffered(
+    caller: &mut Caller<'_, VmState<'_>>,
+    out: Region,
+    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8]) -> HostResult<usize>,
+) -> CallResult<i32> {
+    let mem = memory(caller)?;
+    // One borrow split in two: the guest's bytes for the inputs, the store data for
+    // the output buffer. Taking them together is what keeps the inputs borrowed
+    // rather than copied out.
+    let (data, state) = mem.data_and_store_mut(&mut *caller);
+    let host: &dyn HostFunctions = state.host;
+
+    let n = call(host, data, &mut state.out_buffer[..])?;
+
+    // `out` is checked here rather than before the call: the inputs are judged
+    // first, so a call with both malformed reports the input's verdict.
+    let range = out.range()?;
+    let cap = range.len();
+    if n > MAX_FIELD_BYTES {
+        return Err(HostError::DataFieldTooLarge.into());
+    }
+    let buf = data.get_mut(range).ok_or(HostError::PointerOutOfBounds)?;
+    if n > cap {
+        return Err(HostError::BufferTooSmall.into());
+    }
+    charge_transfer(state, n)?;
+    buf[..n].copy_from_slice(&state.out_buffer[..n]);
+    #[expect(
+        clippy::cast_possible_truncation,
+        clippy::cast_possible_wrap,
+        reason = "`n > MAX_FIELD_BYTES` returned above, and the cap is far inside i32"
+    )]
+    let n = n as i32;
+    Ok(n)
+}
+
+/// The mantissa and exponent widths `float_to_mant_exp` writes: an `i64` and an `i32`.
+/// Fixed by the ABI, not the guest, so the split is a constant rather than a reported
+/// length.
+const MANTISSA_BYTES: usize = 8;
+const EXPONENT_BYTES: usize = 4;
+
+/// Service `float_to_mant_exp`, the one call that writes two output regions: the host
+/// fills the run's output buffer with the mantissa followed by the exponent, and each
+/// is copied to its own guest region once every rule has passed.
+///
+/// Like [`write_buffered`], the host reads its input from the guest's memory and writes
+/// to a scratch buffer, so the input stays borrowed rather than copied. The two output
+/// regions are judged after the input, and the mantissa's region before the exponent's,
+/// so the first fault reported is the leftmost.
+///
+/// The two widths are the ABI's rather than the guest's, so the length the host reports
+/// is checked against their sum for equality rather than as a bound, and ahead of the
+/// output regions: a wrong total means there is no answer to place, whatever the guest
+/// declared. That is a fatal error and not a status, since the guest asked for nothing
+/// wrong.
+pub(crate) fn write_mant_exp(
+    caller: &mut Caller<'_, VmState<'_>>,
+    mantissa_out: Region,
+    exponent_out: Region,
+    call: impl FnOnce(&dyn HostFunctions, &[u8], &mut [u8], &mut [u8]) -> HostResult<usize>,
+) -> CallResult<i32> {
+    let mem = memory(caller)?;
+    let (data, state) = mem.data_and_store_mut(&mut *caller);
+    let host: &dyn HostFunctions = state.host;
+
+    // The scratch buffer is split at the fixed mantissa width: the host fills the first
+    // eight bytes with the mantissa and the next four with the exponent.
+    let (mant_buf, exp_buf) = state.out_buffer.split_at_mut(MANTISSA_BYTES);
+    let mant_buf = &mut mant_buf[..MANTISSA_BYTES];
+    let exp_buf = &mut exp_buf[..EXPONENT_BYTES];
+
+    let total = call(host, data, mant_buf, exp_buf)?;
+
+    // Both buffers are fixed-width and were offered whole, so the only length the host
+    // can correctly report is their sum. Anything else is the host contradicting the
+    // ABI: with the widths in doubt, part of what would be copied out is whatever the
+    // previous call left in the buffer, so none of it is copied.
+    if total != MANTISSA_BYTES + EXPONENT_BYTES {
+        return Err(HostError::InternalFatal.into());
+    }
+
+    // Copy the mantissa, then the exponent, each only if its whole value fits its
+    // region — a region too small is `BufferTooSmall`, with nothing written.
+    let mant_range = mantissa_out.range()?;
+    let mant_dst = data
+        .get_mut(mant_range)
+        .ok_or(HostError::PointerOutOfBounds)?;
+    if mant_dst.len() < MANTISSA_BYTES {
+        return Err(HostError::BufferTooSmall.into());
+    }
+    mant_dst[..MANTISSA_BYTES].copy_from_slice(&state.out_buffer[..MANTISSA_BYTES]);
+
+    let exp_range = exponent_out.range()?;
+    let exp_dst = data
+        .get_mut(exp_range)
+        .ok_or(HostError::PointerOutOfBounds)?;
+    if exp_dst.len() < EXPONENT_BYTES {
+        return Err(HostError::BufferTooSmall.into());
+    }
+    exp_dst[..EXPONENT_BYTES]
+        .copy_from_slice(&state.out_buffer[MANTISSA_BYTES..MANTISSA_BYTES + EXPONENT_BYTES]);
+
+    charge_transfer(state, MANTISSA_BYTES + EXPONENT_BYTES)?;
+    #[expect(
+        clippy::cast_possible_truncation,
+        clippy::cast_possible_wrap,
+        reason = "a total other than 12 returned above, and 12 is far inside i32"
+    )]
+    let total = total as i32;
+    Ok(total)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::vm::TRANSFER_LIMIT_BYTES;
+    use std::cell::Cell;
+    use wasmi::StoreLimitsBuilder;
+    use xrpl_host_functions::TraceDataType;
+
+    /// `charge_transfer` takes the store data, which has to hold a host.
+    struct UncalledHost;
+
+    impl HostFunctions for UncalledHost {
+        fn get_ledger_sqn(&self, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_parent_ledger_time(&self, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_parent_ledger_hash(&self, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_base_fee(&self, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn is_amendment_enabled(&self, _amendment: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn cache_ledger_obj(&self, _obj_id: &[u8], _cache_idx: i32) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_tx_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_current_ledger_obj_field(&self, _field: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_ledger_obj_field(
+            &self,
+            _cache_idx: i32,
+            _field: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_current_ledger_obj_nested_field(
+            &self,
+            _locator: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_ledger_obj_nested_field(
+            &self,
+            _cache_idx: i32,
+            _locator: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_tx_array_len(&self, _field: i32) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_current_ledger_obj_array_len(&self, _field: i32) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_ledger_obj_array_len(&self, _cache_idx: i32, _field: i32) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_tx_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_current_ledger_obj_nested_array_len(&self, _locator: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_ledger_obj_nested_array_len(
+            &self,
+            _cache_idx: i32,
+            _locator: &[u8],
+        ) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn check_signature(
+            &self,
+            _message: &[u8],
+            _signature: &[u8],
+            _pubkey: &[u8],
+        ) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn account_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn amm_keylet(&self, _asset1: &[u8], _asset2: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn check_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn credential_keylet(
+            &self,
+            _subject: &[u8],
+            _issuer: &[u8],
+            _credential_type: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn delegate_keylet(
+            &self,
+            _account: &[u8],
+            _authorize: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn deposit_preauth_keylet(
+            &self,
+            _account: &[u8],
+            _authorize: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn did_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn escrow_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn trust_line_keylet(
+            &self,
+            _account1: &[u8],
+            _account2: &[u8],
+            _currency: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn mptoken_issuance_keylet(
+            &self,
+            _issuer: &[u8],
+            _seq: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn mptoken_keylet(
+            &self,
+            _mptid: &[u8],
+            _holder: &[u8],
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn nftoken_offer_keylet(
+            &self,
+            _account: &[u8],
+            _seq: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn offer_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn oracle_keylet(
+            &self,
+            _account: &[u8],
+            _doc_id: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn paychannel_keylet(
+            &self,
+            _account: &[u8],
+            _destination: &[u8],
+            _seq: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn permissioned_domain_keylet(
+            &self,
+            _account: &[u8],
+            _seq: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn signer_list_keylet(&self, _account: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn ticket_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn vault_keylet(&self, _account: &[u8], _seq: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn trace(&self, _msg: &str, _data: &[u8], _data_type: TraceDataType) -> HostResult<()> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn update_data(&self, _data: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft(&self, _account: &[u8], _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft_issuer(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft_taxon(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft_flags(&self, _nft_id: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft_transfer_fee(&self, _nft_id: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn get_nft_sequence(&self, _nft_id: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_from_int(&self, _x: i64, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_from_uint(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_from_stamount(
+            &self,
+            _amount: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_from_stnumber(
+            &self,
+            _number: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_to_int(&self, _x: &[u8], _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_to_mant_exp(
+            &self,
+            _x: &[u8],
+            _mantissa_out: &mut [u8],
+            _exponent_out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_from_mant_exp(
+            &self,
+            _mantissa: i64,
+            _exponent: i32,
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_compare(&self, _x: &[u8], _y: &[u8]) -> HostResult<i32> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_add(
+            &self,
+            _x: &[u8],
+            _y: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_subtract(
+            &self,
+            _x: &[u8],
+            _y: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_multiply(
+            &self,
+            _x: &[u8],
+            _y: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_divide(
+            &self,
+            _x: &[u8],
+            _y: &[u8],
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_root(&self, _x: &[u8], _n: i32, _mode: i32, _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+        fn float_power(
+            &self,
+            _x: &[u8],
+            _n: i32,
+            _mode: i32,
+            _out: &mut [u8],
+        ) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
+    }
+
+    fn state(budget: u64) -> VmState<'static> {
+        VmState {
+            host: &UncalledHost,
+            mem_limits: StoreLimitsBuilder::new().build(),
+            transfer_budget: Cell::new(budget),
+            memory: None,
+            out_buffer: [0u8; MAX_FIELD_BYTES],
+        }
+    }
+
+    /// `wasmi::Error` is not `PartialEq`, so a test expecting the guest-visible
+    /// channel says so by going through here.
+    fn wire(result: CallResult<i32>) -> i32 {
+        to_wire(result)
+            .unwrap_or_else(|trap| panic!("expected a guest-visible status, got a trap: {trap}"))
+    }
+
+    #[test]
+    fn a_success_becomes_the_value_and_an_error_becomes_its_code() {
+        assert_eq!(wire(Ok(0)), 0);
+        assert_eq!(wire(Ok(32)), 32);
+        assert_eq!(wire(Err(HostError::BufferTooSmall.into())), -3);
+    }
+
+    /// The codes a host may answer that a contract must not see, and the fault each
+    /// becomes. Written out rather than derived from `From<HostError>`, which is what
+    /// they are asserting.
+    const STOPS_THE_RUN: [(HostError, Fault); 3] = [
+        (HostError::InternalFatal, Fault::Internal),
+        (HostError::Unimplemented, Fault::Internal),
+        (HostError::NoMemExported, Fault::NoMemory),
+    ];
+
+    /// Every fault, so the two tests below are the whole set and not a sample.
+    /// `From<Fault> for RunError` is what forces a fault added later to be
+    /// considered; this is what forces it to be tested.
+    const ALL_FAULTS: [Fault; 3] = [Fault::OutOfGas, Fault::Internal, Fault::NoMemory];
+
+    #[test]
+    fn a_code_that_stops_the_run_converts_to_its_fault() {
+        for (error, fault) in STOPS_THE_RUN {
+            assert_eq!(CallError::from(error), CallError::Fatal(fault), "{error:?}");
+        }
+    }
+
+    /// Over `HostError::ALL`, so it is the whole ABI and not a sample: a code added
+    /// to the ABI arrives already asserted to reach the guest as itself, and stopping
+    /// the run on it is then a change someone has to come and make.
+    ///
+    /// `OutOfTransferLimit` is the row worth reading twice: the one budget a
+    /// contract can be expected to handle, so it is told no rather than killed.
+    #[test]
+    fn every_other_code_reaches_the_guest_as_itself() {
+        for &error in HostError::ALL {
+            if STOPS_THE_RUN.iter().any(|&(stops, _)| stops == error) {
+                continue;
+            }
+            assert_eq!(CallError::from(error), CallError::Code(error), "{error:?}");
+            assert_eq!(wire(Err(error.into())), error.code(), "{error:?}");
+        }
+    }
+
+    /// The trap carries the fault, so `run` can name the outcome without parsing a
+    /// message.
+    #[test]
+    fn a_fault_becomes_a_trap_carrying_it() {
+        for fault in ALL_FAULTS {
+            let trap = to_wire(Err(CallError::Fatal(fault)))
+                .expect_err("a fault must not reach the guest as a code");
+            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
+                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
+            });
+            assert_eq!(*payload, FatalHostError(fault));
+        }
+    }
+
+    /// The result-less path splits the same two channels differently: a fault still
+    /// stops the run, and every code is dropped, since `trace` has no return value to
+    /// carry it. Over `HostError::ALL` for the reason above — a code added to the ABI
+    /// arrives asserted against both paths.
+    #[test]
+    fn a_call_with_no_result_drops_a_code_and_traps_on_a_fault() {
+        assert!(dropped(Ok(())).is_ok());
+
+        for &error in HostError::ALL {
+            if let CallError::Code(code) = CallError::from(error) {
+                assert!(
+                    dropped(Err(CallError::Code(code))).is_ok(),
+                    "{error:?} has no channel to the guest and must be dropped"
+                );
+            }
+        }
+
+        for fault in ALL_FAULTS {
+            let trap =
+                dropped(Err(CallError::Fatal(fault))).expect_err("a fault must stop the run");
+            let payload = trap.downcast_ref::<FatalHostError>().unwrap_or_else(|| {
+                panic!("{fault:?}: expected a FatalHostError payload, got: {trap}")
+            });
+            assert_eq!(*payload, FatalHostError(fault));
+        }
+    }
+
+    #[test]
+    fn a_transfer_spends_the_budget() {
+        let state = state(100);
+
+        assert_eq!(charge_transfer(&state, 30), Ok(()));
+        assert_eq!(state.transfer_budget.get(), 70);
+        assert_eq!(charge_transfer(&state, 70), Ok(()));
+        assert_eq!(state.transfer_budget.get(), 0);
+    }
+
+    /// The budget bounds the total, so the transfer that would overrun it is
+    /// refused whole rather than partially charged.
+    #[test]
+    fn a_transfer_past_the_budget_is_refused_and_charges_nothing() {
+        let state = state(100);
+
+        assert_eq!(
+            charge_transfer(&state, 101),
+            Err(HostError::OutOfTransferLimit)
+        );
+        assert_eq!(
+            state.transfer_budget.get(),
+            100,
+            "a refusal must not charge"
+        );
+        assert_eq!(charge_transfer(&state, 100), Ok(()));
+        assert_eq!(
+            charge_transfer(&state, 1),
+            Err(HostError::OutOfTransferLimit)
+        );
+    }
+
+    #[test]
+    fn transferring_nothing_costs_nothing() {
+        let state = state(0);
+
+        assert_eq!(charge_transfer(&state, 0), Ok(()));
+        assert_eq!(state.transfer_budget.get(), 0);
+    }
+
+    /// The field cap holds one call to a small share of the run's budget, so the
+    /// budget bounds a run rather than a call. An inequality, not the two values:
+    /// those are pinned in `vm.rs`.
+    #[test]
+    fn no_single_value_can_exhaust_the_run_budget() {
+        assert!(
+            (MAX_FIELD_BYTES as u64) * 64 <= TRANSFER_LIMIT_BYTES,
+            "one {MAX_FIELD_BYTES}-byte value against a {TRANSFER_LIMIT_BYTES}-byte budget"
+        );
+    }
+}

crates/xrpl-wasm-vm/src/lib.rs

@@ -0,0 +1,28 @@
+//! The escrow wasm VM: compile a contract, meter it, and serve its host calls.
+//!
+//! Every guest access goes through `abi.rs` and reaches linear memory only by
+//! wasmi's bounds-checked slice operations; `forbid(unsafe_code)` makes that a
+//! property rather than a claim. The cast lints are on for the same reason — on a
+//! consensus path a truncating or sign-losing cast changes what a contract is
+//! charged or told, so each one is argued for at its site.
+#![forbid(unsafe_code)]
+#![deny(rustdoc::broken_intra_doc_links)]
+#![deny(unreachable_pub)]
+#![deny(
+    clippy::cast_possible_truncation,
+    clippy::cast_possible_wrap,
+    clippy::cast_sign_loss,
+    clippy::cast_lossless
+)]
+
+mod abi;
+mod preflight;
+mod region;
+mod register;
+mod vm;
+
+pub use preflight::{CheckError, check};
+pub use vm::{
+    MAX_FIELD_BYTES, MAX_MEMORY_BYTES, MAX_MEMORY_PAGES, RunError, RunFailure, RunOutcome,
+    TRANSFER_LIMIT_BYTES, run,
+};

crates/xrpl-wasm-vm/src/preflight.rs

@@ -0,0 +1,351 @@
+//! Screening a contract before it reaches the ledger.
+//!
+//! [`check`] answers whether [`crate::run`] would refuse a module before the
+//! guest's first instruction — the three stages a caller maps to a malformed
+//! transaction rather than to a failed one. It needs **no host, no store and no
+//! gas**: everything it reads is a property of the compiled module. That is what
+//! makes it callable from a transaction's preflight, which has no ledger to serve
+//! host calls from.
+//!
+//! Two things it deliberately does not screen. A module exporting **no** linear
+//! memory passes: a contract that makes no host call needs none, and one that
+//! does is refused at the call and charged for what it burned. A start section
+//! passes: it is guest code, and executing it is the one thing a check must not do
+//! — a trap in one is charged to the contract like any other trap.
+//!
+//! One thing it screens that a run can only discover: an exported memory larger
+//! than the engine grants. See [`check_memory`] for what stays invisible.
+
+use std::fmt;
+use wasmi::{ExternType, FuncType, Module, ValType};
+use xrpl_host_functions::HostFunctionSpec;
+
+use crate::register::HOST_MODULE;
+use crate::vm::{MAX_MEMORY_PAGES, compile};
+
+/// Why a module cannot be run. One variant per stage, since the caller maps the
+/// stages separately.
+#[derive(Debug)]
+pub enum CheckError {
+    /// `wasm` is not a valid module under this engine's configuration.
+    Compile(String),
+    /// An import no engine of this ABI defines: another module namespace, a name
+    /// that is not a host function, or one imported as something other than a
+    /// function.
+    Import(String),
+    /// No export named `function_name` with signature `() -> i32`.
+    EntryPoint(String),
+    /// The module asks for more linear memory than the engine grants.
+    Memory(String),
+}
+
+impl fmt::Display for CheckError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            CheckError::Compile(detail) => write!(f, "compile: {detail}"),
+            CheckError::Import(detail) => write!(f, "import: {detail}"),
+            // The detail says which of the entry point's failures this is, since
+            // "no entry point" would be wrong for an export of the wrong type.
+            CheckError::EntryPoint(detail) => write!(f, "{detail}"),
+            CheckError::Memory(detail) => write!(f, "memory: {detail}"),
+        }
+    }
+}
+
+/// Screen `wasm`: it must compile, import only what the engine serves, export
+/// `function_name` as `() -> i32`, and ask for no more memory than it may have.
+///
+/// The stages are ordered by how much of the module each explains. An import fault
+/// is reported before a missing entry point because the imports are what the rest of
+/// the module is built on; memory comes last, being a resource request rather than a
+/// mistake about the ABI.
+pub fn check(wasm: &[u8], function_name: &str) -> Result<(), CheckError> {
+    let module = compile(wasm).map_err(CheckError::Compile)?;
+    check_imports(&module)?;
+    check_entry_point(&module, function_name)?;
+    check_memory(&module)
+}
+
+/// Every import must be one the linker defines. The first that is not ends the
+/// check, so a module with several faults reports the earliest.
+fn check_imports(module: &Module) -> Result<(), CheckError> {
+    for import in module.imports() {
+        check_import(import.module(), import.name(), import.ty()).map_err(CheckError::Import)?;
+    }
+    Ok(())
+}
+
+/// Whether the engine defines this one import.
+///
+/// The set of names is [`HostFunctionSpec::ALL`], which is also what
+/// [`crate::register::register_host_functions`] iterates — so a check and a run
+/// cannot disagree about which names exist, and adding a host function extends
+/// both at once. The one thing this does not compare is `ty`'s *signature*, which
+/// still parts a module from the engine at instantiation; the kind is compared
+/// because the engine defines these names as functions and as nothing else.
+///
+/// The rules are ordered, not merely alternatives: a guest importing `env::malloc`
+/// is told about the namespace rather than that `malloc` is not a host function,
+/// because the namespace is the one that explains every other import it has too.
+fn check_import(module: &str, name: &str, ty: &ExternType) -> Result<(), String> {
+    if module != HOST_MODULE {
+        return Err(format!("'{module}::{name}' is not from '{HOST_MODULE}'"));
+    }
+    if !HostFunctionSpec::ALL
+        .iter()
+        .any(|op| op.wasm_name() == name)
+    {
+        return Err(format!("no host function '{name}'"));
+    }
+    if !matches!(ty, ExternType::Func(_)) {
+        return Err(format!("'{HOST_MODULE}::{name}' is not a function"));
+    }
+    Ok(())
+}
+
+fn check_entry_point(module: &Module, name: &str) -> Result<(), CheckError> {
+    match module.get_export(name) {
+        Some(ExternType::Func(ty)) if is_entry_point(&ty) => Ok(()),
+        found => Err(CheckError::EntryPoint(entry_point_fault(found, name))),
+    }
+}
+
+/// The entry point's type: nothing in, one `i32` out — what [`crate::run`]'s
+/// `get_typed_func::<(), i32>` accepts.
+fn is_entry_point(ty: &FuncType) -> bool {
+    ty.params().is_empty() && matches!(ty.results(), [ValType::I32])
+}
+
+/// A module may not declare more linear memory than the engine grants.
+///
+/// Only what it *exports* is visible here. A memory a module keeps to itself is not
+/// in its exports, and the store's limiter is what refuses that one — at
+/// instantiation, where the run is charged nothing and the caller cannot tell it
+/// from any other resource failure. Screening the exported case covers every
+/// contract built against the guest SDK, since a contract needs an exported memory
+/// to make a host call at all.
+fn check_memory(module: &Module) -> Result<(), CheckError> {
+    for export in module.exports() {
+        if let ExternType::Memory(ty) = export.ty() {
+            check_initial_pages(ty.minimum()).map_err(CheckError::Memory)?;
+        }
+    }
+    Ok(())
+}
+
+/// Whether the engine will grant a memory of this declared initial size.
+///
+/// The *minimum* only: a declared maximum past the cap is legal and simply
+/// unreachable, which `vm_limits::a_declared_maximum_past_the_cap_is_allowed_but_
+/// unreachable` pins on the run side. Refusing it here would turn a runnable
+/// contract away.
+fn check_initial_pages(pages: u64) -> Result<(), String> {
+    if pages > u64::from(MAX_MEMORY_PAGES) {
+        return Err(format!(
+            "initial memory of {pages} pages is past the {MAX_MEMORY_PAGES}-page cap"
+        ));
+    }
+    Ok(())
+}
+
+/// How an entry-point lookup failed, in the words both stages use: a check and a
+/// run describe the same module the same way, and "no entry point" would send a
+/// contract author looking for a function they already have.
+pub(crate) fn entry_point_fault(found: Option<ExternType>, name: &str) -> String {
+    match found {
+        Some(ExternType::Func(_)) => {
+            format!("entry point '{name}' has the wrong signature, expected '() -> i32'")
+        }
+        Some(_) => format!("export '{name}' is not a function"),
+        None => format!("no entry point '{name}'"),
+    }
+}
+
+/// The rules, one by one, on inputs built directly rather than parsed out of a
+/// module. `tests/preflight.rs` runs real modules through [`check`]; what is here is
+/// what a module cannot state precisely — which rule fires, in which order, and in
+/// what words the caller logs it.
+///
+/// `wat` is a dev-dependency, so the one test here that does need a module writes it
+/// as text like every other test in the crate. What the library must not gain is a
+/// text *entry point* — `check` and `run` take binaries — and a `cfg(test)` caller
+/// cannot give it one.
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wasmi::{GlobalType, MemoryType, Mutability};
+
+    /// A host function as a guest declares it. Any function type will do: the
+    /// signature is not what [`check_import`] compares.
+    fn a_function() -> ExternType {
+        ExternType::Func(FuncType::new([ValType::I32], [ValType::I32]))
+    }
+
+    /// A name every one of these tests can use, taken from the ABI rather than
+    /// spelled, so it stays a real host function as the ABI changes.
+    fn a_host_function_name() -> &'static str {
+        HostFunctionSpec::ALL[0].wasm_name()
+    }
+
+    // -----------------------------------------------------------------------
+    // Imports
+    // -----------------------------------------------------------------------
+
+    /// Every name the ABI declares is served. Derived from `ALL` rather than
+    /// listed, so a host function added to the ABI is covered the day it lands.
+    #[test]
+    fn every_declared_host_function_is_served() {
+        for op in HostFunctionSpec::ALL {
+            assert_eq!(
+                check_import(HOST_MODULE, op.wasm_name(), &a_function()),
+                Ok(()),
+                "{}",
+                op.wasm_name()
+            );
+        }
+    }
+
+    #[test]
+    fn an_import_from_another_namespace_is_refused() {
+        for namespace in ["env", "host", "host_lib2", ""] {
+            let refusal = check_import(namespace, a_host_function_name(), &a_function())
+                .expect_err(namespace);
+            assert!(
+                refusal.contains("is not from 'host_lib'"),
+                "{namespace}: {refusal}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_unknown_name_is_refused() {
+        let refusal =
+            check_import(HOST_MODULE, "no_such_function", &a_function()).expect_err("unknown name");
+        assert_eq!(refusal, "no host function 'no_such_function'");
+    }
+
+    /// The engine defines these names as functions and as nothing else, so a module
+    /// importing one as a global or a memory does not link either.
+    #[test]
+    fn a_host_function_imported_as_anything_else_is_refused() {
+        for ty in [
+            ExternType::Global(GlobalType::new(ValType::I32, Mutability::Const)),
+            ExternType::Memory(MemoryType::new(1, None)),
+        ] {
+            let name = a_host_function_name();
+            let refusal = check_import(HOST_MODULE, name, &ty).expect_err("not a function");
+            assert_eq!(refusal, format!("'host_lib::{name}' is not a function"));
+        }
+    }
+
+    /// The rules are ordered. An import that breaks two of them is reported by the
+    /// first, so the message a contract author reads is the one that explains the
+    /// rest of their imports too.
+    #[test]
+    fn the_namespace_is_reported_before_the_name() {
+        let refusal = check_import("env", "no_such_function", &a_function())
+            .expect_err("neither the namespace nor the name is served");
+
+        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
+        assert!(
+            !refusal.contains("no host function"),
+            "the namespace explains it: {refusal}"
+        );
+    }
+
+    /// Both halves of the type are load-bearing, and neither is checked anywhere
+    /// a module cannot reach.
+    #[test]
+    fn the_entry_point_type_is_nothing_in_and_one_i32_out() {
+        assert!(is_entry_point(&FuncType::new([], [ValType::I32])));
+
+        for wrong in [
+            FuncType::new([], []),
+            FuncType::new([], [ValType::I64]),
+            FuncType::new([ValType::I32], [ValType::I32]),
+            FuncType::new([], [ValType::I32, ValType::I32]),
+        ] {
+            assert!(!is_entry_point(&wrong), "{wrong:?}");
+        }
+    }
+
+    /// Three faults, three descriptions. A run reports these too, with wasmi's own
+    /// error appended, so a swapped arm would mislead at both stages at once.
+    #[test]
+    fn each_entry_point_fault_is_described_as_itself() {
+        assert_eq!(
+            entry_point_fault(Some(a_function()), "finish"),
+            "entry point 'finish' has the wrong signature, expected '() -> i32'"
+        );
+        assert_eq!(
+            entry_point_fault(
+                Some(ExternType::Global(GlobalType::new(
+                    ValType::I32,
+                    Mutability::Const
+                ))),
+                "finish"
+            ),
+            "export 'finish' is not a function"
+        );
+        assert_eq!(
+            entry_point_fault(None, "finish"),
+            "no entry point 'finish'",
+            "an absent export must not be reported as a wrong signature"
+        );
+    }
+
+    /// The cap itself is granted; one page past it is not. The boundary is the whole
+    /// rule, and it is the same boundary the store's limiter applies at
+    /// instantiation.
+    #[test]
+    fn the_initial_memory_may_reach_the_cap_but_not_pass_it() {
+        assert_eq!(check_initial_pages(0), Ok(()));
+        assert_eq!(check_initial_pages(u64::from(MAX_MEMORY_PAGES)), Ok(()));
+
+        let past = u64::from(MAX_MEMORY_PAGES) + 1;
+        let refusal = check_initial_pages(past).expect_err("one page past the cap");
+        assert_eq!(
+            refusal,
+            format!("initial memory of {past} pages is past the {MAX_MEMORY_PAGES}-page cap")
+        );
+    }
+
+    /// The bridge logs this string and the C++ tests match on it, so the stage's
+    /// prefix is part of the interface rather than a debugging aid.
+    #[test]
+    fn a_refusal_names_its_stage() {
+        assert_eq!(
+            CheckError::Compile("bad magic".to_string()).to_string(),
+            "compile: bad magic"
+        );
+        assert_eq!(
+            CheckError::Memory("initial memory of 129 pages".to_string()).to_string(),
+            "memory: initial memory of 129 pages"
+        );
+        assert_eq!(
+            CheckError::Import("no host function 'x'".to_string()).to_string(),
+            "import: no host function 'x'"
+        );
+        // The entry point's detail already says which of its three faults it is,
+        // so a prefix would only repeat it.
+        assert_eq!(
+            CheckError::EntryPoint("no entry point 'finish'".to_string()).to_string(),
+            "no entry point 'finish'"
+        );
+    }
+
+    #[test]
+    fn the_stages_run_in_order() {
+        assert!(
+            matches!(check(b"not wasm", "finish"), Err(CheckError::Compile(_))),
+            "nothing is screened until the module compiles"
+        );
+
+        // A module that compiles and imports nothing, so it reaches the entry point.
+        let empty = wat::parse_str("(module)").expect("assembles");
+        assert!(
+            matches!(check(&empty, "finish"), Err(CheckError::EntryPoint(_))),
+            "a module that compiles and imports nothing reaches the entry point"
+        );
+    }
+}

crates/xrpl-wasm-vm/src/region.rs

@@ -0,0 +1,50 @@
+use crate::vm::MAX_FIELD_BYTES;
+use core::ops::Range;
+use xrpl_host_functions::{HostError, HostResult};
+
+/// A byte region as the guest declared it: the `(ptr, len)` pair off the wire, not
+/// yet checked.
+///
+/// Every byte parameter in this ABI is such a pair, so pairing them once at the wire
+/// boundary is what keeps the helpers in `abi.rs` from each taking two loose integers
+/// they could be handed in either order.
+///
+/// It lives in a module of its own so that the fields are out of reach and
+/// [`range`](Region::range) is the *only* way to indices — the check cannot be
+/// skipped, only deferred. Construction is infallible for that reason: a call whose
+/// output region is malformed is then refused in the order its own helper chooses,
+/// rather than at the moment the pair happened to be formed.
+#[derive(Copy, Clone)]
+pub(crate) struct Region {
+    ptr: i32,
+    len: i32,
+}
+
+impl Region {
+    pub(crate) fn new(ptr: i32, len: i32) -> Region {
+        Region { ptr, len }
+    }
+
+    /// `start..end` as indices. The conversion is the negativity check — it fails on
+    /// exactly the negative values — and the addition guards a 32-bit `usize`, where
+    /// two `i32`s can sum past the end.
+    pub(crate) fn range(self) -> HostResult<Range<usize>> {
+        let (Ok(start), Ok(len)) = (usize::try_from(self.ptr), usize::try_from(self.len)) else {
+            return Err(HostError::InvalidParams);
+        };
+        let end = start
+            .checked_add(len)
+            .ok_or(HostError::PointerOutOfBounds)?;
+        Ok(start..end)
+    }
+
+    /// The region's bytes, refused past the field cap. No copy: the slice aliases
+    /// `data`.
+    pub(crate) fn read(self, data: &[u8]) -> HostResult<&[u8]> {
+        let range = self.range()?;
+        if range.len() > MAX_FIELD_BYTES {
+            return Err(HostError::DataFieldTooLarge);
+        }
+        data.get(range).ok_or(HostError::PointerOutOfBounds)
+    }
+}

