feat(sdk): composite document queries, the client stack

[QuantumExplorer]

Replaces #4600, which GitHub closed as merged when a mistaken force-push briefly collapsed the stack's branches onto one commit. Same branch, same content, same base.

Issue being fixed or feature implemented

Part of the composite document query series (Yappr feed: one merged proof per feed page instead of 15 to 19 round trips). Stack:

1. feat: merge a limited path query below a key another branch already owns grovedb#850 (recursive graft for colliding limited branches)
2. chore: bump grovedb to 2d95c567 (#850 merged: limited branches graft below a shared key) #4597 (grovedb pin)
3. feat(drive): composite document queries: a page plus derived sub-queries under one merged proof #4598 (rs-drive core: shapes, execution, merged proof, verifier)
4. feat(dapi): composite document queries on the getDocuments V1 wire #4603 (wire: proto sub_queries, drive-abci dispatch)
5. this PR (client stack: dash-platform-queries, proof verifier, rs-sdk)
6. next: wasm-sdk + js-evo-sdk surface

What was done?

The client half of composite queries, mirroring the chained-query client stack shipped in #4552:

• dash-platform-queries: CompositeDocumentQuery (a page DocumentQuery plus a list of CompositeSubQuery, each with a kind, fixed clauses, an optional per-value limit and an optional binding). The V1 wire encoder attaches sub_queries to the typed request and refuses the V0 wire, a zero page limit, cursors, offsets, projections, grouping and time ranges. The rich-to-drive conversion mirrors the server's sub-query limit contract ([1, 100], refused rather than clamped). FromProof<CompositeDocumentQuery> for CompositeDocuments verifies the single merged proof. Builders: CompositeSubQuery::documents(..) / ::count(..), .bound_to_page(source_property, field), .bound_to(CompositeBindingSource::SubQuery(n), ..), .with_where, .with_order_by, .with_limit.
• rs-drive-proof-verifier: CompositeDocuments { page_documents, sub_results } and verify_composite_documents_tenderdash_proof, composing rs-drive's merged-proof verification (bootstrap subset pass on the page, re-derivation of every sub-query, one authoritative verify, routing with completeness checks) with the tenderdash root binding. CompositeSubQueryResult (rs-drive's SubQueryResult) is re-exported at the crate root, like SplitCountEntry.
• rs-sdk: the Query impls, impl Fetch for CompositeDocuments, the mock round-trip (page and documents sub-results as per-document CBOR, count sub-results as triples, all order preserving), and the platform re-exports.
• rs-drive-abci: a composite_trust_boundary suite that runs the actual SDK entry points against server-generated proofs, same split as the having and chained suites. It covers the wire encoding, the full FromProof composition (page, like counts, quoted-post by-id join, cross-contract profile lookup where one author's missing profile is a proven absence), a wrong quorum key, tampered metadata, and a plain page-only proof presented for the composite query.

Usage:

let page = DocumentQuery::new(feed.clone(), "post")?
    .with_where(WhereClause { field: "hashtag".into(), operator: WhereOperator::Equal, value: "dash".into() })
    .with_limit(20);
let query = CompositeDocumentQuery::new(page)
    .with_sub_query(CompositeSubQuery::count(feed.clone(), "like")?.bound_to_page("$id", "postId"))
    .with_sub_query(CompositeSubQuery::documents(feed.clone(), "post")?.bound_to_page("quotedPostId", "$id"))
    .with_sub_query(CompositeSubQuery::documents(dashpay, "profile")?.bound_to_page("$ownerId", "$ownerId"));
let feed_page = CompositeDocuments::fetch(&sdk, query).await?;

How Has This Been Tested?

• cargo test -p dash-platform-queries composite: 7 offline tests (wire shape, source numbering, page-limit and page-feature refusals, drive conversion + shape validation, out-of-range sub-query limit, non-refersTo join refusal).
• cargo test -p drive-abci --lib composite_trust_boundary: 5 tests, all green.
• cargo clippy -p dash-platform-queries -p drive-proof-verifier -p dash-sdk -p drive-abci --features dash-sdk/mocks --tests: clean apart from the pre-existing rs-drive DocumentPropertyType unused import under verify-only features.

Breaking Changes

None. New types and functions only; the chained surface is untouched.

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone

🤖 Generated with Claude Code

[thepastaclaw]

🕓 Ready for review — 51 ahead in queue (commit 9036af2)
Queue position: 52/54 · 2 reviews active
ETA: start ~15:21 UTC · complete ~16:11 UTC (median 49m across 30 recent reviews; 2 slots)
Queued 1d 9h ago · Last checked: 2026-09-06 18:40 UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 3d111da2-8582-4334-bb7d-193165d8353d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}