v0.3.0

See also the v0.2.0 to v0.3.0 upgrade guide.

BREAKING CHANGES

binary-codec

• EncodeForSigningBatch now creates the BatchV1_1 signing payload from xrpld 3.3.0 and requires the outer account and effective sequence. The optional batchAccount binds the Batch signer. signerAccount binds a nested multisigner account and is valid only when batchAccount is also present. The obsolete Batch signing payload is no longer supported. Added ErrBatchAccountFieldNotFound, ErrBatchSequenceFieldNotFound, and ErrBatchSignerAccountWithoutBatchAccount for these requirements.
• EncodeQuality now normalizes nonzero values to a 16-digit mantissa and accepts only normalized exponents from -96 through 80. This rejects some extreme values that v0.2.0 accepted, such as 1e-85.
• Removed the unused ErrBatchTxIDNotString sentinel. Invalid transaction ID collection types continue to return ErrBatchTxIDsNotArray.
• Renamed the UInt384 and UInt512 protocol type definitions to Hash384 and Hash512, and removed the tecHOOK_REJECTED and tecNO_DELEGATE_PERMISSION transaction result mappings.
• Removed types.MaxDrops. Use currency.MaxNativeDrops for the maximum native XRP amount in drops.

dependencies

• Raised the minimum Go version from 1.24.3 to 1.25.12 to include upstream standard-library security fixes.

keypairs

• DeriveClassicAddress now accepts only Ed25519 and compressed secp256k1 public keys. Uncompressed secp256k1 and other unsupported public-key encodings return ErrInvalidPublicKeyFormat.

pkg/crypto

• SECP256K1CryptoAlgorithm.Sign now returns ErrInvalidPrivateKey directly for malformed hexadecimal private keys instead of wrapping the hexadecimal decode error. Ed25519 signing continues to preserve its wrapped decode error.

xrpl/hash

• SignTx and SignTxBlob now reject partial, empty, malformed, or mixed single-sign/multisign structures. Multisigned transactions require an explicit empty top-level SigningPubKey. Inner Batch transactions remain hashable only in their canonical unsigned shape with an explicit empty SigningPubKey and no TxnSignature or Signers. Consensus-generated EnableAmendment, SetFee, and UNLModify pseudo-transactions remain hashable without account signatures. Deprecated ErrMissingSignature is now an alias of ErrNonSignedTransaction, so errors.Is matches either name.

xrpl/common

• Changed DefaultFeeCushion from float32 to float64 and DefaultMaxFeeXRP from float32 to a decimal string.

xrpl/currency

• Replaced the deprecated float64 constant DropsPerXrp with the exact untyped constant DropsPerXRP. This is a source-breaking rename, use DropsPerXRP or the native amount conversion helpers.

xrpl/ledger-entry-types

• Changed MPT ledger amount fields from uint64 to quoted base-10 strings. Changed MPToken.OwnerNode and MPTokenIssuance.OwnerNode from uint64 to hexadecimal strings. MPTokenIssuance JSON now omits absent AssetScale, TransferFee, and MPTokenMetadata fields.
• Changed Oracle.OwnerNode and Escrow.IssuerNode from uint64 to hexadecimal strings. Changed PriceData.AssetPrice from uint64 to *uint64, use ledger.AssetPrice to set a value. PriceData now decodes rippled hexadecimal price strings, preserves absent and explicit zero prices, and accepts the XLS-47 Scale range through 20. PriceData.Flatten omits Scale when AssetPrice is absent, while PriceData.Validate rejects a nonzero Scale without a price. Added the missing Oracle.LedgerEntryType and Oracle.Flags fields.
• Replaced the v0.2.0 MPTokenIssuance.MutableFlags model and LsmfMPT* constants with the rippled 3.3.0 ImmutableFlags model and LsifMPT* constants. Set bits now identify capabilities and fields that can no longer change.

xrpl/queries

• EntryRequest.Validate now requires exactly one top-level selector instead of accepting requests with no selector or multiple selectors. EntryRequest.Index now omits an empty value from JSON.