crates/xrpl-wasm-vm/src/vm.rs

@@ -0,0 +1,353 @@
+use std::cell::Cell;
+use std::fmt;
+use std::sync::LazyLock;
+use wasmi::{
+    Config, Engine, Export, Linker, Memory, Module, Store, StoreLimits, StoreLimitsBuilder,
+    TrapCode,
+};
+use xrpl_host_functions::HostFunctions;
+
+use crate::abi::{FatalHostError, Fault};
+use crate::preflight::entry_point_fault;
+use crate::register::register_host_functions;
+
+/// wasm linear-memory page size, fixed by the wasm spec (64 KiB).
+const WASM_PAGE_BYTES: u32 = 64 * 1024;
+
+/// Linear-memory page cap.
+pub const MAX_MEMORY_PAGES: u32 = 128;
+
+/// [`MAX_MEMORY_PAGES`] in bytes: 8 MiB.
+pub const MAX_MEMORY_BYTES: usize = (MAX_MEMORY_PAGES * WASM_PAGE_BYTES) as usize;
+
+/// Total bytes that may cross the host/guest boundary in one [`run`], separate
+/// from gas.
+pub const TRANSFER_LIMIT_BYTES: u64 = 1 << 20;
+
+/// Size cap on any single value crossing the boundary, in either direction; over
+/// it is `DataFieldTooLarge`.
+///
+/// A protocol limit: `kMaxWasmDataLength` in `include/xrpl/protocol/Protocol.h`.
+pub const MAX_FIELD_BYTES: usize = 1024;
+
+/// State threaded through every host call, stored in the wasmi [`Store`].
+pub(crate) struct VmState<'h> {
+    pub(crate) host: &'h dyn HostFunctions,
+    /// Enforces [`MAX_MEMORY_BYTES`] via `Store::limiter`, which needs a `&mut`
+    /// into it from `&mut VmState` — hence a field rather than a local.
+    pub(crate) mem_limits: StoreLimits,
+    /// Remaining transfer budget for this run ([`TRANSFER_LIMIT_BYTES`]).
+    ///
+    /// A `Cell` because it is decremented from a shared `&Caller`. One thread per
+    /// invocation touches the store, so the lack of `Sync` costs nothing.
+    ///
+    /// TODO: the extra charge for an unaligned field copy has nothing to attach to
+    /// until this ABI gains a `FieldLocator` host function.
+    pub(crate) transfer_budget: Cell<u64>,
+    /// The guest's linear memory, resolved once by [`run`] after instantiation so
+    /// no host call pays for an export lookup.
+    ///
+    /// Caching the handle is sound because a [`Memory`] is an arena index, not a
+    /// pointer to the bytes: it survives `memory.grow`, and `data`/`data_mut`
+    /// re-derive the slice per call.
+    ///
+    /// The handle is scoped to one store, so this assumes **one module, one
+    /// instance, one store per `run`**. Module linking or nested execution would
+    /// have to resolve per instance: a cached handle would serve a call against the
+    /// wrong instance's memory, which is a wrong answer rather than an error.
+    pub(crate) memory: Option<Memory>,
+    /// Where a host writes a value before [`crate::abi::write_buffered`] copies it
+    /// to the guest. One buffer per run, so no call zero-fills one of its own.
+    ///
+    /// Inline rather than boxed: the store's data is built once and then only
+    /// borrowed, so a kilobyte in it costs a move where a `Box` costs an
+    /// allocation. A local would cost neither, but `forbid(unsafe_code)` means a
+    /// stack buffer is zero-filled — per call, which is the cost this removes.
+    pub(crate) out_buffer: [u8; MAX_FIELD_BYTES],
+}
+
+/// Outcome of running an escrow contract to completion.
+#[derive(Debug)]
+pub struct RunOutcome {
+    /// The value returned by the exported entry point (`finish`): `> 0` means
+    /// allow the escrow to finish.
+    pub result: i32,
+    /// Fuel (gas) consumed by the whole invocation — guest instructions plus
+    /// the per-call host charges.
+    pub fuel_used: u64,
+}
+
+/// Why a run produced no result. Each variant is one outcome for the caller to
+/// map to a TER.
+#[derive(Debug)]
+pub enum RunError {
+    /// `wasm` is not a valid module under this engine's configuration.
+    Compile(String),
+    /// The module compiled but the engine would not accept it: an import the
+    /// linker does not define, or an initial memory past the page cap. Not guest
+    /// code failing — a start section that traps is [`RunError::Trap`].
+    Instantiate(String),
+    /// No export named `function_name` with signature `() -> i32`: absent, not a
+    /// function, or a function of another type — which the detail tells apart.
+    EntryPoint(String),
+    /// Gas exhausted — by the guest's own instructions or by a host call's
+    /// charge. [`RunFailure::fuel_used`] is the whole limit.
+    OutOfGas,
+    /// The host could not serve a call.
+    Internal,
+    /// A host call had no linear memory to work in: the module exports none, or
+    /// the call came from a start section, which runs before there is an instance
+    /// to resolve the memory from.
+    NoMemory,
+    /// The guest trapped: `unreachable`, division by zero, an out-of-bounds
+    /// access, or `memory.grow` past the page cap. Wherever the guest was
+    /// executing, including a start section during instantiation.
+    Trap(String),
+}
+
+impl fmt::Display for RunError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            RunError::Compile(detail) => write!(f, "compile: {detail}"),
+            RunError::Instantiate(detail) => write!(f, "instantiate: {detail}"),
+            // The detail says which of the entry point's failures this is, since
+            // "no entry point" would be wrong for an export of the wrong type.
+            RunError::EntryPoint(detail) => write!(f, "{detail}"),
+            RunError::OutOfGas => write!(f, "out of gas"),
+            RunError::Internal => write!(f, "internal error"),
+            RunError::NoMemory => write!(f, "no exported memory"),
+            RunError::Trap(detail) => write!(f, "trap: {detail}"),
+        }
+    }
+}
+
+/// A failed run, with the gas it still owes: a contract that traps or exhausts
+/// its gas is charged for what it burned.
+#[derive(Debug)]
+pub struct RunFailure {
+    pub error: RunError,
+    /// Fuel consumed before the failure. The whole limit when gas ran out; `0`
+    /// when the module never ran.
+    pub fuel_used: u64,
+}
+
+impl fmt::Display for RunFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{} (fuel used: {})", self.error, self.fuel_used)
+    }
+}
+
+impl RunFailure {
+    /// A failure with no fuel accounted: it stopped the run at or before the guest's
+    /// first instruction, or under a store with no meter to read.
+    fn owing_nothing(error: RunError) -> RunFailure {
+        RunFailure {
+            error,
+            fuel_used: 0,
+        }
+    }
+}
+
+/// Fuel spent out of `gas`: the one place a run's cost is measured, so success,
+/// trap and refusal all report it the same way.
+///
+/// `Store::get_fuel` fails only on a store without fuel metering, which
+/// [`build_wasm_engine`] rules out and `run`'s `set_fuel` would already have
+/// caught — so a failure here is a defect in this crate. It must not become a
+/// number: `0` forgives a run its whole cost, `gas` charges an untouched one for
+/// everything. [`RunError::Internal`] instead.
+fn fuel_used(store: &Store<VmState<'_>>, gas: u64) -> Result<u64, RunError> {
+    store
+        .get_fuel()
+        .map(|remaining| gas.saturating_sub(remaining))
+        .map_err(|_| RunError::Internal)
+}
+
+/// Report `error` with the run's cost attached. A cost that cannot be read replaces
+/// the outcome rather than being invented — see [`fuel_used`].
+fn failed(store: &Store<VmState<'_>>, gas: u64, error: RunError) -> RunFailure {
+    match fuel_used(store, gas) {
+        Ok(fuel_used) => RunFailure { error, fuel_used },
+        Err(unmetered) => RunFailure::owing_nothing(unmetered),
+    }
+}
+
+/// The outcome a `wasmi::Error` names for itself, if any, rather than leaving it to
+/// the stage that raised it.
+///
+/// Two ways a run halts mid-flight: a host call that could not be served, which
+/// carries a [`FatalHostError`] saying which condition it was, and the guest's own
+/// instructions exhausting the meter, which wasmi raises as `OutOfFuel`.
+///
+/// Both can happen anywhere the guest executes — including a start section, which
+/// is guest code running during instantiation — so every stage from there on asks
+/// this before naming a failure after itself.
+fn guest_halted(error: &wasmi::Error) -> Option<RunError> {
+    if let Some(fatal) = error.downcast_ref::<FatalHostError>() {
+        return Some(fatal.0.into());
+    }
+    (error.as_trap_code() == Some(TrapCode::OutOfFuel)).then_some(RunError::OutOfGas)
+}
+
+/// Why instantiation failed, once [`guest_halted`] has ruled out the two conditions
+/// that can arise anywhere.
+///
+/// A start section is guest code, so it can trap on its own — `unreachable`, a
+/// division by zero, an out-of-bounds access — and a trap is the guest's fault
+/// wherever it happens. Naming that after the *stage* would file it beside the
+/// module faults a caller treats as its own defect, and charge nothing for
+/// instructions the contract burned. What is left for [`RunError::Instantiate`] is a
+/// module the linker or the store would not accept at all.
+fn instantiation_failure(error: &wasmi::Error) -> RunError {
+    match error.as_trap_code() {
+        Some(_) => RunError::Trap(error.to_string()),
+        None => RunError::Instantiate(error.to_string()),
+    }
+}
+
+/// The outcome a [`Fault`] is: the one place a stopped call becomes a stopped run.
+///
+/// Total and one arm each, because a `Fault` is only ever a condition that stops the
+/// run — the guest-visible codes cannot reach here, which is what
+/// [`crate::abi::CallError`] buys. A fault added later has no arm and does not
+/// compile.
+impl From<Fault> for RunError {
+    fn from(fault: Fault) -> RunError {
+        match fault {
+            Fault::OutOfGas => RunError::OutOfGas,
+            Fault::Internal => RunError::Internal,
+            Fault::NoMemory => RunError::NoMemory,
+        }
+    }
+}
+
+/// The process-wide wasmi engine, built once on first use.
+///
+/// The configuration is consensus-fixed and identical for every invocation, and an
+/// [`Engine`] is an internally `Arc`ed `Send + Sync` handle, so one shared engine
+/// serves concurrent [`run`] calls.
+pub(crate) fn wasm_engine() -> &'static Engine {
+    static ENGINE: LazyLock<Engine> = LazyLock::new(build_wasm_engine);
+    &ENGINE
+}
+
+/// Build the wasmi engine the escrow VM requires: deterministic, minimal
+/// features, fuel metering on.
+fn build_wasm_engine() -> Engine {
+    let mut config = Config::default();
+    config.consume_fuel(true);
+    config.ignore_custom_sections(true);
+    config.wasm_mutable_global(false);
+    config.wasm_multi_value(false);
+    config.wasm_sign_extension(false);
+    config.wasm_saturating_float_to_int(false);
+    config.wasm_bulk_memory(false);
+    config.wasm_reference_types(false);
+    config.wasm_tail_call(false);
+    config.wasm_extended_const(false);
+    config.floats(false);
+    config.wasm_multi_memory(false);
+    config.wasm_custom_page_sizes(false);
+    config.wasm_memory64(false);
+    config.wasm_wide_arithmetic(false);
+    // TODO: enable option to reject wasm code containing start section after wasmi 2.0 release
+    Engine::new(&config)
+}
+
+/// Compile `wasm` for this engine.
+///
+/// The one path to a [`Module`]: the configuration is what decides whether a
+/// contract is valid at all, so [`run`] and [`crate::check`] must not be able to
+/// compile against different ones.
+pub(crate) fn compile(wasm: &[u8]) -> Result<Module, String> {
+    Module::new(wasm_engine(), wasm).map_err(|e| e.to_string())
+}
+
+/// Run a contract: compile `wasm`, give it `gas` fuel, service its host
+/// calls through `host`, and call the exported `function_name`.
+pub fn run<'h>(
+    wasm: &[u8],
+    gas: u64,
+    host: &'h dyn HostFunctions,
+    function_name: &str,
+) -> Result<RunOutcome, RunFailure> {
+    let engine = wasm_engine();
+    let module =
+        compile(wasm).map_err(|detail| RunFailure::owing_nothing(RunError::Compile(detail)))?;
+
+    let mem_limits = StoreLimitsBuilder::new()
+        .memory_size(MAX_MEMORY_BYTES)
+        .trap_on_grow_failure(true)
+        .build();
+    let mut store = Store::new(
+        engine,
+        VmState {
+            host,
+            mem_limits,
+            transfer_budget: Cell::new(TRANSFER_LIMIT_BYTES),
+            memory: None,
+            out_buffer: [0u8; MAX_FIELD_BYTES],
+        },
+    );
+
+    store
+        .set_fuel(gas)
+        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
+    store.limiter(|state| &mut state.mem_limits);
+
+    let mut linker = Linker::<VmState<'h>>::new(engine);
+    register_host_functions(&mut linker)
+        .map_err(|_| RunFailure::owing_nothing(RunError::Internal))?;
+
+    let instance = match linker.instantiate_and_start(&mut store, &module) {
+        Ok(instance) => instance,
+        Err(e) => {
+            let error = guest_halted(&e).unwrap_or_else(|| instantiation_failure(&e));
+            return Err(failed(&store, gas, error));
+        }
+    };
+    store.data_mut().memory = instance.exports(&store).find_map(Export::into_memory);
+
+    let function = match instance.get_typed_func::<(), i32>(&store, function_name) {
+        Ok(function) => function,
+        Err(e) => {
+            let found = instance
+                .get_export(&store, function_name)
+                .map(|export| export.ty(&store));
+            let error =
+                RunError::EntryPoint(format!("{}: {e}", entry_point_fault(found, function_name)));
+            return Err(failed(&store, gas, error));
+        }
+    };
+
+    let result = match function.call(&mut store, ()) {
+        Ok(result) => result,
+        Err(e) => {
+            let error = guest_halted(&e).unwrap_or_else(|| RunError::Trap(e.to_string()));
+            return Err(failed(&store, gas, error));
+        }
+    };
+
+    let fuel_used = fuel_used(&store, gas).map_err(RunFailure::owing_nothing)?;
+    Ok(RunOutcome { result, fuel_used })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_engine_is_one_engine() {
+        assert!(Engine::same(wasm_engine(), wasm_engine()));
+    }
+
+    /// The only place these numbers appear as literals; every other test derives
+    /// them from the constants.
+    #[test]
+    fn the_limits_are_the_protocol_limits() {
+        assert_eq!(MAX_MEMORY_PAGES, 128, "linear-memory page cap");
+        assert_eq!(MAX_MEMORY_BYTES, 8 * 1024 * 1024, "page cap in bytes");
+        assert_eq!(MAX_FIELD_BYTES, 1024, "kMaxWasmDataLength");
+        assert_eq!(TRANSFER_LIMIT_BYTES, 1 << 20, "kWasmTransferLimit");
+    }
+}

crates/xrpl-wasm-vm/tests/budgets.rs

@@ -0,0 +1,750 @@
+//! The two budgets a run spends: gas (fuel), and the transfer limit on bytes
+//! crossing the boundary. Both are consensus input, so several of these tests
+//! assert exact numbers.
+
+mod support;
+
+use support::{
+    Answer, EMPTY_REGION, FakeHost, ONE_PAGE, PLENTY_OF_GAS, code, import, module, run,
+    run_with_gas, trace_call,
+};
+use xrpl_host_functions::{HASH_LEN, HostError, HostFunctionSpec, TraceDataType};
+use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError, TRANSFER_LIMIT_BYTES};
+
+// ---------------------------------------------------------------------------
+// Gas
+// ---------------------------------------------------------------------------
+
+/// The fuel a module of `body` burns, given gas to spare.
+fn fuel_for(body: &str, parts: &[&str], host: &FakeHost) -> u64 {
+    let wat = module(parts, body);
+    run(&wat, host).expect("the module should run").fuel_used
+}
+
+/// The fuel a module burns doing nothing but returning a constant; every figure
+/// below builds on it. wasmi's number, pinned deliberately because wasmi's fuel
+/// table is consensus input.
+const EMPTY_MODULE_FUEL: u64 = 30;
+
+/// wasmi's own fuel for a host call whose operands are all constants under 64: 14
+/// per `*.const`, plus 1 for the call. Our gas sits on top.
+///
+/// The formula holds only under 64, because wasmi widens a constant's encoding
+/// above that, each tier costing 7 more. Every call in [`call_for`] keeps its
+/// operands small for that reason; one with a larger constant fails here by a
+/// multiple of 7.
+fn wasmi_call_fuel(small_const_operands: u64) -> u64 {
+    14 * small_const_operands + 1
+}
+
+/// What wasmi charges on top of that for a call to a function with no result —
+/// `trace`'s shape, and nothing else in the ABI. Per call, not per module. Measured
+/// and pinned like the figures above.
+const WASMI_NO_RESULT_FUEL: u64 = 14;
+
+/// wasmi's fuel for one `(drop …)`, which is how a module makes more than one call
+/// and keeps only the last result. Pinned like the two above.
+const WASMI_DROP_FUEL: u64 = 21;
+
+/// The wasm a test needs in order to call one host function: the `(import …)`
+/// declaration, a call with small-constant operands, and how many it pushes.
+struct Call {
+    import: &'static str,
+    call: &'static str,
+    operands: u64,
+    /// Whether the call leaves an `i32` behind. `trace` does not, which is why
+    /// [`Call::body`] ends every module with a constant instead of the call.
+    yields: bool,
+}
+
+impl Call {
+    /// `n` calls in a row, leaving one `i32` for the module to return: the last
+    /// answer where there is one, and a constant where the call has none.
+    fn body(&self, n: usize) -> String {
+        if self.yields {
+            format!(
+                "{}{}",
+                format!("(drop {}) ", self.call).repeat(n - 1),
+                self.call
+            )
+        } else {
+            format!("{}(i32.const 0)", format!("{} ", self.call).repeat(n))
+        }
+    }
+
+    /// What [`Call::body`] burns beside the calls' own gas and the module's floor:
+    /// one `drop` between consecutive answers, or wasmi's own surcharge on a call
+    /// that has none.
+    fn overhead(&self, n: u64) -> u64 {
+        if self.yields {
+            (n - 1) * WASMI_DROP_FUEL
+        } else {
+            n * WASMI_NO_RESULT_FUEL
+        }
+    }
+}
+
+/// The test wasm for each host function. The `match` is exhaustive, so a function
+/// added to the ABI fails to compile until it has wasm here, and iterating
+/// [`HostFunctionSpec::ALL`] then covers the whole ABI.
+fn call_for(op: HostFunctionSpec) -> Call {
+    let (import, call, operands) = match op {
+        HostFunctionSpec::GetLedgerSqn => (
+            import::LDGR_INDEX,
+            "(call $ldgr_index (i32.const 0) (i32.const 4))",
+            2,
+        ),
+        HostFunctionSpec::GetParentLedgerTime => (
+            import::PARENT_LDGR_TIME,
+            "(call $parent_ldgr_time (i32.const 0) (i32.const 4))",
+            2,
+        ),
+        HostFunctionSpec::GetParentLedgerHash => (
+            import::PARENT_LDGR_HASH,
+            "(call $parent_ldgr_hash (i32.const 0) (i32.const 32))",
+            2,
+        ),
+        HostFunctionSpec::GetBaseFee => (
+            import::BASE_FEE,
+            "(call $base_fee (i32.const 0) (i32.const 4))",
+            2,
+        ),
+        HostFunctionSpec::IsAmendmentEnabled => (
+            import::AMENDMENT_ENABLED,
+            "(call $amendment_enabled (i32.const 0) (i32.const 32))",
+            2,
+        ),
+        HostFunctionSpec::CacheLedgerObj => (
+            import::CACHE_LE,
+            "(call $cache_le (i32.const 0) (i32.const 32) (i32.const 0))",
+            3,
+        ),
+        HostFunctionSpec::GetTxField => (
+            import::TX_FIELD,
+            "(call $tx_field (i32.const 1) (i32.const 0) (i32.const 4))",
+            3,
+        ),
+        HostFunctionSpec::GetCurrentLedgerObjField => (
+            import::HOME_LE_FIELD,
+            "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4))",
+            3,
+        ),
+        HostFunctionSpec::GetLedgerObjField => (
+            import::LE_FIELD,
+            "(call $le_field (i32.const 1) (i32.const 1) (i32.const 0) (i32.const 4))",
+            4,
+        ),
+        HostFunctionSpec::GetTxNestedField => (
+            import::TX_INNER,
+            "(call $tx_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
+            4,
+        ),
+        HostFunctionSpec::GetCurrentLedgerObjNestedField => (
+            import::HOME_LE_INNER,
+            "(call $home_le_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
+            4,
+        ),
+        HostFunctionSpec::GetLedgerObjNestedField => (
+            import::LE_INNER,
+            "(call $le_inner (i32.const 1) (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
+            5,
+        ),
+        HostFunctionSpec::GetTxArrayLen => {
+            (import::TX_ARR_LEN, "(call $tx_arr_len (i32.const 1))", 1)
+        }
+        HostFunctionSpec::GetCurrentLedgerObjArrayLen => (
+            import::HOME_LE_ARR_LEN,
+            "(call $home_le_arr_len (i32.const 1))",
+            1,
+        ),
+        HostFunctionSpec::GetLedgerObjArrayLen => (
+            import::LE_ARR_LEN,
+            "(call $le_arr_len (i32.const 1) (i32.const 1))",
+            2,
+        ),
+        HostFunctionSpec::GetTxNestedArrayLen => (
+            import::TX_INNER_ARR_LEN,
+            "(call $tx_inner_arr_len (i32.const 0) (i32.const 4))",
+            2,
+        ),
+        HostFunctionSpec::GetCurrentLedgerObjNestedArrayLen => (
+            import::HOME_LE_INNER_ARR_LEN,
+            "(call $home_le_inner_arr_len (i32.const 0) (i32.const 4))",
+            2,
+        ),
+        HostFunctionSpec::GetLedgerObjNestedArrayLen => (
+            import::LE_INNER_ARR_LEN,
+            "(call $le_inner_arr_len (i32.const 1) (i32.const 0) (i32.const 4))",
+            3,
+        ),
+        HostFunctionSpec::CheckSignature => (
+            import::CHECK_SIG,
+            "(call $check_sig (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0) (i32.const 0))",
+            6,
+        ),
+        HostFunctionSpec::AccountKeylet => (
+            import::ACCOUNTROOT_ID,
+            "(call $accountroot_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
+            4,
+        ),
+        HostFunctionSpec::AmmKeylet => (
+            import::AMM_ID,
+            "(call $amm_id (i32.const 0) (i32.const 20) (i32.const 24) (i32.const 40) (i32.const 0) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::CheckKeylet => (
+            import::CHECK_ID,
+            "(call $check_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::CredentialKeylet => (
+            import::CREDENTIAL_ID,
+            "(call $credential_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 4) (i32.const 44) (i32.const 20))",
+            8,
+        ),
+        HostFunctionSpec::DelegateKeylet => (
+            import::DELEGATE_ID,
+            "(call $delegate_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::DepositPreauthKeylet => (
+            import::DEPOSIT_PREAUTH_ID,
+            "(call $deposit_preauth_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::DidKeylet => (
+            import::DID_ID,
+            "(call $did_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
+            4,
+        ),
+        HostFunctionSpec::EscrowKeylet => (
+            import::ESCROW_ID,
+            "(call $escrow_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::TrustLineKeylet => (
+            import::TRUSTLINE_ID,
+            "(call $trustline_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 40) (i32.const 20) (i32.const 60) (i32.const 32))",
+            8,
+        ),
+        HostFunctionSpec::MptokenIssuanceKeylet => (
+            import::MPT_ISSUANCE_ID,
+            "(call $mpt_issuance_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::MptokenKeylet => (
+            import::MPTOKEN_ID,
+            "(call $mptoken_id (i32.const 0) (i32.const 24) (i32.const 24) (i32.const 20) (i32.const 44) (i32.const 20))",
+            6,
+        ),
+        HostFunctionSpec::NftokenOfferKeylet => (
+            import::NFT_OFFER_ID,
+            "(call $nft_offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::OfferKeylet => (
+            import::OFFER_ID,
+            "(call $offer_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::OracleKeylet => (
+            import::ORACLE_ID,
+            "(call $oracle_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::PaychannelKeylet => (
+            import::PAYCHAN_ID,
+            "(call $paychan_id (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 40) (i32.const 20))",
+            8,
+        ),
+        HostFunctionSpec::PermissionedDomainKeylet => (
+            import::PERMISSIONED_DOMAIN_ID,
+            "(call $permissioned_domain_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::SignerListKeylet => (
+            import::SIGNERS_ID,
+            "(call $signers_id (i32.const 0) (i32.const 20) (i32.const 32) (i32.const 32))",
+            4,
+        ),
+        HostFunctionSpec::TicketKeylet => (
+            import::TICKET_ID,
+            "(call $ticket_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::VaultKeylet => (
+            import::VAULT_ID,
+            "(call $vault_id (i32.const 0) (i32.const 20) (i32.const 0) (i32.const 4) (i32.const 32) (i32.const 32))",
+            6,
+        ),
+        HostFunctionSpec::Sha512Half => (
+            import::SHA512_HALF,
+            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 32))",
+            4,
+        ),
+        HostFunctionSpec::Trace => (
+            import::TRACE,
+            "(call $trace (i32.const 0) (i32.const 0) (i32.const 1) (i32.const 0) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::UpdateData => (
+            import::SET_DATA,
+            "(call $set_data (i32.const 0) (i32.const 8))",
+            2,
+        ),
+        HostFunctionSpec::GetNft => (
+            import::NFT_URI,
+            "(call $nft_uri (i32.const 0) (i32.const 20) (i32.const 20) (i32.const 32) (i32.const 52) (i32.const 12))",
+            6,
+        ),
+        HostFunctionSpec::GetNftIssuer => (
+            import::NFT_ISSUER,
+            "(call $nft_issuer (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 20))",
+            4,
+        ),
+        HostFunctionSpec::GetNftTaxon => (
+            import::NFT_TAXON,
+            "(call $nft_taxon (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
+            4,
+        ),
+        HostFunctionSpec::GetNftFlags => (
+            import::NFT_FLAGS,
+            "(call $nft_flags (i32.const 0) (i32.const 32))",
+            2,
+        ),
+        HostFunctionSpec::GetNftTransferFee => (
+            import::NFT_XFER_FEE,
+            "(call $nft_xfer_fee (i32.const 0) (i32.const 32))",
+            2,
+        ),
+        HostFunctionSpec::GetNftSequence => (
+            import::NFT_SERIAL,
+            "(call $nft_serial (i32.const 0) (i32.const 32) (i32.const 32) (i32.const 4))",
+            4,
+        ),
+        HostFunctionSpec::FloatFromInt => (
+            import::FLOAT_FROM_INT,
+            "(call $float_from_int (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 0))",
+            4,
+        ),
+        HostFunctionSpec::FloatFromUint => (
+            import::FLOAT_FROM_UINT,
+            "(call $float_from_uint (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::FloatFromStamount => (
+            import::FLOAT_FROM_STAMOUNT,
+            "(call $float_from_stamount (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::FloatFromStnumber => (
+            import::FLOAT_FROM_STNUMBER,
+            "(call $float_from_stnumber (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::FloatToInt => (
+            import::FLOAT_TO_INT,
+            "(call $float_to_int (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::FloatToMantExp => (
+            import::FLOAT_TO_MANT_EXP,
+            "(call $float_to_mant_exp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 4))",
+            6,
+        ),
+        HostFunctionSpec::FloatFromMantExp => (
+            import::FLOAT_FROM_MANT_EXP,
+            "(call $float_from_mant_exp (i64.const 0) (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 0))",
+            5,
+        ),
+        HostFunctionSpec::FloatCompare => (
+            import::FLOAT_CMP,
+            "(call $float_cmp (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8))",
+            4,
+        ),
+        HostFunctionSpec::FloatAdd => (
+            import::FLOAT_ADD,
+            "(call $float_add (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
+            7,
+        ),
+        HostFunctionSpec::FloatSubtract => (
+            import::FLOAT_SUB,
+            "(call $float_sub (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
+            7,
+        ),
+        HostFunctionSpec::FloatMultiply => (
+            import::FLOAT_MULT,
+            "(call $float_mult (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
+            7,
+        ),
+        HostFunctionSpec::FloatDivide => (
+            import::FLOAT_DIV,
+            "(call $float_div (i32.const 0) (i32.const 8) (i32.const 8) (i32.const 8) (i32.const 16) (i32.const 8) (i32.const 0))",
+            7,
+        ),
+        HostFunctionSpec::FloatRoot => (
+            import::FLOAT_ROOT,
+            "(call $float_root (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
+            6,
+        ),
+        HostFunctionSpec::FloatPower => (
+            import::FLOAT_POW,
+            "(call $float_pow (i32.const 0) (i32.const 8) (i32.const 2) (i32.const 8) (i32.const 8) (i32.const 0))",
+            6,
+        ),
+    };
+    Call {
+        import,
+        call,
+        operands,
+        yields: !matches!(op, HostFunctionSpec::Trace),
+    }
+}
+
+#[test]
+fn an_empty_module_burns_a_fixed_amount_of_fuel() {
+    let fuel = fuel_for("(i32.const 0)", &[ONE_PAGE], &FakeHost::new());
+    assert_eq!(fuel, EMPTY_MODULE_FUEL);
+}
+
+/// Calling a host function `n` times costs `n` times its gas, to the unit. Every
+/// other term is known — the module's floor, wasmi's fuel per call, one `drop` per
+/// answered call — so the total is a closed form, with the gas read from the spec
+/// table rather than restated. `n = 1` pins the charge, `n > 1` pins that it lands
+/// on every call rather than once per run.
+#[test]
+fn a_host_call_costs_its_gas_every_time_it_is_called() {
+    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
+
+    for &op in HostFunctionSpec::ALL {
+        let call = call_for(op);
+        let per_call = wasmi_call_fuel(call.operands) + op.gas();
+
+        for n in 1..=3 {
+            let body = call.body(n);
+            let n = n as u64;
+
+            assert_eq!(
+                fuel_for(&body, &[call.import, ONE_PAGE], &host),
+                EMPTY_MODULE_FUEL + n * per_call + call.overhead(n),
+                "{n} x {}",
+                call.call
+            );
+        }
+    }
+}
+
+/// The gas charge precedes the call's body, so a failing call costs exactly what a
+/// successful one costs. Field 1 is answered and field 7 is not; the two modules
+/// are otherwise identical, so their totals are comparable.
+#[test]
+fn a_failing_host_call_costs_exactly_what_a_successful_one_costs() {
+    let host = FakeHost::new().answering_field(1, Answer::bytes([0xaa]));
+    let call = |field: i32| {
+        module(
+            &[import::HOME_LE_FIELD, ONE_PAGE],
+            &format!("(call $home_le_field (i32.const {field}) (i32.const 0) (i32.const 4))"),
+        )
+    };
+
+    let answered = run(&call(1), &host).expect("the module should run");
+    let refused = run(&call(7), &host).expect("the module should run");
+
+    assert_eq!(answered.result, 1);
+    assert_eq!(refused.result, code(HostError::FieldNotFound));
+    assert_eq!(refused.fuel_used, answered.fuel_used);
+}
+
+/// `fuel_used` is `gas - remaining`: what the run spent, not what was left or what
+/// it was handed. The gas figures are derived from the run's cost, so the boundary
+/// — exactly enough, and one short — is among the cases.
+#[test]
+fn fuel_used_is_what_was_spent_not_what_was_supplied() {
+    let host = FakeHost::new();
+    let op = HostFunctionSpec::GetLedgerSqn;
+    let call = call_for(op);
+    let wat = module(&[call.import, ONE_PAGE], call.call);
+    let cost = EMPTY_MODULE_FUEL + wasmi_call_fuel(call.operands) + op.gas();
+
+    // Exactly its cost is enough, and no amount above it changes the figure. The
+    // result is checked too, so the figure belongs to a run that did the work
+    // rather than to one that was cut short.
+    for gas in [cost, cost + 1, cost * 100, PLENTY_OF_GAS] {
+        let outcome = run_with_gas(&wat, gas, &host).expect("should run");
+        assert_eq!(
+            outcome.result, 4,
+            "gas {gas}: the call should have succeeded"
+        );
+        assert_eq!(outcome.fuel_used, cost, "gas {gas}");
+    }
+
+    // One fuel short: the run ends at the call it cannot pay for and still owes the
+    // whole limit, because `charge` spends what is left.
+    let short = run_with_gas(&wat, cost - 1, &host).expect_err("one fuel short must not complete");
+    assert!(
+        matches!(short.error, RunError::OutOfGas),
+        "expected the run to end out of gas, got: {short}"
+    );
+    assert_eq!(short.fuel_used, cost - 1);
+}
+
+/// Fuel is metered, so the same module burns the same fuel every time — a
+/// property consensus depends on.
+#[test]
+fn the_same_run_burns_the_same_fuel() {
+    let call = call_for(HostFunctionSpec::Trace);
+    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
+
+    let first = run(&wat, &FakeHost::new()).expect("should run").fuel_used;
+    for _ in 0..4 {
+        assert_eq!(
+            run(&wat, &FakeHost::new()).expect("should run").fuel_used,
+            first
+        );
+    }
+    assert!(first > HostFunctionSpec::Trace.gas());
+}
+
+/// Too little gas to finish stops the run: the meter refuses the guest's own
+/// instructions before it ever reaches the host call.
+#[test]
+fn a_run_that_cannot_afford_itself_fails() {
+    let host = FakeHost::new();
+    let wat = module(
+        &[import::LDGR_INDEX, ONE_PAGE],
+        "(call $ldgr_index (i32.const 0) (i32.const 4))",
+    );
+
+    for gas in [0, 1, 10] {
+        let Err(failure) = run_with_gas(&wat, gas, &host) else {
+            panic!("gas {gas} should not have completed");
+        };
+        assert!(
+            matches!(failure.error, RunError::OutOfGas),
+            "gas {gas}: expected the run to end out of gas, got: {failure}"
+        );
+    }
+}
+
+/// A guest looping forever is stopped by gas rather than running away, and owes
+/// the gas it burned doing it.
+#[test]
+fn an_endless_loop_is_stopped_by_gas() {
+    const GAS: u64 = 100_000;
+
+    let host = FakeHost::new();
+    let wat = module(&[ONE_PAGE], "(loop $l (br $l)) (i32.const 0)");
+
+    let failure = run_with_gas(&wat, GAS, &host).expect_err("an endless loop must not complete");
+    assert!(
+        matches!(failure.error, RunError::OutOfGas),
+        "expected the meter to stop it, got: {failure}"
+    );
+    assert_eq!(
+        failure.fuel_used, GAS,
+        "a runaway guest burns the whole limit"
+    );
+}
+
+/// A host call refused its gas stops the run: the guest never gets a chance to
+/// ignore the refusal and carry on, and it is charged the whole limit.
+///
+/// The gas range is every amount that reaches the call and cannot pay for it, so
+/// the case is the whole boundary rather than one number. `trace` is the call under
+/// it because it is the one that could not report a refusal even if it wanted to:
+/// stopping the run is the whole of what the guest sees.
+#[test]
+fn a_host_call_refused_its_gas_stops_the_run() {
+    let host = FakeHost::new();
+    let op = HostFunctionSpec::Trace;
+    let call = call_for(op);
+    let wat = module(&[call.import, ONE_PAGE], &call.body(1));
+    // Measured rather than derived: the whole run's cost, less the call's own gas,
+    // is the least a guest can be given and still reach the call. Below that the
+    // meter stops the guest's own instructions instead, which is
+    // `a_run_that_cannot_afford_itself_fails`'s case, not this one.
+    let cost = run(&wat, &FakeHost::new())
+        .expect("the module should run")
+        .fuel_used;
+
+    for gas in cost - op.gas()..cost {
+        let Err(failure) = run_with_gas(&wat, gas, &host) else {
+            panic!("gas {gas}: the run completed, so the guest was handed the refusal");
+        };
+        assert!(
+            matches!(failure.error, RunError::OutOfGas),
+            "gas {gas}: expected the run to end out of gas, got: {failure}"
+        );
+        assert_eq!(
+            failure.fuel_used, gas,
+            "gas {gas}: a call it cannot afford burns the whole limit"
+        );
+    }
+    assert!(host.traces().is_empty(), "the host body must not have run");
+}
+
+// ---------------------------------------------------------------------------
+// The transfer limit
+// ---------------------------------------------------------------------------
+
+/// A module that repeats `call` while `keep_going` holds, then returns the last
+/// status, so a budget can be run to exhaustion inside one invocation.
+fn until_refused(imports: &str, call: &str, keep_going: &str) -> String {
+    module(
+        &[imports, ONE_PAGE],
+        &format!(
+            "(local $r i32)
+             (loop $l
+               (local.set $r {call})
+               (br_if $l {keep_going}))
+             (local.get $r)"
+        ),
+    )
+}
+
+/// For a call whose success is a positive byte count.
+const WHILE_POSITIVE: &str = "(i32.gt_s (local.get $r) (i32.const 0))";
+
+/// Bytes written into guest memory are charged against the run's budget, and the
+/// budget is a per-run total: 1 MiB of 1 KiB values exhausts it.
+#[test]
+fn writes_spend_the_transfer_budget() {
+    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
+    let wat = until_refused(
+        import::HOME_LE_FIELD,
+        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
+        WHILE_POSITIVE,
+    );
+
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
+    assert_eq!(
+        host.fields_asked.borrow().len() as u64,
+        TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1,
+        "one call per 1 KiB of budget, plus the one that was refused"
+    );
+}
+
+/// The budget is per run, not per call: a fresh run starts with a full budget.
+#[test]
+fn each_run_gets_its_own_budget() {
+    let wat = until_refused(
+        import::HOME_LE_FIELD,
+        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
+        WHILE_POSITIVE,
+    );
+
+    for _ in 0..2 {
+        let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
+        let outcome = run(&wat, &host).expect("the module should run");
+        assert_eq!(outcome.result, code(HostError::OutOfTransferLimit));
+        assert_eq!(
+            host.fields_asked.borrow().len() as u64,
+            TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64 + 1
+        );
+    }
+}
+
+/// A run well inside the budget never sees it.
+#[test]
+fn a_modest_run_never_meets_the_budget() {
+    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        &format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"),
+    );
+
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(outcome.result, MAX_FIELD_BYTES as i32);
+}
+
+/// Reads leave the budget alone: `read_borrowed` hands the host a slice *aliasing*
+/// guest memory, so there are no copied bytes to charge. What bounds how many reads
+/// a run can make is gas, which every host call pays before its body runs.
+///
+/// The observation is the write at the end, not the reads: the module reads four
+/// times the whole budget first, so a rule that charged reads would have nothing
+/// left, and the write would answer `OutOfTransferLimit` instead of a byte count.
+#[test]
+fn reads_do_not_spend_the_transfer_budget() {
+    /// 1 KiB reads, four times over the budget.
+    const READS: u64 = 4 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
+
+    let host = FakeHost::new().answering_field(1, Answer::filler(MAX_FIELD_BYTES));
+    let read = trace_call(
+        TraceDataType::AsHex,
+        EMPTY_REGION,
+        &format!("(i32.const 0) (i32.const {MAX_FIELD_BYTES})"),
+    );
+    let wat = module(
+        &[import::TRACE, import::HOME_LE_FIELD, ONE_PAGE],
+        &format!(
+            "(local $i i32)
+             (loop $l
+               {read}
+               (local.set $i (i32.add (local.get $i) (i32.const 1)))
+               (br_if $l (i32.lt_u (local.get $i) (i32.const {READS}))))
+             (call $home_le_field (i32.const 1) (i32.const 0) (i32.const {MAX_FIELD_BYTES}))"
+        ),
+    );
+
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(
+        host.traces().len() as u64,
+        READS,
+        "every read should have been served"
+    );
+    assert_eq!(
+        outcome.result, MAX_FIELD_BYTES as i32,
+        "the write after {READS} reads of {MAX_FIELD_BYTES} bytes should still have its budget"
+    );
+}
+
+/// Only the output half of a read-write call spends the budget. `sha512_half`'s
+/// input is a borrowed read like any other, aliasing guest memory rather than
+/// crossing the boundary, so a run may hash far more bytes than the budget holds as
+/// long as the digests it writes fit inside it.
+///
+/// The two totals are asserted, so the arithmetic that makes the case is in the
+/// test rather than in a comment: the inputs alone would overrun the budget, the
+/// digests alone are a small fraction of it.
+#[test]
+fn only_the_output_half_of_a_read_write_spends_the_budget() {
+    /// Enough 1 KiB inputs to overrun the budget twice over.
+    const CALLS: u64 = 2 * TRANSFER_LIMIT_BYTES / MAX_FIELD_BYTES as u64;
+
+    assert!(
+        CALLS * MAX_FIELD_BYTES as u64 > TRANSFER_LIMIT_BYTES,
+        "the inputs alone must overrun the budget"
+    );
+    assert!(
+        CALLS * HASH_LEN as u64 <= TRANSFER_LIMIT_BYTES / 2,
+        "the digests alone must stay well inside it"
+    );
+
+    let host = FakeHost::new().answering_digest(Answer::filler(HASH_LEN));
+    let wat = module(
+        &[import::SHA512_HALF, ONE_PAGE],
+        &format!(
+            "(local $i i32)
+             (local $r i32)
+             (loop $l
+               (local.set $r (call $sha512_half (i32.const 0) (i32.const {MAX_FIELD_BYTES})
+                                                (i32.const 0) (i32.const {HASH_LEN})))
+               (local.set $i (i32.add (local.get $i) (i32.const 1)))
+               (br_if $l (i32.lt_u (local.get $i) (i32.const {CALLS}))))
+             (local.get $r)"
+        ),
+    );
+
+    let outcome = run(&wat, &host).expect("the module should run");
+    assert_eq!(
+        host.digested.borrow().len() as u64,
+        CALLS,
+        "every call should have been served"
+    );
+    assert_eq!(
+        outcome.result, HASH_LEN as i32,
+        "only the digests are charged, and they fit"
+    );
+}

