feat(antd, antd-go): external-signer single-chunk publish

[Nic-dorman]

Summary

Adds external-signer single-chunk publish to both halves of the SDK:

• antd — POST /v1/chunks/prepare + POST /v1/chunks/finalize. Unlike POST /v1/chunks (which requires AUTONOMI_WALLET_KEY on the daemon), neither new endpoint touches the daemon's wallet. Funds flow through the external signer's payForQuotes() exactly like the existing file/data prepare-and-finalize flow.
• antd-go — PrepareChunkUpload(ctx, content) + FinalizeChunkUpload(ctx, uploadID, txHashes), plus the PrepareChunkResult type.

Why

Today's POST /v1/chunks is daemon-wallet-only. Consumers that run antd wallet-less and pay externally (Indelible is the concrete one) have no way to publish single chunks through their own EVM signer. The existing file/data prepare/finalize endpoints don't help — those self-encrypt the input bytes into a multi-chunk DataMap-of-the-bytes, which is the wrong shape when you want to publish an already-serialized chunk verbatim at its content address.

A concrete trigger: a downstream republish flow (78 pre-existing private DataMaps that need to become public) wants to take serialized DataMap bytes already stored locally, publish them as one chunk each, and pay through its own signer rather than provisioning a hot wallet on antd. After this lands, that becomes a normal SDK call.

Surface

antd REST

POST /v1/chunks/prepare
{ "data": "<base64>" }

→ 200 (new chunk)
{
  "address": "<hex64>",
  "already_stored": false,
  "upload_id": "<hex32>",
  "payment_type": "wave_batch",
  "payments": [
    { "quote_hash": "0x…", "rewards_address": "0x…", "amount": "100" },
    …
  ],
  "total_amount": "700",
  "payment_vault_address": "0x…",
  "payment_token_address": "0x…",
  "rpc_url": "https://…"
}

→ 200 (already on network — no payment needed)
{
  "address": "<hex64>",
  "already_stored": true
}

POST /v1/chunks/finalize
{
  "upload_id": "<hex32>",
  "tx_hashes": { "<quote_hash>": "<tx_hash>", … }
}

→ 200
{ "address": "<hex64>" }

Wave-batch only. Single-chunk publishes don't need merkle batching — one chunk's worth of quotes is well below the wave-batch threshold.

antd-go

// happy path
res, _ := client.PrepareChunkUpload(ctx, content)
if !res.AlreadyStored {
    // external signer pays via res.Payments → tx_hashes
    addr, _ := client.FinalizeChunkUpload(ctx, res.UploadID, txHashes)
}

Implementation notes

• state.rs: new pending_chunks: Mutex<HashMap<String, TimestampedChunk>> map alongside the existing pending_uploads, with matching cleanup_stale_chunks. The periodic cleanup task in main.rs now sweeps both.
• chunk_prepare computes the BLAKE3 address up-front so the already-stored exit can return it without ant-core needing to (ant-core's prepare_chunk_payment short-circuits with Ok(None) in that case).
• Zero-amount quotes are filtered out of the payments array — they still live in peer_quotes for ProofOfPayment, but the external signer shouldn't pay for them.
• The chunks REST routes are method-distinct from the existing GET /v1/chunks/{addr} and POST /v1/chunks, so axum routes them correctly without precedence games.
• New types in types.rs use skip_serializing_if heavily so the already-stored response carries only address — no upload_id, no payment fields. Test coverage locks the wire shape.

ant-core dep pin

antd/Cargo.toml currently pins ant-core to the merge commit of WithAutonomi/ant-client#89 (c0f6a81), which adds the Client::finalize_chunk primitive this PR consumes. The rev pin will be bumped to a tag once ant-core cuts a release containing that commit.

Test plan

• cargo build clean
• cargo test — 37 tests pass (6 new type/serialization tests for the chunk surface)
• go build ./... clean (antd-go)
• go test ./... — full suite passes (3 new httptest-backed tests for PrepareChunkUpload / FinalizeChunkUpload)
• Reviewer: end-to-end smoke against a real daemon — quote one chunk via prepare, pay externally, finalize, fetch it back via GET /v1/chunks/{addr} and confirm byte-equality

🤖 Generated with Claude Code

[Nic-dorman]

E2E smoke result — PASSED on Arbitrum One mainnet

Drove prepare → payForQuotes → finalize → ChunkGet against a local antd built from b643bc8, paying via an external wallet (the antd was started wallet-less). Random 256-byte payload, full round-trip.

payload     256 bytes, first8=4b970dc57e5ea6d1

--- prepare ---
address           e60b6f72b3451fc0d7a46eb92054547fcdc03ae4f28bdffd2efa4c9d7b727315
already_stored    false
upload_id         abc95292c2342722e180666bbd570295
payment_type      wave_batch
payments          1 entries, total=11718823242187500 atto
evm rpc           https://arb1.arbitrum.io/rpc
evm token         0xa78d8321B20c4Ef90eCd72f2588AA985A4BDb684
evm vault         0x9A3EcAc693b699Fc0B2B6A50B5549e50c2320A26
prepare took      20.999s

--- pay ---
tx_hashes         1 entries
  15d078..47e9 -> e1bab4..114b
pay took          2.945s

--- finalize ---
stored at         e60b6f72b3451fc0d7a46eb92054547fcdc03ae4f28bdffd2efa4c9d7b727315
finalize took     725ms

--- verify (ChunkGet round-trip) ---
fetched           256 bytes
get took          773ms

E2E PASSED — chunk published via external signer round-tripped intact.

Things this confirms:

• prepare works against a wallet-less antd — the daemon collected one quote for ~0.0117 ANT (1.17e16 atto) without needing AUTONOMI_WALLET_KEY.
• The address returned at prepare time matches the address returned at finalize time — content addressing holds.
• The external wallet's payForQuotes(...) (the same shape Indelible already uses for file uploads) was sufficient for the single-chunk path — no special-casing in the signer.
• ChunkGet after finalize returns the exact bytes that went into prepare — full byte equality on a 256-byte payload.

/v1/chunks/prepare initial quote collection was the slow part at ~21s; the rest of the round-trip (pay + finalize + get) totaled ~4.4s. That's consistent with the file/data prepare flow which also dominates wall-clock on quote collection.