xrpl/queries/server

• Changed types.Info.NetworkID from uint to *uint32, so callers must check for nil before dereferencing the server-reported network ID. Current self-hosted rippled nodes can omit server_info.network_id: rippled sends it only when a network ID is configured, and the example configuration stanza is disabled by default. This is not only an old-server case. Clients can use rpc.WithNetworkIdentity or websocket.ClientConfig.WithNetworkIdentity with trusted deployment values.
• Changed ClosedLedger.BaseFeeXRP from float32 to *float64 so fee calculation starts with binary64 precision and callers can distinguish a missing or null value from an explicit zero.
• Changed the normalized types.Info load factor fields from uint to float64 so fractional server_info values are accepted. A missing load_factor now uses the protocol default of 1 instead of 0.
• Renamed types.Info.LoadFactorFeeEscelation to LoadFactorFeeEscalation and corrected its JSON tag to load_factor_fee_escalation.
• Changed types.ClosedLedgerState.BaseFee and ReserveBase from float32 to uint64, and ReserveInc from float32 to *uint64, because server_state reports these values as integer drops. The pointer distinguishes a missing or null owner reserve from an explicit zero.
• Changed types.LedgerState.BaseFee and ReserveBase from uint to uint64, and ReserveInc from uint to *uint64, so drop values are architecture-independent and callers can distinguish a missing or null owner reserve from an explicit zero.

xrpl/queries/clio

• Changed LedgerInfo.BaseFeeXRP and LedgerInfo.ReserveIncXRP from float32 values to *float64 pointers so Clio responses preserve missing or null fee data separately from explicit zero.

xrpl/rpc

• Changed WithFeeCushion from float32 to float64 and WithMaxFeeXRP from float32 to a decimal string so fee configuration preserves binary64 inputs and exact decimal caps.
• Replaced the public client NetworkID field with the mutex-guarded NetworkIdentity() snapshot accessor, which returns (*uint32, string) for the network ID and build version. A nil network ID means discovery has not completed. An omitted server_info.network_id resolves to rippled's default network ID 0. Use WithNetworkIdentity(networkID, buildVersion) with a non-empty build version to bypass discovery with trusted deployment values. An empty build version leaves the identity incomplete, so the client performs discovery.
• Replaced the exported ErrMismatchedTag struct type with an error sentinel of the same name. Replace struct literals and errors.As checks with errors.Is(err, rpc.ErrMismatchedTag).
• Submit preflight now requires a complete single-sign or multisign structure, including an explicit empty top-level SigningPubKey for multisigned transactions. Partial signing fields now return ErrInvalidSignedTransaction. SubmitMultisigned returns ErrTransactionNotMultisigned for another signing form, ErrSignerDataIsEmpty remains as a deprecated compatibility alias.
• DeliverMax normalization is Payment-only. Other transaction types do not rewrite this field.
• Removed ErrTransactionNotFound. Reliable submission now treats exact txnNotFound responses as a pending state until validation, expiry, finality transport failure, or context cancellation.

xrpl/testutil

• Added NetworkIdentity, GetServerDefinitions, and Simulate to the integration Client interface. External implementations and generated mocks of this test interface must implement these methods.
• NewRunner now replaces zero WalletCount and MaxRetries values with their defaults and modifies those fields in the supplied RunnerConfig. WithWallets(0) and WithMaxRetries(0) no longer preserve explicit zero values.

xrpl/transaction

• Replaced the v0.2.0 Dynamic MPT MutableFlags fields with rippled 3.3.0 ImmutableFlags fields on MPTokenIssuanceCreate and MPTokenIssuanceSet. Use types.ImmutableFlags and the TifMPT* constants and setters to make issuance capabilities or fields permanently immutable.
• Moved MPTokenIssuanceSet capability enablement into transaction Flags. Use TfMPTSetCanLock (0x04), TfMPTSetRequireAuth (0x08), TfMPTSetCanEscrow (0x10), TfMPTSetCanTrade (0x20), TfMPTSetCanTransfer (0x40), TfMPTSetCanClawback (0x80), and TfMPTSetCanHoldConfidentialBalance (0x100). Validate accepts universal transaction flags and rejects unsupported bits.
• Removed the v0.2.0 MutableFlags constants, set and clear methods, helper, and validation errors. The rippled 3.3.0 model permits capability flags with metadata, transfer-fee, and immutability changes, but not with lock or unlock operations. A Holder-only transaction is rejected as empty, it must include a lock or unlock flag.
• Added types.MPTAmount for quoted base-10 MPT values and changed MPTokenIssuanceCreate.MaximumAmount from *types.XRPCurrencyAmount to *types.MPTAmount. When present, MaximumAmount must be in the range 1..2^63-1. types.MaxMPTAmount exposes the upper bound, and types.ErrInvalidMPTAmount reports invalid quoted values.