crates/xrpl-wasm-vm/tests/memory_policy.rs

@@ -0,0 +1,621 @@
+//! The bounds, field-cap and buffer-fit rules `abi.rs` enforces on every region
+//! crossing the boundary. This is the policy the guest observes, so each rule is
+//! pinned to the code it answers with.
+
+mod support;
+
+use support::{
+    Answer, COMPLETED, EMPTY_REGION, FakeHost, ONE_PAGE, code, failure, import, module, status,
+    traced,
+};
+use xrpl_host_functions::{HASH_LEN, HostError, TraceDataType};
+use xrpl_wasm_vm::{MAX_FIELD_BYTES, RunError};
+
+/// One page, so anything at or past 65536 is out of bounds.
+const PAGE: i64 = 64 * 1024;
+
+/// The per-field size cap, as a wasm operand.
+const CAP: i64 = MAX_FIELD_BYTES as i64;
+/// One byte over the cap: the smallest value the engine must refuse.
+const OVER_CAP: i64 = CAP + 1;
+
+// ---------------------------------------------------------------------------
+// Output regions (`write_into`)
+// ---------------------------------------------------------------------------
+
+/// The whole output region must be in bounds, not merely its start — the engine
+/// checks `[dst, dst + cap)` before the host is allowed to write.
+#[test]
+fn an_output_region_running_past_memory_is_refused() {
+    let host = FakeHost::new();
+
+    for (dst, cap) in [(PAGE, 4), (PAGE - 3, 4), (PAGE + 1024, 4), (0, PAGE + 1)] {
+        let wat = module(
+            &[import::LDGR_INDEX, ONE_PAGE],
+            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
+        );
+        assert_eq!(
+            status(&wat, &host),
+            code(HostError::PointerOutOfBounds),
+            "dst {dst} cap {cap}"
+        );
+    }
+}
+
+/// A region ending exactly at the last byte of memory is in bounds.
+#[test]
+fn an_output_region_ending_at_the_last_byte_is_allowed() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::LDGR_INDEX, ONE_PAGE],
+        &format!("(call $ldgr_index (i32.const {}) (i32.const 4))", PAGE - 4),
+    );
+    assert_eq!(status(&wat, &host), 4);
+}
+
+/// The wire carries `i32`, so a guest can present a negative pointer or length.
+#[test]
+fn a_negative_output_pointer_or_length_is_refused() {
+    let host = FakeHost::new();
+
+    for (dst, cap) in [(-1, 4), (0, -1), (-1, -1), (i32::MIN, 4)] {
+        let wat = module(
+            &[import::LDGR_INDEX, ONE_PAGE],
+            &format!("(call $ldgr_index (i32.const {dst}) (i32.const {cap}))"),
+        );
+        assert_eq!(
+            status(&wat, &host),
+            code(HostError::InvalidParams),
+            "dst {dst} cap {cap}"
+        );
+    }
+}
+
+/// The host reports a value's true length whether or not it fitted; a value that
+/// did not fit is the guest's error, not the host's.
+#[test]
+fn a_value_larger_than_the_buffer_is_refused() {
+    let host = FakeHost::new().answering_field(1, Answer::filler(64));
+
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
+    );
+    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
+
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 64))",
+    );
+    assert_eq!(status(&wat, &host), 64, "exactly enough room is enough");
+}
+
+/// A zero-length output region is in bounds and simply cannot hold anything.
+#[test]
+fn a_zero_length_output_region_is_in_bounds_but_too_small() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::LDGR_INDEX, ONE_PAGE],
+        "(call $ldgr_index (i32.const 0) (i32.const 0))",
+    );
+    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
+}
+
+/// A host that reports more than the per-field cap is refused even when the
+/// guest offered room for it: the cap is the engine's rule, not the buffer's.
+#[test]
+fn a_value_past_the_field_cap_is_refused() {
+    let host = FakeHost::new()
+        .answering_field(1, Answer::claiming(OVER_CAP as usize))
+        .answering_field(2, Answer::claiming(MAX_FIELD_BYTES));
+
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 4096))",
+    );
+    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
+
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        "(call $home_le_field (i32.const 2) (i32.const 0) (i32.const 4096))",
+    );
+    assert_eq!(status(&wat, &host), CAP as i32, "the cap itself is allowed");
+}
+
+/// A refused over-cap value leaves nothing behind. `write_into` hands the host at
+/// most [`MAX_FIELD_BYTES`] of the guest's buffer however much room the guest
+/// declared, so a value past the cap does not fit the region it is offered and no
+/// prefix of it can reach guest memory either.
+///
+/// The host answers with a real over-cap value: [`Answer::claiming`] writes
+/// nothing whatever the engine does, so it could not tell the two apart. The
+/// second module folds the *whole* declared buffer rather than one byte, so the
+/// claim is about the region and not about its first byte.
+#[test]
+fn an_over_cap_value_is_refused_without_reaching_guest_memory() {
+    /// The buffer the guest declares: well over the cap, so the clamp bites.
+    const BUFFER: usize = 4096;
+
+    let over_cap = vec![0xff; MAX_FIELD_BYTES + 1];
+    let host = FakeHost::new().answering_field(1, Answer::bytes(over_cap));
+    let call = format!("(call $home_le_field (i32.const 1) (i32.const 0) (i32.const {BUFFER}))");
+
+    // The status the guest sees, from a module that returns it directly.
+    let refusing = module(&[import::HOME_LE_FIELD, ONE_PAGE], &call);
+    assert_eq!(
+        status(&refusing, &host),
+        code(HostError::DataFieldTooLarge),
+        "the value is refused"
+    );
+
+    // Every byte of the buffer, or-ed together: guest memory starts zero-filled,
+    // so any byte the host wrote shows up here.
+    let reading = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        &format!(
+            "(local $i i32)
+             (local $seen i32)
+             (drop {call})
+             (loop $l
+               (local.set $seen (i32.or (local.get $seen) (i32.load8_u (local.get $i))))
+               (local.set $i (i32.add (local.get $i) (i32.const 1)))
+               (br_if $l (i32.lt_u (local.get $i) (i32.const {BUFFER}))))
+             (local.get $seen)"
+        ),
+    );
+    assert_eq!(
+        status(&reading, &host),
+        0,
+        "and not one of its bytes is in the guest's buffer"
+    );
+}
+
+/// The field cap is checked before the buffer-fit rule, so a value that breaks both
+/// is reported as over-cap. The guest branches on the code, and the two rules
+/// answer different questions, so the order is worth pinning.
+#[test]
+fn the_field_cap_precedes_the_buffer_fit_check() {
+    let host = FakeHost::new().answering_field(1, Answer::claiming(MAX_FIELD_BYTES + 1));
+
+    // A 63-byte buffer: the value is both over the cap and far too big to fit.
+    let wat = module(
+        &[import::HOME_LE_FIELD, ONE_PAGE],
+        "(call $home_le_field (i32.const 1) (i32.const 0) (i32.const 63))",
+    );
+    assert_eq!(status(&wat, &host), code(HostError::DataFieldTooLarge));
+}
+
+// ---------------------------------------------------------------------------
+// Input regions (`Region::read`, via `sha512_half`)
+//
+// `sha512_half`'s first pair is an input region like any other, and it is the
+// input the guest gets a status back from: `trace`, the other reader, answers
+// nothing at all. So the codes are pinned here and the silence below.
+// ---------------------------------------------------------------------------
+
+/// An input region is bounds-checked the same way an output region is. Every case
+/// here stays within the field cap, which on an input is checked first.
+#[test]
+fn an_input_region_running_past_memory_is_refused() {
+    let host = FakeHost::new();
+
+    for (ptr, len) in [(PAGE, 1), (PAGE - 3, 4), (PAGE - 1, CAP)] {
+        let wat = module(
+            &[import::SHA512_HALF, ONE_PAGE],
+            &format!(
+                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
+                                    (i32.const 0) (i32.const {HASH_LEN}))"
+            ),
+        );
+        assert_eq!(
+            status(&wat, &host),
+            code(HostError::PointerOutOfBounds),
+            "ptr {ptr} len {len}"
+        );
+        assert!(host.digested.borrow().is_empty(), "the host is not called");
+    }
+}
+
+#[test]
+fn a_negative_input_pointer_or_length_is_refused() {
+    let host = FakeHost::new();
+
+    for (ptr, len) in [(-1, 1), (0, -1), (i32::MIN, 1)] {
+        let wat = module(
+            &[import::SHA512_HALF, ONE_PAGE],
+            &format!(
+                "(call $sha512_half (i32.const {ptr}) (i32.const {len})
+                                    (i32.const 0) (i32.const {HASH_LEN}))"
+            ),
+        );
+        assert_eq!(
+            status(&wat, &host),
+            code(HostError::InvalidParams),
+            "ptr {ptr} len {len}"
+        );
+    }
+}
+
+/// The field cap bounds what the guest may hand *in*, too.
+#[test]
+fn an_input_past_the_field_cap_is_refused() {
+    let host = FakeHost::new();
+    let digest = |len: i64| {
+        module(
+            &[import::SHA512_HALF, ONE_PAGE],
+            &format!(
+                "(call $sha512_half (i32.const 0) (i32.const {len})
+                                    (i32.const 2048) (i32.const {HASH_LEN}))"
+            ),
+        )
+    };
+
+    assert_eq!(
+        status(&digest(OVER_CAP), &host),
+        code(HostError::DataFieldTooLarge)
+    );
+    assert!(host.digested.borrow().is_empty());
+
+    assert_eq!(
+        status(&digest(CAP), &host),
+        HASH_LEN as i32,
+        "the cap itself is allowed"
+    );
+}
+
+/// The two directions check in opposite orders: an input's length is known before
+/// the read, so the cap comes first, while an output's region has to be resolved
+/// before the host can produce a value, so bounds come first there.
+#[test]
+fn the_field_cap_precedes_the_bounds_check_on_an_input() {
+    let host = FakeHost::new();
+
+    let reading = module(
+        &[import::SHA512_HALF, ONE_PAGE],
+        &format!(
+            "(call $sha512_half (i32.const 0) (i32.const {})
+                                (i32.const 0) (i32.const {HASH_LEN}))",
+            PAGE + 1
+        ),
+    );
+    assert_eq!(status(&reading, &host), code(HostError::DataFieldTooLarge));
+
+    let writing = module(
+        &[import::LDGR_INDEX, ONE_PAGE],
+        &format!("(call $ldgr_index (i32.const 0) (i32.const {}))", PAGE + 1),
+    );
+    assert_eq!(status(&writing, &host), code(HostError::PointerOutOfBounds));
+}
+
+// ---------------------------------------------------------------------------
+// The reader with no result (`read_borrowed`, via `trace`)
+// ---------------------------------------------------------------------------
+
+/// `trace` reads two regions and either one being bad refuses the call. The same
+/// rule as above, and the guest is told nothing: the refusal is the host not being
+/// called, and the run carries on to the constant that follows.
+#[test]
+fn both_of_traces_regions_are_checked_silently() {
+    let host = FakeHost::new();
+    let regions = [
+        (
+            format!("(i32.const {PAGE}) (i32.const 1)"),
+            EMPTY_REGION.to_owned(),
+        ),
+        (
+            EMPTY_REGION.to_owned(),
+            format!("(i32.const {PAGE}) (i32.const 1)"),
+        ),
+        (
+            EMPTY_REGION.to_owned(),
+            format!("(i32.const 0) (i32.const {OVER_CAP})"),
+        ),
+        (
+            "(i32.const -1) (i32.const 1)".to_owned(),
+            EMPTY_REGION.to_owned(),
+        ),
+    ];
+
+    for (msg, data) in regions {
+        let wat = module(
+            &[import::TRACE, ONE_PAGE],
+            &traced(TraceDataType::AsHex, &msg, &data),
+        );
+        assert_eq!(status(&wat, &host), COMPLETED, "msg {msg} data {data}");
+        assert!(
+            host.traces().is_empty(),
+            "msg {msg} data {data}: the host must not be called"
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Both at once (`write_buffered`, via `sha512_half`)
+// ---------------------------------------------------------------------------
+
+/// A call with an input and an output region decides everything about the input
+/// before anything about the output, so a bad input is reported however the output
+/// region is wrong — out of bounds, or a pointer that is not one at all.
+///
+/// The whole output region, params included, is judged after the host has answered.
+/// Hoisting any part of that above the call would put the output's verdict first for
+/// these cases, and there is no half of it that can be hoisted on a principle the
+/// other half shares.
+#[test]
+fn a_read_write_checks_its_input_before_its_output() {
+    let host = FakeHost::new();
+    let digest = |src: i64, src_len: i64, dst: i64| {
+        module(
+            &[import::SHA512_HALF, ONE_PAGE],
+            &format!(
+                "(call $sha512_half (i32.const {src}) (i32.const {src_len})
+                                    (i32.const {dst}) (i32.const {HASH_LEN}))"
+            ),
+        )
+    };
+
+    let over_cap = digest(0, OVER_CAP, 0);
+    assert_eq!(status(&over_cap, &host), code(HostError::DataFieldTooLarge));
+
+    let out_of_bounds = digest(PAGE, 4, 0);
+    assert_eq!(
+        status(&out_of_bounds, &host),
+        code(HostError::PointerOutOfBounds)
+    );
+
+    // A bad input against each way the output can be wrong: the input's verdict is
+    // the one reported, and the host is never asked for a value nobody can take.
+    for dst in [PAGE, -1] {
+        let both_bad = digest(0, OVER_CAP, dst);
+        assert_eq!(
+            status(&both_bad, &host),
+            code(HostError::DataFieldTooLarge),
+            "dst {dst}"
+        );
+    }
+    assert!(host.digested.borrow().is_empty(), "the host is not reached");
+}
+
+/// The output half of a read-write call obeys the same rules as a plain write.
+#[test]
+fn a_read_write_output_obeys_the_write_rules() {
+    let host = FakeHost::new().answering_digest(Answer::filler(32));
+
+    let wat = module(
+        &[import::SHA512_HALF, ONE_PAGE],
+        "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 31))",
+    );
+    assert_eq!(status(&wat, &host), code(HostError::BufferTooSmall));
+
+    let wat = module(
+        &[import::SHA512_HALF, ONE_PAGE],
+        &format!(
+            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const {PAGE}) (i32.const 32))"
+        ),
+    );
+    assert_eq!(status(&wat, &host), code(HostError::PointerOutOfBounds));
+}
+
+/// A refused value reaches guest memory in no part, however much of it the host
+/// wrote. The host answers with 32 bytes it did write and a length it did not, so
+/// the refusal happens with the value sitting in the run's output buffer — and the
+/// guest's buffer has to come back untouched.
+///
+/// Stronger than the contract asks for: a guest must not read its buffer on a
+/// negative status. It holds because the buffer is copied to the guest only after
+/// the length, the bounds, the fit and the budget have all passed, so there is no
+/// window in which a refused value is in guest memory.
+#[test]
+fn a_refused_value_leaves_nothing_in_guest_memory() {
+    const MARKER: u8 = 77;
+
+    // The two refusals a value can meet after the host has produced it: longer
+    // than the field cap, and longer than the buffer the guest offered.
+    let refusals = [
+        (MAX_FIELD_BYTES + 1, HASH_LEN, HostError::DataFieldTooLarge),
+        (HASH_LEN, HASH_LEN - 1, HostError::BufferTooSmall),
+    ];
+
+    for (claimed, cap, expected) in refusals {
+        let host =
+            FakeHost::new().answering_digest(Answer::writing_but_claiming([MARKER; 32], claimed));
+        let call = format!(
+            "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 64) (i32.const {cap}))"
+        );
+
+        let refused = module(&[import::SHA512_HALF, ONE_PAGE], &call);
+        assert_eq!(
+            status(&refused, &host),
+            code(expected),
+            "claiming {claimed}"
+        );
+
+        // The same call, reporting what is at the output region afterwards.
+        let inspect = module(
+            &[import::SHA512_HALF, ONE_PAGE],
+            &format!("(drop {call}) (i32.load8_u (i32.const 64))"),
+        );
+        assert_eq!(
+            status(&inspect, &host),
+            0,
+            "claiming {claimed}: the refused value must not have been written"
+        );
+    }
+}
+
+/// An input region may overlap the output region: the host is served the input as
+/// it stands and its answer lands afterwards, so the two cannot interfere. The
+/// marker is any byte distinct from the input's first (`a`), so `finish` returning
+/// it proves the write landed.
+#[test]
+fn an_input_may_overlap_the_output() {
+    const MARKER: u8 = 99;
+
+    let host = FakeHost::new().answering_digest(Answer::bytes([MARKER; HASH_LEN]));
+
+    let wat = module(
+        &[
+            import::SHA512_HALF,
+            ONE_PAGE,
+            r#"(data (i32.const 0) "abcd")"#,
+        ],
+        &format!(
+            "(drop (call $sha512_half (i32.const 0) (i32.const 4)
+                                      (i32.const 0) (i32.const {HASH_LEN})))
+             (i32.load8_u (i32.const 0))"
+        ),
+    );
+    assert_eq!(
+        status(&wat, &host),
+        i32::from(MARKER),
+        "the output overwrote the input"
+    );
+    assert_eq!(
+        *host.digested.borrow(),
+        vec![b"abcd".to_vec()],
+        "the host saw the input as it was"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The memory export itself
+// ---------------------------------------------------------------------------
+
+/// A host call with no memory to work in ends the run instead of answering the
+/// guest: there is no buffer for a status to describe, and nothing the guest could
+/// do about the answer — which is what puts this beside out-of-gas on the fatal
+/// channel. What the guest burned getting there is still charged.
+fn assert_no_memory(wat: &str, host: &FakeHost) {
+    let failure = failure(wat, host);
+    assert!(
+        matches!(failure.error, RunError::NoMemory),
+        "expected the run to end for want of a memory export, got: {failure}"
+    );
+    assert!(failure.fuel_used > 0, "{failure}");
+}
+
+/// Every region is relative to the guest's exported memory, so a module without
+/// one cannot make a host call at all.
+#[test]
+fn a_module_that_exports_no_memory_cannot_call_the_host() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::LDGR_INDEX, "(memory 1)"],
+        "(call $ldgr_index (i32.const 0) (i32.const 4))",
+    );
+    assert_no_memory(&wat, &host);
+}
+
+/// Having no memory is answered before anything about a call's arguments, so a
+/// module without one ends the run even when its arguments would have earned a
+/// guest-visible code of their own (here an input over the field cap).
+///
+/// The order is deliberate: no memory is a fact about the instance, not about this
+/// call, and a region cannot be validated against a memory that is not there. It
+/// costs the guest nothing — every call such a module makes ends the run anyway.
+#[test]
+fn no_memory_is_answered_before_a_calls_arguments_are() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::SHA512_HALF, "(memory 1)"],
+        &format!(
+            "(call $sha512_half (i32.const 0) (i32.const {OVER_CAP})
+                                (i32.const 0) (i32.const {HASH_LEN}))"
+        ),
+    );
+    assert_no_memory(&wat, &host);
+}
+
+/// The memory's export *name* is not part of the contract: the engine takes the
+/// module's memory whatever it is called. Nothing in the wasm spec attaches meaning
+/// to `"memory"` — it is a toolchain convention, so the kind decides.
+#[test]
+fn a_memory_exported_under_any_name_is_the_guests_memory() {
+    let host = FakeHost::new();
+
+    for name in ["mem", "linear", "the memory"] {
+        let wat = module(
+            &[
+                import::LDGR_INDEX,
+                &format!(r#"(memory (export "{name}") 1)"#),
+            ],
+            "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
+             (i32.load (i32.const 64))",
+        );
+        assert_eq!(
+            status(&wat, &host),
+            7,
+            "the host wrote into the memory exported as '{name}'"
+        );
+    }
+}
+
+/// One memory exported under several names is one memory. The engine resolves the
+/// first export of kind memory, and with at most one memory per module every such
+/// export is that memory, so the order the exports are walked in cannot change the
+/// answer.
+#[test]
+fn one_memory_exported_under_several_names_is_still_that_memory() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[
+            import::LDGR_INDEX,
+            r#"(memory (export "memory") (export "mem") (export "linear") 1)"#,
+        ],
+        "(drop (call $ldgr_index (i32.const 64) (i32.const 4)))
+         (i32.load (i32.const 64))",
+    );
+    assert_eq!(status(&wat, &host), 7);
+}
+
+/// The export has to *be* a memory: a global named `memory` is not one, and it
+/// neither serves as the guest's memory nor hides the memory the module really
+/// exports. The kind decides, so the conventional name carries no weight on
+/// either side.
+#[test]
+fn an_export_named_memory_that_is_not_a_memory_is_not_the_guests_memory() {
+    let host = FakeHost::new();
+
+    let call = "(call $ldgr_index (i32.const 0) (i32.const 4))";
+
+    let wrong_kind = module(
+        &[
+            import::LDGR_INDEX,
+            "(memory 1)",
+            r#"(global (export "memory") i32 (i32.const 0))"#,
+        ],
+        call,
+    );
+    assert_no_memory(&wrong_kind, &host);
+
+    let shadowed = module(
+        &[
+            import::LDGR_INDEX,
+            r#"(memory (export "mem") 1)"#,
+            r#"(global (export "memory") i32 (i32.const 0))"#,
+        ],
+        call,
+    );
+    assert_eq!(
+        status(&shadowed, &host),
+        4,
+        "the real memory is found past the global that took its name"
+    );
+}
+
+/// Bounds follow the memory the module actually declared, not a fixed page.
+#[test]
+fn bounds_follow_the_declared_memory_size() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::LDGR_INDEX, r#"(memory (export "memory") 2)"#],
+        &format!("(call $ldgr_index (i32.const {PAGE}) (i32.const 4))"),
+    );
+    assert_eq!(status(&wat, &host), 4, "the second page is in bounds");
+}

