xrpl-ruby 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb8b3e628ddf6a9d9a7e329e6e8c51e4b0cd4f872eb609e589d78795aa9f4782
-  data.tar.gz: 2f5b18b34cb386901a8ad1a7549f7cca241facce58c0841f36a10a4c200413cc
+  metadata.gz: 1b52d066f91b01da1ccdbbe8229cadc3b40b54d79a1234f0ac96f0f131159a06
+  data.tar.gz: 57fc035044049efff0bae7418e48e6ffee589a2cec5d763b056b07d6c23d0b10
 SHA512:
-  metadata.gz: f066a56166ec0aa81ec3acb34106d504962a6e1cf2cee89eb13103719467f9ded35a34d432d9901c8a81f11b7dedc93311d8ebd184dc21564585163536e18558
-  data.tar.gz: 97397fe795b08eed3c56111b876d5476da705e2577c635f12e6aeee9ebc5ef86106fd44e525dc67c3716c11472b273bd4235764d9df2b7bf8bcc3e0d152078a7
+  metadata.gz: 4fd54f7b3c12b2cdf35ceecf7a226526900e31e866f16ad3b138d86ac98571e8cf501904b478fa5fa3ace4a8f49ae0e7ee160a33ba8fbd7031d0563cb59876eb
+  data.tar.gz: 5e61d8a4da0bf7e517b22ae77d3b5ea2580ae36f2751fba690051482c449d2778fb3be9886167e0160ad45d08cc1639afd9eb9b39fefa074163d712b06f1f64b

data/CHANGELOG.md

@@ -5,6 +5,185 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.9.0] - 2026-11-02
+
+Batch (XLS-56) and permission delegation (XLS-75), both enabled on Mainnet
+since October, are fully supported now:
+- `autofill` prepares and prices a Batch.
+- Accounts sign their part with `Wallet#sign_batch`.
+- `Wallet.combine_batch_signers` merges the parts.
+- Delegated transactions are proven on the Testnet.
+
+All Testnet specs pass on the release commit: a Batch of one account, a swap
+between two accounts, a signer list, tickets, and delegation with and
+without permission.
+
+The codec now also reads UInt Strings the way rippled 3.4.1 does, which is
+the one breaking change. It fixes a serialisation bug that could make a
+multisigned transaction invalid: about one `Signers` entry in 256 lost its
+end marker. Codec fixtures are unchanged: 39/39 transactions and 263/263
+ledger entries, both directions.
+
+### Breaking
+
+- **UInt Strings are read the way rippled reads them.** rippled 3.4.1
+  (`STParsedJSON`) and ripple-binary-codec read these field types like this:
+  - **UInt8, UInt16, UInt32:** a whole decimal number.
+  - **UInt64:** hex of any length, except in the base-10 fields
+    (`MPTAmount`, `MaximumAmount`, `OutstandingAmount`, `LockedAmount`,
+    `ConfidentialOutstandingAmount`), which are decimal.
+  - **Int32, Int64:** a signed decimal number.
+
+  A leading `+` is accepted where rippled accepts it (UInt32, Int32,
+  Int64), not for UInt8, UInt16 or UInt64.
+
+  This codec differed in two places, and both now follow rippled:
+  - A UInt8/16/32 String in its full width was read as hex. `"00000065"`
+    as a `Sequence` was 101 here and is 65 in rippled; `"0000000A"` was 10
+    and now raises.
+  - An unpadded UInt64 String was read as decimal. `"100"` as `IndexNext`
+    was 100 and is `0x100` in rippled; `"36d6"` was 36.
+
+  Names count only for their own field: `TransactionType` and
+  `LedgerEntryType` take type names, `TransactionResult` result codes,
+  `PermissionValue` permission names. Before, any field of the same width
+  took them, so `TicketSequence: "TrustSet"` was ticket 21 and
+  `TransferFee: "Payment"` was 0.
+
+  Integers and the names in their own fields are unchanged, as is everything
+  the codec decodes: it renders UInt8/16/32 as Integers and UInt64 as 16 hex
+  digits, which round-trips. Affected is only code that passes
+  - UInt8/16/32 values as hex Strings,
+  - unpadded UInt64 values meant as decimal, or
+  - a name in a field it does not belong to, such as
+    `TicketSequence: "TrustSet"` or `TransferFee: "Payment"`, which now
+    raises, or
+  - an Int64 as a hex String: `Int64.from("DEAD")` was 57005 and now raises.
+    Int64 also decodes to a decimal String (`"-9"`) instead of 16 hex digits
+    (`"FFFFFFFFFFFFFFF7"`), so it round-trips. rippled 3.4.1 has no Int64
+    field, so this concerns direct use of the type only.
+
+  Where ripple-binary-codec accepts a value,
+  `json_to_binary` now produces the same bytes; it also accepts decimal
+  UInt8/16 Strings, which rippled reads and ripple-binary-codec refuses.
+
+### Added
+
+- **Permission delegation is verified on the Testnet** (XLS-75,
+  PermissionDelegationV1_1 enabled on Mainnet since 2026-10-08). The library
+  needed no change:
+  - `Wallet#sign` signs a transaction whose `Account` is another account.
+  - `autofill` takes the `Sequence` from `Account`.
+  - The codec translates `PermissionValue` names (since 0.8.0).
+
+  `spec/integration/xrpl/delegation_spec.rb` covers the whole flow:
+  - a `DelegateSet`,
+  - then a `Payment` with `Delegate`, signed by the delegate,
+  - checked against rippled 3.4.1: the account pays the amount and the
+    delegate pays the fee,
+  - and a delegate without the permission is refused with
+    `terNO_DELEGATE_PERMISSION`.
+
+  The README has a section on it, including the warning from xrpl.org not to
+  delegate `PaymentBurn` before `fixCleanup3_4_0` is enabled.
+- **Batch signing across accounts.** `Wallet#sign_batch` produces the
+  `BatchSigners` entry for an account with inner transactions in the Batch:
+  the wallet's own account, another account it is the regular key of
+  (`batch_account:`), or one signer of a signer list (`multisign:`). For a
+  delegated inner transaction the `Delegate` signs.
+  `Wallet.combine_batch_signers` merges the signed copies, given as Hashes
+  or hex. It sorts the entries by numeric AccountID, drops the outer
