Crate cheers_server 

cheers-server — the origin-side surface

The mint half of edge-verifiable auth (R019): everything that can create or destroy a session, plus the origin-homed stores. Holding any of this is origin-only power, which is why it lives below cheers-verify in the DAG and never leaks to the edge.

• codec — the concrete token codecs. The symmetric PasetoV4Codec (v4.local, encrypted) and HmacBlobCodec (HMAC-SHA256) impl both TokenMinter and TokenVerifier on one type, so they MUST live here — putting them in cheers-verify would re-grant mint to the edge. The asymmetric PasetoV4SecretMinter (Ed25519 secret key) mints only; its matching public verifier lives in cheers-verify.
• store — the origin stores UserStore and RefreshStore (CredentialStore, the device store, stays in cheers-core).
• refresh — refresh-token rotation with replay detection.
• revocation — RevocationWriter, the cold-path write side (the edge holds cheers_verify::RevocationReader).
• standing — the StandingBinder that mints standing node bindings for LanPair sessions, and its per-device BindingSequenceStore.
• session — the SessionAuthority facade that assembles the above.

This crate depends on cheers-verify (and through it cheers-core); the reverse never holds, which is what keeps the edge minter-free.

Re-exports

pub use audit::AuditCursor;

pub use audit::AuditCursorError;

pub use audit::AuditPage;

pub use audit::AuditQuery;

pub use audit::AuditQueryError;

pub use audit::AuditRecord;

pub use audit::AuditRow;

pub use audit::AuditStore;

pub use audit::AuditValidationError;

pub use audit::DEFAULT_AUDIT_PAGE_LIMIT;

pub use audit::MAX_AUDIT_PAGE_LIMIT;

pub use audit::MemoryAuditStore;

pub use bundles::BundleExpansionError;

pub use bundles::BundleName;

pub use bundles::BundleStore;

pub use bundles::MemoryBundleStore;

pub use bundles::ScopeOrBundle;

pub use bundles::expand_scopes;

pub use camp::CampAuthority;

pub use camp::CampAuthorityError;

pub use camp::CampBootstrapCredential;

pub use camp::CampBootstrapPolicy;

pub use camp::CampPrincipalStore;

pub use camp::MemoryCampPrincipalStore;

pub use camp::MemoryUserSigningKeyStore;

pub use camp::NewCampPrincipal;

pub use camp::ProvisionedCamp;

pub use camp::UserSigningKey;

pub use camp::UserSigningKeyStatus;

pub use camp::UserSigningKeyStore;

pub use codec::HmacBlobCodec;

pub use codec::PasetoV4Codec;

pub use codec::PasetoV4SecretMinter;

pub use grants::GrantStore;

pub use grants::SchemaGrantStore;

pub use knock::Admission;

pub use knock::Admitted;

pub use knock::KnockAuthority;

pub use knock::KnockConfig;

pub use knock::KnockFlowError;

pub use knock::KnockStore;

pub use knock::MemoryKnockStore;

pub use knock::PendingKnock;

pub use knock::Queued;

pub use knock::Reconciled;

pub use knock::Redeemed;

pub use knock::StoredOffer;

pub use mcp_authority::McpAuthority;

pub use mcp_authority::McpMintError;

pub use mcp_authority::McpPolicy;

pub use mcp_authority::MintedMcpToken;

pub use ownership::new_revocation_key;

pub use ownership::next_ownership_version;

pub use ownership::Inserted;

pub use ownership::MemoryOwnershipStore;

pub use ownership::NewOwnership;

pub use ownership::OwnershipRow;

pub use ownership::OwnershipStore;

pub use ownership::OwnershipTuples;

pub use ownership::OwnershipValidationError;

pub use ownership::SeedTuple;

pub use ownership::TupleLease;

pub use ownership::seed_ownership;

pub use refresh::ChainId;

pub use refresh::LiveRefresh;

pub use refresh::RefreshRotator;

pub use refresh::RefreshToken;