xrpl/wallet

• types.BatchSignable now includes the outer Account, effective Sequence, optional BatchAccount, and optional SignerAccount required by BatchV1_1. FromBatchTransaction and FromFlatBatchTransaction require a non-empty outer account and exactly one nonzero Sequence or TicketSequence. Added ErrAccountFieldIsNotAString, ErrSequenceFieldIsNotAnUint32, ErrTicketSequenceFieldIsNotAnUint32, ErrBatchSequenceAndTicket, and ErrBatchSequenceNotSet for invalid constructor input. Equals now also compares the outer account and effective sequence. Old unkeyed literals no longer compile. Old keyed literals that omit Account or Sequence compile but cannot create a valid signing payload. Existing Batch signature fragments must be recreated.

xrpl/websocket

• Changed ClientConfig.WithFeeCushion and DefaultFeeCushion from float32 to float64, changed ClientConfig.WithMaxFeeXRP and DefaultMaxFeeXRP from float32 to decimal strings. Fee configuration now preserves binary64 inputs and exact decimal caps.
• Replaced the public client NetworkID field with the mutex-guarded NetworkIdentity() snapshot accessor, which returns (*uint32, string) for the network ID and build version. A nil network ID means discovery has not completed. An omitted server_info.network_id resolves to rippled's default network ID 0. Use ClientConfig.WithNetworkIdentity(networkID, buildVersion) with a non-empty build version to bypass discovery with trusted deployment values. An empty build version leaves the identity incomplete, so the client performs discovery.
• Changed Client.Connect to request server_info before it starts the background reader. A request, response, or identity failure now fails Connect and closes the new connection. An omitted network_id resolves to rippled's default network ID 0.
• Client.Connect no longer replaces an active or in-progress connection and now returns ErrAlreadyConnected.
• Added the exported Err field to ErrMaxReconnectionAttemptsReached. Unkeyed literals such as ErrMaxReconnectionAttemptsReached{3} no longer compile. Use keyed literals such as ErrMaxReconnectionAttemptsReached{Attempts: 3}.
• Submit preflight now requires a complete single-sign or multisign structure, including an explicit empty top-level SigningPubKey for multisigned transactions. Partial signing fields now return ErrInvalidSignedTransaction. SubmitMultisigned returns ErrTransactionNotMultisigned for another signing form, ErrSignerDataIsEmpty remains as a deprecated compatibility alias.
• DeliverMax normalization is Payment-only. Other transaction types do not rewrite this field.
• Removed ErrTransactionNotFound. Reliable submission now treats exact txnNotFound responses as a pending state until validation, expiry, finality transport failure, or context cancellation.

Added

binary-codec

• Added serialization definitions for ReferenceHolding, TakerPaysMPT, and TakerGetsMPT.
• Added types.RawFieldValueOverrides and STObject.FromJSONWithRawFieldValueOverrides for controlled raw field-value serialization.

documentation

• Added a v0.2.0-to-v0.3.0 upgrade guide and versioned v0.3.x changelog pages, and expanded package documentation for currency, hashing, ledger entries, queries, transactions, RPC, and WebSocket usage.

development

• Added an xrpld localnet integration runner and CI workflow, with configurable image, configuration, and container settings.

keypairs

• Added ErrInvalidPrivateKeyFormat and ErrInvalidPublicKeyFormat, which wrap ErrInvalidCryptoImplementation for backward-compatible errors.Is checks without exposing key material.

pkg/typecheck

• Added ToString to convert plain and named string values through one shared helper.

xrpl/currency

• Exported the typed MaxNativeDrops constant for the maximum native XRP amount in drops.
• Added the exact, immutable Drops arithmetic type for non-negative drop quantities, with drops and XRP constructors, fraction-preserving arithmetic, comparison, rounding, and formatting methods. Constructors accept valid non-canonical decimal inputs up to 1024 bytes but do not enforce MaxNativeDrops; callers must validate the protocol limit before encoding or submission. Added ErrInvalidNativeAmount, ErrNegativeNativeAmount, ErrInvalidDecimalMultiplier, ErrFractionalDrops, and ErrDropsDivisionByZero for validation failures.

xrpl/flag

• Added ContainsOnly to check that a flag value contains no bits outside an allowed mask.

xrpl/ledger-entry-types

• Added MPTokenIssuance.ReferenceHolding, DirectoryNode.TakerPaysMPT, and DirectoryNode.TakerGetsMPT, plus the LsfMPTAMM flag and SetLsfMPTAMM setter for AMM-owned MPT holdings.
• Added LsfMPTCanHoldConfidentialBalance and SetLsfMPTCanHoldConfidentialBalance for the rippled 3.3.0 MPT confidential-balance capability.