+  account's entry, and merges signatures from one signer list into a single
+  entry. It refuses copies of different Batches and an outer transaction that
+  is already signed.
+  `BinaryCodec.signing_batch_data` builds the payload rippled 3.4.1 verifies:
+  `BCH\0`, the outer account, the sequence value (the `TicketSequence` when
+  `Sequence` is 0), Flags, the inner transaction IDs and the signer accounts.
+  Signatures match the xrpl.js vectors byte for byte, and a swap between two
+  accounts validates on the Testnet. `examples/batch.rb` shows both flows.
+- **`BinaryCodec.transaction_id`** gives the ID of any transaction, signed or
+  unsigned (SHA512Half of `TXN\0` and its serialisation), and
+  `BinaryCodec.inner_transaction_ids` the IDs of a Batch's inner
+  transactions. `Wallet#sign` uses it for its `hash`.
+- **`autofill` prepares a Batch** (XLS-56, BatchV1_1 enabled on Mainnet
+  since 2026-10-09). Every inner transaction gets `tfInnerBatchTxn`, `Fee`
+  `"0"` and an empty `SigningPubKey`; sequences follow `autofillBatchTxn` in
+  xrpl.js: the outer account's inner transactions continue after the outer
+  `Sequence`, every other account starts at its own, a given `Sequence` or
+  `TicketSequence` is kept, and the account's following inner transactions
+  continue after an explicit `Sequence` (xrpl.js hands it out a second time). What the ledger would refuse raises
+  `ArgumentError` before anything is signed: not exactly one mode flag,
+  fewer than two or more than eight inner transactions, an entry that is not
+  a `RawTransaction` wrapper, a nested Batch, an inner signature, fee or key.
+  The rules live in `XRPL::Batch`, which needs no network.
+
+### Fixed
+
+- **A Sequence next to a TicketSequence is refused in a Batch.** On a ticket
+  `Sequence` is 0, and rippled refuses anything else (`temSEQ_AND_TICKET`).
+  `autofill` kept a nonzero one on an inner transaction and counted it, so
+  the account's later inner transactions got sequences that were too high.
+  It now raises `ArgumentError` before handing out any sequence, for the
+  outer transaction as well as the inner ones. Every inner transaction is
+  checked before the first sequence is fetched. A `Sequence` given as a
+  String is read the way the codec encodes it, also in the BatchSigner
+  payload, rather than with `#to_i`; a name or a malformed String raises.
+- **`autofill` gives a transaction on a ticket `Sequence` 0.** With a
+  `TicketSequence` and no `Sequence`, it fetched the account's sequence,
+  which rippled refuses next to a ticket. This affected every transaction
+  type, not only a Batch.
+- **Batch sequences around tickets.** Two cases of `autofill` were wrong
+  for a Batch:
+  - An inner transaction on a ticket got no `Sequence`. The field is
+    required and is 0 on a ticket, and rippled refuses the Batch without it.
+  - An inner `TicketCreate` did not reserve the sequences of the tickets it
+    creates, so the next inner transaction of that account repeated one of
+    them.
+
+  Both now follow rippled: a transaction on a ticket consumes no sequence,
+  and a `TicketCreate` takes one per ticket after its own, or from the
+  current sequence when it is itself on a ticket. Found through the Testnet
+  tests of xrpl-php, which fixed the first case the same day.
+- **A Batch over several accounts was charged too little.** The fee is
+  `(2 + n) × base fee` plus the inner fees (XLS-56 §2.2), with n the
+  signatures in `BatchSigners`; 0.8.0 left n out unless it came in as
+  `signers_count:`. `Fee.calculate` now counts `BatchSigners` itself, a
+  signer-list entry by its nested `Signers`. Because the signatures cover
+  the finished Batch, its fee is set before they exist:
+  `autofill(batch, batch_signatures: 2)` says how many will come. It is a
+  keyword, not a field, so it never reaches the codec. The 2 XRP cap applies
+  to a Batch as it does in xrpl.js.
+
+- **An STArray element could lose its ObjectEndMarker on encode.** The
+  codec closed an element with `0xE1` only when its last byte was not
+  already `0xE1`, so the marker went missing whenever an element ended in
+  that byte by chance: a `Signer` or `RawTransaction` whose last AccountID
+  ends in `0xE1` (about one address in 256), a `Memo` whose data does, or an
+  element ending in a nested object (`AffectedNodes`). Such a transaction
+  was serialised, and therefore signed, differently from rippled and was
+  rejected. Every element now gets its marker; the binaries match
+  ripple-binary-codec byte for byte. The codec fixtures contain no such
+  element, which is why they never showed it.
+- **Decoding wrote a nested object's end marker twice** when re-serialising
+  it, which surfaced as stray `ArrayEndMarker` / `ObjectEndMarker` keys in
+  decoded metadata.
+
+### Changed
+
+- **UInt fields refuse malformed values.** A String that is not a number in
+  the field's reading (see Breaking) raises `ArgumentError`. Before, it went
+  through `#to_i`:
+  - `"101junk"` became 101, `"12.5"` became 12.
+  - `"abc"`, `"-1"` and `"0x10"` became 0.
+
+  A number outside the field's range also raises now. Before, `2**32` as a
+  UInt32 came out five bytes long, and a negative number became 0.
+- **`STObject.from_parser` raises on malformed input** instead of ending
+  the object silently. The last `rescue => e; break` of the codec is gone;
+  a truncated blob used to decode into a partial object.
+
 ## [0.8.0] - 2026-09-24
 
