feat(sdk)!: reshape dash-platform-cxx into a thin shell over dash-sdk

packages/rs-platform-cxx rebuilt on v4.2-dev with dash-sdk (default-features off: dpns-contract, dashpay-contract, core_key_wallet) and platform-encryption as its only Platform dependencies; the direct dpp/drive/platform-version/context-provider/dash-platform-queries dependencies, the #4632 builders and the decode/st/queries modules are gone.

Bridge (namespace platform_ffi): Config{network, tenderdash_chain_id, platform_llmq_type, proxy}; nine-kind Status; one Verified* struct per read with typed ProvenAbsent (also under an unsupported protocol version, which meta then shows; the default value could not tell absence apart); one page per bridge call with a StartAfter cursor, has_more computed against the query's own limit (at PV13 Drive answers a names_of_identity continuation with an empty page); typed BroadcastResult; builders returning Built{bytes, hash, object_id}; pure DPNS/DIP-15 helpers. Every entry, including new_platform_client and Drop, runs under catch_unwind, and the crate refuses panic=abort at compile time as well as in build.rs.

provider.rs is the push-model ContextProvider: LLMQ-type gate, quorum-hash normalization from Core's internal uint256 order, refusal of every proof until a local ChainLock height is pushed, a 288-block ChainLock-lag floor with no ceiling, and the compiled-in DPNS/DashPay contracts cached per protocol version with negative entries. Provider errors map to Status by variant, also when raised inside proof verification.

client.rs builds the SDK lazily from the https endpoint set the embedder pushes (any other scheme is refused: the address list would dial http in the clear; the host must be an IP address, or an onion name when a proxy is set, so nothing is resolved locally). Config.proxy{kind, address, isolate} is the embedder's SOCKS5 proxy (none, a numeric TCP address or a Unix socket; isolate = fresh random credentials per connection, one Tor circuit each), fixed for the client's lifetime and passed to every SDK it builds through SdkBuilder::with_proxy, with a 15 s connect budget instead of 5 s; a proxy the shell cannot use fails new_platform_client, so there is never a direct fallback. A proxy failure is Unavailable (the SDK neither retries nor bans for it), not Rejected. The DAPI client keeps a pooled channel, and so an open connection, per evonode it has talked to, and removing an address from the list does not touch the pool, which is private to the client: an empty set therefore drops the SDK (no Platform socket stays open while the embedder has disabled networking), a set that removes endpoints rebuilds the SDK over the same, updated AddressList (retained entries keep their ban state), and a set that only adds updates the list in place. The provider, the height watermark and the verified protocol version belong to the client and survive every rebuild; a rebuilt SDK is seeded at the verified version. Proved reads are not dispatched before a ChainLock anchor is pushed or after shutdown. The SDK watermark is off; ops.rs checks the chain id, keeps a tolerance-3 Platform-height watermark keyed after it, records the protocol version of every accepted response, and signals UnsupportedProtocolVersion while still returning the value. Builders and contested_vote_fund_credits take that verified version (transition rules and the contested prefund changed across versions), so they fail before the first accepted read, except on a devnet whose floor is the latest version, and once a version this build does not know was seen. Document queries load the compiled-in contracts at this build's latest version, since a network SDK seeded at the PV13 floor could not decode a DashPay v2 profile. A node's definitive (non-retryable) gRPC refusal of a read or a broadcast, including tonic's answer to a response above the 4 MiB decoding bound, is Rejected; no answer is Unavailable. search_names refuses an empty or over-long prefix before dispatch, which Drive would refuse anyway. runtime.rs owns the tokio runtime and aborts the in-flight task on shutdown.

signer.rs: BytesSigner hands the full signable preimage to WalletSigner::SignForKey; AssetLockSigner is the single digest path and recovers the public key from the compact signature (compressed-key header only, as Core funds P2PKH of the compressed key), so PublicKeyForKey is gone. The adapters take a SignerCallbacks trait whose Send + Sync impls sit on the extern type under the any-thread contract signer.h states. builders.rs: identity create through dpp try_from_identity_with_signers, DPNS preorder/domain and the profile create assembled inline until rs-sdk exports them, each create given the document id put_to_platform derives from its entropy and nonce at the verified version (dpp derives it itself only from PV14; up to PV13 it sends the document's id as is, and a zero id is refused by Drive with InvalidDocumentTransitionIdError), a property the network's contract does not have yet refused before signing, contact requests through Sdk::create_contact_request with client-side ECDH under the verified version. build_profile replaces the Profile a get_profile read at its revision + 1 and carries the fields the embedder does not edit (avatar, DashPay v2 payment addresses) into the replacement, since a replace transition carries the whole document and would otherwise erase what another wallet set.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: PastaPastaPasta

.github/package-filters/rs-packages-direct.yml

@@ -131,6 +131,9 @@ dash-platform-queries:
 dash-sdk:
   - packages/rs-sdk/**
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+
 rs-sdk-ffi:
   - packages/rs-sdk-ffi/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -153,6 +153,11 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - packages/rs-sdk-ffi/**
   - *simple-signer

.github/package-filters/rs-packages.yml

@@ -181,6 +181,12 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-platform-cxx:
+  - .github/workflows/tests*
+  - packages/rs-platform-cxx/**
+  - *sdk
+  - *platform_encryption
+
 rs-sdk-ffi: &sdk_ffi
   - .github/workflows/tests*
   - packages/rs-sdk-ffi/**

Cargo.lock

@@ -40,6 +40,7 @@ members = [
     "packages/app-connect-contract",
     "packages/moderation-charters-contract",
     "packages/rs-sdk-ffi",
+    "packages/rs-platform-cxx",
     "packages/wasm-drive-verify",
     "packages/dash-platform-balance-checker",
     "packages/rs-dapi",

Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "dash-platform-cxx"
+version.workspace = true
+authors = ["Dash Core Group <dev@dash.org>"]
+edition = "2021"
+rust-version.workspace = true
+license = "MIT"
+description = "CXX shell over dash-sdk for C++ embedders that supply their own trust context and signing keys"
+
+[lib]
+name = "dash_platform_cxx"
+crate-type = ["staticlib", "rlib"]
+
+[features]
+default = []
+# dash-sdk's mock transport, for tests that replay recorded proved responses
+# through the same client code an embedder runs. Never enabled by embedders.
+mocks = ["dash-sdk/mocks"]
+
+[dependencies]
+cxx = "1.0"
+dash-sdk = { path = "../rs-sdk", default-features = false, features = [
+  "dpns-contract",
+  "dashpay-contract",
+  "core_key_wallet",
+] }
+platform-encryption = { path = "../rs-platform-encryption" }
+tokio = { version = "1.40", features = ["rt-multi-thread", "net", "time"] }
+futures = "0.3"
+async-trait = "0.1"
+zeroize = "1.8"
+hex = "0.4"
+
+[build-dependencies]
+cxx-build = "1.0"