xrpl/queries

• Added query field coverage for account lines (ignore_default request and limit response), AMM info (account, frozen flags, auction time_interval), NFT offer pagination (limit/marker), vault current-ledger metadata, and v1 account NFT ledger metadata, with default and v1 JSON serialization fixtures including the AMM expired-slot interval sentinel.
• Expanded typed ledger_entry selector support with Clio deleted-entry metadata and distinct JSON (node) and binary (node_binary) responses across RPC and WebSocket transports. Responses must contain exactly one non-empty payload.
• Added typed server_definitions support for validated full, legacy, and hash-only protocol definitions. Validation rejects null or incomplete core sections, accepts the five enhanced sections independently, and requires hash-only responses to match the request hash. Response values can be marshaled before they are complete, while decoding and explicit validation enforce wire requirements. RPC and WebSocket integration tests cover full and hash-only response forms.
• Added XLS-69 simulate dry runs to the RPC and WebSocket clients, with JSON and binary responses and validated JSON or opaque hexadecimal blob requests. JSON requests support server-autofilled NetworkID values and validate supplied NetworkID values against the client target network, with RPC identity discovery when needed. They permit non-empty SigningPubKey values and unsigned Signers or BatchSigners entries. They reject non-empty TxnSignature values in the transaction or supported signer entries. Blob requests check hexadecimal syntax and delegate transaction, signature, and NetworkID validation to the server. Response values can be marshaled before they are complete, while decoding and request-mode validation remain strict. Integration tests cover JSON and binary simulations.
• Added ErrInvalidEntryRequest, ErrInvalidEntrySelector, ErrInvalidBridgeSelector, and ErrInvalidEntryResponse for typed ledger_entry validation failures.

xrpl/queries/amm

• Added ledger_hash and ledger_index fields to InfoRequest, and ledger_current_index to InfoResponse for open-ledger responses.

xrpl/queries/subscription/types

• Added BookChangesStreamType for the bookChanges subscription notification discriminator.

xrpl/transaction

• Added centralized transaction type constants and IsPseudoTransactionType classification for EnableAmendment, SetFee, and UNLModify.
• Added ErrBatchRawTransactionsCount for the XLS-56 limit of 2 through 8 Batch inner transactions. RPC and WebSocket expose the shared signed-Batch preflight sentinel with the same name.
• Added ErrMPTIssuanceCreateInvalidImmutableFlags and ErrMPTIssuanceSetInvalidImmutableFlags for unsupported Dynamic MPT immutability bits, ErrMPTIssuanceSetInvalidFlags for unsupported MPTokenIssuanceSet Flags bits, and transfer-fee conflict errors for confidential MPT balances.
• Added TfMPTCanHoldConfidentialBalance and its create setter, plus immutability support for confidential balances, metadata, and transfer fees.
• Added MPT amount and Holder support to Clawback, including JSON, binary encoding, signing, and validation. Validation rejects invalid issuer and holder combinations, invalid or zero amounts, and XRP amounts.

xrpl/queries/server

• Added types.Info.RippledVersion for Clio server_info responses and types.Info.ServerVersion to prefer build_version with rippled_version as the fallback.
• Added ErrInvalidDefinitionsHash, ErrInvalidDefinitionsResponse, and ErrInvalidDefinitionField for server_definitions validation failures.

xrpl/queries/transactions

• Added ErrInvalidSimulateRequest, ErrInvalidSimulateTxJSON, ErrInvalidSimulateTxBlob, ErrSignedSimulateTransaction, ErrInvalidSimulateNetworkID, ErrMismatchedSimulateNetworkID, and ErrInvalidSimulateResponse for simulate validation failures.

xrpl/rpc

• Added WithNetworkIdentity for trusted network identity configuration.
• Added ErrAddressFieldIsNotAString, ErrTagFieldIsNotAUint32, ErrInvalidAddress, and ErrAccountIDTagNotAllowed for address autofill errors, and ErrNetworkIDFieldUnexpected, ErrInvalidBuildVersion, ErrNetworkIDOverrideMismatch, ErrNetworkIDUnavailable, and ErrBuildVersionUnavailable for network identity errors.
• Added ErrNilTransaction for nil autofill or submission inputs and ErrLastLedgerSequenceFieldMustBeAbsent for invalid Batch inner transactions.
• Added X-address autofill for Account, Destination, Authorize, Unauthorize, Owner, RegularKey, Delegate, NFTokenMinter, Subject, Issuer, and Holder fields in outer and Batch inner transactions. Embedded Account and Destination tags, including tag 0, populate the matching tag field. Conflicting explicit tags return ErrMismatchedTag, and tagged X-addresses in fields without a tag counterpart return ErrAccountIDTagNotAllowed.
• Added SubmitTxAndWaitContext and SubmitTxBlobAndWaitContext with caller cancellation across transaction preparation, submission, and finality monitoring, plus reliable-submission error sentinels for malformed preliminary results, ledger expiry, repeated monitoring transport failure, and invalid polling intervals.
• Added ErrInvalidMaxRetries and ErrInvalidLastLedgerSequence for non-positive retry limits and zero ledger boundaries.
• Added ErrInvalidFeeValue and ErrFeeHasTooManyDecimals for fee validation.
• Added ErrResponseErrorFieldIsNotAString for malformed RPC error responses.
• Added ErrInsecureAuthorization and ErrAuthorizationRequestFailed for secure, redaction-safe authorized transport failures.