 The codec now targets **rippled 3.4.0** (released 2026-09-17) and passes the

data/README.md

@@ -128,7 +128,7 @@ payment.flag_names                   # => ["tfPartialPayment"]
 `autofill` sets the fee the transaction type actually needs, following the
 same rules as xrpl.js: an `EscrowFinish` pays for the size of its
 `Fulfillment`, `AccountDelete`, `AMMCreate` and `VaultCreate` cost the owner
-reserve, a `Batch` pays for its inner transactions, and multisigning adds one
+reserve, a `Batch` pays for its signatures and its inner transactions, and multisigning adds one
 base fee per signature. Ordinary fees are capped at 2 XRP; pass
 `max_fee_drops:` to `Client.new` to change that. The rules are available on
 their own as `XRPL::Fee.calculate`.
@@ -153,6 +153,109 @@ entry.index                       # the entry's hash, as rippled reports it
 Every flag rippled defines is a constant on its type, e.g.
 `XRPL::LedgerEntry::AccountRoot::LSF_DEPOSIT_AUTH`.
 
+## Batch
+
+A `Batch` (XLS-56, enabled on Mainnet since 2026-10-09) applies up to eight
+inner transactions together. `autofill` prepares them: the `tfInnerBatchTxn`
+flag, `Fee "0"`, an empty `SigningPubKey` and their sequences. It also refuses
+a Batch the ledger would refuse. A Batch of one account is signed like any
+other transaction:
+
+```ruby
+batch = client.autofill({
+  'TransactionType' => 'Batch',
+  'Account' => alice.classic_address,
+  'Flags' => XRPL::Batch::FLAGS['Batch']['tfAllOrNothing'],
+  'RawTransactions' => [
+    { 'RawTransaction' => { 'TransactionType' => 'Payment', 'Account' => alice.classic_address,
+                            'Destination' => bob.classic_address, 'Amount' => '1000000' } },
+    { 'RawTransaction' => { 'TransactionType' => 'Payment', 'Account' => alice.classic_address,
+                            'Destination' => carol.classic_address, 'Amount' => '1000000' } }
+  ]
+})
+client.submit_and_wait(batch, wallet: alice, autofill: false)
+```
+
+When inner transactions come from other accounts, each of those accounts
+signs the finished Batch. The outer account signs it last. The signatures
+cover the inner transaction IDs, so the Batch has to be complete before
+anyone signs, and that includes its fee. `batch_signatures:` tells `autofill`
+how many signatures will be collected, one per other account:
+
+```ruby
+batch = client.autofill(swap, batch_signatures: 1)       # Alice pays Bob, Bob pays Alice
+signed = Wallet::Wallet.combine_batch_signers([bob.sign_batch(batch)])
+client.submit_and_wait(signed, wallet: alice, autofill: false)
+```
+
+- `sign_batch(batch, batch_account:)` signs for another account whose
+  regular key the wallet holds.
+- `multisign: true` signs as one member of that account's signer list.
+- `combine_batch_signers` sorts the entries the way rippled requires and
+  drops the outer account's entry. It also merges signatures from one signer
+  list into a single entry.
+- For an inner transaction with a `Delegate`, the delegate signs.
+
+**An outer `tesSUCCESS` does not mean the inner transactions succeeded.**
+Under `tfOnlyOne`, `tfUntilFailure` or `tfIndependent` some of them can fail
+while the Batch itself succeeds. Look up each one by its ID and check its own
+result:
+
+```ruby
+BinaryCodec.inner_transaction_ids(signed).each do |id|
+  result = client.tx_response(transaction: id).dig('result', 'meta', 'TransactionResult')
+  # an inner transaction that was not applied is not found at all
+end
+```
+
+`examples/batch.rb` runs both flows against the Testnet.
+
+## Delegation
+
+An account can let another account send certain transactions on its behalf
+(XLS-75, enabled on Mainnet since 2026-10-08). A `DelegateSet` grants the
+permissions. A permission is either a transaction type, such as `"Payment"`,
+or one of the granular permissions, such as `"TrustlineAuthorize"` or
+`"PaymentMint"`. The codec translates both names.
+
+> **Do not delegate `"PaymentBurn"` until the `fixCleanup3_4_0` amendment is
+> enabled on the target network.** Before that fix, a delegate holding
+> `PaymentBurn` can in certain circumstances also mint fungible tokens
+> (trust line tokens or MPTs). The `feature` method of a node reports
+> whether it is enabled there; [Known Amendments](https://xrpl.org/resources/known-amendments)
+> has the Mainnet status. Source:
+> [Permission Values](https://xrpl.org/docs/references/protocol/data-types/permission-values).
+
+```ruby
+client.submit_and_wait({
+  'TransactionType' => 'DelegateSet',
+  'Account' => isaac.classic_address,
+  'Authorize' => alice.classic_address,
+  'Permissions' => [{ 'Permission' => { 'PermissionValue' => 'Payment' } }]
+}, wallet: isaac)
+```
+
+The delegate then sends the transaction with `Account` set to the delegating
+account and `Delegate` set to itself, and signs it with its own wallet:
+
+```ruby
+client.submit_and_wait({
+  'TransactionType' => 'Payment',
+  'Account' => isaac.classic_address,
+  'Delegate' => alice.classic_address,
+  'Destination' => bob.classic_address,
+  'Amount' => '1000000'
+}, wallet: alice)
+```
+
+- **Sequence:** `autofill` takes it from `Account`, as rippled expects.
+- **Signature and fee:** both belong to the delegate. Isaac pays the amount,
+  Alice pays the fee.
+- **Without the permission:** the transaction comes back as
+  `terNO_DELEGATE_PERMISSION`.
+- **Inside a Batch:** for a delegated inner transaction, the delegate signs
+  the `BatchSigners` entry (see above).
+
 ## Payment channel claims
 
 A claim is signed off-ledger and redeemed later with a `PaymentChannelClaim`

data/lib/binary-codec/binary_codec.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
+require 'digest'
+
 module BinaryCodec
   # Hash prefixes for serialization.
   HASH_PREFIX = {
+    transaction_id: 0x54584E00, # 'TXN\0'
     transaction_sig: 0x53545800, # 'STX\0'
     transaction_multi_sig: 0x534D5400, # 'SMT\0'
     validation: 0x56414C00, # 'VAL\0'
@@ -59,6 +62,97 @@ module BinaryCodec
         Uint64.from(Integer(amount)).to_bytes
     end
 
+    # The ID of a transaction: SHA512Half of 'TXN\0' and its serialisation.
+    # For a signed transaction that is its hash; for an unsigned one, such as
+    # the inner transaction of a Batch, it is the ID rippled gives it.
+    #
+    # @param transaction [Hash, String] the transaction, or its serialisation as hex
+    # @return [String] the ID, 64 uppercase hex characters
+    def transaction_id(transaction)
+      hex = transaction.is_a?(String) ? transaction : json_to_binary(transaction)
+      prefix = int_to_bytes(HASH_PREFIX[:transaction_id], 4).pack('C*')
+      Digest::SHA512.digest(prefix + [hex].pack('H*'))[0, 32].unpack1('H*').upcase
+    end
+
+    # The IDs of a Batch's inner transactions, in order.
+    #
+    # @param batch [Hash] the Batch
+    # @return [Array<String>] one ID per entry of RawTransactions
+    def inner_transaction_ids(batch)
+      Array(batch['RawTransactions']).map do |wrapper|
+        inner = wrapper.is_a?(::Hash) ? wrapper['RawTransaction'] : nil
+        inner = inner.to_h if defined?(XRPL::Transaction) && inner.is_a?(XRPL::Transaction)
+        raise ArgumentError, 'Every entry of RawTransactions needs a RawTransaction' unless inner.is_a?(::Hash)
+
+        transaction_id(inner)
+      end
+    end
+
+    # The bytes a BatchSigner signs over (rippled serializeBatch plus the
+    # signer suffix, rippled 3.4.1 STTx::checkBatchSingleSign and
+    # checkBatchMultiSign): 'BCH\0', the outer Account, the outer sequence
+    # value, Flags, the number of inner transactions and their IDs, then the
+    # BatchSigner's Account and, when multisigning, the signing account.
+    #
+    # Like encodeForSigningBatch in xrpl.js, this encodes what it is given: a
+    # Batch without a Sequence encodes the sequence value 0. Wallet#sign_batch
+    # refuses to sign one, because rippled requires the Sequence.
+    #
+    # @param batch [Hash] the Batch, with Account, Flags and its inner
+    #   transactions complete
+    # @param batch_account [String] the account of the BatchSigner entry
+    # @param signer_account [String, nil] the account of the signer in the
+    #   entry's Signers, when the entry is multisigned
+    # @return [Array<Integer>] the signing data
+    def signing_batch_data(batch, batch_account:, signer_account: nil)
+      unless batch['Account'] && batch.key?('Flags')
+        raise ArgumentError, 'A Batch needs Account and Flags before it can be signed'
+      end
+
+      ids = inner_transaction_ids(batch)
+      bytes = int_to_bytes(HASH_PREFIX[:batch], 4) +
+              account_bytes(batch['Account']) +
+              int_to_bytes(batch_sequence_value(batch), 4) +
+              int_to_bytes(Integer(batch['Flags']), 4) +
+              int_to_bytes(ids.size, 4)
+      ids.each { |id| bytes += hex_to_bytes(id) }
+      bytes += account_bytes(batch_account)
+      bytes += account_bytes(signer_account) if signer_account
+      bytes
+    end
+
+    # rippled's SeqProxy value: the Sequence, or the TicketSequence when the
+    # Sequence is 0 because a ticket is used.
+    #
+    # @param batch [Hash]
+    # @return [Integer]
+    def batch_sequence_value(batch)
+      sequence = uint32_value(batch['Sequence'])
+      return sequence if sequence.positive?
+
+      uint32_value(batch['TicketSequence'])
+    end
+
+    # A UInt32 field's value as the codec serialises it, so a check made on
+    # it agrees with the bytes that are signed. A String is a decimal
+    # number, as rippled reads it, not #to_i: "101junk" raises rather than
+    # becoming 101.
+    #
+    # Only numbers: a UInt32 also takes a permission name ("TrustSet" is
+    # 21), which is meant for PermissionValue and would be a wrong ticket or
+    # sequence here.
+    #
+    # @param value [Integer, String, nil]
+    # @return [Integer] 0 for nil
+    def uint32_value(value)
+      return 0 if value.nil?
+      if value.is_a?(String) && !value.match?(/\A\+?\d+\z/)
+        raise ArgumentError, "A sequence needs a number, got #{value.inspect}"
+      end
+
+      Uint32.from(value).value_of
+    end
+
     # Generates signing data for a transaction.
     # @param transaction [Hash] The transaction to serialize.
     # @param prefix [Integer] The prefix to add to the serialized data.
@@ -81,5 +175,11 @@ module BinaryCodec
 