crates/xrpl-wasm-vm/tests/preflight.rs

@@ -0,0 +1,516 @@
+//! What screening refuses, and that it refuses nothing a run would have served.
+//!
+//! `check` reaches its verdict from the compiled module alone, so these tests take
+//! no host — except the ones that put the same module through `run` to compare the
+//! two.
+
+mod support;
+
+use support::{ENTRY, FakeHost, ONE_PAGE, PLENTY_OF_GAS, assemble, import, module};
+use xrpl_host_functions::HostFunctionSpec;
+use xrpl_wasm_vm::{CheckError, MAX_MEMORY_PAGES, RunError};
+
+/// Assert which stage screening refused a module at, because the caller maps the
+/// stages separately. The error comes back out for the tests that also read its
+/// message.
+macro_rules! assert_stage {
+    ($refusal:expr, $stage:pat) => {{
+        let refusal = $refusal;
+        assert!(
+            matches!(refusal, $stage),
+            concat!("expected a ", stringify!($stage), " refusal, got: {}"),
+            refusal
+        );
+        refusal
+    }};
+}
+
+/// Screens `wat`, which must assemble.
+fn check(wat: &str) -> Result<(), CheckError> {
+    xrpl_wasm_vm::check(&assemble(wat), ENTRY)
+}
+
+fn refusal(wat: &str) -> CheckError {
+    check(wat).expect_err(&format!("expected this module to be refused:\n{wat}"))
+}
+
+fn passes(wat: &str) {
+    if let Err(refusal) = check(wat) {
+        panic!("expected this module to pass, but: {refusal}\n{wat}");
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Compiling
+// ---------------------------------------------------------------------------
+
+/// A contract that imports a host function, exports its memory and exports the
+/// entry point is what screening is looking for.
+#[test]
+fn a_runnable_contract_passes() {
+    passes(&module(
+        &[import::LDGR_INDEX, ONE_PAGE],
+        "(call $ldgr_index (i32.const 0) (i32.const 4))",
+    ));
+}
+
+/// Bytes that are not a wasm module at all.
+#[test]
+fn garbage_does_not_pass() {
+    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
+        let refusal = xrpl_wasm_vm::check(bytes, ENTRY).expect_err("garbage must not pass");
+        assert_stage!(refusal, CheckError::Compile(_));
+    }
+}
+
+/// Screening takes wasm binaries, and text is not one — the same rule the VM
+/// applies, from the same `wasmi` built without its `wat` feature. Turning that
+/// feature on would make this transaction blob valid at both ends.
+#[test]
+fn a_text_format_module_does_not_pass() {
+    let text = module(&[ONE_PAGE], "(i32.const 0)");
+
+    let refusal =
+        xrpl_wasm_vm::check(text.as_bytes(), ENTRY).expect_err("text must not pass as a module");
+    assert_stage!(refusal, CheckError::Compile(_));
+
+    // The same module, assembled first, passes: the text is sound and only the
+    // format was refused.
+    passes(&text);
+}
+
+/// A feature the engine disables is refused here too, because both stages compile
+/// against the one engine. `vm_limits.rs` walks every disabled feature; this pins
+/// that screening sees the same configuration.
+#[test]
+fn a_disabled_feature_does_not_pass() {
+    let refusal = refusal(&module(
+        &[ONE_PAGE],
+        "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
+    ));
+    let refusal = assert_stage!(refusal, CheckError::Compile(_)).to_string();
+    assert!(refusal.contains("floating-point"), "{refusal}");
+}
+
+// ---------------------------------------------------------------------------
+// Imports
+// ---------------------------------------------------------------------------
+
+/// Every host function the ABI declares, spelled as a guest imports it. The count
+/// is asserted against the ABI so a function added to it cannot be left out here.
+const ALL_IMPORTS: [&str; 61] = [
+    import::LDGR_INDEX,
+    import::PARENT_LDGR_TIME,
+    import::PARENT_LDGR_HASH,
+    import::BASE_FEE,
+    import::AMENDMENT_ENABLED,
+    import::CACHE_LE,
+    import::TX_FIELD,
+    import::HOME_LE_FIELD,
+    import::LE_FIELD,
+    import::TX_INNER,
+    import::HOME_LE_INNER,
+    import::LE_INNER,
+    import::TX_ARR_LEN,
+    import::HOME_LE_ARR_LEN,
+    import::LE_ARR_LEN,
+    import::TX_INNER_ARR_LEN,
+    import::HOME_LE_INNER_ARR_LEN,
+    import::LE_INNER_ARR_LEN,
+    import::CHECK_SIG,
+    import::ACCOUNTROOT_ID,
+    import::AMM_ID,
+    import::CHECK_ID,
+    import::CREDENTIAL_ID,
+    import::DELEGATE_ID,
+    import::DEPOSIT_PREAUTH_ID,
+    import::DID_ID,
+    import::ESCROW_ID,
+    import::TRUSTLINE_ID,
+    import::MPT_ISSUANCE_ID,
+    import::MPTOKEN_ID,
+    import::NFT_OFFER_ID,
+    import::OFFER_ID,
+    import::ORACLE_ID,
+    import::PAYCHAN_ID,
+    import::PERMISSIONED_DOMAIN_ID,
+    import::SIGNERS_ID,
+    import::TICKET_ID,
+    import::VAULT_ID,
+    import::SHA512_HALF,
+    import::TRACE,
+    import::SET_DATA,
+    import::NFT_URI,
+    import::NFT_ISSUER,
+    import::NFT_TAXON,
+    import::NFT_FLAGS,
+    import::NFT_XFER_FEE,
+    import::NFT_SERIAL,
+    import::FLOAT_FROM_INT,
+    import::FLOAT_FROM_UINT,
+    import::FLOAT_FROM_STAMOUNT,
+    import::FLOAT_FROM_STNUMBER,
+    import::FLOAT_TO_INT,
+    import::FLOAT_TO_MANT_EXP,
+    import::FLOAT_FROM_MANT_EXP,
+    import::FLOAT_CMP,
+    import::FLOAT_ADD,
+    import::FLOAT_SUB,
+    import::FLOAT_MULT,
+    import::FLOAT_DIV,
+    import::FLOAT_ROOT,
+    import::FLOAT_POW,
+];
+
+#[test]
+fn every_declared_host_function_may_be_imported() {
+    assert_eq!(
+        ALL_IMPORTS.len(),
+        HostFunctionSpec::ALL.len(),
+        "the ABI gained a host function with no import declaration in this test"
+    );
+
+    let mut parts = ALL_IMPORTS.to_vec();
+    parts.push(ONE_PAGE);
+    passes(&module(&parts, "(i32.const 0)"));
+}
+
+/// A module may import fewer host functions than are registered, but not more.
+#[test]
+fn an_unknown_host_function_does_not_pass() {
+    let refusal = refusal(&module(
+        &[
+            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
+            ONE_PAGE,
+        ],
+        "(call $f (i32.const 0))",
+    ));
+    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
+    assert!(
+        refusal.contains("no host function 'no_such_function'"),
+        "{refusal}"
+    );
+}
+
+/// Host functions live under one module name — `host_lib` — and an import naming
+/// another is refused even when the function name is real. `env` is in the list
+/// because that is what plain clang emits.
+#[test]
+fn an_import_from_another_module_does_not_pass() {
+    for module_name in ["host", "env", ""] {
+        let refusal = refusal(&module(
+            &[
+                &format!(
+                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
+                ),
+                ONE_PAGE,
+            ],
+            "(call $f (i32.const 0) (i32.const 4))",
+        ));
+        let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
+        assert!(refusal.contains("is not from 'host_lib'"), "{refusal}");
+    }
+}
+
+/// A host function's name imported as something other than a function. The engine
+/// defines it as a function and nothing else, so this does not link either.
+#[test]
+fn a_host_function_imported_as_a_global_does_not_pass() {
+    let refusal = refusal(&module(
+        &[
+            r#"(import "host_lib" "ldgr_index" (global $g i32))"#,
+            ONE_PAGE,
+        ],
+        "(global.get $g)",
+    ));
+    let refusal = assert_stage!(refusal, CheckError::Import(_)).to_string();
+    assert!(
+        refusal.contains("'host_lib::ldgr_index' is not a function"),
+        "{refusal}"
+    );
+}
+
+/// A module faulty at two stages is refused by the earlier one — it imports what no
+/// engine serves *and* exports no entry point. The imports are what the rest of the
+/// module depends on, so that is the message worth having.
+#[test]
+fn the_earlier_stage_is_the_one_reported() {
+    let refusal = refusal(
+        r#"(module
+             (import "host_lib" "no_such_function" (func $f (result i32)))
+             (memory (export "memory") 1)
+             (func (export "not_the_entry_point") (result i32) (call $f)))"#,
+    );
+
+    assert_stage!(refusal, CheckError::Import(_));
+}
+
+/// The signature is the one part of an import screening does not compare, so a
+/// module that will not link can still pass. Recorded here because it is the gap
+/// this stage leaves, not because it is wanted.
+#[test]
+fn an_import_with_the_wrong_signature_still_passes() {
+    let wat = module(
+        &[
+            r#"(import "host_lib" "ldgr_index" (func $f (param i64 i64) (result i32)))"#,
+            ONE_PAGE,
+        ],
+        "(i32.const 0)",
+    );
+    passes(&wat);
+
+    let host = FakeHost::new();
+    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
+        .expect_err("a mistyped import must not link");
+    assert!(
+        matches!(failure.error, RunError::Instantiate(_)),
+        "{failure}"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The entry point
+// ---------------------------------------------------------------------------
+
+#[test]
+fn a_missing_entry_point_does_not_pass() {
+    let refusal = refusal(
+        r#"(module (memory (export "memory") 1)
+                              (func (export "other") (result i32) (i32.const 0)))"#,
+    );
+    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
+    assert_eq!(refusal, "no entry point 'finish'");
+}
+
+/// The entry point is looked up by the name the caller asks for, as a run looks it
+/// up: screening a contract for one entry point says nothing about another.
+#[test]
+fn the_entry_point_is_the_name_the_caller_gives() {
+    let wasm = assemble(
+        r#"(module (memory (export "memory") 1)
+             (func (export "other") (result i32) (i32.const 0)))"#,
+    );
+
+    assert!(xrpl_wasm_vm::check(&wasm, "other").is_ok());
+    assert!(xrpl_wasm_vm::check(&wasm, ENTRY).is_err());
+}
+
+/// Both halves of the entry point's type are screened: a module returning the
+/// wrong thing, or taking anything at all, would fail the run's typed lookup.
+#[test]
+fn an_entry_point_of_the_wrong_type_does_not_pass() {
+    for (signature, body) in [
+        ("(result i64)", "(i64.const 0)"),
+        ("(param i32) (result i32)", "(i32.const 0)"),
+        ("", "(nop)"),
+    ] {
+        let refusal = refusal(&format!(
+            r#"(module (memory (export "memory") 1)
+                 (func (export "finish") {signature} {body}))"#
+        ));
+        let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
+        assert_eq!(
+            refusal, "entry point 'finish' has the wrong signature, expected '() -> i32'",
+            "{signature}"
+        );
+    }
+}
+
+/// An export of the entry point's name that is not a function at all is a third
+/// case, and named as such: nothing is missing and no signature is wrong.
+#[test]
+fn an_entry_point_that_is_not_a_function_does_not_pass() {
+    let refusal = refusal(
+        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#,
+    );
+    let refusal = assert_stage!(refusal, CheckError::EntryPoint(_)).to_string();
+    assert_eq!(refusal, "export 'finish' is not a function");
+}
+
+// ---------------------------------------------------------------------------
+// Agreement with a run
+// ---------------------------------------------------------------------------
+
+/// A module with no linear memory to export passes. A contract that makes no host
+/// call needs none, and one that does is refused at the call and charged — a
+/// runtime fault, not a malformed module.
+#[test]
+fn a_module_exporting_no_memory_passes() {
+    let wat = r#"(module (func (export "finish") (result i32) (i32.const 0)))"#;
+    passes(wat);
+
+    let host = FakeHost::new();
+    assert_eq!(
+        xrpl_wasm_vm::run(&assemble(wat), PLENTY_OF_GAS, &host, ENTRY)
+            .expect("a module that calls no host function needs no memory")
+            .result,
+        0
+    );
+}
+
+/// Modules spanning what screening decides, each also put through a run.
+fn modules() -> Vec<(&'static str, String)> {
+    vec![
+        (
+            "a runnable contract",
+            module(&[import::LDGR_INDEX, ONE_PAGE], "(i32.const 0)"),
+        ),
+        (
+            "a contract that traps",
+            module(&[ONE_PAGE], "(unreachable)"),
+        ),
+        (
+            "a disabled feature",
+            module(&[ONE_PAGE], "(i32.extend8_s (i32.const 1))"),
+        ),
+        (
+            "an unknown host function",
+            module(
+                &[
+                    r#"(import "host_lib" "nope" (func $f (result i32)))"#,
+                    ONE_PAGE,
+                ],
+                "(call $f)",
+            ),
+        ),
+        (
+            "an import from another module",
+            module(
+                &[
+                    r#"(import "env" "ldgr_index" (func $f (param i32 i32) (result i32)))"#,
+                    ONE_PAGE,
+                ],
+                "(i32.const 0)",
+            ),
+        ),
+        (
+            "a host function imported as a global",
+            module(
+                &[r#"(import "host_lib" "trace" (global $g i32))"#, ONE_PAGE],
+                "(global.get $g)",
+            ),
+        ),
+        (
+            "no entry point",
+            r#"(module (memory (export "memory") 1)
+                 (func (export "other") (result i32) (i32.const 0)))"#
+                .to_string(),
+        ),
+        (
+            "an entry point of the wrong type",
+            r#"(module (memory (export "memory") 1)
+                 (func (export "finish") (result i64) (i64.const 0)))"#
+                .to_string(),
+        ),
+    ]
+}
+
+/// Screening refuses a module exactly when a run would refuse it at one of the
+/// three stages screening covers — nothing it rejects would have run, and nothing
+/// it passes stops before the entry point is called. The exceptions are the ones
+/// [`what_static_screening_cannot_see`] lists.
+#[test]
+fn screening_and_a_run_agree() {
+    let host = FakeHost::new();
+
+    for (label, wat) in modules() {
+        let wasm = assemble(&wat);
+        let refused_early = match xrpl_wasm_vm::run(&wasm, PLENTY_OF_GAS, &host, ENTRY) {
+            Err(failure) => matches!(
+                failure.error,
+                RunError::Compile(_) | RunError::Instantiate(_) | RunError::EntryPoint(_)
+            ),
+            Ok(_) => false,
+        };
+
+        assert_eq!(
+            xrpl_wasm_vm::check(&wasm, ENTRY).is_err(),
+            refused_early,
+            "{label}"
+        );
+    }
+}
+
+/// A module asking for more memory than the engine grants is refused, so the
+/// contract that could never run does not reach the ledger. The cap itself passes.
+#[test]
+fn an_exported_memory_past_the_cap_does_not_pass() {
+    let wat = module(
+        &[&format!(
+            r#"(memory (export "memory") {})"#,
+            MAX_MEMORY_PAGES + 1
+        )],
+        "(i32.const 0)",
+    );
+    let refusal = assert_stage!(refusal(&wat), CheckError::Memory(_)).to_string();
+    assert!(refusal.contains("past the 128-page cap"), "{refusal}");
+
+    passes(&module(
+        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
+        "(i32.const 0)",
+    ));
+}
+
+/// A declared *maximum* past the cap is legal and simply unreachable, so screening
+/// must not turn it away: `vm_limits` runs this very module to completion.
+#[test]
+fn a_declared_maximum_past_the_cap_still_passes() {
+    passes(&module(
+        &[&format!(
+            r#"(memory (export "memory") 1 {})"#,
+            MAX_MEMORY_PAGES + 1
+        )],
+        "(i32.const 0)",
+    ));
+}
+
+/// The gap, listed rather than described, and now one entry long. A memory a module
+/// keeps to itself is not in its exports, so this is the one module that passes
+/// screening and then fails to *instantiate* — which is why a run's refusal at that
+/// stage cannot be read as the node's fault.
+///
+/// A contract needs an exported memory to make any host call, so a module of this
+/// shape can do nothing but compute; the SDK does not produce one.
+#[test]
+fn what_static_screening_cannot_see() {
+    let host = FakeHost::new();
+    let wat = format!(
+        r#"(module (memory {})
+             (func (export "finish") (result i32) (i32.const 0)))"#,
+        MAX_MEMORY_PAGES + 1
+    );
+
+    passes(&wat);
+
+    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
+        .expect_err("the store's limiter must refuse the memory");
+    assert!(
+        matches!(failure.error, RunError::Instantiate(_)),
+        "{failure}"
+    );
+}
+
+/// A start section is guest code, so screening cannot see whether it traps — but it
+/// no longer has to. A trap is the guest's fault wherever it happens, so the run
+/// charges the contract for what it burned instead of reporting a module the node
+/// should have screened.
+#[test]
+fn a_start_section_screening_cannot_see_is_charged_as_a_trap() {
+    let host = FakeHost::new();
+    let wat = format!(
+        r#"(module {ONE_PAGE}
+             (func $init (unreachable))
+             (start $init)
+             (func (export "finish") (result i32) (i32.const 0)))"#
+    );
+
+    passes(&wat);
+
+    let failure = xrpl_wasm_vm::run(&assemble(&wat), PLENTY_OF_GAS, &host, ENTRY)
+        .expect_err("a start section that traps must not complete the run");
+    assert!(matches!(failure.error, RunError::Trap(_)), "{failure}");
+    assert!(
+        failure.fuel_used > 0,
+        "charged for what it burned: {failure}"
+    );
+}

crates/xrpl-wasm-vm/tests/vm_limits.rs

@@ -0,0 +1,580 @@
+//! What the engine refuses outright: modules it will not compile, will not
+//! instantiate, or cannot find an entry point in — plus the linear-memory cap.
+//!
+//! These are the sandbox's outer wall. Everything here fails the run rather than
+//! returning a code to the guest, so each test reads the failure's message.
+
+mod support;
+
+use support::{
+    FakeHost, ONE_PAGE, PLENTY_OF_GAS, failure, import, module, run, run_entry, run_with_gas,
+};
+use xrpl_wasm_vm::{MAX_MEMORY_PAGES, RunError};
+
+/// Assert which stage a run failed at, because the caller maps the stages to
+/// different outcomes. A stage is one `RunError` variant, so the expectation is a
+/// pattern; the failure comes back out for the tests that also read its message.
+macro_rules! assert_stage {
+    ($failure:expr, $stage:pat) => {{
+        let failure = $failure;
+        assert!(
+            matches!(failure.error, $stage),
+            concat!("expected a ", stringify!($stage), " failure, got: {}"),
+            failure
+        );
+        failure
+    }};
+}
+
+// ---------------------------------------------------------------------------
+// Linear memory
+// ---------------------------------------------------------------------------
+
+/// A module declaring more than the cap fails to instantiate — the limit applies
+/// to the initial memory, not only to growth.
+#[test]
+fn an_initial_memory_past_the_cap_is_refused() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!(
+            r#"(memory (export "memory") {})"#,
+            MAX_MEMORY_PAGES + 1
+        )],
+        "(i32.const 0)",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+}
+
+/// The cap itself is allowed.
+#[test]
+fn an_initial_memory_at_the_cap_is_allowed() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[&format!(r#"(memory (export "memory") {MAX_MEMORY_PAGES})"#)],
+        "(i32.const 0)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+}
+
+/// Growth up to the cap succeeds; growth past it traps rather than answering -1 as
+/// `memory.grow` otherwise would, because the engine's limiter sets
+/// `trap_on_grow_failure(true)`.
+#[test]
+fn growth_stops_at_the_cap() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[ONE_PAGE],
+        &format!("(memory.grow (i32.const {}))", MAX_MEMORY_PAGES - 1),
+    );
+    assert_eq!(
+        run(&wat, &host).expect("should run").result,
+        1,
+        "growing to exactly the cap answers the previous size"
+    );
+
+    let wat = module(
+        &[ONE_PAGE],
+        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
+    );
+    assert_stage!(failure(&wat, &host), RunError::Trap(_));
+}
+
+/// A module may declare a maximum above the cap: the cap is enforced on the initial
+/// memory and on growth, not on the memory type's declared bound.
+#[test]
+fn a_declared_maximum_past_the_cap_is_allowed_but_unreachable() {
+    let host = FakeHost::new();
+    let memory = format!(r#"(memory (export "memory") 1 {})"#, MAX_MEMORY_PAGES + 1);
+
+    let wat = module(&[&memory], "(i32.const 0)");
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+
+    let wat = module(
+        &[&memory],
+        &format!("(memory.grow (i32.const {MAX_MEMORY_PAGES}))"),
+    );
+    assert_stage!(failure(&wat, &host), RunError::Trap(_));
+}
+
+// ---------------------------------------------------------------------------
+// Engine configuration
+// ---------------------------------------------------------------------------
+
+/// One row per feature `build_wasm_engine` turns off: the smallest module that uses
+/// it, and the fragment of wasmi's refusal that names the feature. A row declaring
+/// its own memory omits [`ONE_PAGE`], or it is refused for having two memories
+/// instead.
+fn disabled_features() -> Vec<(&'static str, Vec<&'static str>, &'static str, &'static str)> {
+    vec![
+        (
+            "wasm_multi_value",
+            vec![
+                ONE_PAGE,
+                "(func $two (result i32 i32) (i32.const 1) (i32.const 2))",
+            ],
+            "(call $two) (drop) (drop) (i32.const 0)",
+            "multi-value",
+        ),
+        (
+            "wasm_sign_extension",
+            vec![ONE_PAGE],
+            "(i32.extend8_s (i32.const 1))",
+            "sign extension",
+        ),
+        (
+            "wasm_bulk_memory",
+            vec![ONE_PAGE],
+            "(memory.fill (i32.const 0) (i32.const 0) (i32.const 1)) (i32.const 0)",
+            "bulk memory",
+        ),
+        (
+            "wasm_reference_types",
+            vec![ONE_PAGE, "(table 1 externref)"],
+            "(i32.const 0)",
+            "reference types",
+        ),
+        // The proposal covers mutable globals crossing the module boundary; an
+        // internal one is core wasm and stays allowed — see the test below.
+        (
+            "wasm_mutable_global",
+            vec![ONE_PAGE, r#"(global (export "g") (mut i32) (i32.const 0))"#],
+            "(i32.const 0)",
+            "mutable global",
+        ),
+        (
+            "wasm_tail_call",
+            vec![ONE_PAGE, "(func $f (result i32) (i32.const 0))"],
+            "(return_call $f)",
+            "tail call",
+        ),
+        // Arithmetic in a constant initialiser. wasmi names the operator rather
+        // than the proposal here.
+        (
+            "wasm_extended_const",
+            vec![
+                ONE_PAGE,
+                "(global $g i32 (i32.add (i32.const 1) (i32.const 2)))",
+            ],
+            "(global.get $g)",
+            "non-constant operator",
+        ),
+        (
+            "wasm_multi_memory",
+            vec![ONE_PAGE, "(memory 1)"],
+            "(i32.const 0)",
+            "multiple memories",
+        ),
+        (
+            "wasm_memory64",
+            vec![r#"(memory (export "memory") i64 1)"#],
+            "(i32.const 0)",
+            "memory64",
+        ),
+        (
+            "wasm_custom_page_sizes",
+            vec![r#"(memory (export "memory") 1 (pagesize 1))"#],
+            "(i32.const 0)",
+            "custom page sizes",
+        ),
+        (
+            "wasm_wide_arithmetic",
+            vec![ONE_PAGE],
+            "(drop (i64.add128 (i64.const 1) (i64.const 2) (i64.const 3) (i64.const 4)))
+             (i32.const 0)",
+            "wide arithmetic",
+        ),
+        // Determinism across nodes is the reason floats are off.
+        (
+            "floats",
+            vec![ONE_PAGE],
+            "(drop (f64.add (f64.const 1) (f64.const 2))) (i32.const 0)",
+            "floating-point",
+        ),
+    ]
+}
+
+/// Every feature the engine disables is refused, and refused for that reason.
+///
+/// `wasm_custom_page_sizes` and `wasm_wide_arithmetic` are off by default in wasmi
+/// 1.1 (`engine/config.rs:72,74`), so their rows guard against wasmi changing that
+/// default rather than against our own config.
+#[test]
+fn every_disabled_feature_is_refused_by_name() {
+    let host = FakeHost::new();
+
+    for (knob, parts, body, expected) in disabled_features() {
+        let wat = module(&parts, body);
+        let failure = assert_stage!(failure(&wat, &host), RunError::Compile(_)).to_string();
+
+        assert!(
+            failure.contains(expected),
+            "{knob}: expected a refusal mentioning {expected:?}, got: {failure}"
+        );
+    }
+}
+
+/// The three knobs [`every_disabled_feature_is_refused_by_name`] cannot cover. The
+/// engine is a process-wide `LazyLock`, so a test observes the one configuration we
+/// build: a knob masked by another, or with no caller-visible effect, has no
+/// distinguishing module.
+#[test]
+fn the_knobs_without_a_module_of_their_own() {
+    let host = FakeHost::new();
+
+    // `wasm_saturating_float_to_int(false)`: every saturating conversion takes a
+    // float operand, so `floats(false)` refuses it first, as the message shows.
+    let wat = module(&[ONE_PAGE], "(i32.trunc_sat_f32_s (f32.const 1))");
+    let refusal = failure(&wat, &host).to_string();
+    assert!(refusal.contains("floating-point"), "{refusal}");
+    assert!(!refusal.contains("saturating"), "{refusal}");
+
+    // `ignore_custom_sections(true)`: governs whether wasmi retains custom
+    // sections, not accept/reject, so this pins only that one is harmless.
+    let wat = module(
+        &[ONE_PAGE, r#"(@custom "note" "ignored")"#],
+        "(i32.const 0)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+
+    // `consume_fuel(true)`: with it off, `Store::set_fuel` fails and `run` returns
+    // before instantiating, so every test in the suite fails.
+    let wat = module(&[ONE_PAGE], "(i32.const 0)");
+    assert!(run(&wat, &host).expect("should run").fuel_used > 0);
+}
+
+/// A mutable global the module keeps to itself is core wasm, so the disabled
+/// proposal does not reach it: a guest can still have mutable state.
+#[test]
+fn an_internal_mutable_global_is_still_allowed() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[ONE_PAGE, "(global $g (mut i32) (i32.const 0))"],
+        "(global.set $g (i32.const 7)) (global.get $g)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 7);
+}
+
+/// Bytes that are not a wasm module at all.
+#[test]
+fn garbage_does_not_compile() {
+    let host = FakeHost::new();
+
+    for bytes in [b"".as_slice(), b"not wasm", &[0x00, 0x61, 0x73, 0x6d]] {
+        let failure = xrpl_wasm_vm::run(bytes, PLENTY_OF_GAS, &host, support::ENTRY)
+            .expect_err("garbage must not compile");
+        assert_stage!(failure, RunError::Compile(_));
+    }
+}
+
+/// The VM takes wasm binaries, and text is not one. wasmi's `wat` feature is on by
+/// default and would have `Module::new` assemble text too, so the crate builds
+/// wasmi without it; turning it back on would make this transaction blob valid.
+#[test]
+fn the_vm_refuses_a_text_format_module() {
+    let host = FakeHost::new();
+    let text = module(&[ONE_PAGE], "(i32.const 0)");
+
+    let failure = xrpl_wasm_vm::run(text.as_bytes(), PLENTY_OF_GAS, &host, support::ENTRY)
+        .expect_err("text must not compile as a module");
+    assert_stage!(failure, RunError::Compile(_));
+
+    // The same module, assembled first, runs: the text is sound and only the
+    // format was refused.
+    assert_eq!(run(&text, &host).expect("should run").result, 0);
+}
+
+// ---------------------------------------------------------------------------
+// Imports
+// ---------------------------------------------------------------------------
+
+/// A module may import fewer host functions than are registered, but not more:
+/// an import the linker does not define fails instantiation.
+#[test]
+fn an_unknown_import_fails_instantiation() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[
+            r#"(import "host_lib" "no_such_function" (func $f (param i32) (result i32)))"#,
+            ONE_PAGE,
+        ],
+        "(call $f (i32.const 0))",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+}
+
+/// Host functions are registered under one module name — `host_lib`, the name the
+/// guest SDK and this repo's fixtures import from — and a guest naming a different
+/// one does not link. `env` is in the list because that is what plain clang emits.
+#[test]
+fn the_import_module_name_must_match() {
+    let host = FakeHost::new();
+
+    for module_name in ["host", "env", ""] {
+        let wat = module(
+            &[
+                &format!(
+                    r#"(import "{module_name}" "ldgr_index" (func $f (param i32 i32) (result i32)))"#
+                ),
+                ONE_PAGE,
+            ],
+            "(call $f (i32.const 0) (i32.const 4))",
+        );
+        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+    }
+}
+
+/// An import spelled with the wrong signature does not link even under the right
+/// name, which is what makes the registered signatures load-bearing.
+#[test]
+fn an_import_with_the_wrong_signature_fails_instantiation() {
+    let host = FakeHost::new();
+
+    for signature in [
+        "(param i32) (result i32)",         // too few parameters
+        "(param i32 i32 i32) (result i32)", // too many
+        "(param i64 i64) (result i32)",     // wrong parameter types
+        "(param i32 i32) (result i64)",     // wrong result type
+        "(param i32 i32)",                  // no result
+    ] {
+        let wat = module(
+            &[
+                &format!(r#"(import "host_lib" "ldgr_index" (func $f {signature}))"#),
+                ONE_PAGE,
+            ],
+            "(i32.const 0)",
+        );
+        assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+    }
+}
+
+/// A module that imports a host function it never calls still has to link.
+#[test]
+fn an_unused_import_is_still_linked() {
+    let host = FakeHost::new();
+
+    let wat = module(
+        &[import::LDGR_INDEX, import::TRACE, ONE_PAGE],
+        "(i32.const 0)",
+    );
+    assert_eq!(run(&wat, &host).expect("should run").result, 0);
+}
+
+// ---------------------------------------------------------------------------
+// The start section
+// ---------------------------------------------------------------------------
+
+/// A start section runs guest code during instantiation, before the entry point
+/// is even looked up, and `set_fuel` and the memory limiter are both installed by
+/// then — so it is metered like any other guest code, and a run it stops is
+/// charged for what it burned.
+///
+/// Reported as a **trap**, not as a module that would not instantiate: a trap is the
+/// guest's fault wherever it happens, and the stage a run stopped at is not what the
+/// caller maps. Filing it under the stage would put a contract's own defect among the
+/// faults a caller treats as the node's, and charge nothing for the instructions the
+/// contract burned reaching it.
+#[test]
+fn a_trapping_start_section_is_a_guest_trap_and_is_charged() {
+    let host = FakeHost::new();
+
+    let wat = format!(
+        r#"(module {ONE_PAGE}
+             (func $init (unreachable))
+             (start $init)
+             (func (export "finish") (result i32) (i32.const 0)))"#
+    );
+    let failure = assert_stage!(
+        run_with_gas(&wat, PLENTY_OF_GAS, &host)
+            .expect_err("a start section that traps must not complete the run"),
+        RunError::Trap(_)
+    );
+    assert!(
+        failure.fuel_used > 0,
+        "the start section's instructions are metered: {failure}"
+    );
+}
+
+/// What `RunError::Instantiate` is left to mean: a module the linker or the store
+/// would not accept, rather than one whose guest code failed. Its two shapes, so the
+/// variant is not left standing for nothing.
+#[test]
+fn instantiation_failure_is_a_module_the_engine_will_not_accept() {
+    let host = FakeHost::new();
+
+    // The linker defines no such import.
+    let wat = module(
+        &[
+            r#"(import "host_lib" "no_such_function" (func $f (result i32)))"#,
+            ONE_PAGE,
+        ],
+        "(call $f)",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+
+    // The store's limiter will not grant the memory, and does not trap to say so.
+    let wat = module(
+        &[&format!("(memory {})", MAX_MEMORY_PAGES + 1)],
+        "(i32.const 0)",
+    );
+    assert_stage!(failure(&wat, &host), RunError::Instantiate(_));
+}
+
+/// A start section that runs out of gas is reported as out of gas, not as a module
+/// that would not instantiate. The stage a run stopped at is not what the caller
+/// maps — the reason is — and gas exhaustion is one outcome wherever the guest
+/// reaches it.
+#[test]
+fn a_start_section_that_exhausts_gas_is_out_of_gas_not_an_instantiation_failure() {
+    const GAS: u64 = 10_000;
+
+    let host = FakeHost::new();
+    let wat = format!(
+        r#"(module {ONE_PAGE}
+             (func $init (loop $l (br $l)))
+             (start $init)
+             (func (export "finish") (result i32) (i32.const 0)))"#
+    );
+
+    let failure = assert_stage!(
+        run_with_gas(&wat, GAS, &host).expect_err("an endless start section must not instantiate"),
+        RunError::OutOfGas
+    );
+    assert_eq!(
+        failure.fuel_used, GAS,
+        "a runaway start section burns the whole limit"
+    );
+}
+
+/// A start section cannot make a host call that needs guest memory, even in a
+/// module that exports one: the memory is resolved from the *instance's* exports,
+/// and instantiation is what produces the instance, so a call made while it is
+/// still running has no memory to work in and ends the run.
+///
+/// Not a choice: `Module::instantiate` is `pub(crate)` in wasmi, so instantiation
+/// cannot be split from the start section to resolve the memory in between.
+#[test]
+fn a_start_section_cannot_make_a_host_call() {
+    let host = FakeHost::new();
+
+    let wat = format!(
+        r#"(module {ldgr_index} {ONE_PAGE}
+             (func $init (drop (call $ldgr_index (i32.const 0) (i32.const 4))))
+             (start $init)
+             (func (export "finish") (result i32) (i32.const 0)))"#,
+        ldgr_index = import::LDGR_INDEX
+    );
+
+    let failure = assert_stage!(
+        run_with_gas(&wat, PLENTY_OF_GAS, &host)
+            .expect_err("a host call from a start section must not be served"),
+        RunError::NoMemory
+    );
+    assert!(
+        failure.fuel_used > 0,
+        "the start section is metered up to the refused call: {failure}"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The entry point
+// ---------------------------------------------------------------------------
+
+#[test]
+fn a_missing_entry_point_fails() {
+    let host = FakeHost::new();
+
+    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 0)))"#;
+    let failure = assert_stage!(
+        run_with_gas(wat, PLENTY_OF_GAS, &host)
+            .expect_err("a module without the entry point must not run"),
+        RunError::EntryPoint(_)
+    );
+    assert!(
+        failure.to_string().contains("no entry point 'finish'"),
+        "{failure}"
+    );
+}
+
+/// The entry point is looked up by the name the caller asks for.
+#[test]
+fn the_entry_point_is_the_name_the_caller_gives() {
+    let host = FakeHost::new();
+
+    let wat = r#"(module (memory (export "memory") 1) (func (export "other") (result i32) (i32.const 9)))"#;
+    let outcome = run_entry(wat, &host, "other").expect("should run");
+    assert_eq!(outcome.result, 9);
+}
+
+/// The entry point must take nothing and return an `i32`. A module that exports the
+/// name with another signature is told so, rather than being told the export is
+/// missing: wasmi answers both cases with one error, and "no entry point" would send
+/// a contract author looking for a function they already have.
+#[test]
+fn an_entry_point_of_the_wrong_type_fails() {
+    let host = FakeHost::new();
+
+    for signature in ["(result i64)", "(param i32) (result i32)", ""] {
+        let body = if signature.contains("result i64") {
+            "(i64.const 0)"
+        } else if signature.is_empty() {
+            "(nop)"
+        } else {
+            "(i32.const 0)"
+        };
+        let wat = format!(
+            r#"(module (memory (export "memory") 1) (func (export "finish") {signature} {body}))"#
+        );
+        let failure = assert_stage!(
+            run_with_gas(&wat, PLENTY_OF_GAS, &host)
+                .expect_err("a wrongly-typed entry point must not run"),
+            RunError::EntryPoint(_)
+        )
+        .to_string();
+        assert!(
+            failure.contains("entry point 'finish' has the wrong signature"),
+            "{signature}: {failure}"
+        );
+        assert!(
+            !failure.contains("no entry point"),
+            "a present export must not be reported as absent — {signature}: {failure}"
+        );
+    }
+}
+
+/// An export of the entry point's name that is not a function at all is a third
+/// case, and named as such: nothing is missing and no signature is wrong.
+#[test]
+fn an_entry_point_that_is_not_a_function_fails() {
+    let host = FakeHost::new();
+
+    let wat =
+        r#"(module (memory (export "memory") 1) (global (export "finish") i32 (i32.const 0)))"#;
+    let failure = assert_stage!(
+        run_with_gas(wat, PLENTY_OF_GAS, &host).expect_err("a non-function export must not run"),
+        RunError::EntryPoint(_)
+    )
+    .to_string();
+    assert!(
+        failure.contains("export 'finish' is not a function"),
+        "{failure}"
+    );
+}
+
+/// A guest that traps fails the run rather than returning a value.
+#[test]
+fn a_trapping_guest_fails_the_run() {
+    let host = FakeHost::new();
+
+    let wat = module(&[ONE_PAGE], "(unreachable)");
+    assert_stage!(failure(&wat, &host), RunError::Trap(_));
+
+    // An out-of-bounds guest access is a trap too, caught by the engine rather
+    // than anything the host is asked about.
+    let wat = module(&[ONE_PAGE], "(i32.load (i32.const 100000))");
+    assert_stage!(failure(&wat, &host), RunError::Trap(_));
+}

include/xrpl/basics/Number.h

@@ -304,7 +304,7 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *      on-ledger are non-negative. This is due to implementation details of
  *      several operations which use unsigned arithmetic internally. This is
  *      sufficient to represent all valid XRP values (where the absolute value
- *      can not exceed kInitialXrp: 10^17), and MPT values (where the absolute
+ *      can not exceed INITIAL_XRP: 10^17), and MPT values (where the absolute
  *      value can not exceed maxMPTokenAmount: 2^63-1).
  *
  * ---- Mantissa Range Switching ----

include/xrpl/config/Constants.h

@@ -94,7 +94,6 @@ struct Keys
     static constexpr auto kBbtOptions = "bbt_options";
     static constexpr auto kBgThreads = "bg_threads";
     static constexpr auto kBlockSize = "block_size";
-    static constexpr auto kBytecodeSizeLimit = "bytecode_size_limit";
     static constexpr auto kCacheAge = "cache_age";
     static constexpr auto kCacheMb = "cache_mb";
     static constexpr auto kCacheSize = "cache_size";
@@ -109,8 +108,6 @@ struct Keys
     static constexpr auto kFileSizeMult = "file_size_mult";
     static constexpr auto kFilterBits = "filter_bits";
     static constexpr auto kFilterFull = "filter_full";
-    static constexpr auto kGasLimit = "gas_limit";
-    static constexpr auto kGasPrice = "gas_price";
     static constexpr auto kHardSet = "hard_set";
     static constexpr auto kHighThreads = "high_threads";
     static constexpr auto kHoldTime = "hold_time";

include/xrpl/core/ServiceRegistry.h

@@ -6,7 +6,6 @@
 #include <xrpl/basics/TaggedCache.h>
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
-#include <xrpl/protocol/Fees.h>
 
