Module server 

HTTP server: XRPC endpoints over axum.

Currently exposes one route — GET /xrpc/com.atproto.label.subscribeLabels (§F4, WebSocket). Other endpoints land in their respective issues: the binary wire-up (main.rs serving a long-lived listener) is parked until #8 (queryLabels) so both public endpoints compose into one router.

Design notes:

• SubscribeConfig centralizes every runtime knob §F4 mentions: per-IP cap, global cap, batch size, ping/pong cadence, retention window. Default values match §F4 defaults so operators only override what their deployment requires.
• The router constructor takes ownership of a Pool<Sqlite> and a WriterHandle; both clone cheaply. The limiter is created here and wrapped in Arc so tests can inspect it with Limiter::snapshot.
• serve is a thin helper over axum::serve, mostly to keep integration tests from reimplementing the listen/accept dance.

Re-exports

pub use admin::AdminConfig;

pub use admin::admin_router;

pub use public::public_router;

pub use did_document::did_document_router;

pub use health::health_router;

pub use limits::Limiter;

pub use wellknown::wellknown_router;

Modules

admin

tools.cairn.admin.* handlers (§F12).

did_document

GET /.well-known/did.json — did:web DID document for Cairn (L3).

health

/health and /ready orchestrator probe endpoints (#23).

limits

Concurrent-subscriber caps (§F4, §12).

public

tools.cairn.public.* handlers (#54).

wellknown

Embedded lexicon bundle + .well-known/lexicons/… endpoint (§8 + §F13).

xrpc

Shared XRPC primitives used across queryLabels, createReport, and the admin handlers. Currently just the opaque cursor codec — factoring it here prevents the three callers from drifting on encoding decisions (base64url vs standard, trailing newline, etc.).

Structs

CreateReportConfig

Configuration knobs for the createReport endpoint. Defaults track §F11 values; operators override via config file.

RetentionConfig

Sweep-execution policy for the subscribeLabels retention sweep (§F4 retention task). Distinct from SubscribeConfig::retention_days — that field is the cutoff source of truth (read-side floor + write- side cutoff); this struct holds how the sweep runs, not when the cutoff lies. Operators tune the two independently:

SubscribeConfig

Tunables for the subscribeLabels endpoint. All defaults match §F4.

Functions

create_report_router

Build a Router exposing only /xrpc/com.atproto.moderation.createReport. Compose via Router::merge with subscribe/query/admin routers.

current_retention_floor

Live retention floor: oldest visible seq whose row’s created_at is within retention_days of now. Returns None for an empty (or wholly-expired) table. When retention_days = None, returns the MIN(seq) across ALL rows (no cutoff applied).

router

Build a router exposing the public label endpoints. The caller owns the pool and writer; dropping all cloned WriterHandles signals shutdown.

serve

Serve router on addr. Returns when the listener errors or the surrounding runtime shuts down.