Crate cheers_verify 

cheers-verify — the edge-safe, verify-only surface

The verify half of edge-verifiable auth (R019). Everything here can check a session but cannot create one:

• PasetoV4PublicVerifier — PASETO v4.public (Ed25519) verification with a public key alone. The only TokenVerifier that cannot also mint (the symmetric codecs in cheers-server impl both halves).

• RevocationReader — the read side of the revocation split: point checks (jti, device, membership) against an eventually-consistent replica (CF KV / gossip). ReplicatedRevocations is the offline replica: it adopts issuer-signed revocation sets by epoch (R732-F6).

• IssuerTrust — “was this artifact signed by the issuer I trust?”, against a pinned key or a JWKS key set; exportable as a TrustDoc so an offline edge restarts against the keys it persisted.

• StandingVerifier — admits a standing node binding (R732-F5): no expiry, bound to the peer’s node key, ended only by revocation or by a newer binding for the same device (BindingLedger).

• EdgeVerifier — the facade a CF Worker holds: verify a token, then check it hasn’t been revoked. It takes a TokenVerifier, so there is no code path to mint — that absence is what makes shipping it to the edge safe.

• KeySetVerifier — verification against a JWKS key set with key-role enforcement (§D5), fed by a static KeySet or the W159 JwksCache (fetching over HTTP behind the jwks-http feature).

This crate depends on cheers-core and pasetors, but on no minter. cheers-server depends on this crate, never the reverse — that single direction is what guarantees a verify-only consumer has no minter in its dependency graph.

Re-exports

pub use edge::EdgeVerifier;

pub use jwks::JwkKey;

pub use jwks::JwksCache;

pub use jwks::JwksCacheConfig;

pub use jwks::JwksDoc;

pub use jwks::JwksError;

pub use jwks::JwksSource;

pub use jwks::KeyEntry;

pub use jwks::KeySet;

pub use key_set::KeySetVerifier;

pub use key_set::VerifyError;

pub use public_verifier::codec_err;

pub use public_verifier::kid_for;

pub use public_verifier::PasetoV4PublicVerifier;

pub use admit::artifact_hash;

pub use admit::verify_admit_with;

pub use admit::verify_device_artifact;

pub use admit::AdmitAuthority;

pub use admit::AdmitError;

pub use admit::Approval;

pub use admit::IssuerAdmitAuthority;

pub use admit::VerifiedAdmit;

pub use artifact::AnchorDoc;

pub use artifact::IssuerTrust;

pub use artifact::TrustDoc;

pub use revocation::membership_tag;

pub use revocation::revocation_entry;

pub use revocation::AdoptError;

pub use revocation::Adopted;

pub use revocation::ReplicatedRevocations;

pub use revocation::RevocationReader;

pub use snapshot::SnapshotError;

pub use snapshot::SnapshotLedger;

pub use snapshot::SnapshotLedgerDoc;

pub use snapshot::SnapshotVerifier;

pub use snapshot::VerifiedSnapshot;

pub use standing::BindingLedger;

pub use standing::ForeignLedger;

pub use standing::LedgerDoc;

pub use standing::StandingError;

pub use standing::StandingVerifier;

pub use standing::VerifiedStanding;

Modules

admit

Offline admission (R734-F2; knock.md, “Offline verification”).

artifact

IssuerTrust — which issuer a verifier believes, and how it knows that issuer’s keys (R732-F6).

edge

The EdgeVerifier facade — what a CF Worker holds.

jwks

JWKS document, key set, and the W159 cache (first fetch, atomic refresh, rate-limited kid-miss refetch, restart from disk).

key_set

KeySetVerifier — PASETO v4.public verification against a JWKS key set, with key-role enforcement (product-scopes-and-authorization.md §D5).

public_verifier

PASETO v4.public verifier — the edge-safe half of the asymmetric codec.

revocation

The read side of the revocation split.

snapshot

SnapshotVerifier — the edge check for a membership snapshot (R732-F4; noisetable W235 §0.1, §5).

standing

StandingVerifier — the edge check for a standing node binding (R732-F5; noisetable W235 §0.1, §5).