Struct ClientHandlerDeps 

pub struct ClientHandlerDeps {

    pub node_id: PublicKey,
    pub metrics: Arc<Metrics>,
    pub limiter: Arc<ConnectionLimiter>,
    pub shed: Arc<LoadShedController>,
    pub cache: CacheEngine,
    pub eth_signer: Arc<PrivateKeySigner>,
    pub slash_domain: Eip712Domain,
    pub voucher_domain: Eip712Domain,
    pub bind_domain: Eip712Domain,
    pub channel_state_store: Arc<dyn PoolStateStore>,
    pub receipt_sink: Arc<dyn ReceiptSink>,
    pub pool_view: Option<Arc<dyn PoolView>>,
    pub pool_min_remaining_deposit: U256,
    pub rate_per_mb: u64,
    pub max_concurrent_streams: usize,
    pub content_deny: Arc<ContentDenylist>,
    pub chain_freshness: Option<ChainFreshness>,
    pub redeem_hint: Option<Sender<LaneKey>>,
    pub pull_through: Option<Duration>,
    pub local_populate: Option<Duration>,
    pub pull_through_origin: Option<Arc<NodeOrigin>>,
    pub credit_max: u64,
    pub credit_ramp_divisor: u64,
    pub frame_target_bytes: u64,
    pub idle_timeout: Option<Duration>,
    pub pool_recheck_interval: Option<Duration>,
    pub pool_floor_signer_live_windows: u64,
    pub warming_credit: Arc<dyn WarmingCreditSink>,
    pub operator_shares: OperatorShares,
    pub relay_foreign_namespaces: bool,
    pub coarse_clock: Option<Arc<CoarseClock>>,
    pub redeem_interval_secs: u64,
}

Construction bundle for ClientHandler — the 16 required runtime deps plus every optional wiring hook, so a handler’s full configuration is one literal at its call site instead of a new() call followed by a setter chain.

Build it with ClientHandlerDeps::new (required fields only; every optional defaults to None), set the Some optionals the deployment enables, then pass it to ClientHandler::new. Each optional field’s runtime semantics are documented on the matching ClientHandler field.

Fields

node_id: PublicKey

This node’s iroh identity. Carried for diagnostics — the handler does not put it on the wire; StreamResponseBody has no node-id field.

metrics: Arc<Metrics>

Shared metrics registry the serve path records into.

limiter: Arc<ConnectionLimiter>

Per-source connection-rate gate, applied before any work is done.

shed: Arc<LoadShedController>

Overload-protection gate: sheds new serves under resource pressure.

cache: CacheEngine

Blob store the serve path reads from, and the pull-through target on a miss.

eth_signer: Arc<PrivateKeySigner>

The operator’s Ethereum key. Signs the slash_sig on each StreamResponse; every other use reads it only for its address. Client bindings are verified here, never signed.

slash_domain: Eip712Domain

EIP-712 domain for slash attestations.

voucher_domain: Eip712Domain

EIP-712 domain for payment vouchers.

bind_domain: Eip712Domain

EIP-712 domain for lane bindings.

channel_state_store: Arc<dyn PoolStateStore>

Durable per-lane cumulative state. Fences voucher replay across a restart (ADR 003 §Off-chain voucher state persistence).

receipt_sink: Arc<dyn ReceiptSink>

Non-blocking sink for the served-and-paid audit log. One receipt per accepted voucher, so a single delivery emits several.

pool_view: Option<Arc<dyn PoolView>>

Cached getPool view (owner + remaining), read by the floor-M solvency gate and the ADR 011 funder gate. None (tests) disables both gates — they fail open, exactly as before E4 wired the view.

pool_min_remaining_deposit: U256

Refundable minimum-remaining-deposit floor M (token base units). The seller refuses to serve a lane’s pool once its on-chain remaining (getPool.deposit − getPool.totalRedeemed) minus this floor can no longer cover the next credit window. Threaded from config by E4/F; here it is a plain field the floor-M guard reads.

rate_per_mb: u64

The served per-MB price, fixed at startup. Reprice by restarting the daemon (see runtime::reload::warn_restart_required_sections).

max_concurrent_streams: usize

Cap on concurrently served streams within one connection — the semaphore is built per accepted connection, not per node.

content_deny: Arc<ContentDenylist>

Live content deny-set (ADR 011): the operator’s local denylist unioned with the on-chain origin blacklist. NOT an Option, unlike the wiring hooks below — an empty deny-set is a correct steady state (most operators deny nothing), so there is no “unwired” case to represent, and an Option would only add a way to fail open on a takedown gate. It is a required ClientHandlerDeps::new parameter: seeding it empty and relying on the runtime to overwrite it was itself a silent fail-open — a construction site that forgot the wiring was indistinguishable from an operator who denies nothing. Callers with no deny-set (tests) pass ContentDenylist::empty() explicitly.

chain_freshness: Option<ChainFreshness>

Liveness of the node’s chain reads (ADR 011 § Serving while chain-stale). Some only when the blacklist watcher is wired; the admit path refuses a serve once this reads stale. None (dev/test, no chain) disables the gate — the same fail-open shape as an unwired Self::pool_view.

redeem_hint: Option<Sender<LaneKey>>

Best-effort nudge to the settlement service that a lane’s accrued claim advanced; sent on every accepted voucher, against no threshold. None when no settlement service is wired.