       prefix_bytes + serialized_bytes
     end
+
+    private
+
+    def account_bytes(address)
+      AddressCodec::AddressCodec.new.decode_account_id(address).to_a
+    end
   end
 end

data/lib/binary-codec/serdes/binary_serializer.rb

@@ -47,7 +47,13 @@ module BinaryCodec
       end
 
       field_header = field.header
-      associated_value = field.associated_type.from(value)
+      # A UInt reads a String by its field: a UInt64 is hex, or decimal in a
+      # base-10 field.
+      associated_value = if field.associated_type <= Uint
+                           field.associated_type.from(value, field.name)
+                         else
+                           field.associated_type.from(value)
+                         end
 
       @sink.put(field_header.to_bytes)
 

data/lib/binary-codec/types/st_array.rb

@@ -3,6 +3,7 @@
 module BinaryCodec
   class STArray < SerializedType
     ARRAY_END_MARKER = 0xF1
+    OBJECT_END_MARKER = 0xE1
 
     def initialize(byte_buf = nil)
       super(byte_buf || [])
@@ -35,7 +36,11 @@ module BinaryCodec
             
             obj = STObject.from(field_value, nil, definitions)
             bytes.concat(obj.to_bytes)
-            bytes.concat([0xE1]) unless bytes.last == 0xE1
+            # Every element is closed by its own ObjectEndMarker. Testing the
+            # last byte for 0xE1 instead dropped it whenever the element
+            # happened to end in that byte - an AccountID, a Memo, or a nested
+            # object, whose own marker is 0xE1 too.
+            bytes.concat([OBJECT_END_MARKER])
           else
             raise StandardError, "STArray item must be a Hash, got #{item.class}"
           end
@@ -70,7 +75,7 @@ module BinaryCodec
         # Reconstruct the serialized item: [FieldHeader][STObject][ObjectEndMarker]
         bytes.concat(field_header.to_bytes)
         bytes.concat(obj.to_bytes)
-        bytes.concat([0xE1]) unless bytes.last == 0xE1
+        bytes.concat([OBJECT_END_MARKER])
       end
 
       # The ArrayEndMarker has to go back in. Without it the reconstructed

data/lib/binary-codec/types/st_object.rb

@@ -100,20 +100,16 @@ module BinaryCodec
       list = BytesList.new
       bytes = BinarySerializer.new(list)
 
+      # Malformed input raises rather than ending the object early: a silent
+      # break here returned a truncated object that nothing could trace.
       until parser.end?
-        begin
-          field = parser.read_field
-          break if field.name == OBJECT_END_MARKER
+        field = parser.read_field
+        break if field.name == OBJECT_END_MARKER
 
-          associated_value = parser.read_field_value(field)
+        associated_value = parser.read_field_value(field)
 
-          bytes.write_field_and_value(field, associated_value)
-          bytes.put(OBJECT_END_MARKER_BYTE) if field.type == ST_OBJECT
-        rescue => e
-          # If we fail to read a field (e.g. unknown header), we might have hit 
-          # the end of the object without an end marker, or just malformed data.
-          break
-        end
+        # Closes a nested STObject with its ObjectEndMarker itself.
+        bytes.write_field_and_value(field, associated_value)
       end
 
       STObject.new(list.to_bytes)

data/lib/binary-codec/types/uint.rb

@@ -24,9 +24,20 @@ module BinaryCodec
     end
 
     # Creates a new Uint instance from a value.
+    #
+    # A String is read the way rippled 3.4.1 reads it (STParsedJSON):
+    # UInt8, UInt16 and UInt32 as a whole decimal number; UInt64 as hex of
+    # any length, except in the base-10 fields (BASE10_UINT64_FIELDS),
+    # which are decimal. The fields that carry a name also take the name.
+    # ripple-binary-codec reads them the same way. Anything else, and any
+    # value outside the type's range, raises ArgumentError. Names count only
+    # for their own field (NAMED_FIELDS) when the field is given.
+    #
     # @param value [Uint, String, Integer] The value to convert.
+    # @param field_name [String, nil] the field, which decides how a UInt64
+    #   String is read; without it, as hex
     # @return [Uint] The created instance.
-    def self.from(value)
+    def self.from(value, field_name = nil)
       return value if value.is_a?(self)
 
       if value.is_a?(String)
@@ -34,25 +45,58 @@ module BinaryCodec
         # LedgerEntryType (UInt16), TransactionResult (UInt8) and the
         # PermissionValue of a DelegateSet (UInt32). A name is never a valid
         # number, so the lookup cannot capture a numeric string.
-        code = NAMED_VALUES.fetch(self, [])
-                           .filter_map { |table| Definitions.instance.public_send(table)[value] }
-                           .first
+        # With the field known, only that field's names count, so a
+        # Sequence cannot take "TrustSet" or a TransferFee "Payment".
+        tables = field_name ? Array(NAMED_FIELDS[field_name]) : NAMED_VALUES.fetch(self, [])
+        code = tables.filter_map { |table| Definitions.instance.public_send(table)[value] }.first
         return new(int_to_bytes(code, width)) if code
 