 #include <boost/asio.hpp>
 
@@ -247,9 +246,6 @@ public:
     virtual DatabaseCon&
     getWalletDB() = 0;
 
-    [[nodiscard]] virtual Fees
-    getFees() const = 0;
-
     // Temporary: Get the underlying Application for functions that haven't
     // been migrated yet. This should be removed once all code is migrated.
     virtual Application&

include/xrpl/ledger/ApplyViewImpl.h

@@ -13,7 +13,6 @@
 #include <xrpl/protocol/TxMeta.h>
 
 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <optional>
 
@@ -69,18 +68,6 @@ public:
         deliver_ = amount;
     }
 
-    void
-    setGasUsed(std::optional<std::uint32_t> const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    void
-    setVMReturnCode(std::int32_t const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
     /**
      * Get the number of modified entries
      */
@@ -101,8 +88,6 @@ public:
 
 private:
     std::optional<STAmount> deliver_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;
 };
 
 }  // namespace xrpl

include/xrpl/ledger/OpenViewSandbox.h

@@ -1,82 +0,0 @@
-#pragma once
-
-#include <xrpl/ledger/OpenView.h>
-
-#include <memory>
-
-namespace xrpl {
-
-class OpenViewSandbox
-{
-private:
-    OpenView& parent_;
-    std::unique_ptr<OpenView> sandbox_;
-
-public:
-    using key_type = ReadView::key_type;
-
-    OpenViewSandbox(OpenView& parent)
-        : parent_(parent), sandbox_(std::make_unique<OpenView>(kBatchView, parent))
-    {
-    }
-
-    void
-    rawErase(std::shared_ptr<SLE> const& sle)
-    {
-        sandbox_->rawErase(sle);
-    }
-
-    void
-    rawInsert(std::shared_ptr<SLE> const& sle)
-    {
-        sandbox_->rawInsert(sle);
-    }
-
-    void
-    rawReplace(std::shared_ptr<SLE> const& sle)
-    {
-        sandbox_->rawReplace(sle);
-    }
-
-    void
-    rawDestroyXRP(XRPAmount const& fee)
-    {
-        sandbox_->rawDestroyXRP(fee);
-    }
-
-    void
-    rawTxInsert(
-        key_type const& key,
-        std::shared_ptr<Serializer const> const& txn,
-        std::shared_ptr<Serializer const> const& metaData)
-    {
-        sandbox_->rawTxInsert(key, txn, metaData);
-    }
-
-    void
-    commit()
-    {
-        sandbox_->apply(parent_);
-        sandbox_ = std::make_unique<OpenView>(kBatchView, parent_);
-    }
-
-    void
-    discard()
-    {
-        sandbox_ = std::make_unique<OpenView>(kBatchView, parent_);
-    }
-
-    OpenView const&
-    view() const
-    {
-        return *sandbox_;
-    }
-
-    OpenView&
-    view()
-    {
-        return *sandbox_;
-    }
-};
-
-}  // namespace xrpl

include/xrpl/ledger/View.h

@@ -5,10 +5,6 @@
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ReadView.h>
-#include <xrpl/ledger/helpers/MPTokenHelpers.h>
-#include <xrpl/ledger/helpers/OfferHelpers.h>
-#include <xrpl/ledger/helpers/RippleStateHelpers.h>
-#include <xrpl/ledger/helpers/TokenHelpers.h>
 #include <xrpl/protocol/AccountID.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/Keylet.h>
@@ -229,27 +225,6 @@ doWithdraw(
     STAmount const& amount,
     beast::Journal j);
 
-enum class SendIssuerHandling { ihSENDER_NOT_ALLOWED, ihRECEIVER_NOT_ALLOWED, ihIGNORE };
-enum class SendEscrowHandling { ehIGNORE, ehCHECK };
-enum class SendAuthHandling { ahCHECK_SENDER, ahCHECK_RECEIVER, ahBOTH, ahNEITHER };
-enum class SendFreezeHandling { fhCHECK_SENDER, fhCHECK_RECEIVER, fhBOTH, fhNEITHER };
-enum class SendTransferHandling { thIGNORE, thCHECK };
-enum class SendBalanceHandling { bhIGNORE, bhCHECK };
-
-TER
-canTransferFT(
-    ReadView const& view,
-    AccountID const& sender,
-    AccountID const& receiver,
-    STAmount const& amount,
-    beast::Journal j,
-    SendIssuerHandling issuerHandling,
-    SendEscrowHandling escrowHandling,
-    SendAuthHandling authHandling,
-    SendFreezeHandling freezeHandling,
-    SendTransferHandling transferHandling,
-    SendBalanceHandling balanceHandling);
-
 /**
  * Deleter function prototype. Returns the status of the entry deletion
  * (if should not be skipped) and if the entry should be skipped. The status

include/xrpl/ledger/detail/ApplyStateTable.h

@@ -16,7 +16,6 @@
 #include <xrpl/protocol/XRPAmount.h>
 
 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <map>
 #include <optional>
@@ -63,8 +62,6 @@ public:
         TER ter,
         std::optional<STAmount> const& deliver,
         std::optional<uint256 const> const& parentBatchId,
-        std::optional<std::uint32_t> const& gasUsed,
-        std::optional<std::int32_t> const& vmReturnCode,
         bool isDryRun,
         beast::Journal j);
 

include/xrpl/ledger/helpers/ContractUtils.h

@@ -1,102 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/core/ServiceRegistry.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/AccountID.h>
-#include <xrpl/protocol/STData.h>
-#include <xrpl/protocol/STJson.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/TxFlags.h>
-
-#include <map>
-
-namespace xrpl {
-
-class ContractDataMap : public std::map<xrpl::AccountID, std::pair<bool, STJson>>
-{
-public:
-    uint32_t modifiedCount = 0;
-};
-
-class ContractEventMap : public std::map<std::string, STJson>
-{
-};
-
-namespace contract {
-
-/** The maximum number of data modifications in a single function. */
-int64_t constexpr maxDataModifications = 1000;
-
-/** The maximum number of bytes the data can occupy. */
-int64_t constexpr maxContractDataSize = 1024;
-
-/** The multiplier for contract data size calculations. */
-int64_t constexpr dataByteMultiplier = 512;
-
-/** The cost multiplier of creating a contract in bytes. */
-int64_t constexpr createByteMultiplier = 500ULL;
-
-/** The value to return when the fee calculation failed. */
-int64_t constexpr feeCalculationFailed = 0x7FFFFFFFFFFFFFFFLL;
-
-/** The maximum number of contract parameters that can be in a transaction. */
-std::size_t constexpr maxContractParams = 8;
-
-/** The maximum number of contract functions that can be in a transaction. */
-std::size_t constexpr maxContractFunctions = 32;
-
-int64_t
-contractCreateFee(uint64_t byteCount);
-
-NotTEC
-preflightFunctions(STTx const& tx, beast::Journal j);
-
-NotTEC
-preflightInstanceParameters(STTx const& tx, beast::Journal j);
-
-bool
-validateParameterMapping(STArray const& params, STArray const& values, beast::Journal j);
-
-NotTEC
-preflightInstanceParameterValues(STTx const& tx, beast::Journal j);
-
-NotTEC
-preflightFlagParameters(STArray const& parameters, beast::Journal j);
-
-bool
-isValidParameterFlag(std::uint32_t flags);
-
-TER
-preclaimFlagParameters(
-    ReadView const& view,
-    AccountID const& sourceAccount,
-    AccountID const& contractAccount,
-    STArray const& parameters,
-    beast::Journal j);
-
-TER
-doApplyFlagParameters(
-    ApplyView& view,
-    STTx const& tx,
-    AccountID const& sourceAccount,
-    AccountID const& contractAccount,
-    STArray const& parameters,
-    XRPAmount const& priorBalance,
-    beast::Journal j);
-
-TER
-finalizeContractData(
-    ServiceRegistry& registry,
-    ApplyView& view,
-    AccountID const& contractAccount,
-    ContractDataMap const& dataMap,
-    ContractEventMap const& eventMap,
-    uint256 const& txnID);
-
-}  // namespace contract
-}  // namespace xrpl

include/xrpl/ledger/helpers/EscrowHelpers.h

@@ -25,8 +25,6 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/UintTypes.h>
 
-#include <cstdint>
-
 namespace xrpl {
 
 template <ValidIssueType T>
@@ -274,18 +272,4 @@ escrowUnlockApplyHelper<MPTIssue>(
         journal);
 }
 
-// calculateAdditionalReserve computes the owner count impact of an Escrow.
-// An escrow without a FinishFunction costs 1 reserve. With a FinishFunction,
-// each additional 500 bytes beyond the first 500 adds another reserve slot.
-template <class T>
-static int32_t
-calculateAdditionalReserve(T const& finishFunction)
-{
-    if (!finishFunction)
-        return 1;
-    // First 500 bytes included in the normal reserve
-    // Each additional 500 bytes requires an additional reserve
-    return 1 + (finishFunction->size() / 500);
-}
-
 }  // namespace xrpl

include/xrpl/ledger/helpers/NFTokenHelpers.h

@@ -16,7 +16,6 @@
 #include <xrpl/protocol/TER.h>
 #include <xrpl/protocol/TxFlags.h>
 #include <xrpl/protocol/XRPAmount.h>
-#include <xrpl/protocol/nft.h>
 
 #include <cstddef>
 #include <cstdint>
@@ -162,12 +161,4 @@ checkTrustlineDeepFrozen(
     beast::Journal const j,
     Issue const& issue);
 
-TER
-transferNFToken(
-    ApplyView& view,
-    AccountID const& buyer,
-    AccountID const& seller,
-    uint256 const& nftokenID,
-    beast::Journal j);
-
 }  // namespace xrpl::nft

include/xrpl/protocol/AMMCore.h

@@ -47,7 +47,7 @@ ammLPTIssue(Asset const& asset1, Asset const& asset2, AccountID const& ammAccoun
 
 /**
  * Validate the amount.
- * If validZero is false and amount is beast::kZero then invalid amount.
+ * If validZero is false and amount is beast::zero then invalid amount.
  * Return error code if invalid amount.
  * If pair then validate amount's issue matches one of the pair's issue.
  */

include/xrpl/protocol/Emitable.h

@@ -1,78 +0,0 @@
-#pragma once
-
-#include <xrpl/protocol/Rules.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/protocol/TxFormats.h>
-
-#include <optional>
-#include <string>
-#include <unordered_map>
-
-namespace xrpl {
-/**
- * We have both transaction type emitables and granular type emitables.
- * Since we will reuse the TransactionFormats to parse the Transaction
- * Emitables, only the GranularEmitableType is defined here. To prevent
- * conflicts with TxType, the GranularEmitableType is always set to a value
- * greater than the maximum value of uint16.
- */
-enum GranularEmitableType : std::uint32_t {
-#pragma push_macro("EMITABLE")
-#undef EMITABLE
-
-#define EMITABLE(type, txType, value) type = value,
-
-#include <xrpl/protocol/detail/emitable.macro>
-
-#undef EMITABLE
-#pragma pop_macro("EMITABLE")
-};
-
-enum Emittance { emitable, notEmitable };
-
-class Emitable
-{
-private:
-    Emitable();
-
-    std::unordered_map<std::uint16_t, Emittance> emitableTx_;
-
-    std::unordered_map<std::string, GranularEmitableType> granularEmitableMap_;
-
-    std::unordered_map<GranularEmitableType, std::string> granularNameMap_;
-
-    std::unordered_map<GranularEmitableType, TxType> granularTxTypeMap_;
-
-public:
-    static Emitable const&
-    getInstance();
-
-    Emitable(Emitable const&) = delete;
-    Emitable&
-    operator=(Emitable const&) = delete;
-
-    std::optional<std::string>
-    getEmitableName(std::uint32_t const value) const;
-
-    std::optional<std::uint32_t>
-    getGranularValue(std::string const& name) const;
-
-    std::optional<std::string>
-    getGranularName(GranularEmitableType const& value) const;
-
-    std::optional<TxType>
-    getGranularTxType(GranularEmitableType const& gpType) const;
-
-    bool
-    isEmitable(std::uint32_t const& emitableValue) const;
-
-    // for tx level emitable, emitable value is equal to tx type plus one
-    uint32_t
-    txToEmitableType(TxType const& type) const;
-
-    // tx type value is emitable value minus one
-    TxType
-    emitableToTxType(uint32_t const& value) const;
-};
-
-}  // namespace xrpl

include/xrpl/protocol/Fees.h

@@ -10,15 +10,6 @@ namespace xrpl {
 // This was the reference fee units used in the old fee calculation.
 inline constexpr std::uint32_t kFeeUnitsDeprecated = 10;
 
-// Number of micro-drops in one drop.
-constexpr std::uint32_t microDropsPerDrop{1'000'000};
-
-/**
- * Maximum Feature Extension fee settings.
- */
-inline constexpr std::uint32_t kMaxGasLimit{2'000'000};
-inline constexpr std::uint32_t kMaxBytecodeSizeLimit{200'000};
-
 /**
  * Reflects the fee settings for a particular ledger.
  *
@@ -42,21 +33,6 @@ struct Fees
      */
     XRPAmount increment{0};
 
-    /**
-     * @brief Gas limit for Feature Extensions (instructions).
-     */
-    std::uint32_t gasLimit{0};
-
-    /**
-     * @brief Bytecode size limit for Feature Extensions (bytes).
-     */
-    std::uint32_t bytecodeSizeLimit{0};
-
-    /**
-     * @brief Price of WASM gas (micro-drops).
-     */
-    std::uint32_t gasPrice{0};
-
     explicit Fees() = default;
     Fees(Fees const&) = default;
     Fees&

include/xrpl/protocol/Indexes.h

@@ -237,12 +237,6 @@ page(Keylet const& root, std::uint64_t const index = 0) noexcept
 Keylet
 escrow(AccountID const& src, SeqProxy const& seq) noexcept;
 
-inline Keylet
-escrow(uint256 const& key) noexcept
-{
-    return {ltESCROW, key};
-}
-
 /**
  * A PaymentChannel
  */
@@ -392,22 +386,6 @@ permissionedDomain(AccountID const& account, SeqProxy const& seq) noexcept;
 
 Keylet
 permissionedDomain(uint256 const& domainID) noexcept;
-
-Keylet
-contractSource(uint256 const& contractHash) noexcept;
-
-Keylet
-contract(uint256 const& contractHash, AccountID const& owner, std::uint32_t seq) noexcept;
-
-inline Keylet
-contract(uint256 const& contractID)
-{
-    return {ltCONTRACT, contractID};
-}
-
-Keylet
-contractData(AccountID const& owner, AccountID const& contractAccount) noexcept;
-
 }  // namespace keylet
 
 // Everything below is deprecated and should be removed in favor of keylets:

include/xrpl/protocol/LedgerFormats.h

@@ -85,6 +85,15 @@ enum LedgerEntryType : std::uint16_t {
      */
     ltNICKNAME [[deprecated("This object type is not supported and should not be used.")]] = 0x006e,
 
+    /**
+     * A legacy, deprecated type.
+     *
+     * @deprecated **This object type is not supported and should not be used.**
+     *             Support for this type of object was never implemented.
+     *             No objects of this type were ever created.
+     */
+    ltCONTRACT [[deprecated("This object type is not supported and should not be used.")]] = 0x0063,
+
     /**
      * A legacy, deprecated type.
      *

include/xrpl/protocol/SField.h

@@ -34,9 +34,6 @@ class STNumber;
 class STXChainBridge;
 class STVector256;
 class STCurrency;
-class STData;
-class STDataType;
-class STJson;
 
 // NOLINTBEGIN(readability-identifier-naming)
 #pragma push_macro("XMACRO")
@@ -76,9 +73,6 @@ class STJson;
     STYPE(STI_ISSUE, 24)                          \
     STYPE(STI_XCHAIN_BRIDGE, 25)                  \
     STYPE(STI_CURRENCY, 26)                       \
-    STYPE(STI_DATA, 27)                           \
-    STYPE(STI_DATATYPE, 28)                       \
-    STYPE(STI_JSON, 29)                           \
                                                   \
     /* high-level types */                        \
     /* cannot be serialized inside other types */ \
@@ -365,9 +359,6 @@ using SF_NUMBER = TypedField<STNumber>;
 using SF_VL = TypedField<STBlob>;
 using SF_VECTOR256 = TypedField<STVector256>;
 using SF_XCHAIN_BRIDGE = TypedField<STXChainBridge>;
-using SF_DATA = TypedField<STData>;
-using SF_DATATYPE = TypedField<STDataType>;
-using SF_JSON = TypedField<STJson>;
 
 //------------------------------------------------------------------------------
 

include/xrpl/protocol/STData.h

@@ -1,289 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAccount.h>
-#include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/STBitString.h>
-#include <xrpl/protocol/STInteger.h>
-#include <xrpl/protocol/detail/STVar.h>
-
-#include <cstdint>
-#include <string>
-#include <vector>
-
-namespace xrpl {
-
-class STData final : public STBase
-{
-private:
-    using data_type = detail::STVar;
-    std::uint16_t inner_type_;
-    data_type data_;
-    bool default_{true};
-
-public:
-    using value_type = STData;  // Although not directly holding a single value
-
-    STData(SField const& n);
-    STData(SField const& n, unsigned char);
-    STData(SField const& n, std::uint16_t);
-    STData(SField const& n, std::uint32_t);
-    STData(SField const& n, std::uint64_t);
-    STData(SField const& n, uint128 const&);
-    STData(SField const& n, uint160 const&);
-    STData(SField const& n, uint192 const&);
-    STData(SField const& n, uint256 const&);
-    STData(SField const& n, Blob const&);
-    STData(SField const& n, Slice const&);
-    STData(SField const& n, AccountID const&);
-    STData(SField const& n, STAmount const&);
-    STData(SField const& n, STIssue const&);
-    STData(SField const& n, STCurrency const&);
-    STData(SField const& n, STNumber const&);
-
-    STData(SerialIter& sit, SField const& name);
-
-    std::size_t
-    size() const;
-
-    SerializedTypeID
-    getSType() const override;
-
-    std::string
-    getInnerTypeString() const;
-
-    std::string
-    getText() const override;
-
-    json::Value getJson(JsonOptions) const override;
-
-    void
-    add(Serializer& s) const override;
-
-    bool
-    isEquivalent(STBase const& t) const override;
-
-    bool
-    isDefault() const override;
-
-    SerializedTypeID
-    getInnerSType() const noexcept;
-
-    STBase*
-    makeFieldPresent();
-
-    void
-    setFieldU8(unsigned char);
-    void
-    setFieldU16(std::uint16_t);
-    void
-    setFieldU32(std::uint32_t);
-    void
-    setFieldU64(std::uint64_t);
-    void
-    setFieldH128(uint128 const&);
-    void
-    setFieldH160(uint160 const&);
-    void
-    setFieldH192(uint192 const&);
-    void
-    setFieldH256(uint256 const&);
-    void
-    setFieldVL(Blob const&);
-    void
-    setFieldVL(Slice const&);
-    void
-    setAccountID(AccountID const&);
-    void
-    setFieldAmount(STAmount const&);
-    void
-    setIssue(STIssue const&);
-    void
-    setCurrency(STCurrency const&);
-    void
-    setFieldNumber(STNumber const&);
-
-    unsigned char
-    getFieldU8() const;
-    std::uint16_t
-    getFieldU16() const;
-    std::uint32_t
-    getFieldU32() const;
-    std::uint64_t
-    getFieldU64() const;
-    uint128
-    getFieldH128() const;
-    uint160
-    getFieldH160() const;
-    uint192
-    getFieldH192() const;
-    uint256
-    getFieldH256() const;
-    Blob
-    getFieldVL() const;
-    AccountID
-    getAccountID() const;
-    STAmount const&
-    getFieldAmount() const;
-    STIssue
-    getFieldIssue() const;
-    STCurrency
-    getFieldCurrency() const;
-    STNumber
-    getFieldNumber() const;
-
-private:
-    STBase*
-    copy(std::size_t n, void* buf) const override;
-    STBase*
-    move(std::size_t n, void* buf) override;
-
-    friend class detail::STVar;
-
-    // Implementation for getting (most) fields that return by value.
-    //
-    // The remove_cv and remove_reference are necessitated by the STBitString
-    // types.  Their value() returns by const ref.  We return those types
-    // by value.
-    template <
-        typename T,
-        typename V = typename std::remove_cv<
-            typename std::remove_reference<decltype(std::declval<T>().value())>::type>::type>
-    V
-    getFieldByValue() const;
-
-    // Implementations for getting (most) fields that return by const reference.
-    //
-    // If an absent optional field is deserialized we don't have anything
-    // obvious to return.  So we insist on having the call provide an
-    // 'empty' value we return in that circumstance.
-    template <typename T, typename V>
-    V const&
-    getFieldByConstRef(V const& empty) const;
-
-    // Implementation for setting most fields with a setValue() method.
-    template <typename T, typename V>
-    void
-    setFieldUsingSetValue(V value);
-
-    // Implementation for setting fields using assignment
-    template <typename T>
-    void
-    setFieldUsingAssignment(T const& value);
-};
-
-//------------------------------------------------------------------------------
-// Implementation
-//------------------------------------------------------------------------------
-
-inline SerializedTypeID
-STData::getInnerSType() const noexcept
-{
-    return static_cast<SerializedTypeID>(inner_type_);
-}
-
-template <typename T, typename V>
-V
-STData::getFieldByValue() const
-{
-    STBase const* rf = &data_.get();
-
-    // if (!rf)
-    //     throwFieldNotFound(getFName());
-
-    SerializedTypeID const id = rf->getSType();
-
-    if (id == STI_NOTPRESENT)
-        Throw<std::runtime_error>("Field not present");
-
-    T const* cf = dynamic_cast<T const*>(rf);
-
-    if (!cf)
-        Throw<std::runtime_error>("Wrong field type");
-
-    return cf->value();
-}
-
-// Implementations for getting (most) fields that return by const reference.
-//
-// If an absent optional field is deserialized we don't have anything
-// obvious to return.  So we insist on having the call provide an
-// 'empty' value we return in that circumstance.
-template <typename T, typename V>
-V const&
-STData::getFieldByConstRef(V const& empty) const
-{
-    STBase const* rf = &data_.get();
-
-    // if (!rf)
-    //     throwFieldNotFound(field);
-
-    SerializedTypeID const id = rf->getSType();
-
-    if (id == STI_NOTPRESENT)
-        return empty;  // optional field not present
-
-    T const* cf = dynamic_cast<T const*>(rf);
-
-    if (!cf)
-        Throw<std::runtime_error>("Wrong field type");
-
-    return *cf;
-}
-
-// Implementation for setting most fields with a setValue() method.
-template <typename T, typename V>
-void
-STData::setFieldUsingSetValue(V value)
-{
-    static_assert(!std::is_lvalue_reference<V>::value, "");
-
-    STBase* rf = &data_.get();
-
-    // if (!rf)
-    //     throwFieldNotFound(field);
-
-    if (rf->getSType() == STI_NOTPRESENT)
-        rf = makeFieldPresent();
-
-    T* cf = dynamic_cast<T*>(rf);
-
-    if (!cf)
-        Throw<std::runtime_error>("Wrong field type");
-
-    cf->setValue(std::move(value));
-}
-
-// Implementation for setting fields using assignment
-template <typename T>
-void
-STData::setFieldUsingAssignment(T const& value)
-{
-    STBase* rf = &data_.get();
-
-    // if (!rf)
-    //     throwFieldNotFound(field);
-
-    // if (rf->getSType() == STI_NOTPRESENT)
-    //     rf = makeFieldPresent(field);
-
-    T* cf = dynamic_cast<T*>(rf);
-
-    if (!cf)
-        Throw<std::runtime_error>("Wrong field type");
-
-    (*cf) = value;
-}
-
-//------------------------------------------------------------------------------
-//
-// Creation
-//
-//------------------------------------------------------------------------------
-
-STData
-dataFromJson(SField const& field, json::Value const& value);
-
-}  // namespace xrpl

include/xrpl/protocol/STDataType.h

@@ -1,87 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Buffer.h>
-#include <xrpl/protocol/SField.h>
-#include <xrpl/protocol/STAccount.h>
-#include <xrpl/protocol/STAmount.h>
-#include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/STBitString.h>
-#include <xrpl/protocol/STInteger.h>
-#include <xrpl/protocol/detail/STVar.h>
-
-#include <cstdint>
-#include <string>
-#include <vector>
-
-namespace xrpl {
-
-class STDataType final : public STBase
-{
-private:
-    std::uint16_t inner_type_;
-    bool default_{true};
-
-public:
-    using value_type = STDataType;  // Although not directly holding a single value
-
-    STDataType(SField const& n);
-    STDataType(SField const& n, SerializedTypeID);
-
-    STDataType(SerialIter& sit, SField const& name);
-
-    SerializedTypeID
-    getSType() const override;
-
-    std::string
-    getInnerTypeString() const;
-
-    std::string
-    getText() const override;
-
-    json::Value getJson(JsonOptions) const override;
-
-    void
-    add(Serializer& s) const override;
-
-    bool
-    isEquivalent(STBase const& t) const override;
-
-    bool
-    isDefault() const override;
-
-    void setInnerSType(SerializedTypeID);
-
-    SerializedTypeID
-    getInnerSType() const noexcept;
-
-    STBase*
-    makeFieldPresent();
-
-    STBase*
-    copy(std::size_t n, void* buf) const override;
-    STBase*
-    move(std::size_t n, void* buf) override;
-
-    friend class detail::STVar;
-};
-
-//------------------------------------------------------------------------------
-// Implementation
-//------------------------------------------------------------------------------
-
-inline SerializedTypeID
-STDataType::getInnerSType() const noexcept
-{
-    return static_cast<SerializedTypeID>(inner_type_);
-}
-
-//------------------------------------------------------------------------------
-//
-// Creation
-//
-//------------------------------------------------------------------------------
-
-STDataType
-dataTypeFromJson(SField const& field, json::Value const& value);
-
-}  // namespace xrpl

include/xrpl/protocol/STJson.h

@@ -1,193 +0,0 @@
-#pragma once
-
-#include <xrpl/json/json_value.h>
-#include <xrpl/protocol/STBase.h>
-#include <xrpl/protocol/Serializer.h>
-
-#include <map>
-#include <memory>
-#include <string>
-#include <variant>
-#include <vector>
-
-namespace xrpl {
-
-/**
- * STJson: Serialized Type for JSON-like structures (objects or arrays).
- *
- * Supports two modes:
- * - Object: Key-value pairs where keys are VL-encoded strings
- * - Array: Ordered list of values
- *
- * Values are [SType marker][VL-encoded SType serialization].
- * Values can be any SType, including nested STJson.
- *
- * Serialization format: [type_byte][VL_length][data...]
- * - type_byte: 0x00 = Object, 0x01 = Array
- */
-class STJson : public STBase
-{
-public:
-    enum class JsonType : uint8_t { Object = 0x00, Array = 0x01 };
-
-    using value_type = STJson;
-    value_type
-    value() const
-    {
-        return *this;
-    }
-
-    using Key = std::string;
-    using Value = std::shared_ptr<STBase>;
-    using Map = std::map<Key, Value>;
-    using Array = std::vector<Value>;
-
-    STJson() = default;
-
-    explicit STJson(Map&& map);
-    explicit STJson(Array&& array);
-    explicit STJson(SField const& name);
-    explicit STJson(SerialIter& sit, SField const& name);
-
-    SerializedTypeID
-    getSType() const override;
-
-    // Type checking
-    bool
-    isArray() const;
-
-    bool
-    isObject() const;
-
-    JsonType
-    getType() const;
-
-    // Depth checking (0 = no nesting, 1 = one level of nesting)
-    int
-    getDepth() const;
-
-    // Parse from binary blob
-    static std::shared_ptr<STJson>
-    fromBlob(void const* data, std::size_t size);
-
-    // Parse from SerialIter
-    static std::shared_ptr<STJson>
-    fromSerialIter(SerialIter& sit);
-
-    // Serialize to binary
-    void
-    add(Serializer& s) const override;
-
-    // JSON representation
-    json::Value
-    getJson(JsonOptions options) const override;
-
-    bool
-    isEquivalent(STBase const& t) const override;
-
-    bool
-    isDefault() const override;
-
-    // Blob representation
-    Blob
-    toBlob() const;
-
-    // STJson size
-    std::size_t
-    size() const;
-
-    // Object accessors (only valid when isObject() == true)
-    Map const&
-    getMap() const;
-
-    void
-    setObjectField(Key const& key, Value const& value);
-
-    std::optional<STJson::Value>
-    getObjectField(Key const& key) const;
-
-    void
-    setNestedObjectField(Key const& key, Key const& nestedKey, Value const& value);
-
-    std::optional<Value>
-    getNestedObjectField(Key const& key, Key const& nestedKey) const;
-
-    // Array accessors (only valid when isArray() == true)
-    Array const&
-    getArray() const;
-
-    void
-    pushArrayElement(Value const& value);
-
-    std::optional<Value>
-    getArrayElement(size_t index) const;
-
-    void
-    setArrayElement(size_t index, Value const& value);
-
-    void
-    setArrayElementField(size_t index, Key const& key, Value const& value);
-
-    std::optional<Value>
-    getArrayElementField(size_t index, Key const& key) const;
-
-    size_t
-    arraySize() const;
-
-    // Nested array accessors (for arrays stored in object fields)
-    void
-    setNestedArrayElement(Key const& key, size_t index, Value const& value);
-
-    void
-    setNestedArrayElementField(
-        Key const& key,
-        size_t index,
-        Key const& nestedKey,
-        Value const& value);
-
-    std::optional<Value>
-    getNestedArrayElement(Key const& key, size_t index) const;
-
-    std::optional<Value>
-    getNestedArrayElementField(Key const& key, size_t index, Key const& nestedKey) const;
-
-    // Factory for SType value from blob (with SType marker)
-    static Value
-    makeValueFromVLWithType(SerialIter& sit);
-
-    void
-    setValue(STJson const& v);
-
-private:
-    std::variant<Map, Array> data_{Map{}};
-    bool default_{false};
-
-    // Helper: validate nesting depth (max 1 level)
-    void
-    validateDepth(Value const& value, int currentDepth) const;
-
-    // Helper: parse a single key-value pair from SerialIter
-    static std::pair<Key, Value>
-    parsePair(SerialIter& sit);
-
-    // Helper: parse array elements from SerialIter
-    static Array
-    parseArray(SerialIter& sit, int length);
-
-    // Helper: encode a key as VL
-    static void
-    addVLKey(Serializer& s, std::string const& str);
-
-    // Helper: encode a value as [SType marker][VL]
-    static void
-    addVLValue(Serializer& s, std::shared_ptr<STBase> const& value);
-
-    STBase*
-    copy(std::size_t n, void* buf) const override;
-    STBase*
-    move(std::size_t n, void* buf) override;
-
-    friend class detail::STVar;
-};
-
-}  // namespace xrpl

include/xrpl/protocol/STObject.h

@@ -17,7 +17,6 @@
 #include <xrpl/protocol/STBitString.h>
 #include <xrpl/protocol/STCurrency.h>
 #include <xrpl/protocol/STIssue.h>
-#include <xrpl/protocol/STJson.h>
 #include <xrpl/protocol/STPathSet.h>
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/Serializer.h>
@@ -233,10 +232,6 @@ public:
     getFieldI32(SField const& field) const;
     [[nodiscard]] AccountID
     getAccountID(SField const& field) const;
-    STData
-    getFieldData(SField const& field) const;
-    STDataType
-    getFieldDataType(SField const& field) const;
 
     [[nodiscard]] Blob
     getFieldVL(SField const& field) const;
@@ -255,8 +250,6 @@ public:
     getFieldCurrency(SField const& field) const;
     [[nodiscard]] STNumber const&
     getFieldNumber(SField const& field) const;
-    STJson const&
-    getFieldJson(SField const& field) const;
 
     /**
      * Get the value of a field.
@@ -370,9 +363,6 @@ public:
     void
     set(STBase&& v);
 
-    void
-    addFieldFromSlice(SField const& sfield, Slice const& data);
-
     void
     setFieldU8(SField const& field, unsigned char);
     void
@@ -413,8 +403,6 @@ public:
     setFieldArray(SField const& field, STArray const& v);
     void
     setFieldObject(SField const& field, STObject const& v);
-    void
-    setFieldJson(SField const& field, STJson const& v);
 
     template <class Tag>
     void

include/xrpl/protocol/TER.h

@@ -133,8 +133,6 @@ enum TEMcodes : TERUnderlyingType {
     temBAD_MPT,
     temBAD_CIPHERTEXT,
     temBAD_WASM,
-    temINVALID_BYTECODE,
-    temTEMP_DISABLED,
 };
 
 //------------------------------------------------------------------------------
@@ -183,8 +181,6 @@ enum TEFcodes : TERUnderlyingType {
     tefINVALID_LEDGER_FIX_TYPE,
     tefNO_DST_PARTIAL,
     tefBAD_PATH_COUNT,
-    tefNO_BYTECODE,
-    tefBYTECODE_NOT_INCLUDED,
 };
 
 //------------------------------------------------------------------------------
@@ -377,8 +373,6 @@ enum TECcodes : TERUnderlyingType {
     tecBAD_PROOF = 199,
     tecNO_SPONSOR_PERMISSION = 200,
     tecOUT_OF_GAS = 201,
-    tecBYTECODE_REJECTED = 202,
-    tecINVALID_PARAMETERS = 203,
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/TxFlags.h

