feat(sdk): add CXX bindings over dash-sdk for C++ embedders

A C++ application that wants Dash Platform with its own trust context and signing keys had no supported path: rs-sdk-ffi is a C ABI shaped for mobile wallets that fetch quorum keys from a trusted HTTP service and hold private keys in-process. Dash Core's platform GUI needs the opposite: quorum keys from its locally synced LLMQ store, endpoints from its deterministic masternode list, signatures from its wallet, and no key or trust ever leaving the node.

packages/rs-platform-cxx is a thin cxx bridge over dash-sdk. The embedder pushes endpoints, Platform quorum keys, its best ChainLock height and a digest-signing callback; the SDK owns query construction, transport (TLS to the evonodes), retries with address banning, proof verification and protocol-version tracking. Queries go through the SDK's Fetch/FetchMany so the rich query it built is what it verifies against; no wire request is ever reconstructed from bytes. On top of the SDK's signed-time window and monotonic Platform height, the client refuses a verified response whose Tenderdash chain id is not the network's or whose signed core-chain-locked height trails the embedder's ChainLock by more than 288 blocks. Every bridge entry point runs under catch_unwind, so a panic anywhere in the SDK surfaces as rust::Error rather than aborting the embedding process; the crate refuses to build under panic=abort.

Document assembly is dash-platform-queries' pure DPNS/DashPay builders; signing is dpp's Signer over the callback, with dash-sdk's structure validation before serialization. Broadcast rejections carry DAPI's consensus error decoded through the SDK's error conversion.

Tests replay drive-proof-verifier's proof-vector corpus through dash-sdk's mock transport (only the socket is mocked; the SDK runs the GroveDB replay and the BLS quorum check against the key pushed through the client) and cover unknown quorum key, wrong quorum type, tampered signature, foreign chain id, the ChainLock staleness floor, the height watermark surviving an SDK rebuild, cancellation and input bounds; builders are pinned byte for byte against rs-dpp-generated vectors; tests/cxx_smoke.cc links and runs from C++ in CI. Validated against live testnet from a release-built C++ driver: identity, nonce, DPNS resolve (registered and proven absent), names-of-identity, prefix search, profile, contact requests, contested vote state and a rejected broadcast all verify in 0.3 to 2 s; bit-flipped quorum keys fail at the BLS check.

Author: PastaPastaPasta

.github/package-filters/rs-packages-direct.yml

@@ -121,6 +121,9 @@ dash-platform-queries:
 dash-sdk:
   - packages/rs-sdk/**
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+
 rs-sdk-ffi:
   - packages/rs-sdk-ffi/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -130,6 +130,17 @@ platform-encryption: &platform_encryption
 dash-platform-queries: &platform_queries
   - packages/dash-platform-queries/**
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+  - *platform_queries
+  - *context_provider
+  - *dpp
+  - *drive
+  - *dapi_grpc
+  - packages/rs-drive-proof-verifier/**
+  - packages/rs-sdk/**
+  - packages/rs-dapi-client/**
+
 dash-sdk: &sdk
   - packages/rs-drive-proof-verifier/**
   - packages/rs-sdk/**

.github/package-filters/rs-packages.yml

@@ -155,6 +155,18 @@ dash-platform-queries: &platform_queries
   - .github/workflows/tests*
   - packages/dash-platform-queries/**
 
+dash-platform-cxx:
+  - .github/workflows/tests*
+  - packages/rs-platform-cxx/**
+  - *platform_queries
+  - *context_provider
+  - *dpp
+  - *drive
+  - *dapi_grpc
+  - packages/rs-drive-proof-verifier/**
+  - packages/rs-sdk/**
+  - packages/rs-dapi-client/**
+
 dash-sdk: &sdk
   - .github/workflows/tests*
   - packages/rs-drive-proof-verifier/**