-        # Handle hex strings or numeric strings
-        if valid_hex?(value) && value.length == self.width * 2
-          return new(hex_to_bytes(value))
-        end
-        return new(int_to_bytes(value.to_i, width))
+        return new(int_to_bytes(in_range!(parse_string(value, field_name)), width))
       end
 
-      if value.is_a?(Integer)
-        return new(int_to_bytes(value, width))
-      end
+      return new(int_to_bytes(in_range!(value), width)) if value.is_a?(Integer)
 
       raise StandardError, "Cannot construct #{self} from the value given"
     end
 
+    # How a String becomes a number for this width. UInt8/16/32: decimal.
+    # UInt64: hex, or decimal in a base-10 field. The wider types keep the
+    # codec's earlier reading: hex in their full width, otherwise decimal.
+    def self.parse_string(value, field_name)
+      if width == 8
+        if BASE10_UINT64_FIELDS.include?(field_name)
+          return Integer(value, 10) if value.match?(/\A\d+\z/)
+
+          raise ArgumentError, "#{field_name} is base 10 and needs a whole decimal number, got #{value.inspect}"
+        end
+        return Integer(value, 16) if value.match?(/\A\h{1,16}\z/)
+
+        raise ArgumentError, "#{name} needs up to 16 hex digits, got #{value.inspect}"
+      elsif width > 8 && valid_hex?(value) && value.length == width * 2
+        Integer(value, 16)
+      elsif value.match?(/\A\d+\z/) || (width == 4 && value.match?(/\A\+\d+\z/))
+        # A leading '+' only for UInt32: rippled reads it with
+        # beast::lexicalCast, which skips it. Its UInt8 and UInt16 parsers
+        # take a String that does not start with a digit as a name and
+        # refuse "+5"; UInt64 above uses std::from_chars and takes no sign;
+        # the wider types are hex in rippled.
+        Integer(value, 10)
+      else
+        raise ArgumentError, "#{name} needs a whole decimal number, got #{value.inspect}"
+      end
+    end
+    private_class_method :parse_string
+
+    # A value that does not fit the width used to come out a byte too long
+    # (2**32 as a UInt32) or, if negative, as 0.
+    def self.in_range!(number)
+      max = (1 << (width * 8)) - 1
+      return number if number.between?(0, max)
+
+      raise ArgumentError, "#{name} takes 0 to #{max}, got #{number}"
+    end
+    private_class_method :in_range!
+
     # Creates a Uint instance from a parser.
     # @param parser [BinaryParser] The parser to read from.
     # @param _hint [Integer, nil] Unused hint.
@@ -167,8 +211,15 @@ module BinaryCodec
     # Creates a new Int32 instance from a value.
     # @param value [Int32, Integer] The value to convert.
     # @return [Int32] The created instance.
-    def self.from(value)
+    def self.from(value, _field_name = nil)
       return value if value.is_a?(self)
+      # rippled reads an Int32 String as a signed decimal number, and
+      # nothing else: not as the hex a UInt64 would take.
+      if value.is_a?(String)
+        raise ArgumentError, "#{name} needs a signed decimal number, got #{value.inspect}" unless value.match?(/\A[+-]?\d+\z/)
+
+        value = Integer(value, 10)
+      end
       if value.is_a?(Integer)
         # Ensure it fits in 32-bit signed
         if value < -2147483648 || value > 2147483647
@@ -191,11 +242,26 @@ module BinaryCodec
       val > 0x7FFFFFFFFFFFFFFF ? val - 0x10000000000000000 : val
     end
 
+    # The signed value as a decimal String: not the 16 hex digits of a
+    # UInt64, so the decoder's output goes back in through .from; and a
+    # String, as rippled renders 64-bit values, so a JSON reader that holds
+    # numbers as doubles (JavaScript) cannot round it.
+    def to_json(_definitions = nil, _field_name = nil)
+      value_of.to_s
+    end
+
     # Creates a new Int64 instance from a value.
     # @param value [Int64, Integer] The value to convert.
     # @return [Int64] The created instance.
-    def self.from(value)
+    def self.from(value, _field_name = nil)
       return value if value.is_a?(self)
+      # rippled reads an Int64 String as a signed decimal number, and
+      # nothing else: not as the hex a UInt64 would take.
+      if value.is_a?(String)
+        raise ArgumentError, "#{name} needs a signed decimal number, got #{value.inspect}" unless value.match?(/\A[+-]?\d+\z/)
+
+        value = Integer(value, 10)
+      end
       if value.is_a?(Integer)
         if value < -9223372036854775808 || value > 9223372036854775807
           raise StandardError, "Value #{value} out of range for Int64"

data/lib/wallet/wallet.rb

@@ -124,14 +124,10 @@ module Wallet
         # 4. Serialize the signed transaction
         tx_blob = BinaryCodec.json_to_binary(signed_tx)
         
-        # 5. Generate the hash (transaction ID)
-        # For transactions, the hash is SHA512Half of the serialized transaction with a prefix
-        hash_prefix = [0x54, 0x58, 0x4E, 0x00].pack('C*') # 'TXN\0'
-        hash = Digest::SHA512.digest(hash_prefix + [tx_blob].pack('H*'))[0...32].unpack1('H*').upcase
-        
+        # 5. The transaction ID: SHA512Half of 'TXN\0' and the blob
         return {
           'tx_blob' => tx_blob,
-          'hash' => hash
+          'hash' => BinaryCodec.transaction_id(tx_blob)
         }
       end
 
@@ -194,6 +190,152 @@ module Wallet
       KeyPairs::KeyPairs.new.verify(bytes_to_hex(data), signature, public_key)
     end
 
