Module types 

HOP types and data structures.

Structs

HopEntryMeta

Metadata for a pool entry (stored in-memory index and on-disk .meta files).

PoolStatus

Pool statistics

Recipient

One intended recipient of a HOP entry: the ephemeral public key the sender generated for this handoff, paired with the claimed flag that tracks whether this recipient has acked. Fusing the two into a single struct (and a single BoundedVec<Recipient, ...>) makes it impossible — by construction and on disk — for the key list and the ack state to drift out of sync.

SubmitResult

Result of a successful hop_submit call

Enums

HopError

HOP errors

Constants

DEFAULT_BANDWIDTH_BURST_MIB

Default bandwidth burst per account in MiB.

DEFAULT_BANDWIDTH_PER_MIN_MIB

Default sustained bandwidth per account in MiB per minute.

DEFAULT_CHECK_INTERVAL_SECS

Default maintenance interval in seconds (5 minutes)

DEFAULT_MAX_POOL_SIZE

Default maximum pool size in bytes (10 GiB)

DEFAULT_MAX_POOL_SIZE_MIB

Default maximum pool size in MiB (10 GiB = 10240 MiB)

DEFAULT_MAX_USER_SIZE_MIB

Default per-user quota in MiB (256 MiB). Hard cap, not scaled by active users.

DEFAULT_PROMOTION_BUFFER_SECS

Default buffer before expiry at which to start promoting entries on-chain (2 h).

DEFAULT_RETENTION_SECS

Default retention period in seconds (24 hours).

DEFAULT_SUBMIT_BURST

Default submit burst per account (requests).

DEFAULT_SUBMIT_RATE_PER_MIN

Default sustained submit rate per account (requests per minute).

HOP_ACK_CONTEXT

Domain-separator prefix for hop_ack signatures.

HOP_BLOCK_TIME_SECS

Block-time assumption used when translating the wall-clock maintenance interval into block deltas for the promotion back-off scheduler.

HOP_CLAIM_CONTEXT

Domain-separator prefix for hop_claim signatures.

HOP_META_VERSION

On-disk format version for HopEntryMeta records. Startup recovery rejects .meta files whose version field doesn’t match, so same-shape schema changes (e.g. semantic reinterpretation of an existing field) can be rolled out by bumping this constant; shape changes are caught by SCALE decode failure.

HOP_SUBMIT_CONTEXT

Domain-separator prefix for hop_submit signatures.

MAX_PROMOTION_ATTEMPTS

Maximum number of promotion attempts per entry before the maintenance task gives up and lets the entry expire naturally. With the back-off schedule below this caps wasted work at 1+2+4+8+16 = 31 check intervals (~2.6 h at the default 5 min cadence) per stuck entry. The first 5 attempts fit inside the default 2 h promotion buffer; the 6th is an upper bound that may land past expiry on a stuck entry.

MAX_RECIPIENTS

Maximum number of recipients allowed per submission.

METADATA_COST_PER_RECIPIENT

Per-recipient overhead charged against pool capacity and per-user quota, in bytes. Covers the in-memory Recipient (a MultiSigner plus a bool). Kept as a small constant that over-approximates size_of::<Recipient>().

Functions

entry_accounted_size

Total bytes an entry charges against pool capacity: the blob plus bounded per-recipient metadata overhead.

promotion_backoff_blocks

Compute the back-off in blocks to wait before the next promotion attempt after attempts consecutive failures. The first failure triggers a 1× wait, doubling each subsequent failure: 1×, 2×, 4×, 8×, 16×, 32× the check interval, with the shift saturated to keep multiplication safe.

signing_payload

Compute the 32-byte payload that HOP recipients / submitters sign for a given operation. This is blake2_256(context || hash) and ensures signatures from one operation cannot be replayed in another.

submit_signing_payload

Compute the 32-byte payload signed at hop_submit time.

Type Aliases

HopBlockNumber

Block number type used by HOP.

HopHash

Hash type used by HOP.

RecipientVec

A Vec<Recipient> that SCALE-decode rejects if it exceeds MAX_RECIPIENTS, enforcing the fan-out cap at the type level instead of via scattered runtime checks.

SenderId

Sender identity derived from the account that signed the submission.