feat(sdk)!: reshape dash-platform-cxx into a thin shell over dash-sdk

packages/rs-platform-cxx rebuilt on v4.2-dev with dash-sdk (default-features off: dpns-contract, dashpay-contract, core_key_wallet) and platform-encryption as its only Platform dependencies; the direct dpp/drive/platform-version/context-provider/dash-platform-queries dependencies, the #4632 builders and the decode/st/queries modules are gone.

Bridge (namespace platform_ffi): Config{network, tenderdash_chain_id, platform_llmq_type}; nine-kind Status; one Verified* struct per read with typed ProvenAbsent (also under an unsupported protocol version, which meta then shows; the default value could not tell absence apart); one page per bridge call with a StartAfter cursor, has_more computed against the query's own limit; typed BroadcastResult; builders returning Built{bytes, hash, object_id}; pure DPNS/DIP-15 helpers. Every entry, including new_platform_client and Drop, runs under catch_unwind, and the crate refuses panic=abort at compile time as well as in build.rs.

provider.rs is the push-model ContextProvider: LLMQ-type gate, quorum-hash normalization from Core's internal uint256 order, refusal of every proof until a local ChainLock height is pushed, a 288-block ChainLock-lag floor with no ceiling, and the compiled-in DPNS/DashPay contracts cached per protocol version with negative entries. Provider errors map to Status by variant, also when raised inside proof verification.

client.rs builds the SDK lazily on the first non-empty https endpoint set (any other scheme is refused: the address list would dial http in the clear) and afterwards diffs the shared AddressList in place; an empty set removes everything. Proved reads are not dispatched before a ChainLock anchor is pushed or after shutdown. The SDK watermark is off; ops.rs checks the chain id, keeps a tolerance-3 Platform-height watermark keyed after it, records the protocol version of every accepted response, and signals UnsupportedProtocolVersion while still returning the value. Builders and contested_vote_fund_credits take that verified version (transition rules and the contested prefund changed across versions), so they fail before the first accepted read, except on a devnet whose floor is the latest version, and once a version this build does not know was seen. Document queries load the compiled-in contracts at this build's latest version, since a network SDK seeded at the PV13 floor could not decode a DashPay v2 profile. A node's definitive (non-retryable) gRPC refusal of a read or a broadcast, including tonic's answer to a response above the 4 MiB decoding bound, is Rejected; no answer is Unavailable. search_names refuses an empty or over-long prefix before dispatch, which Drive would refuse anyway. runtime.rs owns the tokio runtime and aborts the in-flight task on shutdown.

signer.rs: BytesSigner hands the full signable preimage to WalletSigner::SignForKey; AssetLockSigner is the single digest path and recovers the public key from the compact signature (compressed-key header only, as Core funds P2PKH of the compressed key), so PublicKeyForKey is gone. The adapters take a SignerCallbacks trait whose Send + Sync impls sit on the extern type under the any-thread contract signer.h states. builders.rs: identity create through dpp try_from_identity_with_signers, DPNS preorder/domain assembled inline until rs-sdk exports them, contact requests through Sdk::create_contact_request with client-side ECDH under the verified version. build_profile replaces the Profile a get_profile read at its revision + 1 and carries the fields the embedder does not edit (avatar, DashPay v2 payment addresses) into the replacement, since a replace transition carries the whole document and would otherwise erase what another wallet set.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: PastaPastaPasta

.github/package-filters/rs-packages-direct.yml

@@ -126,6 +126,9 @@ dash-platform-queries:
 dash-sdk:
   - packages/rs-sdk/**
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+
 rs-sdk-ffi:
   - packages/rs-sdk-ffi/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -147,6 +147,11 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - packages/rs-sdk-ffi/**
   - *simple-signer

.github/package-filters/rs-packages.yml

@@ -174,6 +174,12 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - .github/workflows/tests*
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - .github/workflows/tests*
   - packages/rs-sdk-ffi/**

Cargo.lock

@@ -39,6 +39,7 @@ members = [
     "packages/keyword-search-contract",
     "packages/app-connect-contract",
     "packages/rs-sdk-ffi",
+    "packages/rs-platform-cxx",
     "packages/wasm-drive-verify",
     "packages/dash-platform-balance-checker",
     "packages/rs-dapi",

Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "dash-platform-cxx"
+version.workspace = true
+authors = ["Dash Core Group <dev@dash.org>"]
+edition = "2021"
+rust-version.workspace = true
+license = "MIT"
+description = "CXX shell over dash-sdk for C++ embedders that supply their own trust context and signing keys"
+
+[lib]
+name = "dash_platform_cxx"
+crate-type = ["staticlib", "rlib"]
+
+[features]
+default = []
+# dash-sdk's mock transport, for tests that replay recorded proved responses
+# through the same client code an embedder runs. Never enabled by embedders.
+mocks = ["dash-sdk/mocks"]
+
+[dependencies]
+cxx = "1.0"
+dash-sdk = { path = "../rs-sdk", default-features = false, features = [
+  "dpns-contract",
+  "dashpay-contract",
+  "core_key_wallet",
+] }
+platform-encryption = { path = "../rs-platform-encryption" }
+tokio = { version = "1.40", features = ["rt-multi-thread", "net", "time"] }
+futures = "0.3"
+async-trait = "0.1"
+zeroize = "1.8"
+hex = "0.4"
+
+[build-dependencies]
+cxx-build = "1.0"