mpool

type Config struct {
	// Topic name. Defaults to build.MainnetGossipTopicMessages.
	Topic string
	// DryRun: when true, Publish validates locally and records the
	// would-be publish but doesn't actually push to gossipsub. Useful
	// for production safety while we shake out the libp2p mesh.
	DryRun bool
	// OnMessage is fired for every signed message received from the
	// network. Nil means "ignore incoming traffic".
	OnMessage func(*ltypes.SignedMessage, peer.ID)

	// --- #47: pending confirm + rebroadcast loop ---
	//
	// ConfirmAfterEpochs is the confidence window: a published message not
	// seen on chain for at least this many epochs is rebroadcast (identical
	// bytes, same nonce/CID). Default 3 (~90s mainnet). Long enough that a
	// slow-but-valid inclusion isn't mistaken for failure.
	ConfirmAfterEpochs int64
	// MaxRetries caps rebroadcasts before a message is marked failed.
	// Default 5. 0 uses the default; use a negative value for "unlimited".
	MaxRetries int
	// OnFailed, if set, is invoked once when a pending message gives up
	// (max retries exhausted). The message is also moved to a failed set
	// observable via Stats.Failed. Never silently stuck.
	OnFailed func(*ltypes.SignedMessage, string)

	// --- #119: durable pending-message store ---
	//
	// PersistPath is the on-disk JSONL journal Lantern uses to keep the
	// pending set alive across daemon restart. When empty (the historical
	// default), the pool is memory-only and behaves like pre-#119.
	//
	// When set:
	//   - New() opens the file, replays the journal, and re-registers every
	//     live entry into the in-memory pending set. Nonce derivation
	//     (MpoolGetNonce) reads Pending() so a restart transparently keeps
	//     each account's next nonce correct.
	//   - Publish() fsyncs an "add" line before returning success.
	//   - Reconcile confirm/fail branches fsync a "tombstone" line.
	//   - Rebroadcast fsyncs a "retry" line with the bumped counter.
	//
	// The file lives at <home>/<network>/mpool/pending.jsonl. It is chain-
	// side of the secrets boundary (never in keystore/, secrets/, or
	// backups/), but `lantern reset --chain-state` deliberately does NOT
	// wipe it: user-signed pending messages are user state, not rebuildable
	// chain state.
	PersistPath string

	// --- #123: alternate wire sink for devnet ---
	//
	// Sink, when non-nil, replaces the gossipsub topic.Publish call in
	// Publish(). This is the devnet lotus-RPC path: on a single-node
	// docker devnet the gossipsub mesh can't form, so signed messages
	// are POST'd directly to the devnet lotus via Filecoin.MpoolPush
	// instead. All other Pool semantics (persist journal, pending set,
	// nonce derivation, reconcile/retry loop) work identically.
	//
	// When Sink is set, New() may be called with a nil pubsub instance;
	// no topic is joined and no subscription is created. The reconcile
	// loop still runs, rebroadcasting via Sink until inclusion.
	Sink func(ctx context.Context, sm *ltypes.SignedMessage, raw []byte) (cid.Cid, error)
}

type PersistEntry struct {
	CID           cid.Cid
	Raw           []byte
	PublishedAt   int64
	Retries       int
	FirstSeenWall time.Time
}

type Pool struct {
	// contains filtered or unexported fields
}

type SearchFunc func(ctx context.Context, msgCID cid.Cid) (SearchResult, error)

type SearchResult int

type Stats struct {
	Received     uint64
	Rejected     uint64
	Published    uint64
	Rebroadcasts uint64 // #47
	Confirmed    uint64 // #47
	Failed       uint64 // #47
	PendingCnt   int
	Topic        string
	Restored     uint64 // #119 — entries re-registered from persist journal on startup
	PersistPath  string // #119 — empty when persistence is disabled
}