+    # Signs a Batch (XLS-56) for an account with inner transactions in it:
+    # the BatchSigners entry that account contributes. The outer account does
+    # not need one; it signs the whole Batch with #sign once the entries are
+    # in (see .combine_batch_signers).
+    #
+    # The Batch must be complete: Account, Sequence, Flags and the inner
+    # transactions as XRPL::Client#autofill leaves them, because the
+    # signature covers the inner transaction IDs.
+    #
+    # @param batch [Hash, XRPL::Transaction] the Batch
+    # @param batch_account [String, nil] the account to sign for; by default
+    #   this wallet's. Another account when this wallet is its regular key,
+    #   or the account whose signer list this wallet belongs to.
+    # @param multisign [Boolean, String] true to sign as one signer of
+    #   batch_account's signer list, as this wallet's own account; or the
+    #   signer account, when this wallet is that signer's regular key
+    # @return [Hash] a copy of the Batch whose BatchSigners holds this one entry
+    # @raise [ArgumentError] for anything but a Batch, or an account with no
+    #   inner transaction in it
+    def sign_batch(batch, batch_account: nil, multisign: false)
+      batch = self.class.batch_hash(batch)
+      # rippled requires a Sequence, and the signature covers its value (or
+      # the TicketSequence). Signed without one, the entry matches no Batch
+      # that can be submitted: autofill first, then sign.
+      unless BinaryCodec.batch_sequence_value(batch).positive?
+        raise ArgumentError, 'A Batch needs its Sequence or TicketSequence before it is signed; autofill it first'
+      end
+
+      batch_account ||= @classic_address
+      unless self.class.batch_signer_accounts(batch).include?(batch_account)
+        raise ArgumentError, "#{batch_account} has no inner transaction to sign for in this Batch"
+      end
+
+      entry = { 'Account' => batch_account }
+      if multisign
+        signer_account = multisign.is_a?(String) ? multisign : @classic_address
+        data = BinaryCodec.signing_batch_data(batch, batch_account: batch_account, signer_account: signer_account)
+        entry['Signers'] = [{ 'Signer' => {
+          'Account' => signer_account,
+          'SigningPubKey' => @public_key,
+          'TxnSignature' => @key_pairs.sign(bytes_to_hex(data), @private_key, @algorithm)
+        } }]
+      else
+        data = BinaryCodec.signing_batch_data(batch, batch_account: batch_account)
+        entry['SigningPubKey'] = @public_key
+        entry['TxnSignature'] = @key_pairs.sign(bytes_to_hex(data), @private_key, @algorithm)
+      end
+
+      batch.merge('BatchSigners' => [{ 'BatchSigner' => entry }])
+    end
+
+    # The accounts that sign a Batch's BatchSigners: the Account of every
+    # inner transaction, or its Delegate when it has one, since the delegate
+    # acts for the account. Each account once, in order of appearance. The
+    # outer account is included; its entry is dropped when combining.
+    #
+    # @param batch [Hash, XRPL::Transaction] the Batch
+    # @return [Array<String>]
+    def self.batch_signer_accounts(batch)
+      batch_hash(batch)['RawTransactions'].map do |wrapper|
+        inner = wrapper['RawTransaction'] || {}
+        inner['Delegate'] || inner['Account']
+      end.compact.uniq
+    end
+
+    # Merges the copies of a Batch that each signer returned from
+    # #sign_batch into one Batch carrying all BatchSigners entries, ready for
+    # the outer account to sign with #sign.
+    #
+    # Entries are sorted by numeric AccountID, as rippled requires. The outer
+    # account's entry is dropped: its signature is the outer one. Signatures
+    # of the same account's signer list are merged into one entry with its
+    # Signers sorted the same way; an identical entry given twice is kept once.
+    #
+    # @param batches [Array<Hash, String>] the signed copies, as Hashes or
+    #   serialised hex
+    # @return [Hash] the Batch with the combined BatchSigners
+    # @raise [ArgumentError] when the copies are not of the same Batch, one
+    #   carries no BatchSigners, or the outer transaction is already signed
+    def self.combine_batch_signers(batches)
+      batches = Array(batches).map { |b| b.is_a?(String) ? BinaryCodec.binary_to_json(b) : batch_hash(b) }
+      raise ArgumentError, 'combine_batch_signers needs at least one signed Batch' if batches.empty?
+
+      batches.each do |b|
+        raise ArgumentError, 'The Batch must not be signed yet; the outer account signs last' if b['TxnSignature'] || b['Signers']
+        raise ArgumentError, 'Every Batch to combine needs BatchSigners' if Array(b['BatchSigners']).empty?
+      end
+      unsigned = batches.map { |b| b.reject { |key, _| key == 'BatchSigners' } }
+      unless unsigned.uniq.size == 1
+        raise ArgumentError, 'The Batches to combine have to be the same apart from BatchSigners'
+      end
+
+      outer = batches.first['Account']
+      by_account = {}
+      batches.flat_map { |b| b['BatchSigners'] }.each do |wrapper|
+        entry = wrapper['BatchSigner']
+        account = entry['Account']
+        next if account == outer
+
+        by_account[account] = merge_batch_signer(by_account[account], entry)
+      end
+
+      entries = by_account.values.sort_by { |entry| account_sort_key(entry['Account']) }
+      unsigned.first.merge('BatchSigners' => entries.map { |entry| { 'BatchSigner' => entry } })
+    end
+
+    # The Batch as a Hash, its inner transactions included: a model, or a
+    # Hash whose RawTransaction entries are models, comes back as plain
+    # Hashes, so the copy that sign_batch returns can be serialised.
+    #
+    # @api private
+    def self.batch_hash(batch)
+      batch = batch.to_h if !batch.is_a?(::Hash) && batch.respond_to?(:to_h)
+      unless batch.is_a?(::Hash) && batch['TransactionType'] == 'Batch'
+        raise ArgumentError, 'sign_batch needs a Batch transaction'
+      end
+      return batch unless batch['RawTransactions'].is_a?(Array)
+
+      raw = batch['RawTransactions'].map do |wrapper|
+        inner = wrapper.is_a?(::Hash) ? wrapper['RawTransaction'] : nil
+        inner.is_a?(XRPL::Transaction) ? wrapper.merge('RawTransaction' => inner.to_h) : wrapper
+      end
+      batch.merge('RawTransactions' => raw)
+    end
+
+    # Two entries for the same account: identical ones collapse, signer-list
+    # entries merge their Signers, anything else is a conflict.
+    def self.merge_batch_signer(existing, entry)
+      return entry if existing.nil? || existing == entry
+
+      unless existing['Signers'] && entry['Signers']
+        raise ArgumentError, "Conflicting BatchSigners entries for #{entry['Account']}"
+      end
+
+      signers = (existing['Signers'] + entry['Signers'])
+                .uniq { |s| s['Signer']['Account'] }
+                .sort_by { |s| account_sort_key(s['Signer']['Account']) }
+      existing.merge('Signers' => signers)
+    end
+
+    def self.account_sort_key(address)
+      AddressCodec::AddressCodec.new.decode_account_id(address).to_a
+    end
+
+    private_class_method :merge_batch_signer, :account_sort_key
+
     # Derives the X-address for this wallet.
     # @param tag [Integer, false, nil] The destination tag.
     # @param test_network [Boolean] Whether the address is for a test network.

