Skip to content

feat(sdk): add transport-free CXX bindings - #4416

Draft
PastaPastaPasta wants to merge 8 commits into
dashpay:refactor/shared-document-transition-prepfrom
PastaPastaPasta:feat/platform-cxx-bindings
Draft

feat(sdk): add transport-free CXX bindings#4416
PastaPastaPasta wants to merge 8 commits into
dashpay:refactor/shared-document-transition-prepfrom
PastaPastaPasta:feat/platform-cxx-bindings

Conversation

@PastaPastaPasta

@PastaPastaPastaPastaPastaPasta commented Aug 18, 2026

Copy link
Copy Markdown
Member

Issue being fixed or feature implemented

Dash Core's Platform GUI currently carries a private copy of its Rust/CXX bridge and pins individual Platform crates. This makes the embedding ABI, proof-verification logic, decoders, state-transition builders, and dependency closure owned by the consumer instead of Platform.

This stacked PR gives Platform ownership of that transport-free C++ embedding surface. It is based on #4433 (which stacks on #4389) and assumes #4389 and #4433 merge before this PR is retargeted to v4.2-dev. (#4388 and #4434 have already merged.)

What was done?

  • Added the dash-platform-cxx workspace package with the existing platform_ffi ABI for proof verification, DPP decoding, state-transition construction, quorum context, and callback-based wallet signing.
  • Added 31 Rust tests and the proof/decoder/signing vectors previously maintained with the Dash Core integration.
  • Added a standalone manifest and lockfile so downstream build systems can vendor only this package's dependency closure.
  • Added an install contract for the static archive and public/generated CXX headers.
  • Added a real C++ link-and-run smoke test and CI checks that reject native DAPI transport dependencies.
  • Integrated the package with workspace metadata, package filters, Docker package discovery, feature checks, and nightly CI.

After this lands, PastaPastaPasta/dash#67 will consume the installed archive and headers through Dash Core's depends system and remove its private Rust/CXX implementation.

How Has This Been Tested?

  • cargo test -p dash-platform-cxx --locked (31 tests)
  • cargo clippy -p dash-platform-cxx --all-targets --locked -- -D warnings
  • cargo check --manifest-path packages/rs-platform-cxx/standalone/Cargo.toml --locked
  • standalone debug C++ link-and-run smoke test
  • standalone release build and install-layout verification
  • workspace and standalone dependency-tree checks for rs-dapi-client, Hyper, Rustls, Tower, and Reqwest
  • cargo machete
  • cargo fmt --all -- --check
  • shellcheck packages/rs-platform-cxx/install.sh packages/rs-platform-cxx/test-cxx-link.sh
  • YAML parsing and git diff --check

Breaking Changes

None. The existing platform_ffi namespace and bridge ABI from the downstream integration are preserved.

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have added or updated relevant unit/integration/functional/e2e tests
  • I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
  • I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

  • I have assigned this pull request to a milestone

This pull request was created by Codex.