pull_through: Option<Duration>

Deadline for the node-to-node cache-miss pull, so a slow upstream cannot pin the delivery path. None disables the node-to-node leg only; a miss can still fill from the local origin via Self::local_populate.

local_populate: Option<Duration>

Deadline for filling a miss from this node’s OWN configured fs/http/s3 origin, tried ahead of any node-to-node path and independent of Self::pull_through. None skips the local-origin tier.

pull_through_origin: Option<Arc<NodeOrigin>>

Selects the window-paced node-to-node pull leg, which bounds speculative spend to the ramped credit window. None falls back to the buffered populate path when Self::pull_through is set.

credit_max: u64

Downstream credit-window ceiling in bytes (ADR 003 §Credit window): the per-stream window ramps toward this cap as the stream pays. Defaults to DEFAULT_CREDIT_MAX (64 MiB); the runtime sets it from payment.credit_max. The SAME ceiling paces the pull leg’s upstream speculative spend on a cache-miss pull (RampPacer, #1669), so the upstream and downstream ramps never diverge. Floored at one chunk so the serve loop can always make progress.

credit_ramp_divisor: u64

Ramp divisor for the credit window (ADR 003 §Credit window): the window is paid / credit_ramp_divisor, floored at one chunk and capped at credit_max. Defaults to DEFAULT_CREDIT_RAMP_DIVISOR (2); the runtime sets it from payment.credit_ramp_divisor. 0 opens the full ceiling immediately.

frame_target_bytes: u64

Target wire-frame size in bytes for the serve path (ADR 005 §cdn/client/v1). Node-local policy, never negotiated: the payer accepts any non-empty frame, and neither payment nor bao verification is defined over frame boundaries. Defaults to DEFAULT_FRAME_TARGET_BYTES (1 MiB); the runtime sets it from payment.frame_target_bytes. The serve loop clamps each request to the credit window’s remaining room, so this is a ceiling on frame size rather than an exact size.

idle_timeout: Option<Duration>

Application-layer idle-close ceiling for a whole connection (ADR 005 §Connection lifetime). None — the production path — reads as APP_IDLE_TIMEOUT (30s); tests set a shorter one.

pool_recheck_interval: Option<Duration>

Wall-clock cadence for the mid-stream pool-solvency re-check (ADR 003 §Pool solvency). None (the default and production path) reads as crate::pool_view::POOL_RECHECK_INTERVAL; a shorter value is set at construction only by tests, so a drain case need not wait a real interval.

pool_floor_signer_live_windows: u64

Per-signer LIVE concurrency cap k, in credit windows (ADR 003 §Pool solvency, per-signer floor isolation): the most live un-vouchered reservation one signer may hold, k · one_window. The runtime sets it from blockchain.pool_floor_signer_live_windows; the default of u64::MAX leaves it effectively unbounded, which is what unit tests that only exercise the pool-wide bound want. Lower-clamped to one window at use.

warming_credit: Arc<dyn WarmingCreditSink>

ADR 041 serve-credit boundary in front of the per-source warming allowance — the ledger the buy loop (crate::node_origin::NodeOriginConfig) debits and eviction forgets. On each clean serve the handler enqueues the realized operator margin for the source that speculatively warmed the blob (a no-op for an untagged / non-speculative hash), so the stream task never waits on the ledger lock. Defaults to the inert crate::warming_allowance::NoopWarmingCreditSink; the runtime overwrites it with the channel sink from crate::warming_allowance::spawn_warming_creditor, and a handler left with the default simply applies no warming credit.

operator_shares: OperatorShares

Live operator fee-share (basis points) cell (FeeRouter.getShares()[0]), the (1 − f) numerator the ADR 041 serve credit realizes. Defaults to zero (tests): a zero share credits nothing.

relay_foreign_namespaces: bool

Origin-only policy (#1759). When false, serve_stream declines any hash its own backend does not hold — including a cache HIT for a foreign hash — before any discovery, lane accounting, or spend. true (the default) serves and relays foreign hashes as well.

coarse_clock: Option<Arc<CoarseClock>>

Coarse wall clock for the two reads the voucher-accept path takes under the per-lane lock — the capability-expiry gate and the last_voucher_at stamp (issue #1792 item 4). None (the default and every test) means the handler builds its own unrefreshed clock, which reads the live wall clock on every call. The runtime sets Some with a refresher running, so each of those two reads becomes a relaxed atomic load instead of a SystemTime::now() syscall in the critical section.

redeem_interval_secs: u64

The redeemer’s self-tick interval in seconds (blockchain.redeem_interval_secs). The voucher-accept path stops accepting vouchers this interval plus the redeemer’s landing slack before a capability expires (decdn_common::config::capability_expiry_margin_secs, ADR 003 §Revocation). Defaults to the config default.

Implementations

impl ClientHandlerDeps

pub fn new( node_id: PublicKey, metrics: Arc<Metrics>, limiter: Arc<ConnectionLimiter>, cache: CacheEngine, eth_signer: Arc<PrivateKeySigner>, slash_domain: Eip712Domain, voucher_domain: Eip712Domain, bind_domain: Eip712Domain, channel_state_store: Arc<dyn PoolStateStore>, receipt_sink: Arc<dyn ReceiptSink>, rate_per_mb: u64, max_concurrent_streams: usize, content_deny: Arc<ContentDenylist>, pool_min_remaining_deposit: U256, shed: Arc<LoadShedController>, ) -> Self

The required runtime deps; every optional wiring hook defaults to None.

Trait Implementations

impl Debug for ClientHandlerDeps

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.