data/lib/xrpl/batch.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+module XRPL
+  # Prepares the inner transactions of a Batch (XLS-56) before it is signed.
+  #
+  # The ledger requires every inner transaction to carry the tfInnerBatchTxn
+  # flag, a Fee of "0" and an empty SigningPubKey: the outer transaction pays
+  # the fees, and the outer signature together with BatchSigners authorises
+  # the inner transactions. They must also carry their final Sequence, because
+  # the BatchSigners sign over the inner transaction IDs. So the Batch has to
+  # be complete before anyone signs it.
+  #
+  # The module is pure: XRPL::Client#autofill passes in a way to fetch an
+  # account's sequence. What the ledger would refuse is refused here, before
+  # anything is signed or sent.
+  module Batch
+    FLAGS = Model::DEFINITIONS['TRANSACTION_FLAGS']
+
+    # The four modes; a Batch names exactly one of them.
+    MODE_FLAGS = FLAGS.fetch('Batch').values.reduce(0, :|)
+
+    # Marks a transaction as the inner transaction of a Batch.
+    TF_INNER_BATCH_TXN = FLAGS.fetch('universal').fetch('tfInnerBatchTxn')
+
+    MIN_INNER = 2
+    MAX_INNER = 8
+
+    module_function
+
+    # @param batch [Hash] the Batch, with its outer Sequence (or
+    #   TicketSequence) already set; it is not modified
+    # @param sequence_for [#call] takes an account and returns its next
+    #   sequence; only called for accounts whose inner transactions lack a
+    #   Sequence and a TicketSequence, once per account
+    # @return [Hash] a copy of the Batch with its inner transactions filled in
+    # @raise [ArgumentError] when the ledger would refuse the Batch
+    def prepare(batch, sequence_for:)
+      check_mode!(batch['Flags'])
+      check_sequence_and_ticket!(batch, 'The Batch')
+      raw = batch['RawTransactions']
+      unless raw.is_a?(Array) && raw.size.between?(MIN_INNER, MAX_INNER)
+        count = raw.is_a?(Array) ? raw.size : 0
+        raise ArgumentError, "A Batch carries #{MIN_INNER} to #{MAX_INNER} inner transactions, this one has #{count}"
+      end
+
+      # Per account: the next sequence to hand out, and the lowest one still
+      # free after the explicit sequences seen so far. An inner transaction
+      # without a sequence gets the higher of the two, so it never repeats
+      # one given explicitly earlier in the Batch.
+      next_sequence = {}
+      floor = Hash.new(0)
+      take = lambda do |account|
+        [next_sequence[account] || first_sequence(batch, account, sequence_for), floor[account]].max
+      end
+
+      # Everything is checked before the first sequence is handed out, so a
+      # Batch the ledger would refuse never reaches sequence_for.
+      inners = raw.each_with_index.map do |wrapper, index|
+        unwrap(wrapper, index).tap { |inner| check_inner!(inner, index) }
+      end
+
+      prepared = inners.map do |inner|
+        inner['Flags'] = Integer(inner['Flags'] || 0) | TF_INNER_BATCH_TXN
+        inner['Fee'] = '0'
+        inner['SigningPubKey'] = ''
+
+        account = inner['Account']
+        # A TicketCreate also takes a sequence for every ticket it creates.
+        reserved = inner['TransactionType'] == 'TicketCreate' ? Integer(inner['TicketCount'] || 0) : 0
+
+        if !inner['TicketSequence'].nil? && BinaryCodec.uint32_value(inner['Sequence']).zero?
+          # On a ticket: Sequence is a required field and 0 here. Only a
+          # TicketCreate still moves the account's sequence on, by the
+          # tickets it creates, starting at the current one.
+          inner['Sequence'] = 0
+          next_sequence[account] = take.call(account) + reserved if reserved.positive?
+        elsif inner['Sequence'].nil?
+          sequence = take.call(account)
+          inner['Sequence'] = sequence
+          next_sequence[account] = sequence + 1 + reserved
+        else
+          floor[account] = [floor[account], BinaryCodec.uint32_value(inner['Sequence']) + 1 + reserved].max
+        end
+
+        { 'RawTransaction' => inner }
+      end
+
+      batch.merge('RawTransactions' => prepared)
+    end
+
+    # The number of signatures a BatchSigners array carries: one per entry,
+    # or, for an entry signed by a signer list, one per nested signer.
+    #
+    # @param batch_signers [Array<Hash>, nil]
+    # @return [Integer]
+    def signature_count(batch_signers)
+      Array(batch_signers).sum do |entry|
+        signer = entry.is_a?(Hash) ? (entry['BatchSigner'] || entry) : {}
+        nested = signer['Signers']
+        nested.is_a?(Array) && !nested.empty? ? nested.size : 1
+      end
+    end
+
+    def check_mode!(flags)
+      mode = Integer(flags || 0) & MODE_FLAGS
+      return if mode.positive? && (mode & (mode - 1)).zero?
+
+      raise ArgumentError, 'A Batch needs exactly one of tfAllOrNothing, tfOnlyOne, ' \
+                           'tfUntilFailure and tfIndependent in Flags'
+    end
+
+    def unwrap(wrapper, index)
+      inner = wrapper.is_a?(Hash) && wrapper.keys == ['RawTransaction'] ? wrapper['RawTransaction'] : nil
+      inner = inner.to_h if inner.is_a?(XRPL::Transaction)
+      unless inner.is_a?(Hash)
+        raise ArgumentError, "RawTransactions[#{index}] must be { 'RawTransaction' => transaction }"
+      end
+
+      inner.dup
+    end
+
+    # On a ticket, Sequence is 0; rippled refuses a nonzero Sequence next to
+    # a TicketSequence (temSEQ_AND_TICKET). Refused before any sequence is
+    # handed out, so it cannot push the account's later sequences up.
+    def check_sequence_and_ticket!(transaction, label)
+      # Reading both values here refuses a malformed or out-of-range one in
+      # the checking pass, not after sequences were already fetched.
+      sequence = BinaryCodec.uint32_value(transaction['Sequence'])
+      BinaryCodec.uint32_value(transaction['TicketSequence'])
+      return if transaction['TicketSequence'].nil? || sequence.zero?
+
+      raise ArgumentError, "#{label} has both a Sequence and a TicketSequence; " \
+                           'on a ticket, Sequence is 0 (temSEQ_AND_TICKET)'
+    end
+
+    def check_inner!(inner, index)
+      prefix = "RawTransactions[#{index}]"
+      raise ArgumentError, "#{prefix} has no Account" if inner['Account'].nil?
+
+      check_sequence_and_ticket!(inner, prefix)
+      raise ArgumentError, "#{prefix} is a Batch; a Batch cannot nest" if inner['TransactionType'] == 'Batch'
+      if inner.key?('TxnSignature') || inner.key?('Signers')
+        raise ArgumentError, "#{prefix} must not be signed; the Batch is signed as a whole"
+      end
+      if inner.key?('Fee') && inner['Fee'].to_s != '0'
+        raise ArgumentError, "#{prefix} must have Fee \"0\"; the Batch pays the fees"
+      end
+      return unless inner.key?('SigningPubKey') && inner['SigningPubKey'].to_s != ''
+
+      raise ArgumentError, "#{prefix} must have an empty SigningPubKey"
+    end
+
+    # The outer account's inner transactions follow the outer one, which
+    # consumes its Sequence; when it uses a ticket instead, the account's
+    # sequence is still free. Every other account starts at its own.
+    def first_sequence(batch, account, sequence_for)
+      outer_sequence = BinaryCodec.uint32_value(batch['Sequence'])
+      if account == batch['Account'] && outer_sequence.positive? && batch['TicketSequence'].nil?
+        outer_sequence + 1
+      else
+        Integer(sequence_for.call(account))
+      end
+    end
+
+    private_class_method :check_mode!, :check_sequence_and_ticket!, :unwrap, :check_inner!, :first_sequence
+  end
+end

