Module client 

cdn/client/v1 handler — paid blob delivery (ADR 005 §cdn/client/v1).

Serves the revenue path: a payer opens one bidirectional QUIC stream per blob, the node answers with a signed StreamResponse, then streams ChunkData frames, collecting one hash-chain preimage per delivered CHUNK_BYTES chunk — with a signed Voucher to open a chain, to roll one, and to settle a sub-chunk residual — and pausing only when the unpaid balance (delivered − paid) reaches the credit window — so delivery pipelines several intervals ahead of payment rather than stopping at each one — and finishing with ClientMessage::StreamEnd. A delivery fault rides in the initial response (ok: false + StreamError); a mid-stream voucher rejection is sent as a ClientMessage::StreamError and the stream is closed cleanly (no QUIC reset) so the client can read the reason.

Scope (#317 / #327)

This handler validates vouchers per lane — a (pool_id, signer, provider) triple keyed by LaneKey — against the persisted PoolStateStore. A lane’s watermark is hydrated from the store at construction (see ClientHandler::new) and, for a lane first seen live, created on the first voucher from its off-chain capability handle. A voucher whose pool_id names an unknown pool is rejected with VoucherRejectReason::WrongPool. After accepting a voucher the handler emits a redeem hint (via the redeem_hint sender wired on ClientHandlerDeps) so the settlement service can redeem the accrued claim once it crosses its threshold.

Structs

ClientHandler

cdn/client/v1 paid-delivery handler.

ClientHandlerDeps

Construction bundle for ClientHandler — the 16 required runtime deps plus every optional wiring hook, so a handler’s full configuration is one literal at its call site instead of a new() call followed by a setter chain.

ClientProtocol

Router-facing ProtocolHandler for cdn/client/v1.

LaneActivityClock

Read handle over the client handler’s live lane registry, exposing each lane’s whole-seconds age since its last accepted voucher for the admin lanes surface (issue #1733). Cloning shares the same registry Arc, so the admin surface and the handler observe one set of lanes. The timestamp lives on the lane’s own delivery state, stamped under the per-lane lock the voucher-accept path already holds, so reading liveness needs no separate global lock.

Constants

MAX_CLIENT_STREAMS

Default per-connection concurrent-stream cap for cdn/client/v1 (ADR 005 §Concurrent stream limits). The QUIC transport config also caps bidi streams at this value; the application semaphore makes the per-ALPN bound explicit and testable.