Proposal: Canton C++ SDK
The Canton C++ SDK lets native C++ applications generate typed Daml bindings and build, sign, submit, stream and query Canton Ledger API v2 workflows through one maintained native SDK, without adding a JVM or sidecar to the application runtime. It ships six layered canton::* libraries, a .dar-driven code generator distributed as a dpm component, and conformance, benchmark and reference artifacts, all Apache-2.0.
Development Fund Proposal Submission
Proposal file:
proposals/2026-08-Equilibrium-cpp-sdk.md
Applicant
Organization: Equilibrium
Author / Primary Contact: Olli Tiainen (olli@equilibrium.co)
Champion: Heslin Kim, Zenith (@heslin-zenith)
Proposal Classification
Proposal Type:
- RFP-aligned proposal
- Individual initiative
RFP / Roadmap Area: RFP #17: SDKs in different languages
Label:
canton-apis
Funding & Timeline
Total Funding Request: Up to 2,545,000 CC base. The independent security review is priced separately as a pass-through cost at Milestone 3, converted from vendor quotes at the CC/USD basis stated at filing.
Project Duration: ~4 months engineering (6-month hard deadline), adoption window to month 14
Maximum Amount: N/A
Maximum Duration: N/A
Summary
A C++ team integrating with Canton can find Ledger API protobuf definitions, an OpenAPI document, and SDKs for Java, TypeScript, Rust, Go, Python and C#. It cannot find a maintained C or C++ SDK. Building directly on the protos leaves the application layer to implement: Daml-LF decoding, serialization for every generated type, change-ID deduplication, command recovery, resumable streams and reassignment semantics. A sidecar in a supported language avoids some of that work, but adds a process boundary and a second toolchain — and splits the signing path, which matters because PKCS #11, the standard HSM API, is specified in ANSI C.
The Canton C++ SDK gives C++ applications typed access to commands, ledger state, update streams, CIP-0056 and CIP-0112 token workflows, interactive submission with a pluggable signer interface, and typed Participant Query Store reads — all natively, with no JVM or sidecar in the runtime path.
What this delivers
Three artifact families, all Apache-2.0, distributed through CMake, Conan, vcpkg and dpm.
| Deliverable | What it is |
|---|---|
canton-cpp-sdk | Six layered libraries — canton::core, canton::ledger, canton::admin, canton::auth, canton::token, canton::pqs — with JWT/OIDC authentication, TLS/mTLS, resumable streams, command recovery and OpenTelemetry on every transport |
canton-codegen-cpp | Typed C++ from .dar files (templates, choices, interfaces, contract keys) with gRPC and JSON codecs and round-trip tests on every generated type, shipped as a dpm codegen-cpp component |
| Verification and adoption artifacts | canton-conformance-cpp and canton-bench-cpp with per-release published results, the canton-reference-cpp application, COMPATIBILITY.md and a versioned documentation site |
Submission Checklist
- Full proposal file is included in this PR
- Organization and primary contact identified
- Champion identified or
Needs Championselected - RFP / roadmap alignment identified, if applicable
- Total funding request provided
- Project duration provided
- Proposal is within any RFP maximum amount
- Proposal is within any RFP maximum duration
- Milestones and milestone funding are defined in the proposal
- Acceptance criteria are based on ecosystem value
- Architectural alignment is addressed
Notes for Reviewers
- The runtime path has no JVM. Daml-LF decoding happens at code-generation time through a project-owned thin adapter to the public
daml-lf-archiveinterface; generated code and runtime libraries have no JVM dependency. The funded C# (#46) and Rust (#407) SDKs use the same model. - Memory safety is part of the deliverable. The SDK decodes untrusted network data and prepares payloads for signing, so sanitizers, continuous fuzzing of every decoder boundary and at least 80 percent coverage on codegen and serialization paths run in CI. Critical and high findings from the independent security review are remediated before Milestone 3 acceptance.
- Conformance does not wait for the ledger client standard. The standard is not publicly readable, so
canton-conformance-cppstarts from a provisional matrix reconstructed from the funded SDK scopes, consumes the transaction-hashing test vectors proposed in #617 rather than defining a competing standard, and is reconciled against Digital Asset's working standard at Milestone 1 once access is provided. - 30% of the grant is paid on verified adoption. The MainNet application pool pays 4 percent of the base per qualified production application, up to five; a 10 percent completion tranche is gated on the reference application, documentation continuity, organisation adoption and external contributions. Attestations go to the Foundation directly.