@@ -238,21 +238,8 @@ inline constexpr FlagValue tfUniversalMask = ~tfUniversal;
         TF_FLAG(tfSponsorshipEnd, 0x00010000)                                                                                                                  \
         TF_FLAG(tfSponsorshipCreate, 0x00020000)                                                                                                               \
         TF_FLAG(tfSponsorshipReassign, 0x00040000),                                                                                                            \
-        MASK_ADJ(0))                                                                                                                                           \
-                                                                                                                                                               \
-        TRANSACTION(Contract,                                                                                                                                  \
-        TF_FLAG(tfImmutable, 0x00010000)                                                                                                                       \
-        TF_FLAG(tfCodeImmutable, 0x00020000)                                                                                                                   \
-        TF_FLAG(tfABIImmutable, 0x00040000)                                                                                                                    \
-        TF_FLAG(tfUndeletable, 0x00080000),                                                                                                                    \
         MASK_ADJ(0))
 
-constexpr std::uint32_t tfSendAmount     = 0x00010000;
-constexpr std::uint32_t tfSendNFToken    = 0x00020000;
-constexpr std::uint32_t tfAuthorizeToken = 0x00040000;
-constexpr std::uint32_t tfContractParameterMask =
-    ~(tfSendAmount | tfSendNFToken | tfAuthorizeToken);
-
 // clang-format on
 
 // Create all the flag values.

include/xrpl/protocol/TxMeta.h

@@ -95,12 +95,6 @@ public:
 
         if (obj.isFieldPresent(sfParentBatchID))
             parentBatchID_ = obj.getFieldH256(sfParentBatchID);
-
-        if (obj.isFieldPresent(sfGasUsed))
-            gasUsed_ = obj.getFieldU32(sfGasUsed);
-
-        if (obj.isFieldPresent(sfVMReturnCode))
-            vmReturnCode_ = obj.getFieldI32(sfVMReturnCode);
     }
 
     [[nodiscard]] std::optional<STAmount> const&
@@ -121,30 +115,6 @@ public:
         parentBatchID_ = id;
     }
 
-    void
-    setGasUsed(std::optional<std::uint32_t> const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    [[nodiscard]] std::optional<std::uint32_t> const&
-    getGasUsed() const
-    {
-        return gasUsed_;
-    }
-
-    void
-    setVMReturnCode(std::optional<std::int32_t> const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
-    [[nodiscard]] std::optional<std::int32_t> const&
-    getVMReturnCode() const
-    {
-        return vmReturnCode_;
-    }
-
 private:
     uint256 transactionID_;
     std::uint32_t ledgerSeq_;
@@ -153,8 +123,6 @@ private:
 
     std::optional<STAmount> deliveredAmount_;
     std::optional<uint256> parentBatchID_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;
 
     STArray nodes_;
 };

include/xrpl/protocol/detail/emitable.macro

@@ -1,19 +0,0 @@
-#if !defined(EMITABLE)
-#error "undefined macro: EMITABLE"
-#endif
-
-/**
- * EMITABLE(name, type, txType, value)
- *
- * This macro defines a permission:
- * name: the name of the permission.
- * type: the GranularPermissionType enum.
- * txType: the corresponding TxType for this permission.
- * value: the uint32 numeric value for the enum type.
- */
-
-/** This removes the contract account the ability to set or remove deposit auth. */
-EMITABLE(AccountDepositAuth, ttACCOUNT_SET, 65537)
-
-// ** This removes the contract account the ability to set or remove disable master key. */
-EMITABLE(AccountDisableMaster, ttACCOUNT_SET, 65538)

include/xrpl/protocol/detail/features.macro

@@ -15,9 +15,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
-XRPL_FEATURE(SmartContract,               Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(SmartEscrow,                 Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -153,7 +153,6 @@ LEDGER_ENTRY(ltACCOUNT_ROOT, 0x0061, AccountRoot, account, ({
     {sfAMMID,                  SoeOptional}, // pseudo-account designator
     {sfVaultID,                SoeOptional}, // pseudo-account designator
     {sfLoanBrokerID,           SoeOptional}, // pseudo-account designator
-    {sfContractID,             SoeOptional}, // pseudo-account designator
 }))
 
 /** A ledger object which contains a list of object identifiers.
@@ -310,11 +309,6 @@ LEDGER_ENTRY(ltFEE_SETTINGS, 0x0073, FeeSettings, fee, ({
     {sfBaseFeeDrops,           SoeOptional},
     {sfReserveBaseDrops,       SoeOptional},
     {sfReserveIncrementDrops,  SoeOptional},
-    // Smart Escrow fields
-    {sfGasLimit,               SoeOptional},
-    {sfBytecodeSizeLimit,      SoeOptional},
-    {sfGasPrice,               SoeOptional},
-
     {sfPreviousTxnID,          SoeOptional},
     {sfPreviousTxnLgrSeq,      SoeOptional},
 }))
@@ -345,8 +339,6 @@ LEDGER_ENTRY(ltESCROW, 0x0075, Escrow, escrow, ({
     {sfCondition,            SoeOptional},
     {sfCancelAfter,          SoeOptional},
     {sfFinishAfter,          SoeOptional},
-    {sfBytecode,             SoeOptional},
-    {sfData,                 SoeOptional},
     {sfSourceTag,            SoeOptional},
     {sfDestinationTag,       SoeOptional},
     {sfOwnerNode,            SoeRequired},
@@ -518,48 +510,6 @@ LEDGER_ENTRY(ltVAULT, 0x0084, Vault, vault, ({
     // no PermissionedDomainID ever (use MPTIssuance.sfDomainID)
 }))
 
-
-
-/** A ledger object representing a contract source.
-    \sa keylet::contractSource
- */
-LEDGER_ENTRY(ltCONTRACT_SOURCE, 0x0085, ContractSource, contract_source, ({
-    {sfPreviousTxnID,        SoeRequired},
-    {sfPreviousTxnLgrSeq,    SoeRequired},
-    {sfContractHash,         SoeRequired},
-    {sfContractCode,         SoeRequired},
-    {sfFunctions,            SoeRequired},
-    {sfInstanceParameters,   SoeOptional},
-    {sfReferenceCount,       SoeRequired},
-}))
-
-/** A ledger object representing a contract.
-    \sa keylet::contract
- */
-LEDGER_ENTRY(ltCONTRACT, 0x0086, Contract, contract, ({
-    {sfPreviousTxnID,             SoeRequired},
-    {sfPreviousTxnLgrSeq,         SoeRequired},
-    {sfSequence,                  SoeRequired},
-    {sfOwnerNode,                 SoeRequired},
-    {sfOwner,                     SoeRequired},
-    {sfContractAccount,           SoeRequired},
-    {sfContractHash,              SoeRequired},
-    {sfInstanceParameterValues,   SoeOptional},
-    {sfURI,                       SoeOptional},
-}))
-
-/** A ledger object representing a contract data.
-    \sa keylet::contractData
- */
-LEDGER_ENTRY(ltCONTRACT_DATA, 0x0087, ContractData, contract_data, ({
-    {sfPreviousTxnID,        SoeRequired},
-    {sfPreviousTxnLgrSeq,    SoeRequired},
-    {sfOwnerNode,            SoeRequired},
-    {sfOwner,                SoeRequired},
-    {sfContractAccount,      SoeRequired},
-    {sfContractJson,         SoeRequired},
-}))
-
 /** Reserve 0x0084-0x0087 for future Vault-related objects. */
 
 /** A ledger object representing a loan broker

include/xrpl/protocol/detail/sfields.macro

@@ -23,10 +23,9 @@ TYPED_SFIELD(sfLEVersion,                UINT8,      6)
 // 8-bit integers (uncommon)
 TYPED_SFIELD(sfTickSize,                 UINT8,     16)
 TYPED_SFIELD(sfUNLModifyDisabling,       UINT8,     17)
-// 18 unused
+TYPED_SFIELD(sfHookResult,               UINT8,     18)
 TYPED_SFIELD(sfWasLockingChainSend,      UINT8,     19)
 TYPED_SFIELD(sfWithdrawalPolicy,         UINT8,     20)
-TYPED_SFIELD(sfContractResult,           UINT8,     21)
 
 // 16-bit integers (common)
 TYPED_SFIELD(sfLedgerEntryType,          UINT16,     1, SField::kSmdNever)
@@ -38,7 +37,10 @@ TYPED_SFIELD(sfDiscountedFee,            UINT16,     6)
 
 // 16-bit integers (uncommon)
 TYPED_SFIELD(sfVersion,                  UINT16,    16)
-// 17 to 20 unused
+TYPED_SFIELD(sfHookStateChangeCount,     UINT16,    17)
+TYPED_SFIELD(sfHookEmitCount,            UINT16,    18)
+TYPED_SFIELD(sfHookExecutionIndex,       UINT16,    19)
+TYPED_SFIELD(sfHookApiVersion,           UINT16,    20)
 TYPED_SFIELD(sfLedgerFixType,            UINT16,    21)
 TYPED_SFIELD(sfManagementFeeRate,        UINT16,    22) // 1/10 basis points (bips)
 
@@ -89,7 +91,9 @@ TYPED_SFIELD(sfTicketSequence,           UINT32,    41)
 TYPED_SFIELD(sfNFTokenTaxon,             UINT32,    42)
 TYPED_SFIELD(sfMintedNFTokens,           UINT32,    43)
 TYPED_SFIELD(sfBurnedNFTokens,           UINT32,    44)
-// 45 to 47 unused
+TYPED_SFIELD(sfHookStateCount,           UINT32,    45)
+TYPED_SFIELD(sfEmitGeneration,           UINT32,    46)
+//                                                  47 reserved for Hooks
 TYPED_SFIELD(sfVoteWeight,               UINT32,    48)
 TYPED_SFIELD(sfFirstNFTokenSequence,     UINT32,    50)
 TYPED_SFIELD(sfOracleDocumentID,         UINT32,    51)
@@ -116,12 +120,6 @@ TYPED_SFIELD(sfSponsoringOwnerCount,     UINT32,    71)
 TYPED_SFIELD(sfSponsoringAccountCount,   UINT32,    72)
 TYPED_SFIELD(sfRemainingOwnerCount,      UINT32,    73)
 TYPED_SFIELD(sfSponsorFlags,             UINT32,    74)
-TYPED_SFIELD(sfGasLimit,                 UINT32,    75)
-TYPED_SFIELD(sfBytecodeSizeLimit,        UINT32,    76)
-TYPED_SFIELD(sfGasPrice,                 UINT32,    77)
-TYPED_SFIELD(sfGas,                      UINT32,    78)
-TYPED_SFIELD(sfGasUsed,                  UINT32,    79)
-TYPED_SFIELD(sfParameterFlag,            UINT32,    80)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -139,7 +137,9 @@ TYPED_SFIELD(sfNFTokenOfferNode,         UINT64,    12)
 TYPED_SFIELD(sfEmitBurden,               UINT64,    13)
 
 // 64-bit integers (uncommon)
-// 16 to 18 unused
+TYPED_SFIELD(sfHookOn,                   UINT64,    16)
+TYPED_SFIELD(sfHookInstructionCount,     UINT64,    17)
+TYPED_SFIELD(sfHookReturnCode,           UINT64,    18)
 TYPED_SFIELD(sfReferenceCount,           UINT64,    19)
 TYPED_SFIELD(sfXChainClaimID,            UINT64,    20)
 TYPED_SFIELD(sfXChainAccountCreateCount, UINT64,    21)
@@ -203,7 +203,10 @@ TYPED_SFIELD(sfPreviousPageMin,          UINT256,   26)
 TYPED_SFIELD(sfNextPageMin,              UINT256,   27)
 TYPED_SFIELD(sfNFTokenBuyOffer,          UINT256,   28)
 TYPED_SFIELD(sfNFTokenSellOffer,         UINT256,   29)
-// 30 to 33 unused
+TYPED_SFIELD(sfHookStateKey,             UINT256,   30)
+TYPED_SFIELD(sfHookHash,                 UINT256,   31)
+TYPED_SFIELD(sfHookNamespace,            UINT256,   32)
+TYPED_SFIELD(sfHookSetTxnID,             UINT256,   33)
 TYPED_SFIELD(sfDomainID,                 UINT256,   34)
 TYPED_SFIELD(sfVaultID,                  UINT256,   35,
     SField::kSmdPseudoAccount | SField::kSmdDefault)
@@ -214,9 +217,6 @@ TYPED_SFIELD(sfLoanID,                   UINT256,   38)
 TYPED_SFIELD(sfReferenceHolding,         UINT256,   39)
 TYPED_SFIELD(sfBlindingFactor,           UINT256,   40)
 TYPED_SFIELD(sfObjectID,                 UINT256,   41)
-TYPED_SFIELD(sfContractHash,             UINT256,   42)
-TYPED_SFIELD(sfContractID,               UINT256,   43,
-    SField::kSmdPseudoAccount | SField::kSmdDefault)
 
 // number (common)
 TYPED_SFIELD(sfNumber,                   NUMBER,     1)
@@ -237,10 +237,9 @@ TYPED_SFIELD(sfTotalValueOutstanding,    NUMBER,     15, SField::kSmdNeedsAsset
 TYPED_SFIELD(sfPeriodicPayment,          NUMBER,     16)
 TYPED_SFIELD(sfManagementFeeOutstanding, NUMBER,     17, SField::kSmdNeedsAsset | SField::kSmdDefault)
 
-// 32-bit signed (common)
+// int32
 TYPED_SFIELD(sfLoanScale,                INT32,      1)
 TYPED_SFIELD(sfRemainingOwnerCountDelta, INT32,      2)
-TYPED_SFIELD(sfVMReturnCode,             INT32,      3)
 
 // currency amount (common)
 TYPED_SFIELD(sfAmount,                   AMOUNT,     1)
@@ -262,13 +261,15 @@ TYPED_SFIELD(sfMinimumOffer,             AMOUNT,    16)
 TYPED_SFIELD(sfRippleEscrow,             AMOUNT,    17)
 TYPED_SFIELD(sfDeliveredAmount,          AMOUNT,    18)
 TYPED_SFIELD(sfNFTokenBrokerFee,         AMOUNT,    19)
-// 20 to 21 unused
+
+// Reserve 20 & 21 for Hooks.
+
 // currency amount (fees)
 TYPED_SFIELD(sfBaseFeeDrops,             AMOUNT,    22)
 TYPED_SFIELD(sfReserveBaseDrops,         AMOUNT,    23)
 TYPED_SFIELD(sfReserveIncrementDrops,    AMOUNT,    24)
 
-// currency amount (more)
+// currency amount (AMM)
 TYPED_SFIELD(sfLPTokenOut,               AMOUNT,    25)
 TYPED_SFIELD(sfLPTokenIn,                AMOUNT,    26)
 TYPED_SFIELD(sfEPrice,                   AMOUNT,    27)
@@ -303,7 +304,10 @@ TYPED_SFIELD(sfMasterSignature,          VL,        18, SField::kSmdDefault, SFi
 TYPED_SFIELD(sfUNLModifyValidator,       VL,        19)
 TYPED_SFIELD(sfValidatorToDisable,       VL,        20)
 TYPED_SFIELD(sfValidatorToReEnable,      VL,        21)
-// 22 to 25 unused
+TYPED_SFIELD(sfHookStateData,            VL,        22)
+TYPED_SFIELD(sfHookReturnString,         VL,        23)
+TYPED_SFIELD(sfHookParameterName,        VL,        24)
+TYPED_SFIELD(sfHookParameterValue,       VL,        25)
 TYPED_SFIELD(sfDIDDocument,              VL,        26)
 TYPED_SFIELD(sfData,                     VL,        27)
 TYPED_SFIELD(sfAssetClass,               VL,        28)
@@ -325,9 +329,6 @@ TYPED_SFIELD(sfAuditorEncryptedAmount,      VL,     43)
 TYPED_SFIELD(sfAuditorEncryptionKey,        VL,     44)
 TYPED_SFIELD(sfAmountCommitment,            VL,     45)
 TYPED_SFIELD(sfBalanceCommitment,           VL,     46)
-TYPED_SFIELD(sfBytecode,                    VL,     47)
-TYPED_SFIELD(sfContractCode,                VL,     48)
-TYPED_SFIELD(sfFunctionName,                VL,     49)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)
@@ -344,7 +345,7 @@ TYPED_SFIELD(sfHolder,                   ACCOUNT,   11)
 TYPED_SFIELD(sfDelegate,                 ACCOUNT,   12)
 
 // account (uncommon)
-// 16 unused
+TYPED_SFIELD(sfHookAccount,              ACCOUNT,   16)
 TYPED_SFIELD(sfOtherChainSource,         ACCOUNT,   18)
 TYPED_SFIELD(sfOtherChainDestination,    ACCOUNT,   19)
 TYPED_SFIELD(sfAttestationSignerAccount, ACCOUNT,   20)
@@ -359,7 +360,6 @@ TYPED_SFIELD(sfHighSponsor,              ACCOUNT,   28)
 TYPED_SFIELD(sfLowSponsor,               ACCOUNT,   29)
 TYPED_SFIELD(sfCounterpartySponsor,      ACCOUNT,   30)
 TYPED_SFIELD(sfSponsee,                  ACCOUNT,   31)
-TYPED_SFIELD(sfContractAccount,          ACCOUNT,   32)
 
 // vector of 256-bit
 TYPED_SFIELD(sfIndexes,                  VECTOR256,  1, SField::kSmdNever)
@@ -398,7 +398,7 @@ UNTYPED_SFIELD(sfMemo,                   OBJECT,    10)
 UNTYPED_SFIELD(sfSignerEntry,            OBJECT,    11)
 UNTYPED_SFIELD(sfNFToken,                OBJECT,    12)
 UNTYPED_SFIELD(sfEmitDetails,            OBJECT,    13)
-// 14 unused
+UNTYPED_SFIELD(sfHook,                   OBJECT,    14)
 UNTYPED_SFIELD(sfPermission,             OBJECT,    15)
 
 // inner object (uncommon)
@@ -406,7 +406,11 @@ UNTYPED_SFIELD(sfSigner,                 OBJECT,    16)
 //                                                  17 unused
 UNTYPED_SFIELD(sfMajority,               OBJECT,    18)
 UNTYPED_SFIELD(sfDisabledValidator,      OBJECT,    19)
-// 20 to 24 unused
+UNTYPED_SFIELD(sfEmittedTxn,             OBJECT,    20)
+UNTYPED_SFIELD(sfHookExecution,          OBJECT,    21)
+UNTYPED_SFIELD(sfHookDefinition,         OBJECT,    22)
+UNTYPED_SFIELD(sfHookParameter,          OBJECT,    23)
+UNTYPED_SFIELD(sfHookGrant,              OBJECT,    24)
 UNTYPED_SFIELD(sfVoteEntry,              OBJECT,    25)
 UNTYPED_SFIELD(sfAuctionSlot,            OBJECT,    26)
 UNTYPED_SFIELD(sfAuthAccount,            OBJECT,    27)
@@ -421,10 +425,6 @@ UNTYPED_SFIELD(sfBatchSigner,            OBJECT,    35)
 UNTYPED_SFIELD(sfBook,                   OBJECT,    36)
 UNTYPED_SFIELD(sfCounterpartySignature,  OBJECT,    37, SField::kSmdDefault, SField::kNotSigning)
 UNTYPED_SFIELD(sfSponsorSignature,       OBJECT,    38, SField::kSmdDefault, SField::kNotSigning)
-UNTYPED_SFIELD(sfFunction,               OBJECT,    39)
-UNTYPED_SFIELD(sfInstanceParameter,      OBJECT,    40)
-UNTYPED_SFIELD(sfInstanceParameterValue, OBJECT,    41)
-UNTYPED_SFIELD(sfParameter,              OBJECT,    42)
 
 // array of objects (common)
 // ARRAY/1 is reserved for end of array
@@ -438,14 +438,16 @@ UNTYPED_SFIELD(sfSufficient,             ARRAY,      7)
 UNTYPED_SFIELD(sfAffectedNodes,          ARRAY,      8)
 UNTYPED_SFIELD(sfMemos,                  ARRAY,      9)
 UNTYPED_SFIELD(sfNFTokens,               ARRAY,     10)
-// 11 unused
+UNTYPED_SFIELD(sfHooks,                  ARRAY,     11)
 UNTYPED_SFIELD(sfVoteSlots,              ARRAY,     12)
 UNTYPED_SFIELD(sfAdditionalBooks,        ARRAY,     13)
 
 // array of objects (uncommon)
 UNTYPED_SFIELD(sfMajorities,             ARRAY,     16)
 UNTYPED_SFIELD(sfDisabledValidators,     ARRAY,     17)
-// 18 to 20 unused
+UNTYPED_SFIELD(sfHookExecutions,         ARRAY,     18)
+UNTYPED_SFIELD(sfHookParameters,         ARRAY,     19)
+UNTYPED_SFIELD(sfHookGrants,             ARRAY,     20)
 UNTYPED_SFIELD(sfXChainClaimAttestations, ARRAY,    21)
 UNTYPED_SFIELD(sfXChainCreateAccountAttestations, ARRAY, 22)
 //                                                  23 unused
@@ -457,16 +459,3 @@ UNTYPED_SFIELD(sfAcceptedCredentials,    ARRAY,     28)
 UNTYPED_SFIELD(sfPermissions,            ARRAY,     29)
 UNTYPED_SFIELD(sfRawTransactions,        ARRAY,     30)
 UNTYPED_SFIELD(sfBatchSigners,           ARRAY,     31, SField::kSmdDefault, SField::kNotSigning)
-UNTYPED_SFIELD(sfFunctions,              ARRAY,     32)
-UNTYPED_SFIELD(sfInstanceParameters,     ARRAY,     33)
-UNTYPED_SFIELD(sfInstanceParameterValues,ARRAY,     34)
-UNTYPED_SFIELD(sfParameters,             ARRAY,     35)
-
-// data
-TYPED_SFIELD(sfParameterValue,           DATA,       1, SField::kSmdDefault)
-
-// data type
-TYPED_SFIELD(sfParameterType,            DATATYPE,   1)
-
-// json
-TYPED_SFIELD(sfContractJson,             JSON,       1)

include/xrpl/protocol/detail/transactions.macro

@@ -3,7 +3,7 @@
 #endif
 
 /**
- * TRANSACTION(tag, value, name, delegable, amendments, privileges, emitable, fields)
+ * TRANSACTION(tag, value, name, delegable, amendments, privileges, fields)
  *
  * To ease maintenance, you may replace any unneeded values with "..."
  * e.g. #define TRANSACTION(tag, value, name, ...)
@@ -28,7 +28,6 @@ TRANSACTION(ttPAYMENT, 0, Payment,
     Delegation::Delegable,
     uint256{},
     CreateAcct | MayCreateMpt,
-    Emittance::emitable,
     ({
     {sfDestination, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
@@ -49,16 +48,13 @@ TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDestination, SoeRequired},
-    {sfDestinationTag, SoeOptional},
     {sfAmount, SoeRequired, SoeMptSupported},
     {sfCondition, SoeOptional},
     {sfCancelAfter, SoeOptional},
     {sfFinishAfter, SoeOptional},
-    {sfBytecode, SoeOptional},
-    {sfData,           SoeOptional},
+    {sfDestinationTag, SoeOptional},
 }))
 
 /** This transaction type completes an existing escrow. */
@@ -69,14 +65,12 @@ TRANSACTION(ttESCROW_FINISH, 2, EscrowFinish,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfOwner, SoeRequired},
     {sfOfferSequence, SoeRequired},
     {sfFulfillment, SoeOptional},
     {sfCondition, SoeOptional},
     {sfCredentialIDs, SoeOptional},
-    {sfGas, SoeOptional},
 }))
 
 
@@ -88,7 +82,6 @@ TRANSACTION(ttACCOUNT_SET, 3, AccountSet,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfEmailHash, SoeOptional},
     {sfWalletLocator, SoeOptional},
@@ -110,7 +103,6 @@ TRANSACTION(ttESCROW_CANCEL, 4, EscrowCancel,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfOwner, SoeRequired},
     {sfOfferSequence, SoeRequired},
@@ -124,7 +116,6 @@ TRANSACTION(ttREGULAR_KEY_SET, 5, SetRegularKey,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfRegularKey, SoeOptional},
 }))
@@ -139,7 +130,6 @@ TRANSACTION(ttOFFER_CREATE, 7, OfferCreate,
     Delegation::Delegable,
     uint256{},
     MayCreateMpt,
-    Emittance::emitable,
     ({
     {sfTakerPays, SoeRequired, SoeMptSupported},
     {sfTakerGets, SoeRequired, SoeMptSupported},
@@ -156,7 +146,6 @@ TRANSACTION(ttOFFER_CANCEL, 8, OfferCancel,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfOfferSequence, SoeRequired},
 }))
@@ -171,7 +160,6 @@ TRANSACTION(ttTICKET_CREATE, 10, TicketCreate,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfTicketCount, SoeRequired},
 }))
@@ -188,7 +176,6 @@ TRANSACTION(ttSIGNER_LIST_SET, 12, SignerListSet,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfSignerQuorum, SoeRequired},
     {sfSignerEntries, SoeOptional},
@@ -202,7 +189,6 @@ TRANSACTION(ttPAYCHAN_CREATE, 13, PaymentChannelCreate,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDestination, SoeRequired},
     {sfAmount, SoeRequired},
@@ -220,7 +206,6 @@ TRANSACTION(ttPAYCHAN_FUND, 14, PaymentChannelFund,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfChannel, SoeRequired},
     {sfAmount, SoeRequired},
@@ -235,7 +220,6 @@ TRANSACTION(ttPAYCHAN_CLAIM, 15, PaymentChannelClaim,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfChannel, SoeRequired},
     {sfAmount, SoeOptional},
@@ -253,7 +237,6 @@ TRANSACTION(ttCHECK_CREATE, 16, CheckCreate,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDestination, SoeRequired},
     {sfSendMax, SoeRequired, SoeMptSupported},
@@ -270,7 +253,6 @@ TRANSACTION(ttCHECK_CASH, 17, CheckCash,
     Delegation::Delegable,
     uint256{},
     MayCreateMpt,
-    Emittance::emitable,
     ({
     {sfCheckID, SoeRequired},
     {sfAmount, SoeOptional, SoeMptSupported},
@@ -285,7 +267,6 @@ TRANSACTION(ttCHECK_CANCEL, 18, CheckCancel,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfCheckID, SoeRequired},
 }))
@@ -298,7 +279,6 @@ TRANSACTION(ttDEPOSIT_PREAUTH, 19, DepositPreauth,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfAuthorize, SoeOptional},
     {sfUnauthorize, SoeOptional},
@@ -314,7 +294,6 @@ TRANSACTION(ttTRUST_SET, 20, TrustSet,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfLimitAmount, SoeOptional},
     {sfQualityIn, SoeOptional},
@@ -329,7 +308,6 @@ TRANSACTION(ttACCOUNT_DELETE, 21, AccountDelete,
     Delegation::NotDelegable,
     uint256{},
     MustDeleteAcct,
-    Emittance::notEmitable,
     ({
     {sfDestination, SoeRequired},
     {sfDestinationTag, SoeOptional},
@@ -346,7 +324,6 @@ TRANSACTION(ttNFTOKEN_MINT, 25, NFTokenMint,
     Delegation::Delegable,
     uint256{},
     ChangeNftCounts,
-    Emittance::emitable,
     ({
     {sfNFTokenTaxon, SoeRequired},
     {sfTransferFee, SoeOptional},
@@ -365,7 +342,6 @@ TRANSACTION(ttNFTOKEN_BURN, 26, NFTokenBurn,
     Delegation::Delegable,
     uint256{},
     ChangeNftCounts,
-    Emittance::emitable,
     ({
     {sfNFTokenID, SoeRequired},
     {sfOwner, SoeOptional},
@@ -379,7 +355,6 @@ TRANSACTION(ttNFTOKEN_CREATE_OFFER, 27, NFTokenCreateOffer,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfNFTokenID, SoeRequired},
     {sfAmount, SoeRequired},
@@ -396,7 +371,6 @@ TRANSACTION(ttNFTOKEN_CANCEL_OFFER, 28, NFTokenCancelOffer,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfNFTokenOffers, SoeRequired},
 }))
@@ -409,7 +383,6 @@ TRANSACTION(ttNFTOKEN_ACCEPT_OFFER, 29, NFTokenAcceptOffer,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfNFTokenBuyOffer, SoeOptional},
     {sfNFTokenSellOffer, SoeOptional},
@@ -424,7 +397,6 @@ TRANSACTION(ttCLAWBACK, 30, Clawback,
     Delegation::Delegable,
     uint256{},
     NoPriv,
-    Emittance::emitable,
     ({
     {sfAmount, SoeRequired, SoeMptSupported},
     {sfHolder, SoeOptional},
@@ -438,7 +410,6 @@ TRANSACTION(ttAMM_CLAWBACK, 31, AMMClawback,
     Delegation::Delegable,
     featureAMMClawback,
     MayDeleteAcct | OverrideFreeze | MayAuthorizeMpt,
-    Emittance::emitable,
     ({
     {sfHolder, SoeRequired},
     {sfAsset, SoeRequired, SoeMptSupported},
@@ -454,7 +425,6 @@ TRANSACTION(ttAMM_CREATE, 35, AMMCreate,
     Delegation::Delegable,
     featureAMM,
     CreatePseudoAcct | MayCreateMpt,
-    Emittance::emitable,
     ({
     {sfAmount, SoeRequired, SoeMptSupported},
     {sfAmount2, SoeRequired, SoeMptSupported},
@@ -469,7 +439,6 @@ TRANSACTION(ttAMM_DEPOSIT, 36, AMMDeposit,
     Delegation::Delegable,
     featureAMM,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAsset2, SoeRequired, SoeMptSupported},
@@ -488,7 +457,6 @@ TRANSACTION(ttAMM_WITHDRAW, 37, AMMWithdraw,
     Delegation::Delegable,
     featureAMM,
     MayDeleteAcct | MayAuthorizeMpt,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAsset2, SoeRequired, SoeMptSupported},
@@ -506,7 +474,6 @@ TRANSACTION(ttAMM_VOTE, 38, AMMVote,
     Delegation::Delegable,
     featureAMM,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAsset2, SoeRequired, SoeMptSupported},
@@ -521,7 +488,6 @@ TRANSACTION(ttAMM_BID, 39, AMMBid,
     Delegation::Delegable,
     featureAMM,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAsset2, SoeRequired, SoeMptSupported},
@@ -538,7 +504,6 @@ TRANSACTION(ttAMM_DELETE, 40, AMMDelete,
     Delegation::Delegable,
     featureAMM,
     MustDeleteAcct | MayDeleteMpt,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAsset2, SoeRequired, SoeMptSupported},
@@ -552,7 +517,6 @@ TRANSACTION(ttXCHAIN_CREATE_CLAIM_ID, 41, XChainCreateClaimID,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfSignatureReward, SoeRequired},
@@ -564,7 +528,6 @@ TRANSACTION(ttXCHAIN_COMMIT, 42, XChainCommit,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfXChainClaimID, SoeRequired},
@@ -577,7 +540,6 @@ TRANSACTION(ttXCHAIN_CLAIM, 43, XChainClaim,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfXChainClaimID, SoeRequired},
@@ -591,7 +553,6 @@ TRANSACTION(ttXCHAIN_ACCOUNT_CREATE_COMMIT, 44, XChainAccountCreateCommit,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfDestination, SoeRequired},
@@ -604,7 +565,6 @@ TRANSACTION(ttXCHAIN_ADD_CLAIM_ATTESTATION, 45, XChainAddClaimAttestation,
     Delegation::Delegable,
     featureXChainBridge,
     CreateAcct,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
 
@@ -626,7 +586,6 @@ TRANSACTION(ttXCHAIN_ADD_ACCOUNT_CREATE_ATTESTATION, 46,
     Delegation::Delegable,
     featureXChainBridge,
     CreateAcct,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
 
@@ -648,7 +607,6 @@ TRANSACTION(ttXCHAIN_MODIFY_BRIDGE, 47, XChainModifyBridge,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfSignatureReward, SoeOptional},
@@ -660,7 +618,6 @@ TRANSACTION(ttXCHAIN_CREATE_BRIDGE, 48, XChainCreateBridge,
     Delegation::Delegable,
     featureXChainBridge,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfXChainBridge, SoeRequired},
     {sfSignatureReward, SoeRequired},
@@ -675,7 +632,6 @@ TRANSACTION(ttDID_SET, 49, DIDSet,
     Delegation::Delegable,
     featureDID,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDIDDocument, SoeOptional},
     {sfURI, SoeOptional},
@@ -690,7 +646,6 @@ TRANSACTION(ttDID_DELETE, 50, DIDDelete,
     Delegation::Delegable,
     featureDID,
     NoPriv,
-    Emittance::emitable,
     ({}))
 