xrpl/transaction/integration

• Added RPC and WebSocket live-ledger coverage for X-address autofill and discovered NetworkID policy.

xrpl/transaction/types

• Added shared TfFullyCanonicalSig and TfUniversal transaction flag definitions, and moved the existing TfInnerBatchTxn definition alongside them.
• Added MaxMPTAmount and ErrInvalidMPTAmount for the quoted base-10 MPT amount range.

xrpl/websocket

• Added ClientConfig.WithNetworkIdentity for trusted network identity configuration and NetworkIdentity for concurrency-safe identity access.
• Added ErrAddressFieldIsNotAString, ErrTagFieldIsNotAUint32, ErrInvalidAddress, ErrMismatchedTag, and ErrAccountIDTagNotAllowed for address autofill errors, and ErrNetworkIDFieldUnexpected, ErrInvalidBuildVersion, ErrNetworkIDOverrideMismatch, ErrNetworkIDUnavailable, and ErrBuildVersionUnavailable for network identity errors.
• Added ErrNilTransaction for nil autofill or submission inputs and ErrLastLedgerSequenceFieldMustBeAbsent for invalid Batch inner transactions.
• Added X-address autofill for Account, Destination, Authorize, Unauthorize, Owner, RegularKey, Delegate, NFTokenMinter, Subject, Issuer, and Holder fields in outer and Batch inner transactions. Embedded Account and Destination tags, including tag 0, populate the matching tag field. Conflicting explicit tags return ErrMismatchedTag, and tagged X-addresses in fields without a tag counterpart return ErrAccountIDTagNotAllowed.
• Added SubmitTxAndWaitContext and SubmitTxBlobAndWaitContext with caller cancellation across transaction preparation, submission, and finality monitoring, plus reliable-submission error sentinels for malformed preliminary results, ledger expiry, repeated monitoring transport failure, and invalid polling intervals.
• Added ErrInvalidMaxRetries and ErrInvalidLastLedgerSequence for non-positive retry limits and zero ledger boundaries.
• Added ErrInvalidFeeValue and ErrFeeHasTooManyDecimals for fee validation.

Changed

binary-codec

• Replaced the v0.2.0 Dynamic MPT codec definitions with the rippled 3.3.0 ImmutableFlags field and current MPT transaction and ledger flags.
• UInt64 serialization is now field-aware. MPT amount fields (MaximumAmount, OutstandingAmount, MPTAmount, and LockedAmount) use quoted base-10 strings, while other UInt64 fields use hexadecimal strings.
• Issued-currency amounts now accept tagless mainnet and testnet X-address issuers and encode the underlying AccountID. Issuers with embedded tags are rejected.
• Expanded the embedded protocol definitions with account-set, ledger-entry, and transaction flag maps, ledger-entry and transaction format maps, and updated protocol type and transaction result mappings.

dependencies

• Upgraded golang.org/x/crypto to v0.54.0 to include upstream SSH security fixes.

documentation

• Refreshed the README and contribution guide, upgraded the documentation toolchain to Docusaurus 3.10.2, and updated or pinned patched transitive documentation dependencies.

development

• Standard test and coverage targets now include xrpl/testutil/integration unit tests. Integration test targets now cover nested integration packages, and the localnet target runs them serially.

xrpl/queries/amm

• InfoRequest.Validate now rejects amm_info requests that combine amm_account with the asset and asset2 lookup form.

