feat(platform-wallet): dip-13 dashpay invitations

packages/rs-platform-wallet-ffi/src/dashpay.rs

@@ -675,6 +675,20 @@ impl platform_wallet::ContactCryptoProvider for ResolverContactCryptoProvider {
             .map_err(|e| platform_wallet::PlatformWalletError::InvalidIdentityData(e.to_string()))
     }
 
+    async fn export_invitation_private_key(
+        &self,
+        path: &key_wallet::bip32::DerivationPath,
+    ) -> Result<dashcore::secp256k1::SecretKey, platform_wallet::PlatformWalletError> {
+        let scalar = self
+            .signer
+            .export_invitation_private_key(path)
+            .map_err(|e| {
+                platform_wallet::PlatformWalletError::InvalidIdentityData(e.to_string())
+            })?;
+        dashcore::secp256k1::SecretKey::from_slice(scalar.as_ref())
+            .map_err(|e| platform_wallet::PlatformWalletError::InvalidIdentityData(e.to_string()))
+    }
+
     async fn account_reference(
         &self,
         path: &key_wallet::bip32::DerivationPath,

packages/rs-platform-wallet-ffi/src/identity_registration_funded_with_signer.rs

@@ -147,6 +147,13 @@ pub unsafe extern "C" fn platform_wallet_register_identity_with_funding_signer(
 /// wallet-balance path — the resume logic and IS→CL fallback live
 /// there, not here. This FFI is a thin marshaler.
 ///
+/// `consume_invitation_voucher` is the explicit authorization to consume an
+/// `IdentityInvitation`-typed lock (a DashPay bearer voucher whose key is
+/// shared in the invitation link). Pass `false` for every generic resume
+/// surface — the resolver then refuses invitation locks, so a shared voucher
+/// can never be silently consumed into an unrelated local identity. Only the
+/// invitation reclaim flow passes `true`.
+///
 /// # Safety
 /// - `out_point` must be a valid, non-null pointer to an
 ///   `OutPointFFI` (32-byte raw txid + u32 vout). The caller retains
@@ -168,6 +175,7 @@ pub unsafe extern "C" fn platform_wallet_resume_identity_with_existing_asset_loc
     identity_pubkeys_count: usize,
     signer_handle: *mut SignerHandle,
     core_signer_handle: *mut MnemonicResolverHandle,
+    consume_invitation_voucher: bool,
     out_identity_id: *mut [u8; 32],
     out_identity_handle: *mut Handle,
 ) -> PlatformWalletFFIResult {
@@ -223,6 +231,7 @@ pub unsafe extern "C" fn platform_wallet_resume_identity_with_existing_asset_loc
                 .register_identity_with_funding(
                     AssetLockFunding::FromExistingAssetLock {
                         out_point: resume_outpoint,
+                        consume_invitation_voucher,
                     },
                     identity_index,
                     keys_map,
@@ -253,13 +262,21 @@ pub unsafe extern "C" fn platform_wallet_resume_identity_with_existing_asset_loc
 /// completing the top-up against `identity_id` from the stored outpoint.
 /// Sister to
 /// [`platform_wallet_resume_identity_with_existing_asset_lock_signer`],
-/// which resumes the lock as a NEW-identity registration instead.
+/// which resumes the lock as a NEW-identity registration instead. Also the
+/// DashPay invitation "reclaim into an existing identity" path (see
+/// `consume_invitation_voucher` below).
 ///
 /// The `FromExistingAssetLock` resume + IS→CL fallback logic lives in
 /// `top_up_identity_with_funding`; this FFI is a thin marshaler. No
 /// per-identity-key signer is needed (a top-up creates no keys); only the
 /// Core-side asset-lock signature, produced by the wallet's own resolver.
 ///
+/// `consume_invitation_voucher` is the explicit authorization to consume an
+/// `IdentityInvitation`-typed lock (a DashPay bearer voucher whose key is
+/// shared in the invitation link) — the invitation reclaim flow passes
+/// `true`; every generic top-up/crash-recovery surface must pass `false`
+/// and is refused invitation locks by the funding resolver.
+///
 /// # Safety
 /// - `out_point` must be a valid, non-null `*const OutPointFFI`; the caller
 ///   retains ownership.
@@ -273,6 +290,7 @@ pub unsafe extern "C" fn platform_wallet_topup_identity_with_existing_asset_lock
     out_point: *const OutPointFFI,
     identity_id: *const [u8; 32],
     core_signer_handle: *mut MnemonicResolverHandle,
+    consume_invitation_voucher: bool,
     out_new_balance: *mut u64,
 ) -> PlatformWalletFFIResult {
     check_ptr!(out_point);
@@ -310,6 +328,7 @@ pub unsafe extern "C" fn platform_wallet_topup_identity_with_existing_asset_lock
                     &identity_id,
                     AssetLockFunding::FromExistingAssetLock {
                         out_point: reclaim_outpoint,
+                        consume_invitation_voucher,
                     },
                     &asset_lock_signer,
                     None,
@@ -351,6 +370,7 @@ mod topup_existing_lock_guard_tests {
                 std::ptr::null(),
                 &id,
                 dangling_core_signer(),
+                false,
                 &mut balance,
             )
         };
@@ -367,6 +387,7 @@ mod topup_existing_lock_guard_tests {
                 &op,
                 std::ptr::null(),
                 dangling_core_signer(),
+                false,
                 &mut balance,
             )
         };
@@ -384,6 +405,7 @@ mod topup_existing_lock_guard_tests {
                 &op,
                 &id,
                 std::ptr::null_mut(),
+                false,
                 &mut balance,
             )
         };
@@ -400,6 +422,7 @@ mod topup_existing_lock_guard_tests {
                 &op,
                 &id,
                 dangling_core_signer(),
+                false,
                 std::ptr::null_mut(),
             )
         };