pub use refresh::Rotated;

pub use revocation::epoch_from_sql;

pub use revocation::next_epoch;

pub use revocation::revoked_columns;

pub use revocation::revoked_from_columns;

pub use revocation::MemoryRevocationStore;

pub use revocation::RevokedColumns;

pub use revocation::RevocationPublisher;

pub use revocation::RevocationSnapshot;

pub use revocation::RevocationWriter;

pub use revocation::SignedRevocationSet;

pub use service_principal::MemoryServicePrincipalStore;

pub use service_principal::NewServicePrincipal;

pub use service_principal::OverlapPolicy;

pub use service_principal::ProvisionedKey;

pub use service_principal::ServicePrincipalAuthority;

pub use service_principal::ServicePrincipalError;

pub use service_principal::ServicePrincipalStore;

pub use service_principal::SigningKey;

pub use service_principal::SigningKeyStatus;

pub use session::BindingResolver;

pub use session::NewSession;

pub use session::SessionAuthority;

pub use session::SessionPolicy;

pub use snapshot::revoke_ownership;

pub use snapshot::revoke_principal_ownership;

pub use snapshot::SignedSetSnapshot;

pub use snapshot::SnapshotIssuer;

pub use standing::next_binding_seq;

pub use standing::BindingSequenceStore;

pub use standing::MemoryBindingSequenceStore;

pub use standing::SignedStandingBinding;

pub use standing::StandingBinder;

pub use user_tokens::decode_scopes;

pub use user_tokens::encode_scopes;

pub use user_tokens::MemoryUserTokenStore;

pub use user_tokens::UserTokenRecord;

pub use user_tokens::UserTokenStore;

pub use store::NewUser;

pub use store::PasskeyCredentialStore;

pub use store::ProviderKey;

pub use store::RefreshStore;

pub use store::RefreshTokenRecord;

pub use store::UserStore;

Modules

audit

Centralized audit table — the AuditStore trait.

bundles

Role-bundle storage and mint-time expansion.

camp

Camp-principal bootstrap — provision a camp on behalf of a user U.

codec

Concrete session-token codecs — origin-side.

grants

Grant persistence — what scope-or-bundle entries a principal holds against a given audience.

knock

Knock on the issuer side: online knocks, offers, and reconciliation of offline Admits (knock.md, “Reconciliation”, “Sybil controls”; R734-F4).

mcp_authority

The McpAuthority origin facade for minting MCP-call tokens.

ownership

Embedded-ownership persistence — the OwnershipStore trait.

refresh

Refresh-token rotation with replay detection.

revocation

The write side of the revocation split, and the issuer’s signed revocation set (R732-F6).

service_principal

Service-principal lifecycle — provisioning, rotation, key publication.

session

The SessionAuthority origin facade + SessionPolicy TTL defaults.

snapshot

The issuer half of the membership snapshot (R732-F4; noisetable W235 §0.1, §2.4, §5).

standing

The issuer half of the standing node binding (R732-F5; noisetable W235 §0.1, §5).

store

Origin-side persistence contracts — UserStore and RefreshStore.

user_tokens

User API tokens (PATs) — the metadata half.

Structs

EdgeVerifier

Edge facade: verify a token, then check it hasn’t been revoked.

IssuerTrust

One trusted issuer and the keys that may speak for it. Cheap to clone.

PasetoV4PublicVerifier

PASETO v4.public verifier — checks signatures with an Ed25519 public key.

ReplicatedRevocations

An offline replica of one issuer’s revocation set (R732-F6).

SnapshotVerifier

The edge facade for membership snapshots: trust, revocation replica and supersession ledger for one issuer. Holds no minter.

StandingVerifier

The edge facade for standing node bindings: trust, revocation replica and supersession ledger for one issuer. Like EdgeVerifier it holds no minter.

Traits

RevocationReader

Edge-side revocation check. The verify-only consumer depends on this — it can ask whether something is revoked but holds no power to revoke.