 /** This transaction type creates an Oracle instance */
@@ -701,7 +656,6 @@ TRANSACTION(ttORACLE_SET, 51, OracleSet,
     Delegation::Delegable,
     featurePriceOracle,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfOracleDocumentID, SoeRequired},
     {sfProvider, SoeOptional},
@@ -719,7 +673,6 @@ TRANSACTION(ttORACLE_DELETE, 52, OracleDelete,
     Delegation::Delegable,
     featurePriceOracle,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfOracleDocumentID, SoeRequired},
 }))
@@ -732,7 +685,6 @@ TRANSACTION(ttLEDGER_STATE_FIX, 53, LedgerStateFix,
     Delegation::Delegable,
     fixNFTokenPageLinks,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfLedgerFixType, SoeRequired},
     {sfOwner, SoeOptional},
@@ -747,7 +699,6 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_CREATE, 54, MPTokenIssuanceCreate,
     Delegation::Delegable,
     featureMPTokensV1,
     CreateMptIssuance,
-    Emittance::emitable,
     ({
     {sfAssetScale, SoeOptional},
     {sfTransferFee, SoeOptional},
@@ -765,7 +716,6 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_DESTROY, 55, MPTokenIssuanceDestroy,
     Delegation::Delegable,
     featureMPTokensV1,
     DestroyMptIssuance,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
 }))
@@ -778,7 +728,6 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 56, MPTokenIssuanceSet,
     Delegation::Delegable,
     featureMPTokensV1,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfHolder, SoeOptional},
@@ -798,7 +747,6 @@ TRANSACTION(ttMPTOKEN_AUTHORIZE, 57, MPTokenAuthorize,
     Delegation::Delegable,
     featureMPTokensV1,
     MustAuthorizeMpt,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfHolder, SoeOptional},
@@ -812,7 +760,6 @@ TRANSACTION(ttCREDENTIAL_CREATE, 58, CredentialCreate,
     Delegation::Delegable,
     featureCredentials,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfSubject, SoeRequired},
     {sfCredentialType, SoeRequired},
@@ -828,7 +775,6 @@ TRANSACTION(ttCREDENTIAL_ACCEPT, 59, CredentialAccept,
     Delegation::Delegable,
     featureCredentials,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfIssuer, SoeRequired},
     {sfCredentialType, SoeRequired},
@@ -842,7 +788,6 @@ TRANSACTION(ttCREDENTIAL_DELETE, 60, CredentialDelete,
     Delegation::Delegable,
     featureCredentials,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfSubject, SoeOptional},
     {sfIssuer, SoeOptional},
@@ -857,7 +802,6 @@ TRANSACTION(ttNFTOKEN_MODIFY, 61, NFTokenModify,
     Delegation::Delegable,
     featureDynamicNFT,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfNFTokenID, SoeRequired},
     {sfOwner, SoeOptional},
@@ -872,7 +816,6 @@ TRANSACTION(ttPERMISSIONED_DOMAIN_SET, 62, PermissionedDomainSet,
     Delegation::Delegable,
     featurePermissionedDomains,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDomainID, SoeOptional},
     {sfAcceptedCredentials, SoeRequired},
@@ -886,7 +829,6 @@ TRANSACTION(ttPERMISSIONED_DOMAIN_DELETE, 63, PermissionedDomainDelete,
     Delegation::Delegable,
     featurePermissionedDomains,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfDomainID, SoeRequired},
 }))
@@ -899,7 +841,6 @@ TRANSACTION(ttDELEGATE_SET, 64, DelegateSet,
     Delegation::NotDelegable,
     featurePermissionDelegationV1_1,
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfAuthorize, SoeRequired},
     {sfPermissions, SoeRequired},
@@ -913,7 +854,6 @@ TRANSACTION(ttVAULT_CREATE, 65, VaultCreate,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     CreatePseudoAcct | CreateMptIssuance | MustModifyVault,
-    Emittance::emitable,
     ({
     {sfAsset, SoeRequired, SoeMptSupported},
     {sfAssetsMaximum, SoeOptional},
@@ -932,7 +872,6 @@ TRANSACTION(ttVAULT_SET, 66, VaultSet,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     MustModifyVault,
-    Emittance::emitable,
     ({
     {sfVaultID, SoeRequired},
     {sfAssetsMaximum, SoeOptional},
@@ -948,7 +887,6 @@ TRANSACTION(ttVAULT_DELETE, 67, VaultDelete,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     MustDeleteAcct | DestroyMptIssuance | MustModifyVault,
-    Emittance::emitable,
     ({
     {sfVaultID, SoeRequired},
     {sfMemoData, SoeOptional},
@@ -962,7 +900,6 @@ TRANSACTION(ttVAULT_DEPOSIT, 68, VaultDeposit,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     MayAuthorizeMpt | MustModifyVault,
-    Emittance::emitable,
     ({
     {sfVaultID, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
@@ -976,7 +913,6 @@ TRANSACTION(ttVAULT_WITHDRAW, 69, VaultWithdraw,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     MayDeleteMpt | MayAuthorizeMpt | MustModifyVault,
-    Emittance::emitable,
     ({
     {sfVaultID, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
@@ -992,7 +928,6 @@ TRANSACTION(ttVAULT_CLAWBACK, 70, VaultClawback,
     Delegation::NotDelegable,
     featureSingleAssetVault,
     MayDeleteMpt | MustModifyVault,
-    Emittance::emitable,
     ({
     {sfVaultID, SoeRequired},
     {sfHolder, SoeRequired},
@@ -1007,7 +942,6 @@ TRANSACTION(ttBATCH, 71, Batch,
     Delegation::NotDelegable,
     featureBatchV1_1,
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfRawTransactions, SoeRequired},
     {sfBatchSigners, SoeOptional},
@@ -1022,9 +956,7 @@ TRANSACTION(ttBATCH, 71, Batch,
 TRANSACTION(ttLOAN_BROKER_SET, 74, LoanBrokerSet,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    CreatePseudoAcct | MayAuthorizeMpt,
-    Emittance::emitable,
-    ({
+    CreatePseudoAcct | MayAuthorizeMpt, ({
     {sfVaultID, SoeRequired},
     {sfLoanBrokerID, SoeOptional},
     {sfData, SoeOptional},
@@ -1041,9 +973,7 @@ TRANSACTION(ttLOAN_BROKER_SET, 74, LoanBrokerSet,
 TRANSACTION(ttLOAN_BROKER_DELETE, 75, LoanBrokerDelete,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    MustDeleteAcct | MayAuthorizeMpt,
-    Emittance::emitable,
-    ({
+    MustDeleteAcct | MayAuthorizeMpt, ({
     {sfLoanBrokerID, SoeRequired},
 }))
 
@@ -1054,9 +984,7 @@ TRANSACTION(ttLOAN_BROKER_DELETE, 75, LoanBrokerDelete,
 TRANSACTION(ttLOAN_BROKER_COVER_DEPOSIT, 76, LoanBrokerCoverDeposit,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    NoPriv,
-    Emittance::emitable,
-    ({
+    NoPriv, ({
     {sfLoanBrokerID, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
 }))
@@ -1068,9 +996,7 @@ TRANSACTION(ttLOAN_BROKER_COVER_DEPOSIT, 76, LoanBrokerCoverDeposit,
 TRANSACTION(ttLOAN_BROKER_COVER_WITHDRAW, 77, LoanBrokerCoverWithdraw,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    MayAuthorizeMpt,
-    Emittance::emitable,
-    ({
+    MayAuthorizeMpt, ({
     {sfLoanBrokerID, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
     {sfDestination, SoeOptional},
@@ -1085,9 +1011,7 @@ TRANSACTION(ttLOAN_BROKER_COVER_WITHDRAW, 77, LoanBrokerCoverWithdraw,
 TRANSACTION(ttLOAN_BROKER_COVER_CLAWBACK, 78, LoanBrokerCoverClawback,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    NoPriv,
-    Emittance::emitable,
-    ({
+    NoPriv, ({
     {sfLoanBrokerID, SoeOptional},
     {sfAmount, SoeOptional, SoeMptSupported},
 }))
@@ -1099,9 +1023,7 @@ TRANSACTION(ttLOAN_BROKER_COVER_CLAWBACK, 78, LoanBrokerCoverClawback,
 TRANSACTION(ttLOAN_SET, 80, LoanSet,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    MayAuthorizeMpt | MustModifyVault,
-    Emittance::emitable,
-    ({
+    MayAuthorizeMpt | MustModifyVault, ({
     {sfLoanBrokerID, SoeRequired},
     {sfData, SoeOptional},
     {sfCounterparty, SoeOptional},
@@ -1128,9 +1050,7 @@ TRANSACTION(ttLOAN_SET, 80, LoanSet,
 TRANSACTION(ttLOAN_DELETE, 81, LoanDelete,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    NoPriv,
-    Emittance::emitable,
-    ({
+    NoPriv, ({
     {sfLoanID, SoeRequired},
 }))
 
@@ -1144,9 +1064,7 @@ TRANSACTION(ttLOAN_MANAGE, 82, LoanManage,
     // All of the LoanManage options will modify the vault, but the
     // transaction can succeed without options, essentially making it
     // a noop.
-    MayModifyVault,
-    Emittance::emitable,
-    ({
+    MayModifyVault, ({
     {sfLoanID, SoeRequired},
 }))
 
@@ -1157,9 +1075,7 @@ TRANSACTION(ttLOAN_MANAGE, 82, LoanManage,
 TRANSACTION(ttLOAN_PAY, 84, LoanPay,
     Delegation::NotDelegable,
     featureLendingProtocol,
-    MayAuthorizeMpt | MustModifyVault,
-    Emittance::emitable,
-    ({
+    MayAuthorizeMpt | MustModifyVault, ({
     {sfLoanID, SoeRequired},
     {sfAmount, SoeRequired, SoeMptSupported},
 }))
@@ -1172,7 +1088,6 @@ TRANSACTION(ttCONFIDENTIAL_MPT_CONVERT, 85, ConfidentialMPTConvert,
     Delegation::NotDelegable,
     featureConfidentialTransfer,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfMPTAmount, SoeRequired},
@@ -1192,7 +1107,6 @@ TRANSACTION(ttCONFIDENTIAL_MPT_MERGE_INBOX, 86, ConfidentialMPTMergeInbox,
     Delegation::Delegable,
     featureConfidentialTransfer,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
 }))
@@ -1205,7 +1119,6 @@ TRANSACTION(ttCONFIDENTIAL_MPT_CONVERT_BACK, 87, ConfidentialMPTConvertBack,
     Delegation::Delegable,
     featureConfidentialTransfer,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfMPTAmount, SoeRequired},
@@ -1224,7 +1137,6 @@ TRANSACTION(ttCONFIDENTIAL_MPT_SEND, 88, ConfidentialMPTSend,
     Delegation::Delegable,
     featureConfidentialTransfer,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfDestination, SoeRequired},
@@ -1246,7 +1158,6 @@ TRANSACTION(ttCONFIDENTIAL_MPT_CLAWBACK, 89, ConfidentialMPTClawback,
     Delegation::Delegable,
     featureConfidentialTransfer,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfMPTokenIssuanceID, SoeRequired},
     {sfHolder, SoeRequired},
@@ -1262,7 +1173,6 @@ TRANSACTION(ttSPONSORSHIP_TRANSFER, 90, SponsorshipTransfer,
     Delegation::NotDelegable,
     featureSponsor,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfObjectID, SoeOptional},
     {sfSponsee, SoeOptional},
@@ -1276,7 +1186,6 @@ TRANSACTION(ttSPONSORSHIP_SET, 91, SponsorshipSet,
     Delegation::Delegable,
     featureSponsor,
     NoPriv,
-    Emittance::emitable,
     ({
     {sfCounterpartySponsor, SoeOptional},
     {sfSponsee, SoeOptional},
@@ -1285,101 +1194,6 @@ TRANSACTION(ttSPONSORSHIP_SET, 91, SponsorshipSet,
     {sfRemainingOwnerCountDelta, SoeOptional},
 }))
 
-/** This transaction type creates the smart contract. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractCreate.h>
-#endif
-TRANSACTION(ttCONTRACT_CREATE, 92, ContractCreate,
-    Delegation::Delegable,
-    featureSmartContract,
-    CreatePseudoAcct,
-    Emittance::emitable,
-    ({
-    {sfContractCode, SoeOptional},
-    {sfContractHash, SoeOptional},
-    {sfFunctions, SoeOptional},
-    {sfInstanceParameters, SoeOptional},
-    {sfInstanceParameterValues, SoeOptional},
-    {sfURI, SoeOptional},
-}))
-
-/** This transaction type modifies the smart contract. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractModify.h>
-#endif
-TRANSACTION(ttCONTRACT_MODIFY, 93, ContractModify,
-    Delegation::Delegable,
-    featureSmartContract,
-    NoPriv,
-    Emittance::emitable,
-    ({
-    {sfContractAccount, SoeOptional},
-    {sfOwner, SoeOptional},
-    {sfContractCode, SoeOptional},
-    {sfContractHash, SoeOptional},
-    {sfFunctions, SoeOptional},
-    {sfInstanceParameters, SoeOptional},
-    {sfInstanceParameterValues, SoeOptional},
-    {sfURI, SoeOptional},
-}))
-
-/** This transaction type deletes the smart contract. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractDelete.h>
-#endif
-TRANSACTION(ttCONTRACT_DELETE, 94, ContractDelete,
-    Delegation::Delegable,
-    featureSmartContract,
-    MustDeleteAcct,
-    Emittance::emitable,
-    ({
-    {sfContractAccount, SoeRequired},
-}))
-
-/** This transaction type claws back funds from the contract. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractClawback.h>
-#endif
-TRANSACTION(ttCONTRACT_CLAWBACK, 95, ContractClawback,
-    Delegation::Delegable,
-    featureSmartContract,
-    NoPriv,
-    Emittance::emitable,
-    ({
-    {sfContractAccount, SoeOptional},
-    {sfAmount, SoeRequired, SoeMptSupported},
-}))
-
-/** This transaction type deletes user data. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractUserDelete.h>
-#endif
-TRANSACTION(ttCONTRACT_USER_DELETE, 96, ContractUserDelete,
-    Delegation::Delegable,
-    featureSmartContract,
-    NoPriv,
-    Emittance::notEmitable,
-    ({
-    {sfContractAccount, SoeRequired},
-    {sfGas, SoeRequired},
-}))
-
-/** This transaction type calls the smart contract. */
-#if TRANSACTION_INCLUDE
-#   include <xrpl/tx/transactors/contract/ContractCall.h>
-#endif
-TRANSACTION(ttCONTRACT_CALL, 97, ContractCall,
-    Delegation::Delegable,
-    featureSmartContract,
-    NoPriv,
-    Emittance::notEmitable,
-    ({
-    {sfContractAccount, SoeRequired},
-    {sfFunctionName, SoeRequired},
-    {sfParameters, SoeOptional},
-    {sfGas, SoeRequired},
-}))
-
 /** This system-generated transaction type is used to update the status of the various amendments.
 
     For details, see: https://xrpl.org/amendments.html
@@ -1391,7 +1205,6 @@ TRANSACTION(ttAMENDMENT, 100, EnableAmendment,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfLedgerSequence, SoeRequired},
     {sfAmendment, SoeRequired},
@@ -1404,7 +1217,6 @@ TRANSACTION(ttFEE, 101, SetFee,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfLedgerSequence, SoeOptional},
     // Old version uses raw numbers
@@ -1416,10 +1228,6 @@ TRANSACTION(ttFEE, 101, SetFee,
     {sfBaseFeeDrops, SoeOptional},
     {sfReserveBaseDrops, SoeOptional},
     {sfReserveIncrementDrops, SoeOptional},
-    // Smart Escrow fields
-    {sfGasLimit, SoeOptional},
-    {sfBytecodeSizeLimit, SoeOptional},
-    {sfGasPrice, SoeOptional},
 }))
 
 /** This system-generated transaction type is used to update the network's negative UNL
@@ -1430,7 +1238,6 @@ TRANSACTION(ttUNL_MODIFY, 102, UNLModify,
     Delegation::NotDelegable,
     uint256{},
     NoPriv,
-    Emittance::notEmitable,
     ({
     {sfUNLModifyDisabling, SoeRequired},
     {sfLedgerSequence, SoeRequired},

include/xrpl/protocol/jss.h

@@ -189,7 +189,6 @@ JSS(confidential_balance_inbox);  // out: mpt_holders (confidential MPT)
 JSS(confidential_balance_spending);  // out: mpt_holders (confidential MPT)
 JSS(confidential_balance_version);   // out: mpt_holders (confidential MPT)
 JSS(consensus);                      // out: NetworkOPs, LedgerConsensus
-JSS(contract_account);               // out: ContractInfo
 JSS(converge_time);                  // out: NetworkOPs
 JSS(converge_time_s);                // out: NetworkOPs
 JSS(cookie);                         // out: NetworkOPs
@@ -253,9 +252,6 @@ JSS(expected_date);                  // out: any (warnings)
 JSS(expected_date_UTC);              // out: any (warnings)
 JSS(expected_ledger_size);           // out: TxQ
 JSS(expiration);                     // out: AccountOffers, AccountChannels, ValidatorList, amm_info
-JSS(gas_limit);                      // out: NetworkOPs
-JSS(bytecode_size_limit);            // out: NetworkOPs
-JSS(gas_price);                      // out: NetworkOPs
 JSS(fail_hard);                      // in: Sign, Submit
 JSS(failed);                         // out: InboundLedger
 JSS(feature);                        // in: Feature
@@ -282,8 +278,6 @@ JSS(frozen_balances);                // out: GatewayBalances
 JSS(full);                           // in: LedgerClearer, handlers/Ledger
 JSS(full_reply);                     // out: PathFind
 JSS(fullbelow_size);                 // out: GetCounts
-JSS(function);                       // in: ContractInfo
-JSS(functions);                      // out: ContractInfo
 JSS(git);                            // out: server_info
 JSS(good);                           // out: RPCVersion
 JSS(hash);                           // out: NetworkOPs, InboundLedger, LedgerToJson, STTx; field
@@ -566,7 +560,6 @@ JSS(size);                        // out: get_aggregate_price
 JSS(snapshot);                    // in: Subscribe
 JSS(source_account);              // in: PathRequest, RipplePathFind
 JSS(source_amount);               // in: PathRequest, RipplePathFind
-JSS(source_code_uri);             // out: ContractInfo
 JSS(source_currencies);           // in: PathRequest, RipplePathFind
 JSS(source_tag);                  // out: AccountChannels
 JSS(sponsee);                     // in: LedgerEntry
@@ -667,7 +660,6 @@ JSS(url);                         // in/out: Subscribe, Unsubscribe
 JSS(url_password);                // in: Subscribe
 JSS(url_username);                // in: Subscribe
 JSS(urlgravatar);                 //
-JSS(user_data);                   // out: ContractInfo
 JSS(username);                    // in: Subscribe
 JSS(validated);                   // out: NetworkOPs, RPCHelpers, AccountTx*, Tx
 JSS(validator_list_expires);      // out: NetworkOps, ValidatorList

include/xrpl/protocol_autogen/ledger_entries/AccountRoot.h

@@ -590,30 +590,6 @@ public:
     {
         return this->sle_->isFieldPresent(sfLoanBrokerID);
     }
-
-    /**
-     * @brief Get sfContractID (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT256::type::value_type>
-    getContractID() const
-    {
-        if (hasContractID())
-            return this->sle_->at(sfContractID);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractID is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractID() const
-    {
-        return this->sle_->isFieldPresent(sfContractID);
-    }
 };
 
 /**
@@ -950,17 +926,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfContractID (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    AccountRootBuilder&
-    setContractID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfContractID] = value;
-        return *this;
-    }
-
     /**
      * @brief Build and return the completed AccountRoot wrapper.
      * @param index The ledger entry index.

include/xrpl/protocol_autogen/ledger_entries/Contract.h

@@ -1,336 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/LedgerEntryBase.h>
-#include <xrpl/protocol_autogen/LedgerEntryBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::ledger_entries {
-
-class ContractBuilder;
-
-/**
- * @brief Ledger Entry: Contract
- *
- * Type: ltCONTRACT (0x0086)
- * RPC Name: contract
- *
- * Immutable wrapper around SLE providing type-safe field access.
- * Use ContractBuilder to construct new ledger entries.
- */
-class Contract : public LedgerEntryBase
-{
-public:
-    static constexpr LedgerEntryType entryType = ltCONTRACT;
-
-    /**
-     * @brief Construct a Contract ledger entry wrapper from an existing SLE object.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    explicit Contract(SLE::const_pointer sle)
-        : LedgerEntryBase(std::move(sle))
-    {
-        // Verify ledger entry type
-        if (sle_->getType() != entryType)
-        {
-            throw std::runtime_error("Invalid ledger entry type for Contract");
-        }
-    }
-
-    // Ledger entry-specific field getters
-
-    /**
-     * @brief Get sfPreviousTxnID (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT256::type::value_type
-    getPreviousTxnID() const
-    {
-        return this->sle_->at(sfPreviousTxnID);
-    }
-
-    /**
-     * @brief Get sfPreviousTxnLgrSeq (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getPreviousTxnLgrSeq() const
-    {
-        return this->sle_->at(sfPreviousTxnLgrSeq);
-    }
-
-    /**
-     * @brief Get sfSequence (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getSequence() const
-    {
-        return this->sle_->at(sfSequence);
-    }
-
-    /**
-     * @brief Get sfOwnerNode (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT64::type::value_type
-    getOwnerNode() const
-    {
-        return this->sle_->at(sfOwnerNode);
-    }
-
-    /**
-     * @brief Get sfOwner (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getOwner() const
-    {
-        return this->sle_->at(sfOwner);
-    }
-
-    /**
-     * @brief Get sfContractAccount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getContractAccount() const
-    {
-        return this->sle_->at(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfContractHash (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT256::type::value_type
-    getContractHash() const
-    {
-        return this->sle_->at(sfContractHash);
-    }
-
-    /**
-     * @brief Get sfInstanceParameterValues (SoeOptional)
-     * @note This is an untyped field (unknown).
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameterValues() const
-    {
-        if (this->sle_->isFieldPresent(sfInstanceParameterValues))
-            return this->sle_->getFieldArray(sfInstanceParameterValues);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameterValues is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameterValues() const
-    {
-        return this->sle_->isFieldPresent(sfInstanceParameterValues);
-    }
-
-    /**
-     * @brief Get sfURI (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getURI() const
-    {
-        if (hasURI())
-            return this->sle_->at(sfURI);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfURI is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasURI() const
-    {
-        return this->sle_->isFieldPresent(sfURI);
-    }
-};
-
-/**
- * @brief Builder for Contract ledger entries.
- *
- * Provides a fluent interface for constructing ledger entries with method chaining.
- * Uses STObject internally for flexible ledger entry construction.
- * Inherits common field setters from LedgerEntryBuilderBase.
- */
-class ContractBuilder : public LedgerEntryBuilderBase<ContractBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractBuilder with required fields.
-     * @param previousTxnID The sfPreviousTxnID field value.
-     * @param previousTxnLgrSeq The sfPreviousTxnLgrSeq field value.
-     * @param sequence The sfSequence field value.
-     * @param ownerNode The sfOwnerNode field value.
-     * @param owner The sfOwner field value.
-     * @param contractAccount The sfContractAccount field value.
-     * @param contractHash The sfContractHash field value.
-     */
-    ContractBuilder(std::decay_t<typename SF_UINT256::type::value_type> const& previousTxnID,std::decay_t<typename SF_UINT32::type::value_type> const& previousTxnLgrSeq,std::decay_t<typename SF_UINT32::type::value_type> const& sequence,std::decay_t<typename SF_UINT64::type::value_type> const& ownerNode,std::decay_t<typename SF_ACCOUNT::type::value_type> const& owner,std::decay_t<typename SF_ACCOUNT::type::value_type> const& contractAccount,std::decay_t<typename SF_UINT256::type::value_type> const& contractHash)
-        : LedgerEntryBuilderBase<ContractBuilder>(ltCONTRACT)
-    {
-        setPreviousTxnID(previousTxnID);
-        setPreviousTxnLgrSeq(previousTxnLgrSeq);
-        setSequence(sequence);
-        setOwnerNode(ownerNode);
-        setOwner(owner);
-        setContractAccount(contractAccount);
-        setContractHash(contractHash);
-    }
-
-    /**
-     * @brief Construct a ContractBuilder from an existing SLE object.
-     * @param sle The existing ledger entry to copy from.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    ContractBuilder(SLE::const_pointer sle)
-    {
-        if (sle->at(sfLedgerEntryType) != ltCONTRACT)
-        {
-            throw std::runtime_error("Invalid ledger entry type for Contract");
-        }
-        object_ = *sle;
-    }
-
-    /**
-     * @brief Ledger entry-specific field setters
-     */
-
-    /**
-     * @brief Set sfPreviousTxnID (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setPreviousTxnID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnID] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfPreviousTxnLgrSeq (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setPreviousTxnLgrSeq(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnLgrSeq] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfSequence (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setSequence(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfSequence] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfOwnerNode (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setOwnerNode(std::decay_t<typename SF_UINT64::type::value_type> const& value)
-    {
-        object_[sfOwnerNode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfOwner (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setOwner(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfOwner] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractAccount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractHash (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setContractHash(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfContractHash] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameterValues (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setInstanceParameterValues(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameterValues, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfURI (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractBuilder&
-    setURI(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfURI] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the completed Contract wrapper.
-     * @param index The ledger entry index.
-     * @return The constructed ledger entry wrapper.
-     */
-    Contract
-    build(uint256 const& index)
-    {
-        return Contract{std::make_shared<SLE>(std::move(object_), index)};
-    }
-};
-
-}  // namespace xrpl::ledger_entries

include/xrpl/protocol_autogen/ledger_entries/ContractData.h

@@ -1,241 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/LedgerEntryBase.h>
-#include <xrpl/protocol_autogen/LedgerEntryBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::ledger_entries {
-
-class ContractDataBuilder;
-
-/**
- * @brief Ledger Entry: ContractData
- *
- * Type: ltCONTRACT_DATA (0x0087)
- * RPC Name: contract_data
- *
- * Immutable wrapper around SLE providing type-safe field access.
- * Use ContractDataBuilder to construct new ledger entries.
- */
-class ContractData : public LedgerEntryBase
-{
-public:
-    static constexpr LedgerEntryType entryType = ltCONTRACT_DATA;
-
-    /**
-     * @brief Construct a ContractData ledger entry wrapper from an existing SLE object.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    explicit ContractData(SLE::const_pointer sle)
-        : LedgerEntryBase(std::move(sle))
-    {
-        // Verify ledger entry type
-        if (sle_->getType() != entryType)
-        {
-            throw std::runtime_error("Invalid ledger entry type for ContractData");
-        }
-    }
-
-    // Ledger entry-specific field getters
-
-    /**
-     * @brief Get sfPreviousTxnID (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT256::type::value_type
-    getPreviousTxnID() const
-    {
-        return this->sle_->at(sfPreviousTxnID);
-    }
-
-    /**
-     * @brief Get sfPreviousTxnLgrSeq (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getPreviousTxnLgrSeq() const
-    {
-        return this->sle_->at(sfPreviousTxnLgrSeq);
-    }
-
-    /**
-     * @brief Get sfOwnerNode (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT64::type::value_type
-    getOwnerNode() const
-    {
-        return this->sle_->at(sfOwnerNode);
-    }
-
-    /**
-     * @brief Get sfOwner (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getOwner() const
-    {
-        return this->sle_->at(sfOwner);
-    }
-
-    /**
-     * @brief Get sfContractAccount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getContractAccount() const
-    {
-        return this->sle_->at(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfContractJson (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_JSON::type::value_type
-    getContractJson() const
-    {
-        return this->sle_->at(sfContractJson);
-    }
-};
-
-/**
- * @brief Builder for ContractData ledger entries.
- *
- * Provides a fluent interface for constructing ledger entries with method chaining.
- * Uses STObject internally for flexible ledger entry construction.
- * Inherits common field setters from LedgerEntryBuilderBase.
- */
-class ContractDataBuilder : public LedgerEntryBuilderBase<ContractDataBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractDataBuilder with required fields.
-     * @param previousTxnID The sfPreviousTxnID field value.
-     * @param previousTxnLgrSeq The sfPreviousTxnLgrSeq field value.
-     * @param ownerNode The sfOwnerNode field value.
-     * @param owner The sfOwner field value.
-     * @param contractAccount The sfContractAccount field value.
-     * @param contractJson The sfContractJson field value.
-     */
-    ContractDataBuilder(std::decay_t<typename SF_UINT256::type::value_type> const& previousTxnID,std::decay_t<typename SF_UINT32::type::value_type> const& previousTxnLgrSeq,std::decay_t<typename SF_UINT64::type::value_type> const& ownerNode,std::decay_t<typename SF_ACCOUNT::type::value_type> const& owner,std::decay_t<typename SF_ACCOUNT::type::value_type> const& contractAccount,std::decay_t<typename SF_JSON::type::value_type> const& contractJson)
-        : LedgerEntryBuilderBase<ContractDataBuilder>(ltCONTRACT_DATA)
-    {
-        setPreviousTxnID(previousTxnID);
-        setPreviousTxnLgrSeq(previousTxnLgrSeq);
-        setOwnerNode(ownerNode);
-        setOwner(owner);
-        setContractAccount(contractAccount);
-        setContractJson(contractJson);
-    }
-
-    /**
-     * @brief Construct a ContractDataBuilder from an existing SLE object.
-     * @param sle The existing ledger entry to copy from.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    ContractDataBuilder(SLE::const_pointer sle)
-    {
-        if (sle->at(sfLedgerEntryType) != ltCONTRACT_DATA)
-        {
-            throw std::runtime_error("Invalid ledger entry type for ContractData");
-        }
-        object_ = *sle;
-    }
-
-    /**
-     * @brief Ledger entry-specific field setters
-     */
-
-    /**
-     * @brief Set sfPreviousTxnID (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setPreviousTxnID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnID] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfPreviousTxnLgrSeq (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setPreviousTxnLgrSeq(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnLgrSeq] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfOwnerNode (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setOwnerNode(std::decay_t<typename SF_UINT64::type::value_type> const& value)
-    {
-        object_[sfOwnerNode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfOwner (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setOwner(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfOwner] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractAccount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractJson (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDataBuilder&
-    setContractJson(std::decay_t<typename SF_JSON::type::value_type> const& value)
-    {
-        object_[sfContractJson] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the completed ContractData wrapper.
-     * @param index The ledger entry index.
-     * @return The constructed ledger entry wrapper.
-     */
-    ContractData
-    build(uint256 const& index)
-    {
-        return ContractData{std::make_shared<SLE>(std::move(object_), index)};
-    }
-};
-
-}  // namespace xrpl::ledger_entries

include/xrpl/protocol_autogen/ledger_entries/ContractSource.h

@@ -1,278 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/LedgerEntryBase.h>
-#include <xrpl/protocol_autogen/LedgerEntryBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::ledger_entries {
-
-class ContractSourceBuilder;
-
-/**
- * @brief Ledger Entry: ContractSource
- *
- * Type: ltCONTRACT_SOURCE (0x0085)
- * RPC Name: contract_source
- *
- * Immutable wrapper around SLE providing type-safe field access.
- * Use ContractSourceBuilder to construct new ledger entries.
- */
-class ContractSource : public LedgerEntryBase
-{
-public:
-    static constexpr LedgerEntryType entryType = ltCONTRACT_SOURCE;
-
-    /**
-     * @brief Construct a ContractSource ledger entry wrapper from an existing SLE object.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    explicit ContractSource(SLE::const_pointer sle)
-        : LedgerEntryBase(std::move(sle))
-    {
-        // Verify ledger entry type
-        if (sle_->getType() != entryType)
-        {
-            throw std::runtime_error("Invalid ledger entry type for ContractSource");
-        }
-    }
-
-    // Ledger entry-specific field getters
-
-    /**
-     * @brief Get sfPreviousTxnID (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT256::type::value_type
-    getPreviousTxnID() const
-    {
-        return this->sle_->at(sfPreviousTxnID);
-    }
-
-    /**
-     * @brief Get sfPreviousTxnLgrSeq (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getPreviousTxnLgrSeq() const
-    {
-        return this->sle_->at(sfPreviousTxnLgrSeq);
-    }
-
-    /**
-     * @brief Get sfContractHash (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT256::type::value_type
-    getContractHash() const
-    {
-        return this->sle_->at(sfContractHash);
-    }
-
-    /**
-     * @brief Get sfContractCode (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_VL::type::value_type
-    getContractCode() const
-    {
-        return this->sle_->at(sfContractCode);
-    }
-
-    /**
-     * @brief Get sfFunctions (SoeRequired)
-     * @note This is an untyped field (unknown).
-     * @return The field value.
-     */
-    [[nodiscard]]
-    STArray const&
-    getFunctions() const
-    {
-        return this->sle_->getFieldArray(sfFunctions);
-    }
-
-    /**
-     * @brief Get sfInstanceParameters (SoeOptional)
-     * @note This is an untyped field (unknown).
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameters() const
-    {
-        if (this->sle_->isFieldPresent(sfInstanceParameters))
-            return this->sle_->getFieldArray(sfInstanceParameters);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameters is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameters() const
-    {
-        return this->sle_->isFieldPresent(sfInstanceParameters);
-    }
-
-    /**
-     * @brief Get sfReferenceCount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT64::type::value_type
-    getReferenceCount() const
-    {
-        return this->sle_->at(sfReferenceCount);
-    }
-};
-
-/**
- * @brief Builder for ContractSource ledger entries.
- *
- * Provides a fluent interface for constructing ledger entries with method chaining.
- * Uses STObject internally for flexible ledger entry construction.
- * Inherits common field setters from LedgerEntryBuilderBase.
- */
-class ContractSourceBuilder : public LedgerEntryBuilderBase<ContractSourceBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractSourceBuilder with required fields.
-     * @param previousTxnID The sfPreviousTxnID field value.
-     * @param previousTxnLgrSeq The sfPreviousTxnLgrSeq field value.
-     * @param contractHash The sfContractHash field value.
-     * @param contractCode The sfContractCode field value.
-     * @param functions The sfFunctions field value.
-     * @param referenceCount The sfReferenceCount field value.
-     */
-    ContractSourceBuilder(std::decay_t<typename SF_UINT256::type::value_type> const& previousTxnID,std::decay_t<typename SF_UINT32::type::value_type> const& previousTxnLgrSeq,std::decay_t<typename SF_UINT256::type::value_type> const& contractHash,std::decay_t<typename SF_VL::type::value_type> const& contractCode,STArray const& functions,std::decay_t<typename SF_UINT64::type::value_type> const& referenceCount)
-        : LedgerEntryBuilderBase<ContractSourceBuilder>(ltCONTRACT_SOURCE)
-    {
-        setPreviousTxnID(previousTxnID);
-        setPreviousTxnLgrSeq(previousTxnLgrSeq);
-        setContractHash(contractHash);
-        setContractCode(contractCode);
-        setFunctions(functions);
-        setReferenceCount(referenceCount);
-    }
-
-    /**
-     * @brief Construct a ContractSourceBuilder from an existing SLE object.
-     * @param sle The existing ledger entry to copy from.
-     * @throws std::runtime_error if the ledger entry type doesn't match.
-     */
-    ContractSourceBuilder(SLE::const_pointer sle)
-    {
-        if (sle->at(sfLedgerEntryType) != ltCONTRACT_SOURCE)
-        {
-            throw std::runtime_error("Invalid ledger entry type for ContractSource");
-        }
-        object_ = *sle;
-    }
-
-    /**
-     * @brief Ledger entry-specific field setters
-     */
-
-    /**
-     * @brief Set sfPreviousTxnID (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setPreviousTxnID(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnID] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfPreviousTxnLgrSeq (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setPreviousTxnLgrSeq(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfPreviousTxnLgrSeq] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractHash (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setContractHash(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfContractHash] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractCode (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setContractCode(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfContractCode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfFunctions (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setFunctions(STArray const& value)
-    {
-        object_.setFieldArray(sfFunctions, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameters (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setInstanceParameters(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameters, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfReferenceCount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractSourceBuilder&
-    setReferenceCount(std::decay_t<typename SF_UINT64::type::value_type> const& value)
-    {
-        object_[sfReferenceCount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the completed ContractSource wrapper.
-     * @param index The ledger entry index.
-     * @return The constructed ledger entry wrapper.
-     */
-    ContractSource
-    build(uint256 const& index)
-    {
-        return ContractSource{std::make_shared<SLE>(std::move(object_), index)};
-    }
-};
-
-}  // namespace xrpl::ledger_entries

include/xrpl/protocol_autogen/ledger_entries/Escrow.h

@@ -174,54 +174,6 @@ public:
         return this->sle_->isFieldPresent(sfFinishAfter);
     }
 