xrpl/rpc

• Autofill now omits and rejects an explicit NetworkID for network IDs from 0 through 1024 and for network IDs above 1024 on rippled versions before 1.11.0. It adds and requires the exact NetworkID for IDs above 1024 on rippled 1.11.0 or later. The same rules apply to outer and Batch inner transactions.
• The client now discovers and caches network identity with server_info before an identity-dependent operation. A discovery failure fails the operation without mutation and is retried by a later operation.
• Client-side submission helpers now discover and validate network identity before they sign an unsigned transaction, including when autofill is disabled. Use wallet.Sign for fully offline signing, or WithNetworkIdentity when trusted deployment configuration supplies the identity.
• Network identity discovery now uses Clio rippled_version only when build_version is absent.
• WithMaxRetries now limits consecutive incomplete finality rounds caused by query or transport failures. A complete round resets the count, and successful pending rounds do not consume the limit.
• Authorized RPC requests now require a parsed HTTPS endpoint for every HTTP client, recognize header names case-insensitively and URL userinfo, and redact credential material from returned diagnostics. Standard *http.Client requests also reject authenticated plaintext redirects, while custom HTTPClient implementations remain supported on HTTPS and control their own redirects.

xrpl/transaction

• MPTokenIssuanceCreate and MPTokenIssuanceSet validation now rejects unsupported ImmutableFlags bits and an explicitly zero mask. MPTokenIssuanceSet rejects holder-only no-op transactions, so Holder must be paired with a lock or unlock flag. MPTokenIssuanceSet, MPTokenAuthorize, and MPTokenIssuanceDestroy also require their MPTokenIssuanceID to be an exact 192-bit hexadecimal value.
• DelegateSet now uses a present empty Permissions list to delete a Delegate object. Vault and Loan transaction types are rejected as non-delegable according to XLS-75.
• Inner Batch transaction flattening now preserves the wire-required empty SigningPubKey, and raw inner-transaction validation requires that explicit empty field. Explicit null Batch inner fields now fail where the wire requires absent or empty values.
• Batch.Validate now requires 2 through 8 inner transactions. ErrBatchRawTransactionsEmpty remains a compatibility alias that matches the new count error with errors.Is.

xrpl/websocket

• Autofill now omits and rejects an explicit NetworkID for network IDs from 0 through 1024 and for network IDs above 1024 on rippled versions before 1.11.0. It adds and requires the exact NetworkID for IDs above 1024 on rippled 1.11.0 or later. The same rules apply to outer and Batch inner transactions.
• Identity discovery or validation failures now make Connect fail closed. Autofill and unsigned signing fail when identity data required by the target-network policy is unavailable. An omitted server_info.network_id resolves to rippled's default network ID 0.
• Client-side signing now applies network identity policy when autofill is disabled.
• Network identity discovery now uses Clio rippled_version only when build_version is absent. Explicit and automatic connections rediscover untrusted server identity and reject a discovered network-ID change before the socket is published.
• WithMaxRetries now limits consecutive incomplete finality rounds caused by query or transport failures. A complete round resets the count, and successful pending rounds do not consume the limit.
• Documented the stream-handler concurrency, per-stream ordering, and unbuffered backpressure contract.

Fixed

address-codec

• Base58Check checksum and family-seed-prefix comparisons now run in constant time (crypto/subtle) to avoid leaking timing information while decoding addresses and seeds.

binary-codec

• UInt16 transaction and ledger entry type encoding now accepts named string values, including transaction.TxType values.
• Encoding a field with an unsupported serialized type now returns a descriptive error instead of panicking.
• BinaryParser.ReadBytes now returns ErrParserOutOfBound for negative lengths instead of silently returning no data.
• DecodeQuality now returns ErrInvalidQuality for malformed hex input or input that decodes to fewer than 8 bytes, instead of returning raw hex errors or panicking on short input.
• DecodeQuality now positions the decimal point correctly for quality values below 1.
• EncodeQuality now wraps invalid decimal parsing errors with ErrInvalidQuality, so callers can match the stable sentinel and inspect the underlying parsing error.
• EncodeQuality now validates the complete numeric syntax before zero detection. Malformed inputs such as . or 0..0 no longer encode as zero and return ErrInvalidQuality, while valid zero forms such as -0 and 0e5 now encode as the canonical zero quality.
• Encoded the empty Account of UNLModify pseudo-transactions through a transaction-boundary raw field-value override, keeping generic STObject encoding transaction-agnostic and rippled-compatible. UNLModify now accepts an absent Account, an empty string, or the canonical XRPL zero account, including equivalent named strings, other supplied values return ErrInvalidUNLModifyAccount without changing caller data.
• Decode now returns an error for malformed Vector256 fields whose byte length is not a multiple of 32 instead of panicking.

xrpl/currency

• XrpToDrops and DropsToXrp now accept valid non-canonical decimal inputs up to 1024 bytes, including long zero-padded values, while retaining bounded exponent, input-size, and native-amount range validation.