.github/workflows/tests-rs-workspace.yml

@@ -226,6 +226,13 @@ jobs:
             done
           done
 
+      # The C++ embedding surface must link and run from the staged headers
+      # and archive alone; the Rust tests cannot see a broken header layout.
+      # (dash-platform-cxx wraps the full dash-sdk, networking included, so it
+      # is deliberately absent from the transport-free cuts above.)
+      - name: Link the Platform CXX embedder from C++
+        run: packages/rs-platform-cxx/scripts/cxx-smoke.sh
+
       - name: Detect immutable structure changes
         if: github.event_name == 'pull_request'
         run: |
@@ -342,6 +349,7 @@ jobs:
             --package rs-sdk-ffi \
             --package platform-wallet-ffi \
             --package rs-dapi-client \
+            --package dash-platform-cxx \
             --package platform-serialization \
             --package dapi-grpc \
             --package json-schema-compatibility-validator \

Cargo.lock

@@ -38,6 +38,7 @@ members = [
     "packages/document-history-contract",
     "packages/keyword-search-contract",
     "packages/rs-sdk-ffi",
+    "packages/rs-platform-cxx",
     "packages/wasm-drive-verify",
     "packages/dash-platform-balance-checker",
     "packages/rs-dapi",

Cargo.toml

@@ -27,13 +27,15 @@ downstream code may need to:
 Embedders that bring their own transport and trust context and only need the
 verification/query layer:
 
-- **Dash Core's platform GUI** — fetches over its own gRPC-Web transport,
-  serves quorum keys from its locally synced LLMQ state via a
-  [`ContextProvider`](../rs-context-provider), and verifies every response
-  proof with [`drive-proof-verifier`](../rs-drive-proof-verifier).
 - Block explorers, Electrum-style servers, hardware-wallet tooling — anything
   that talks to DAPI its own way but must not trust responses.
 
+Dash Core's platform GUI consumes the full `dash-sdk` instead, through
+[`dash-platform-cxx`](../rs-platform-cxx): it serves quorum keys from its
+locally synced LLMQ state via a [`ContextProvider`](../rs-context-provider)
+and signatures from its wallet, and lets the SDK own transport, retries and
+proof verification.
+
 If you want networking, retries, and a managed connection pool, use
 `dash-sdk` — it consumes this crate internally.
 

packages/dash-platform-queries/README.md

@@ -0,0 +1,51 @@
+[package]
+name = "dash-platform-cxx"
+version.workspace = true
+authors = ["Dash Core Group <dev@dash.org>"]
+edition = "2021"
+rust-version.workspace = true
+license = "MIT"
+description = "CXX bindings over dash-sdk for C++ embedders that supply their own trust context and signing keys"
+
+[lib]
+name = "dash_platform_cxx"
+crate-type = ["staticlib", "rlib"]
+
+[features]
+default = []
+# dash-sdk's mock transport, for tests that replay canned proved responses
+# through the same client code an embedder runs. Never enabled by embedders.
+mocks = ["dash-sdk/mocks"]
+
+[dependencies]
+cxx = "1.0"
+dash-sdk = { path = "../rs-sdk", default-features = false, features = [
+  "dpns-contract",
+  "dashpay-contract",
+] }
+dash-context-provider = { path = "../rs-context-provider", default-features = false }
+dash-platform-queries = { path = "../dash-platform-queries", default-features = false }
+dpp = { path = "../rs-dpp", default-features = false, features = [
+  "state-transitions",
+  "state-transition-signing",
+  "state-transition-validation",
+  "identity-serialization",
+  "identity-hashing",
+  "bls-signatures",
+  "dpns-contract",
+  "dashpay-contract",
+] }
+drive = { path = "../rs-drive", default-features = false, features = ["verify"] }
+platform-version = { path = "../rs-platform-version" }
+tokio = { version = "1.40", features = ["rt-multi-thread", "net", "time"] }
+hex = "0.4"
+futures = "0.3"
+async-trait = "0.1"
+
+[build-dependencies]
+cxx-build = "1.0"
+
+[dev-dependencies]
+dash-platform-cxx = { path = ".", features = ["mocks"] }
+serde_json = "1"
+serde = { version = "1", features = ["derive"] }