-    /**
-     * @brief Get sfBytecode (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getBytecode() const
-    {
-        if (hasBytecode())
-            return this->sle_->at(sfBytecode);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecode is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecode() const
-    {
-        return this->sle_->isFieldPresent(sfBytecode);
-    }
-
-    /**
-     * @brief Get sfData (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getData() const
-    {
-        if (hasData())
-            return this->sle_->at(sfData);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfData is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasData() const
-    {
-        return this->sle_->isFieldPresent(sfData);
-    }
-
     /**
      * @brief Get sfSourceTag (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -501,28 +453,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfBytecode (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowBuilder&
-    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfBytecode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfData (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowBuilder&
-    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfData] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfSourceTag (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/ledger_entries/FeeSettings.h

@@ -213,78 +213,6 @@ public:
         return this->sle_->isFieldPresent(sfReserveIncrementDrops);
     }
 
-    /**
-     * @brief Get sfGasLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasLimit() const
-    {
-        if (hasGasLimit())
-            return this->sle_->at(sfGasLimit);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasLimit() const
-    {
-        return this->sle_->isFieldPresent(sfGasLimit);
-    }
-
-    /**
-     * @brief Get sfBytecodeSizeLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getBytecodeSizeLimit() const
-    {
-        if (hasBytecodeSizeLimit())
-            return this->sle_->at(sfBytecodeSizeLimit);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecodeSizeLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecodeSizeLimit() const
-    {
-        return this->sle_->isFieldPresent(sfBytecodeSizeLimit);
-    }
-
-    /**
-     * @brief Get sfGasPrice (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasPrice() const
-    {
-        if (hasGasPrice())
-            return this->sle_->at(sfGasPrice);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasPrice is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasPrice() const
-    {
-        return this->sle_->isFieldPresent(sfGasPrice);
-    }
-
     /**
      * @brief Get sfPreviousTxnID (SoeOptional)
      * @return The field value, or std::nullopt if not present.
@@ -447,39 +375,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGasLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfBytecodeSizeLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfBytecodeSizeLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGasPrice (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    FeeSettingsBuilder&
-    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasPrice] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfPreviousTxnID (SoeOptional)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/transactions/ContractCall.h

@@ -1,214 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractCallBuilder;
-
-/**
- * @brief Transaction: ContractCall
- *
- * Type: ttCONTRACT_CALL (97)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: NoPriv
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractCallBuilder to construct new transactions.
- */
-class ContractCall : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_CALL;
-
-    /**
-     * @brief Construct a ContractCall transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractCall(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractCall");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractAccount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getContractAccount() const
-    {
-        return this->tx_->at(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfFunctionName (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_VL::type::value_type
-    getFunctionName() const
-    {
-        return this->tx_->at(sfFunctionName);
-    }
-    /**
-     * @brief Get sfParameters (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getParameters() const
-    {
-        if (this->tx_->isFieldPresent(sfParameters))
-            return this->tx_->getFieldArray(sfParameters);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfParameters is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasParameters() const
-    {
-        return this->tx_->isFieldPresent(sfParameters);
-    }
-
-    /**
-     * @brief Get sfGas (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getGas() const
-    {
-        return this->tx_->at(sfGas);
-    }
-};
-
-/**
- * @brief Builder for ContractCall transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractCallBuilder : public TransactionBuilderBase<ContractCallBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractCallBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param contractAccount The sfContractAccount field value.
-     * @param functionName The sfFunctionName field value.
-     * @param gas The sfGas field value.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractCallBuilder(SF_ACCOUNT::type::value_type account,
-                     std::decay_t<typename SF_ACCOUNT::type::value_type> const& contractAccount,                     std::decay_t<typename SF_VL::type::value_type> const& functionName,                     std::decay_t<typename SF_UINT32::type::value_type> const& gas,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractCallBuilder>(ttCONTRACT_CALL, account, sequence, fee)
-    {
-        setContractAccount(contractAccount);
-        setFunctionName(functionName);
-        setGas(gas);
-    }
-
-    /**
-     * @brief Construct a ContractCallBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractCallBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_CALL)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractCallBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractAccount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCallBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfFunctionName (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCallBuilder&
-    setFunctionName(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfFunctionName] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfParameters (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCallBuilder&
-    setParameters(STArray const& value)
-    {
-        object_.setFieldArray(sfParameters, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGas (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCallBuilder&
-    setGas(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGas] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractCall wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractCall
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractCall{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/ContractClawback.h

@@ -1,170 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractClawbackBuilder;
-
-/**
- * @brief Transaction: ContractClawback
- *
- * Type: ttCONTRACT_CLAWBACK (95)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: NoPriv
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractClawbackBuilder to construct new transactions.
- */
-class ContractClawback : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_CLAWBACK;
-
-    /**
-     * @brief Construct a ContractClawback transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractClawback(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractClawback");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractAccount (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
-    getContractAccount() const
-    {
-        if (hasContractAccount())
-        {
-            return this->tx_->at(sfContractAccount);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractAccount is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractAccount() const
-    {
-        return this->tx_->isFieldPresent(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfAmount (SoeRequired)
-     * @note This field supports MPT (Multi-Purpose Token) amounts.
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_AMOUNT::type::value_type
-    getAmount() const
-    {
-        return this->tx_->at(sfAmount);
-    }
-};
-
-/**
- * @brief Builder for ContractClawback transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractClawbackBuilder : public TransactionBuilderBase<ContractClawbackBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractClawbackBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param amount The sfAmount field value.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractClawbackBuilder(SF_ACCOUNT::type::value_type account,
-                     std::decay_t<typename SF_AMOUNT::type::value_type> const& amount,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractClawbackBuilder>(ttCONTRACT_CLAWBACK, account, sequence, fee)
-    {
-        setAmount(amount);
-    }
-
-    /**
-     * @brief Construct a ContractClawbackBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractClawbackBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_CLAWBACK)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractClawbackBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractAccount (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractClawbackBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfAmount (SoeRequired)
-     * @note This field supports MPT (Multi-Purpose Token) amounts.
-     * @return Reference to this builder for method chaining.
-     */
-    ContractClawbackBuilder&
-    setAmount(std::decay_t<typename SF_AMOUNT::type::value_type> const& value)
-    {
-        object_[sfAmount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractClawback wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractClawback
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractClawback{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/ContractCreate.h

@@ -1,323 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractCreateBuilder;
-
-/**
- * @brief Transaction: ContractCreate
- *
- * Type: ttCONTRACT_CREATE (92)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: CreatePseudoAcct
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractCreateBuilder to construct new transactions.
- */
-class ContractCreate : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_CREATE;
-
-    /**
-     * @brief Construct a ContractCreate transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractCreate(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractCreate");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractCode (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getContractCode() const
-    {
-        if (hasContractCode())
-        {
-            return this->tx_->at(sfContractCode);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractCode is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractCode() const
-    {
-        return this->tx_->isFieldPresent(sfContractCode);
-    }
-
-    /**
-     * @brief Get sfContractHash (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT256::type::value_type>
-    getContractHash() const
-    {
-        if (hasContractHash())
-        {
-            return this->tx_->at(sfContractHash);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractHash is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractHash() const
-    {
-        return this->tx_->isFieldPresent(sfContractHash);
-    }
-    /**
-     * @brief Get sfFunctions (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getFunctions() const
-    {
-        if (this->tx_->isFieldPresent(sfFunctions))
-            return this->tx_->getFieldArray(sfFunctions);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfFunctions is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasFunctions() const
-    {
-        return this->tx_->isFieldPresent(sfFunctions);
-    }
-    /**
-     * @brief Get sfInstanceParameters (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameters() const
-    {
-        if (this->tx_->isFieldPresent(sfInstanceParameters))
-            return this->tx_->getFieldArray(sfInstanceParameters);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameters is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameters() const
-    {
-        return this->tx_->isFieldPresent(sfInstanceParameters);
-    }
-    /**
-     * @brief Get sfInstanceParameterValues (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameterValues() const
-    {
-        if (this->tx_->isFieldPresent(sfInstanceParameterValues))
-            return this->tx_->getFieldArray(sfInstanceParameterValues);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameterValues is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameterValues() const
-    {
-        return this->tx_->isFieldPresent(sfInstanceParameterValues);
-    }
-
-    /**
-     * @brief Get sfURI (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getURI() const
-    {
-        if (hasURI())
-        {
-            return this->tx_->at(sfURI);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfURI is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasURI() const
-    {
-        return this->tx_->isFieldPresent(sfURI);
-    }
-};
-
-/**
- * @brief Builder for ContractCreate transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractCreateBuilder : public TransactionBuilderBase<ContractCreateBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractCreateBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractCreateBuilder(SF_ACCOUNT::type::value_type account,
-                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractCreateBuilder>(ttCONTRACT_CREATE, account, sequence, fee)
-    {
-    }
-
-    /**
-     * @brief Construct a ContractCreateBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractCreateBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_CREATE)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractCreateBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractCode (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setContractCode(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfContractCode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractHash (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setContractHash(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfContractHash] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfFunctions (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setFunctions(STArray const& value)
-    {
-        object_.setFieldArray(sfFunctions, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameters (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setInstanceParameters(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameters, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameterValues (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setInstanceParameterValues(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameterValues, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfURI (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractCreateBuilder&
-    setURI(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfURI] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractCreate wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractCreate
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractCreate{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/ContractDelete.h

@@ -1,131 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractDeleteBuilder;
-
-/**
- * @brief Transaction: ContractDelete
- *
- * Type: ttCONTRACT_DELETE (94)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: MustDeleteAcct
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractDeleteBuilder to construct new transactions.
- */
-class ContractDelete : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_DELETE;
-
-    /**
-     * @brief Construct a ContractDelete transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractDelete(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractDelete");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractAccount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getContractAccount() const
-    {
-        return this->tx_->at(sfContractAccount);
-    }
-};
-
-/**
- * @brief Builder for ContractDelete transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractDeleteBuilder : public TransactionBuilderBase<ContractDeleteBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractDeleteBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param contractAccount The sfContractAccount field value.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractDeleteBuilder(SF_ACCOUNT::type::value_type account,
-                     std::decay_t<typename SF_ACCOUNT::type::value_type> const& contractAccount,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractDeleteBuilder>(ttCONTRACT_DELETE, account, sequence, fee)
-    {
-        setContractAccount(contractAccount);
-    }
-
-    /**
-     * @brief Construct a ContractDeleteBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractDeleteBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_DELETE)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractDeleteBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractAccount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractDeleteBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractDelete wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractDelete
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractDelete{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/ContractModify.h

@@ -1,397 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractModifyBuilder;
-
-/**
- * @brief Transaction: ContractModify
- *
- * Type: ttCONTRACT_MODIFY (93)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: NoPriv
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractModifyBuilder to construct new transactions.
- */
-class ContractModify : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_MODIFY;
-
-    /**
-     * @brief Construct a ContractModify transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractModify(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractModify");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractAccount (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
-    getContractAccount() const
-    {
-        if (hasContractAccount())
-        {
-            return this->tx_->at(sfContractAccount);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractAccount is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractAccount() const
-    {
-        return this->tx_->isFieldPresent(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfOwner (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_ACCOUNT::type::value_type>
-    getOwner() const
-    {
-        if (hasOwner())
-        {
-            return this->tx_->at(sfOwner);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfOwner is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasOwner() const
-    {
-        return this->tx_->isFieldPresent(sfOwner);
-    }
-
-    /**
-     * @brief Get sfContractCode (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getContractCode() const
-    {
-        if (hasContractCode())
-        {
-            return this->tx_->at(sfContractCode);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractCode is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractCode() const
-    {
-        return this->tx_->isFieldPresent(sfContractCode);
-    }
-
-    /**
-     * @brief Get sfContractHash (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT256::type::value_type>
-    getContractHash() const
-    {
-        if (hasContractHash())
-        {
-            return this->tx_->at(sfContractHash);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfContractHash is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasContractHash() const
-    {
-        return this->tx_->isFieldPresent(sfContractHash);
-    }
-    /**
-     * @brief Get sfFunctions (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getFunctions() const
-    {
-        if (this->tx_->isFieldPresent(sfFunctions))
-            return this->tx_->getFieldArray(sfFunctions);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfFunctions is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasFunctions() const
-    {
-        return this->tx_->isFieldPresent(sfFunctions);
-    }
-    /**
-     * @brief Get sfInstanceParameters (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameters() const
-    {
-        if (this->tx_->isFieldPresent(sfInstanceParameters))
-            return this->tx_->getFieldArray(sfInstanceParameters);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameters is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameters() const
-    {
-        return this->tx_->isFieldPresent(sfInstanceParameters);
-    }
-    /**
-     * @brief Get sfInstanceParameterValues (SoeOptional)
-     * @note This is an untyped field.
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    std::optional<std::reference_wrapper<STArray const>>
-    getInstanceParameterValues() const
-    {
-        if (this->tx_->isFieldPresent(sfInstanceParameterValues))
-            return this->tx_->getFieldArray(sfInstanceParameterValues);
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfInstanceParameterValues is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasInstanceParameterValues() const
-    {
-        return this->tx_->isFieldPresent(sfInstanceParameterValues);
-    }
-
-    /**
-     * @brief Get sfURI (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getURI() const
-    {
-        if (hasURI())
-        {
-            return this->tx_->at(sfURI);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfURI is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasURI() const
-    {
-        return this->tx_->isFieldPresent(sfURI);
-    }
-};
-
-/**
- * @brief Builder for ContractModify transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractModifyBuilder : public TransactionBuilderBase<ContractModifyBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractModifyBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractModifyBuilder(SF_ACCOUNT::type::value_type account,
-                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractModifyBuilder>(ttCONTRACT_MODIFY, account, sequence, fee)
-    {
-    }
-
-    /**
-     * @brief Construct a ContractModifyBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractModifyBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_MODIFY)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractModifyBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractAccount (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfOwner (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setOwner(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfOwner] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractCode (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setContractCode(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfContractCode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfContractHash (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setContractHash(std::decay_t<typename SF_UINT256::type::value_type> const& value)
-    {
-        object_[sfContractHash] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfFunctions (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setFunctions(STArray const& value)
-    {
-        object_.setFieldArray(sfFunctions, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameters (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setInstanceParameters(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameters, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfInstanceParameterValues (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setInstanceParameterValues(STArray const& value)
-    {
-        object_.setFieldArray(sfInstanceParameterValues, value);
-        return *this;
-    }
-
-    /**
-     * @brief Set sfURI (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractModifyBuilder&
-    setURI(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfURI] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractModify wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractModify
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractModify{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/ContractUserDelete.h

@@ -1,155 +0,0 @@
-// This file is auto-generated. Do not edit.
-#pragma once
-
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/STParsedJSON.h>
-#include <xrpl/protocol/jss.h>
-#include <xrpl/protocol_autogen/TransactionBase.h>
-#include <xrpl/protocol_autogen/TransactionBuilderBase.h>
-#include <xrpl/json/json_value.h>
-
-#include <stdexcept>
-#include <optional>
-
-namespace xrpl::transactions {
-
-class ContractUserDeleteBuilder;
-
-/**
- * @brief Transaction: ContractUserDelete
- *
- * Type: ttCONTRACT_USER_DELETE (96)
- * Delegable: Delegation::Delegable
- * Amendment: featureSmartContract
- * Privileges: NoPriv
- *
- * Immutable wrapper around STTx providing type-safe field access.
- * Use ContractUserDeleteBuilder to construct new transactions.
- */
-class ContractUserDelete : public TransactionBase
-{
-public:
-    static constexpr xrpl::TxType txType = ttCONTRACT_USER_DELETE;
-
-    /**
-     * @brief Construct a ContractUserDelete transaction wrapper from an existing STTx object.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    explicit ContractUserDelete(std::shared_ptr<STTx const> tx)
-        : TransactionBase(std::move(tx))
-    {
-        // Verify transaction type
-        if (tx_->getTxnType() != txType)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractUserDelete");
-        }
-    }
-
-    // Transaction-specific field getters
-
-    /**
-     * @brief Get sfContractAccount (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_ACCOUNT::type::value_type
-    getContractAccount() const
-    {
-        return this->tx_->at(sfContractAccount);
-    }
-
-    /**
-     * @brief Get sfGas (SoeRequired)
-     * @return The field value.
-     */
-    [[nodiscard]]
-    SF_UINT32::type::value_type
-    getGas() const
-    {
-        return this->tx_->at(sfGas);
-    }
-};
-
-/**
- * @brief Builder for ContractUserDelete transactions.
- *
- * Provides a fluent interface for constructing transactions with method chaining.
- * Uses STObject internally for flexible transaction construction.
- * Inherits common field setters from TransactionBuilderBase.
- */
-class ContractUserDeleteBuilder : public TransactionBuilderBase<ContractUserDeleteBuilder>
-{
-public:
-    /**
-     * @brief Construct a new ContractUserDeleteBuilder with required fields.
-     * @param account The account initiating the transaction.
-     * @param contractAccount The sfContractAccount field value.
-     * @param gas The sfGas field value.
-     * @param sequence Optional sequence number for the transaction.
-     * @param fee Optional fee for the transaction.
-     */
-    ContractUserDeleteBuilder(SF_ACCOUNT::type::value_type account,
-                     std::decay_t<typename SF_ACCOUNT::type::value_type> const& contractAccount,                     std::decay_t<typename SF_UINT32::type::value_type> const& gas,                    std::optional<SF_UINT32::type::value_type> sequence = std::nullopt,
-                    std::optional<SF_AMOUNT::type::value_type> fee = std::nullopt
-)
-        : TransactionBuilderBase<ContractUserDeleteBuilder>(ttCONTRACT_USER_DELETE, account, sequence, fee)
-    {
-        setContractAccount(contractAccount);
-        setGas(gas);
-    }
-
-    /**
-     * @brief Construct a ContractUserDeleteBuilder from an existing STTx object.
-     * @param tx The existing transaction to copy from.
-     * @throws std::runtime_error if the transaction type doesn't match.
-     */
-    ContractUserDeleteBuilder(std::shared_ptr<STTx const> tx)
-    {
-        if (tx->getTxnType() != ttCONTRACT_USER_DELETE)
-        {
-            throw std::runtime_error("Invalid transaction type for ContractUserDeleteBuilder");
-        }
-        object_ = *tx;
-    }
-
-    /**
-     * @brief Transaction-specific field setters
-     */
-
-    /**
-     * @brief Set sfContractAccount (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractUserDeleteBuilder&
-    setContractAccount(std::decay_t<typename SF_ACCOUNT::type::value_type> const& value)
-    {
-        object_[sfContractAccount] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGas (SoeRequired)
-     * @return Reference to this builder for method chaining.
-     */
-    ContractUserDeleteBuilder&
-    setGas(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGas] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Build and return the ContractUserDelete wrapper.
-     * @param publicKey The public key for signing.
-     * @param secretKey The secret key for signing.
-     * @return The constructed transaction wrapper.
-     */
-    ContractUserDelete
-    build(PublicKey const& publicKey, SecretKey const& secretKey)
-    {
-        sign(publicKey, secretKey);
-        return ContractUserDelete{std::make_shared<STTx>(std::move(object_))};
-    }
-};
-
-}  // namespace xrpl::transactions

include/xrpl/protocol_autogen/transactions/EscrowCreate.h

@@ -58,32 +58,6 @@ public:
         return this->tx_->at(sfDestination);
     }
 
-    /**
-     * @brief Get sfDestinationTag (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getDestinationTag() const
-    {
-        if (hasDestinationTag())
-        {
-            return this->tx_->at(sfDestinationTag);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfDestinationTag is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasDestinationTag() const
-    {
-        return this->tx_->isFieldPresent(sfDestinationTag);
-    }
-
     /**
      * @brief Get sfAmount (SoeRequired)
      * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -175,55 +149,29 @@ public:
     }
 
     /**
-     * @brief Get sfBytecode (SoeOptional)
+     * @brief Get sfDestinationTag (SoeOptional)
      * @return The field value, or std::nullopt if not present.
      */
     [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getBytecode() const
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getDestinationTag() const
     {
-        if (hasBytecode())
+        if (hasDestinationTag())
         {
-            return this->tx_->at(sfBytecode);
+            return this->tx_->at(sfDestinationTag);
         }
         return std::nullopt;
     }
 
     /**
-     * @brief Check if sfBytecode is present.
+     * @brief Check if sfDestinationTag is present.
      * @return True if the field is present, false otherwise.
      */
     [[nodiscard]]
     bool
-    hasBytecode() const
+    hasDestinationTag() const
     {
-        return this->tx_->isFieldPresent(sfBytecode);
-    }
-
-    /**
-     * @brief Get sfData (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_VL::type::value_type>
-    getData() const
-    {
-        if (hasData())
-        {
-            return this->tx_->at(sfData);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfData is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasData() const
-    {
-        return this->tx_->isFieldPresent(sfData);
+        return this->tx_->isFieldPresent(sfDestinationTag);
     }
 };
 
@@ -284,17 +232,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfDestinationTag (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowCreateBuilder&
-    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfDestinationTag] = value;
-        return *this;
-    }
-
     /**
      * @brief Set sfAmount (SoeRequired)
      * @note This field supports MPT (Multi-Purpose Token) amounts.
@@ -341,24 +278,13 @@ public:
     }
 
     /**
-     * @brief Set sfBytecode (SoeOptional)
+     * @brief Set sfDestinationTag (SoeOptional)
      * @return Reference to this builder for method chaining.
      */
     EscrowCreateBuilder&
-    setBytecode(std::decay_t<typename SF_VL::type::value_type> const& value)
+    setDestinationTag(std::decay_t<typename SF_UINT32::type::value_type> const& value)
     {
-        object_[sfBytecode] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfData (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowCreateBuilder&
-    setData(std::decay_t<typename SF_VL::type::value_type> const& value)
-    {
-        object_[sfData] = value;
+        object_[sfDestinationTag] = value;
         return *this;
     }
 

include/xrpl/protocol_autogen/transactions/EscrowFinish.h

@@ -146,32 +146,6 @@ public:
     {
         return this->tx_->isFieldPresent(sfCredentialIDs);
     }
-
-    /**
-     * @brief Get sfGas (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGas() const
-    {
-        if (hasGas())
-        {
-            return this->tx_->at(sfGas);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGas is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGas() const
-    {
-        return this->tx_->isFieldPresent(sfGas);
-    }
 };
 
 /**
@@ -275,17 +249,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGas (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    EscrowFinishBuilder&
-    setGas(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGas] = value;
-        return *this;
-    }
-
     /**
      * @brief Build and return the EscrowFinish wrapper.
      * @param publicKey The public key for signing.

include/xrpl/protocol_autogen/transactions/SetFee.h

@@ -254,84 +254,6 @@ public:
     {
         return this->tx_->isFieldPresent(sfReserveIncrementDrops);
     }
-
-    /**
-     * @brief Get sfGasLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasLimit() const
-    {
-        if (hasGasLimit())
-        {
-            return this->tx_->at(sfGasLimit);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasLimit() const
-    {
-        return this->tx_->isFieldPresent(sfGasLimit);
-    }
-
-    /**
-     * @brief Get sfBytecodeSizeLimit (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getBytecodeSizeLimit() const
-    {
-        if (hasBytecodeSizeLimit())
-        {
-            return this->tx_->at(sfBytecodeSizeLimit);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfBytecodeSizeLimit is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasBytecodeSizeLimit() const
-    {
-        return this->tx_->isFieldPresent(sfBytecodeSizeLimit);
-    }
-
-    /**
-     * @brief Get sfGasPrice (SoeOptional)
-     * @return The field value, or std::nullopt if not present.
-     */
-    [[nodiscard]]
-    protocol_autogen::Optional<SF_UINT32::type::value_type>
-    getGasPrice() const
-    {
-        if (hasGasPrice())
-        {
-            return this->tx_->at(sfGasPrice);
-        }
-        return std::nullopt;
-    }
-
-    /**
-     * @brief Check if sfGasPrice is present.
-     * @return True if the field is present, false otherwise.
-     */
-    [[nodiscard]]
-    bool
-    hasGasPrice() const
-    {
-        return this->tx_->isFieldPresent(sfGasPrice);
-    }
 };
 
 /**
@@ -464,39 +386,6 @@ public:
         return *this;
     }
 
-    /**
-     * @brief Set sfGasLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setGasLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfBytecodeSizeLimit (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setBytecodeSizeLimit(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfBytecodeSizeLimit] = value;
-        return *this;
-    }
-
-    /**
-     * @brief Set sfGasPrice (SoeOptional)
-     * @return Reference to this builder for method chaining.
-     */
-    SetFeeBuilder&
-    setGasPrice(std::decay_t<typename SF_UINT32::type::value_type> const& value)
-    {
-        object_[sfGasPrice] = value;
-        return *this;
-    }
-
     /**
      * @brief Build and return the SetFee wrapper.
      * @param publicKey The public key for signing.

include/xrpl/server/InfoSub.h

@@ -270,11 +270,6 @@ public:
         virtual bool
         unsubConsensus(std::uint64_t uListener) = 0;
 
-        virtual bool
-        subContractEvent(ref ispListener) = 0;
-        virtual bool
-        unsubContractEvent(std::uint64_t uListener) = 0;
-
         // VFALCO TODO Remove
         //             This was added for one particular partner, it
         //             "pushes" subscription data to a particular URL.

include/xrpl/server/NetworkOPs.h

@@ -259,9 +259,6 @@ public:
     virtual void
     pubValidation(std::shared_ptr<STValidation> const& val) = 0;
 
-    virtual void
-    pubContractEvent(std::string const& name, STJson const& event) = 0;
-
     virtual void
     stateAccounting(json::Value& obj) = 0;
 

include/xrpl/tx/ApplyContext.h

@@ -7,7 +7,6 @@
 #include <xrpl/ledger/ApplyView.h>
 #include <xrpl/ledger/ApplyViewImpl.h>
 #include <xrpl/ledger/OpenView.h>
-#include <xrpl/ledger/OpenViewSandbox.h>
 #include <xrpl/ledger/RawView.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STTx.h>
@@ -16,10 +15,8 @@
 #include <xrpl/protocol/XRPAmount.h>
 
 #include <cstddef>
-#include <cstdint>
 #include <functional>
 #include <optional>
-#include <queue>
 #include <utility>
 
 namespace xrpl {
@@ -63,12 +60,6 @@ public:
     XRPAmount const baseFee;
     beast::Journal const journal;
 
-    OpenView&
-    openView()
-    {
-        return base_.view();
-    }
-
     ApplyView&
     view()
     {
@@ -104,51 +95,12 @@ public:
         view_->deliver(amount);
     }
 
-    /**
-     * Sets the gas used in the metadata
-     */
-    void
-    setGasUsed(std::uint32_t const gasUsed)
-    {
-        gasUsed_ = gasUsed;
-    }
-
-    /**
-     * Sets the gas used in the metadata
-     */
-    void
-    setVMReturnCode(std::int32_t const vmReturnCode)
-    {
-        vmReturnCode_ = vmReturnCode;
-    }
-
-    /**
-     * Sets the transactions emitted by this transaction
-     */
-    void
-    setEmittedTxns(std::queue<std::shared_ptr<STTx const>> const emittedTxns)
-    {
-        emittedTxns_ = emittedTxns;
-    }
-
-    std::queue<std::shared_ptr<STTx const>>
-    getEmittedTxns()
-    {
-        return emittedTxns_;
-    }
-
     /**
      * Discard changes and start fresh.
      */
     void
     discard();
 
-    /**
-     * Finalize changes.
-     */
-    void
-    finalize();
-
     /**
      * Apply the transaction result to the base.
      */
@@ -205,15 +157,12 @@ private:
     TER
     checkInvariantsHelper(TER const result, XRPAmount const fee, std::index_sequence<Is...>);
 
-    OpenViewSandbox base_;
+    OpenView& base_;
     ApplyFlags flags_;
     std::optional<ApplyViewImpl> view_;
 
     // The ID of the batch transaction we are executing under, if set.
     std::optional<uint256 const> parentBatchId_;
-    std::optional<std::uint32_t> gasUsed_;
-    std::optional<std::int32_t> vmReturnCode_;
-    std::queue<std::shared_ptr<STTx const>> emittedTxns_;
 };
 
 }  // namespace xrpl

include/xrpl/tx/apply.h

@@ -13,8 +13,6 @@
 
 namespace xrpl {
 
-class Application;
-
 class HashRouter;
 class ServiceRegistry;
 
@@ -118,22 +116,6 @@ apply(
     ApplyFlags flags,
     beast::Journal journal);
 
-/**
- * Apply a transaction that is part of a batch.
- *
- * @param parentBatchId The ID of the enclosing `Batch` transaction.
- *
- * @see apply
- */
-ApplyResult
-apply(
-    ServiceRegistry& registry,
-    OpenView& view,
-    uint256 const& parentBatchId,
-    STTx const& tx,
-    ApplyFlags flags,
-    beast::Journal j);
-
 /**
  * Enum class for return value from `applyTransaction`
  *

include/xrpl/tx/invariants/InvariantCheck.h

@@ -198,7 +198,7 @@ public:
 
 /**
  * @brief Invariant: An account XRP balance must be in XRP and take a value
- *                   between 0 and kInitialXrp drops, inclusive.
+ *                   between 0 and INITIAL_XRP drops, inclusive.
  *
  * We iterate all account roots modified by the transaction and ensure that
  * their XRP balances are reasonable.
@@ -290,7 +290,7 @@ public:
 
 /**
  * @brief Invariant: an escrow entry must take a value between 0 and
- *                   kInitialXrp drops exclusive.
+ *                   INITIAL_XRP drops exclusive.
  */
 class NoZeroEscrow
 {

include/xrpl/tx/transactors/DeleteUtils.h

@@ -1,42 +0,0 @@
-#pragma once
-
-#include <xrpl/basics/Log.h>
-#include <xrpl/basics/base_uint.h>
-#include <xrpl/beast/utility/Journal.h>
-#include <xrpl/core/ServiceRegistry.h>
-#include <xrpl/ledger/ApplyView.h>
-#include <xrpl/ledger/ReadView.h>
-#include <xrpl/protocol/TER.h>
-#include <xrpl/tx/ApplyContext.h>
-#include <xrpl/tx/Transactor.h>
-
-namespace xrpl {
-
-// Define a function pointer type that can be used to delete ledger node types.
-using DeleterFuncPtr = TER (*)(
-    ServiceRegistry& registry,
-    ApplyView& view,
-    AccountID const& account,
-    uint256 const& delIndex,
-    std::shared_ptr<SLE> const& sleDel,
-    beast::Journal j);
-
-DeleterFuncPtr
-nonObligationDeleter(LedgerEntryType t);
-
-TER
-deletePreclaim(
-    PreclaimContext const& ctx,
-    std::uint32_t seqDelta,
-    AccountID const account,
-    AccountID const dest,
-    bool isPseudoAccount = false);
-
-TER
-deleteDoApply(
-    ApplyContext& applyCtx,
-    STAmount const& accountBalance,
-    AccountID const& account,
-    AccountID const& dest);
-
-}  // namespace xrpl

include/xrpl/tx/transactors/contract/ContractCall.h

@@ -1,40 +0,0 @@
-#pragma once
-
-#include <xrpl/tx/Transactor.h>
-
-namespace xrpl {
-
-class ContractCall : public Transactor
-{
-public:
-    static constexpr auto kConsequencesFactory = ConsequencesFactoryType::Normal;
-
-    explicit ContractCall(ApplyContext& ctx) : Transactor(ctx)
-    {
-    }
-
-    static XRPAmount
-    calculateBaseFee(ReadView const& view, STTx const& tx);
-
-    static NotTEC
-    preflight(PreflightContext const& ctx);
-
-    static TER
-    preclaim(PreclaimContext const& ctx);
-
-    TER
-    doApply() override;
-
-    void
-    visitInvariantEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after) override;
-
-    [[nodiscard]] bool
-    finalizeInvariants(
-        STTx const& tx,
-        TER result,
-        XRPAmount fee,
-        ReadView const& view,
-        beast::Journal const& j) override;
-};
-
-}  // namespace xrpl