xrpl/internal/client

• Preserved recovered binary codec error identity during transaction blob decoding so callers can use errors.Is and errors.As, while converting non-error panic values to ordinary errors.
• Centralized Batch inner traversal and validation for RPC and WebSocket autofill, and removed the duplicate NetworkID policy application.
• Shared DeliverMax conflict, signed-Batch count, non-multisigned transaction, Batch structure, and NetworkID validation error identities across both public clients. errors.Is can match corresponding shared sentinels from either client package.
• Normalized the Batch transaction count error text to the Go error-string convention while preserving sentinel identity.

xrpl/hash

• SignTx and SignTxBlob now calculate transaction IDs for EnableAmendment, SetFee, and UNLModify pseudo-transactions with an absent or empty SigningPubKey and no TxnSignature or Signers. Named string TransactionType map values are supported without changing caller data.

keypairs

• Key algorithm detection now validates the requested key type, complete hexadecimal encoding, prefix, and exact length before selecting Ed25519 or secp256k1. Signing supports raw and 00-prefixed secp256k1 private keys, verification and classic-address derivation support Ed25519 and compressed secp256k1 public keys.
• DeriveClassicAddress now rejects unsupported public-key formats with ErrInvalidPublicKeyFormat instead of hashing any decodable 33-byte value.
• secp256k1 signing now rejects zero and out-of-range private scalars instead of reducing them modulo the curve order.
• secp256k1 verification now rejects malleable high-S signatures that do not meet XRPL's fully canonical signature requirement.
• DeriveClassicAddress now verifies that compressed secp256k1 public keys encode valid curve points before address hashing.

xrpl/transaction

• OracleSet now omits the default Scale value of zero from flattened price data, as required by the server object template.
• Fixed DelegateSet validation to reject Batch permissions as required by XLS-75.
• Named string TransactionType values now work consistently through FlatTransaction validation, special fee selection, Batch inner processing, submission policy, and binary encoding. Malformed values remain rejected.

xrpl/transaction/types

• Rejected currency amount JSON that combines mpt_issuance_id with issued-currency currency or issuer fields.

xrpl/wallet

• SignMultiBatch and CombineBatchSigners now implement BatchV1_1 signing from xrpld 3.3.0. Batch signatures bind the outer account and sequence or ticket value, support inner Delegate and Counterparty authorizers, bind nested multisigner accounts, and reject fragments with different signed outer fields. CombineBatchSigners sorts fragments by outer Batch signer account and keeps the first fragment for each duplicate account; it does not merge nested Signers arrays. Flat Batch transactions accept Flags, Sequence, and TicketSequence values of any whole-number Go type.

xrpl/rpc

• AccountDelete autofill now runs blocker checks for plain and named string Account values, including values converted from X-addresses.
• Concurrent callers now share one in-flight network identity discovery result, including failures, while later independent operations can retry.
• Rippled prerelease versions with numeric suffixes now compare the suffix numerically.
• Made autofill and unsigned signing fail closed when network identity discovery or validation fails, unless WithNetworkIdentity supplies an explicit trusted identity.
• Rejected nil custom HTTP clients during configuration and request-time revalidation with ErrNilHTTPClient instead of allowing request-time panics.
• Redacted bare authorization credentials and percent-encoded URL passwords from authorized RPC request errors.
• Authorized RPC redirects now reject an HTTPS-to-HTTP downgrade before invoking the caller's CheckRedirect, so a callback never observes Authorization on a plaintext target.
• Account-only amm_info requests now omit empty asset and asset2 selectors from the RPC payload.
• Corrected fee precision and rounding with shared exact rational arithmetic, including fractional base fees and load factors, rippled-compatible integer EscrowFinish fulfillment scaling, final whole-drop half-up rounding, validated-ledger LoanSet signer data, and presence-aware zero base and owner-reserve fees.
• Made submit options nil-safe without enabling autofill by default. Forced fail_hard for AccountDelete. The standard maxFeeXRP cap now applies. Normalized Payment DeliverMax to wire Amount. Prevented autofill and submission failures from changing caller-owned maps.
• AutofillMultisigned now preserves a supplied Fee, when absent, it calculates the fee once with the signer count.
• SubmitTxBlobAndWait now decodes the signed blob once and uses the decoded transaction for preflight and hashing.
• Autofill now normalizes named string address values, such as types.Address, before account checks.
• Rejected tagged X-addresses for fields that cannot represent tags instead of silently discarding the embedded tag.
• Signed Batch blob submission now rejects a malformed inner transaction (non-empty TxnSignature/Signers, or a missing inner-Batch form) even when the outer signature is valid.
• Batch fee calculation now rejects a nested Batch before recursive fee calculation.
• Made reliable-submission outcomes ledger-driven: require a positive LastLedgerSequence, reject non-positive maximum retry values, reject missing preliminary engine results and preliminary tem results, retry exact txnNotFound responses, and return every validated transaction response without an error. Each polling round verifies the latest validated ledger, performs a final transaction lookup, and reports expiry only when that lookup remains inconclusive after the ledger passes LastLedgerSequence. Expiry errors retain the preliminary engine result, and negative polling intervals fail before submission.

