Proposal: Rust SDK for Canton Network

Development Fund Proposal Submission

Proposal file: /proposals/2026-06-Nodejumper-rust-sdk.md

Summary

This proposal requests funding for a production-grade, open-source Rust SDK for Canton Network: an async (tokio) Ledger API client over gRPC and JSON, type-safe code generation from DAR packages, built-in CIP-56 token-standard support, and JWT/OIDC authentication, shipped as a dpm component and published on crates.io under Apache-2.0.

Canton's funded language coverage today is Go and Python (#38), C#/.NET (#46), and the TypeScript dApp SDK (#69). Rust is the one unfilled quadrant, and it is the language of the cohort that sits closest to the network: indexers, validators, oracle relays, and market-making engines. Those teams currently drop to raw gRPC/JSON and re-implement command de-duplication, codegen, and CIP-56 handling per project, or depend on a partial community crate with no codegen, conformance, or maintainer.

In short:

• Go, C#, TypeScript, and Python have SDKs; Rust is the gap.
• This delivers the Rust member of that set, built on the same official daml-lf-archive foundation and integrated through dpm, so it extends the toolchain rather than competing with it.

We are a GSF-sponsored Canton validator and will maintain the SDK long-term, which is the part that matters most for a language binding.

What this delivers

• an async canton-ledger client (gRPC + JSON) with correct change-ID command de-duplication, streaming, structured errors, and OpenTelemetry;
• canton-codegen: DAR → typed Rust via the official daml-lf-archive, Smart-Contract-Upgrade-aware, shipped as dpm codegen-rust;
• a documented Daml-LF → Rust type mapping;
• built-in CIP-56 support (holdings, transfer instruction, allocations, choice-context, ledger-derived createdEventBlob);
• a typed PQS client (no hand-written JSONB SQL);
• external/interactive submission with a pluggable signer (HSM/KMS-compatible);
• pre-built canton-splice-* crates for the protocol DARs (cargo add canton-splice-wallet), refreshed on each Canton/Splice release;
• a reference application, a conformance suite, an independent security review, and docs;
• a working PoC at Milestone 1 (a real transaction submitted and read on DevNet).

Codegen and Smart Contract Upgrade

Code generation reads Daml-LF through the official daml-lf-archive decoder, not a bespoke DAR parser, so it tracks Daml/LF additions as they ship. Generated types carry package id and version plus the PackageMap, so consumers resolve the correct template version under Smart Contract Upgrade; a version bump regenerates compatible code rather than breaking silently. Codegen is invoked as a dpm component (dpm codegen-rust), not a competing standalone CLI.

Checklist

• [x] Proposal file added under /proposals/
• [x] Milestones and funding amounts defined (1,500,000 CC across 4 milestones, ~6 months)
• [x] Acceptance criteria included (adoption- and demonstration-based)
• [x] Alignment with Canton priorities described

Notes for Reviewers

The scope is deliberately narrow: a Rust client SDK and codegen for the Ledger API plus CIP-56, distributed through dpm. It does not add a smart-contract language, a wallet, an indexer, a DEX, or admin/topology tooling.

The main points:

• Fills the one unfilled language quadrant. Go (#38), C#/.NET (#46), and TypeScript (#69) are precedent; this is the same category for Rust, the language of the infrastructure cohort (indexers, validators, oracle relays, market-making).
• Extends, does not replace. It consumes the published Ledger API protos, the JSON Ledger API, and daml-lf-archive unchanged, ships codegen as a dpm component, and requires no protocol, ledger-contract, or CIP-56/CIP-0112 changes.
• Consolidates existing community work. The DLC-link/canton-lib crate is a useful low-level partial (some ledger calls, registry/wallet helpers) with no codegen, conformance, or maintenance guarantee. We consolidate that surface into a complete, versioned, maintained SDK and will engage its authors so the ecosystem converges rather than forks.
• Not just an OpenAPI/gRPC generator. Generators produce transport stubs. The value is de-duplication semantics, DAR-versioned typed bindings (SCU-aware), CIP-56 choice-context and disclosed-contract handling, typed PQS access, and idiomatic async — the per-project wrapper layer every existing SDK was funded to remove.
• De-risked. A working PoC lands on DevNet at Milestone 1, and a Rust SDK maintained by a standing Canton validator addresses the maintenance risk that language bindings live or die on.