@coderabbitai

coderabbitaiBot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
auto_review:
drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copies the wire-proto -> drive-type decoders for the v1 getDocuments surface from rs-drive-abci's query/document_query/v1/conversions.rs into dash-platform-queries::documents::proto_conversions, verbatim except for a neutral DecodeError replacing the server's QueryError with the exact same message strings.
The server is untouched. This is a client-side mirror kept in lockstep by doc contract, the same convention the v0 path uses where CBOR clause decoding mirrors query_documents_v0. Hosting a single shared decode crate that both sides consume is proposed separately; this PR deliberately avoids adding any drive-abci dependency.
Upcoming client-side wire decoding (DocumentQuery::try_from_request) consumes these functions; until that commit lands the module carries a temporary allow(dead_code).
…policy
is_consensus_valid_label matches exactly the DPNS contract's label schema pattern (consecutive hyphens allowed); is_valid_username is recomposed as that pattern plus the stricter client-side consecutive-hyphen rejection. Its acceptance set is unchanged - the pre-existing test vectors pass as-is - but the consensus check is now available on its own so document builders cannot reject labels the contract accepts.
…rked flows
register_dpns_name and create_contact_request were interleaving document assembly (id derivation, salted-domain-hash commitment, property maps, size validation) with fetching, ECDH, and broadcasting. The assembly halves become pure functions - build_dpns_preorder_and_domain_documents and build_contact_request_document - that take caller-supplied entropy/salt/ciphertexts and touch no network or randomness. The networked flows now call them; ids, properties, size-validation bounds, and error messages are unchanged.
One addition beyond the extraction: the DPNS builder validates the label against the consensus pattern (is_consensus_valid_label) before assembling. The previous flow did no label validation locally and let the network reject invalid labels; failing locally with a clear message is strictly earlier, and using the consensus pattern (not the stricter client policy) means the builder cannot reject labels the contract accepts.
…-platform-queries
File move of the pure builders introduced in the previous commit, unchanged except for the error type: they now return dash_platform_queries::Error::InvalidInput, which dash-sdk maps back to Error::Generic with identical messages, so the SDK surface is byte-for-byte the same. rs-sdk re-exports the builders at their previous paths.
This makes the document-assembly half of DPNS registration and DashPay contact requests reachable without the SDK's transport stack; crypto material and randomness stay with the caller.
…d client code
DocumentQuery::try_from_request decodes a wire GetDocumentsRequest back into a rich DocumentQuery - the inverse of request encoding. V1 typed clauses go through the same proto_conversions functions the server's v1 handler runs; V0 CBOR where/order_by fields are decoded exactly as the server's query_documents_v0 does. Multi-projection selects and limit Some(0) are rejected, mirroring the server's contracts.
…d embedders
verify_documents_response verifies a proved GetDocumentsResponse directly against the wire request that produced it: the wire version (V0/V1 oneof arm) is checked against the platform version's document_query feature bounds (the server's own dispatch gate), prove=false requests are rejected (an honest server answers them unproved), and the request decodes through the shared try_from_request before delegating to FromProof.
The query-shape gates (HAVING, GROUP BY, OFFSET, non-documents SELECT - every field the DocumentQuery -> DriveDocumentQuery lowering drops) run inside the shared FromProof<DocumentQuery> impl itself rather than only at the wire entry point. dash-sdk's document fetches verify through that impl, and the SDK talks to the same untrusted evonodes an embedder's transport does, so both paths now reject request shapes no honest server would have proved before any proof machinery runs.
@PastaPastaPasta
PastaPastaPastaforce-pushed the refactor/document-query-decode-builders branch from f5a1304 to 29c4233CompareAugust 23, 2026 22:58
Extracts the document create/replace preparation out of dash-sdk's PutDocument broadcast path into dash-platform-queries: property sanitization for the transition (prepare_document_for_transition) and the entropy/document-id consistency check (ensure_entropy_matches_document_id) that surfaces an id/entropy drift locally instead of after the broadcast has paid a bumped identity-contract nonce. dash-sdk delegates to the shared helpers with unchanged behavior; transport-free embedders (packages/rs-platform-cxx) assemble their own transitions through the same code instead of reimplementing it in C++. Split out of dashpay#4389 to keep that PR to its declared decode/builders/verification scope.
@PastaPastaPasta
PastaPastaPastaforce-pushed the feat/platform-cxx-bindings branch from df4fdb6 to 13472b6CompareAugust 23, 2026 23:13
@PastaPastaPasta
PastaPastaPasta changed the base branch from refactor/document-query-decode-builders to refactor/shared-document-transition-prepAugust 23, 2026 23:13
@PastaPastaPasta
PastaPastaPastaforce-pushed the refactor/shared-document-transition-prep branch 2 times, most recently from 970dd23 to f036c83CompareAugust 25, 2026 13:55
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@PastaPastaPasta