xrpl/testutil

• Local integration wallet funding now waits for a validated tesSUCCESS result before it returns, preventing later validated-ledger autofill requests from observing an unfunded account.

xrpl/websocket

• Corrected fee precision and rounding with shared exact rational arithmetic, including fractional base fees and load factors, rippled-compatible integer EscrowFinish fulfillment scaling, final whole-drop half-up rounding, validated-ledger LoanSet signer data, and presence-aware zero base and owner-reserve fees.
• Pending requests now return ErrDisconnected immediately on connection loss or write failure and are never replayed after reconnection. A request timeout covers both its write and response wait. Write deadlines are cleared on all completion paths, and cancellation after a completed write does not invalidate the healthy socket. Stale read failures do not close replacement sockets, and disconnecting an idle client succeeds.
• Reconnection exhaustion now unwraps the last connection or identity failure while preserving errors.As checks for ErrMaxReconnectionAttemptsReached.
• Made connection-time network discovery atomic and leak-free. Reconnecting sockets remain private and application requests remain gated until identity checks finish. Cancellation closes in-progress connection attempts, and failed attempts cannot replace a live connection. After a prior socket is lost or disconnected, a successful manual Connect cancels the old reader lifecycle and fails its pending requests with ErrDisconnected before publishing the new socket.
• AccountDelete autofill now runs blocker checks for plain and named string Account values, including values converted from X-addresses.
• Identity discovery now accepts out-of-order frames, replays buffered stream messages, and clears temporary read deadlines after failed reads. The client timeout now bounds the whole connection handshake, covering the WebSocket dial and identity discovery in a single window, for both Connect and automatic reconnects.
• Made autofill and unsigned signing reject public network identity values until successful discovery, unless WithNetworkIdentity supplies an explicit trusted override.
• Autofill now normalizes named string address values, such as types.Address, before account checks.
• Rejected tagged X-addresses for fields that cannot represent tags instead of silently discarding the embedded tag.
• Signed Batch blob submission now rejects a malformed inner transaction (non-empty TxnSignature/Signers, or a missing inner-Batch form) even when the outer signature is valid.
• Batch fee calculation now rejects a nested Batch before recursive fee calculation.
• Made submit options nil-safe without enabling autofill by default. Forced fail_hard for AccountDelete. The standard maxFeeXRP cap now applies. Normalized Payment DeliverMax to wire Amount. Prevented autofill and submission failures from changing caller-owned maps.
• AutofillMultisigned now preserves a supplied Fee, when absent, it calculates the fee once with the signer count.
• SubmitTxBlobAndWait now decodes the signed blob once and uses the decoded transaction for preflight and hashing.
• Matched RPC reliable-submission outcomes: require a positive LastLedgerSequence, reject non-positive maximum retry values, reject missing preliminary engine results and preliminary tem results, retry exact txnNotFound responses, and return every validated transaction response without an error. Each polling round verifies the latest validated ledger, performs a final transaction lookup, and reports expiry only when that lookup remains inconclusive after the ledger passes LastLedgerSequence. Expiry errors retain the preliminary engine result, and negative polling intervals fail before submission.
• Closed and invalidated WebSocket connections after write or write-deadline failures. The active read loop now attempts reconnection after any read error, not only close errors, within the existing WithMaxReconnects budget.
• Made manual disconnect claim an in-progress reconnect socket before lifecycle cancellation so cancellation-driven invalidation cannot cause a false not-connected error.
• Made reconnect backoff configuration immutable per client to prevent concurrent clients and reconnect tests from racing over shared delay state.
• Preserved per-handler serialization across manual disconnects and later connections by waiting for detached handler runners before starting replacements.
• Client.Request now preserves custom JSON from request types that implement json.Marshaler, including flattened and object-form selectors, while retaining exact JSON number values before transport fields are added.
• Preserved validated, domain, and MPT issuance identifiers in typed bookChanges notifications.
• Dispatched bookChanges notifications to the exported book-changes handler with typed decoding and no duplicate handler delivery across reconnects. Automatic reconnects do not replay subscriptions, so callers must resubscribe.