Add draft C++ language bindings for payjoin-ffi

[chavic]

Draft C++ bindings for payjoin-ffi, following the same per-language layout as the C# and Dart bindings: an optional cpp cargo feature and dispatch arm in uniffi-bindgen.rs, payjoin-ffi/cpp/ with scripts/generate_bindings.sh + contrib/test.sh, a CMake build exposing a consumable payjoin_cpp target, a .#cpp nix dev shell, and a CI workflow mirroring the other binding workflows.

Generator

There is no uniffi 0.31-compatible C++ generator upstream: NordSecurity/uniffi-bindgen-cpp tops out at v0.9.0+v0.29.4 (metadata contract v29, incompatible with our uniffi 0.31.2 / contract v30), and their uniffi 0.30 migration (NordSecurity/uniffi-bindgen-cpp#59) is unmerged. This PR pins a fork, chavic/uniffi-bindgen-cpp@830943d, which takes that PR and adds:

• a bump to uniffi_bindgen 0.31.2 (contract v30 is shared between 0.30 and 0.31, so this is compile-only churn)
• a lib entry point (pub fn main()) mirroring uniffi-bindgen-cs, so it can be consumed as a cargo dep by our dispatcher
• a --skip-async library mode that drops async exports with a warning instead of failing generation (async is unsupported upstream, #51)
• fixes for five generator bugs surfaced by payjoin-ffi's interface: object fields in records double-wrapped in shared_ptr, duplicate type definitions from the topological sort, a callback vtable initializer that omitted uniffi_clone and misordered fields (uniffi 0.30 ABI), a stubbed-out error-deref filter, and even foreign handles (uniffi requires odd ones)

The intent is to upstream the fork's commits and re-pin to a NordSecurity release when one supports uniffi 0.31; until then this stays a draft.

Parity caveat

The async API surface (save_async, replay_*_event_log_async, the *PersisterAsync interfaces) is not exposed in C++ — generation skips it. The synchronous API is complete.

Testing

nix develop .#cpp -c bash ./payjoin-ffi/cpp/contrib/test.sh generates the bindings and runs the ported python suite: 11 unit tests (URI parsing, receiver/sender persistence via an in-memory persister subclassing the callback traits, cancel flows, validation errors) and the integration tests (test_ffi_validation, test_integration_v2_to_v2 against bitcoind and the payjoin test services). All pass locally on Linux; the macOS leg relies on CI.

Disclosure: co-authored by Claude Opus

[coveralls]

Coverage Report for CI Build 32370913939

Coverage remained the same at 86.718%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	16458
Covered Lines:	14272
Line Coverage:	86.72%
Coverage Strength:	343.61 hits per line

---

💛 - Coveralls

[ValeraFinebits]

This is a promising draft. I built the bindings and ran the tests under WSL Ubuntu 24.04:

• C++ unit tests: 11/11 passed
• C++ integration tests: 2/2 passed

I found three issues:

1. The integration test returns success when no proposal is received after four polls, skipping signing, broadcast, and final assertions. This should fail after a timeout.
2. --skip-async generates truncated callback vtables: Rust expects 40 bytes (free/clone/save/load/close), while C++ provides 16 bytes (free/clone). This is an ABI mismatch.
3. BUILD_TESTING=OFF still requires CURL and nlohmann-json. Test dependencies and targets should be wrapped in if(BUILD_TESTING).

Overall, the synchronous bindings build and run successfully, but I think these issues should be addressed before merging.

[ValeraFinebits]

Here are a few additional recommendations:

1. Export the C++20 requirement through the payjoin_cpp target using target_compile_features(payjoin_cpp PUBLIC cxx_std_20).

2. Although inherited from the Python test, catching RPC or JSON errors and returning false hides operational failures. The generated C++ trampoline already reports standard exceptions through the UniFFI error channel, so these exceptions should be allowed to propagate.

3. Make the libcurl write callback noexcept and manage CURL resources with RAII to prevent exceptions from crossing the C boundary and avoid leaks.

4. Enable strict, target-scoped compiler warnings and treat warnings as errors by default. Generated code can be handled separately until its warnings are cleaned up.

5. Consider adding a Linux CI job that builds the generated wrapper and runs the full test suite under ASan and UBSan.

The first two affect correctness; the remaining items are non-blocking hardening suggestions for this draft.