data/lib/xrpl/client.rb

@@ -326,15 +326,31 @@ module XRPL
     #
     # The fee follows the transaction type (see XRPL::Fee): an EscrowFinish
     # pays for its Fulfillment, AccountDelete, AMMCreate and VaultCreate cost
-    # the owner reserve, a Batch pays for its inner transactions.
+    # the owner reserve, a Batch pays for its signatures and its inner
+    # transactions.
+    #
+    # A Batch also gets its inner transactions prepared (see XRPL::Batch):
+    # tfInnerBatchTxn, Fee "0", an empty SigningPubKey and their sequences.
+    # The BatchSigners sign over the finished Batch, so its fee has to be set
+    # before they exist; +batch_signatures:+ says how many there will be.
     #
     # @param transaction [Hash, XRPL::Transaction] the transaction to complete.
     # @param signers_count [Integer] number of signatures for multisign fee scaling.
+    # @param batch_signatures [Integer] for a Batch: the signatures its
+    #   BatchSigners will carry, one per other account (or one per signer of
+    #   an account signing with a signer list). Zero for a Batch of one account.
     # @return [Hash] a copy of the transaction with the missing fields filled in.
-    def autofill(transaction, signers_count: 0)
+    # @raise [ArgumentError] for a Batch the ledger would refuse.
+    def autofill(transaction, signers_count: 0, batch_signatures: 0)
       tx = self.class.to_transaction_hash(transaction).dup
+      # On a ticket, Sequence is 0; the account's own would be refused
+      # (temSEQ_AND_TICKET).
+      tx['Sequence'] = 0 if tx['Sequence'].nil? && !tx['TicketSequence'].nil?
       tx['Sequence'] ||= fetch_sequence(tx.fetch('Account'))
-      tx['Fee'] ||= calculate_fee(tx, signers_count)
+      if tx['TransactionType'] == 'Batch'
+        tx = Batch.prepare(tx, sequence_for: ->(account) { fetch_sequence(account) })
+      end
+      tx['Fee'] ||= calculate_fee(tx, signers_count, batch_signatures)
       tx['LastLedgerSequence'] ||= current_ledger_index + LEDGER_OFFSET
       tx
     end
@@ -449,11 +465,12 @@ module XRPL
       Integer(sequence)
     end
 
-    def calculate_fee(tx, signers_count)
+    def calculate_fee(tx, signers_count, batch_signatures = 0)
       Fee.calculate(
         tx,
         base_fee: base_fee_drops,
         signers_count: signers_count.to_i,
+        batch_signatures: batch_signatures.to_i,
         max_fee: @max_fee_drops,
         owner_reserve: -> { owner_reserve_drops }
       ).to_s

data/lib/xrpl/fee.rb

@@ -6,7 +6,7 @@ module XRPL
   # rippled charges most transactions the network's base fee, but not all of
   # them: an EscrowFinish pays for the size of its Fulfillment, AccountDelete,
   # AMMCreate and VaultCreate cost an owner reserve rather than a fee, a Batch
-  # pays for its inner transactions, and the confidential MPT transactions
+  # pays for its signatures and its inner transactions, and the confidential MPT transactions
   # cost ten base fees. Multisigning adds one base fee per signature. The
   # rules are the ones xrpl.js applies in its autofill.
   #
@@ -40,8 +40,12 @@ module XRPL
     # @param owner_reserve [Integer, #call, nil] the owner reserve in drops,
     #   or something that fetches it; only consulted for the reserve-priced
     #   types
+    # @param batch_signatures [Integer] for a Batch: the signatures its
+    #   BatchSigners will carry once collected. Ignored when the Batch already
+    #   carries BatchSigners, which are counted instead.
     # @return [Integer] the fee in drops, rounded up
-    def calculate(transaction, base_fee:, signers_count: 0, max_fee: MAX_FEE_DROPS, owner_reserve: nil)
+    def calculate(transaction, base_fee:, signers_count: 0, max_fee: MAX_FEE_DROPS, owner_reserve: nil,
+                  batch_signatures: 0)
       tx = transaction.respond_to?(:to_h) ? transaction.to_h : transaction
       type = tx['TransactionType'] || tx[:TransactionType]
       base_fee = Integer(base_fee)
@@ -60,7 +64,8 @@ module XRPL
           calculate(raw['RawTransaction'] || raw, base_fee: base_fee, max_fee: max_fee,
                                                   owner_reserve: owner_reserve)
         end
-        fee = base_fee * 2 + inner
+        # XLS-56 §2.2: (2 + signatures in BatchSigners) × base fee + inner fees
+        fee = base_fee * (2 + batch_signature_count(tx, batch_signatures)) + inner
       elsif CONFIDENTIAL_MPT_TYPES.include?(type)
         fee += base_fee * CONFIDENTIAL_MPT_MULTIPLIER
       end
@@ -72,6 +77,13 @@ module XRPL
       fee.ceil
     end
 
+    def batch_signature_count(batch, expected)
+      signers = batch['BatchSigners']
+      return Integer(expected || 0) if signers.nil? || signers.empty?
+
+      Batch.signature_count(signers)
+    end
+
     def resolve_owner_reserve(owner_reserve, type)
       reserve = owner_reserve.respond_to?(:call) ? owner_reserve.call : owner_reserve
       raise ArgumentError, "#{type} costs the owner reserve, which was not given" if reserve.nil?

data/lib/xrpl/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module XRPL
-  VERSION = '0.8.0'
+  VERSION = '0.9.0'
 end

data/lib/xrpl-ruby.rb

@@ -44,5 +44,6 @@ require_relative 'xrpl/model'
 require_relative 'xrpl/transaction'
 require_relative 'xrpl/ledger_entry'
 require_relative 'xrpl/fee'
+require_relative 'xrpl/batch'
 require_relative 'xrpl/client'
 require_relative 'xrpl/faucet'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: xrpl-ruby
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Alexander Busse
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-24 00:00:00.000000000 Z
+date: 2026-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -169,6 +169,7 @@ files:
 - lib/key-pairs/secp256k1.rb
 - lib/wallet/wallet.rb
 - lib/xrpl-ruby.rb
+- lib/xrpl/batch.rb
 - lib/xrpl/client.rb
 - lib/xrpl/faucet.rb
 - lib/xrpl/fee.rb