feat(sdk): add CXX bindings over dash-sdk for C++ embedders

[PastaPastaPasta]

Issue being fixed or feature implemented

Stacked on #4632 (review from feat(sdk): add CXX bindings onward). Replaces #4620, and with it the reason for #4618's decoder crate on the Core side (see dashpay/dash#7512).

Dash Core's platform GUI needs Dash Platform from C++ with its own trust context and signing keys: quorum keys from its locally synced LLMQ store, evonode endpoints from its deterministic masternode list, signatures from its wallet, and no key or trust ever leaving the node. rs-sdk-ffi is a C ABI shaped for mobile wallets that fetch quorum keys from a trusted HTTP service and hold private keys in-process, so it does not fit. The previous approach (#4620) kept the SDK's networking out and had C++ own the DAPI transport, which required reconstructing document queries from wire bytes (#4618, #4619) to verify proofs against them.

The maintainers' direction was to use the SDK instead. This PR does that: dash-sdk owns query construction, transport (TLS to the evonodes), retries with address banning, proof verification and protocol-version tracking; Core supplies what only it knows. Queries go through the SDK's Fetch/FetchMany, so the SDK verifies against the rich query it built and no wire request is ever reconstructed from bytes.

Measured before choosing: the full SDK type-checks for x86_64/aarch64 Linux musl, x86_64-pc-windows-gnu, and riscv64gc-unknown-linux-gnu (in a container with a pinned protoc); a release-built C++ driver against live testnet verified identity, nonce, DPNS resolve (registered and proven absent), names-of-identity, prefix search, profile, contact requests, contested vote state and a rejected broadcast in 0.3 to 2 s each, with bit-flipped quorum keys failing at the BLS check; a statically linked x86_64-unknown-linux-musl build of the same driver ran under emulation with identical results. macOS needs Security + CoreFoundation (rustls reads the system trust store); Windows needs ws2_32 bcrypt crypt32 userenv ntdll. Dependency graph: 337 crates vs 281 for the transport-free crate.

What was done?

packages/rs-platform-cxx, a thin cxx bridge over dash-sdk:

• client.rs: one Sdk instance, the tokio runtime that drives it, and the embedder's freshness policy. The embedder pushes endpoints, Platform quorum keys and its best ChainLock height; Client::fetch runs an SDK operation and then applies the chain-id check and the ChainLock staleness floor (signed core-chain-locked height must not trail the embedder's ChainLock by more than 288 blocks) on top of the SDK's signed-time window and monotonic Platform height. The verified-height watermark survives an SDK rebuild on endpoint changes. shutdown cancels in-flight work and releases the runtime.
• queries.rs: identities (by id, by unique public key hash), identity and identity-contract nonces, DPNS resolve/search/names-of-identity, DashPay profile and contact requests, contested-name vote state, and broadcast. Broadcast runs the raw DAPI request with address banning off (a node rejecting our transition is not a failing node) and reports the decoded consensus error code and message.
• provider.rs: a ContextProvider over the pushed quorum keys and the pinned DPNS/DashPay contracts; a proof naming any quorum type other than the network's Platform type is refused before its key is looked up.
• st.rs: state-transition construction with dpp's Signer over a C++ digest callback (WalletSigner, include/dash/platform/signer.h); document assembly is dash-platform-queries' pure builders from feat(sdk)!: pure DPNS and DashPay document builders shared with embedders #4632. Structure validation runs before serialization, as dash-sdk does before broadcast.
• Every fallible bridge entry point runs under catch_unwind, so a panic anywhere in the SDK surfaces as rust::Error; build.rs refuses panic = "abort". build.rs stages include/dash/platform/{ffi.h,signer.h} and include/rust/cxx.h under target/<profile>/; consumers vendor from the workspace root (build: make the workspace lockfile vendorable with --locked #4631) and install that tree plus the static archive.
• CI: the crate is checked, its tests run under nextest, and scripts/cxx-smoke.sh links and runs tests/cxx_smoke.cc from C++.

How Has This Been Tested?

• tests/queries.rs replays drive-proof-verifier's proof-vector corpus through dash-sdk's mock transport: only the socket is mocked, the SDK's FromProof path runs the GroveDB replay and the BLS quorum check against the key the test pushed through the client. Covers unknown quorum key, wrong quorum type, tampered signature, a validly signed response from another chain id, the ChainLock staleness floor at and past the bound, the height watermark refusing an older state after an SDK rebuild, queries without endpoints, and input bounds.
• tests/signing.rs pins every builder byte for byte against rs-dpp-generated vectors; tests/decoders.rs covers the stored-document decoders; unit tests pin the contested-state heuristic and normalization idempotence. 36 tests, cargo clippy --all-targets -D warnings, cargo fmt --check, cargo machete clean.
• scripts/cxx-smoke.sh links and runs from C++ (macOS, debug and release).
• Live testnet from a release-built C++ driver, as described above.
• An independent code review pass and a simplification pass were applied before opening.

Breaking Changes

None to existing crates. packages/rs-sdk/README.md and packages/dash-platform-queries/README.md now point C++ embedders here.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}