Struct Server 

pub struct Server { /* private fields */ }

The HTTP API, its background jobs, and the state they share.

Implementations

impl Server

pub fn new(cfg: Config, store: Arc<Store>) -> Self

Builds a server around an already-open store. Nothing is recorded yet: the start leaf waits until the server is serving (see Server::serve_with_shutdown).

pub fn router(&self) -> Router

The router, built separately from binding a port so tests can drive it without real sockets.

pub async fn refresh_claude_status(&self)

Re-runs the local claude auth status probe.

pub fn claude_status(&self) -> Status

The last known state of the claude CLI.

pub fn set_claude_status(&self, status: Status)

Overrides the cached CLI status.

Exposed so tests can exercise the merge-failure path — reaching it otherwise needs a real, logged-in CLI on the machine running them.

pub fn set_clock_offset(&self, seconds: i64)

Moves the clock device signatures are judged by, in seconds.

Exposed so tests can reach the edges of the signature window, and what happens after it, without waiting a minute for each.

pub fn backdate_start(&self, seconds: i64)

Makes this server act as if it had started seconds earlier than it did.

Exposed so tests can sign requests at once, rather than waiting out the few seconds after a start in which every signature is refused.

pub fn backdate_last_claim(&self, seconds: u64)

Makes the last claim by a worker, or this server’s start if there has been none, seconds older than it is.

Exposed so tests can reach a worker whose claims have stopped without waiting minutes for it.

pub async fn drain_jobs(&self) -> Result<()>

Merges the jobs left in the queue here, or marks them failed when this server cannot merge, if no worker is enrolled; otherwise does nothing. Run by itself when the last worker is revoked and on every sweep; exposed so tests can wait for it.

pub fn run_scheduled_evaluation(&self) -> Result<Option<String>>

Queues the run RECALL_EVAL_INTERVAL_HOURS asks for: every project, never the contradiction check. Skipped, answering None, while no worker is enrolled or another run is open. Run by itself on the schedule; exposed so tests need not wait an hour for it.

pub fn run_backup(&self)

Writes a backup now. Failure is logged, never propagated: it becomes visible through /health’s last_backup_at going stale.

pub fn issue_bootstrap_code(&self) -> Result<Option<BootstrapCode>>

Issues a new bootstrap code, when passkey sign-in is on and no passkey is registered: the one-time code that, with RECALL_TOKEN, registers the first. None otherwise. recall-server calls it on start and prints what it gets; see crate::bootstrap.

pub fn public_url(&self) -> Option<&str>

Where the admin page is, when RECALL_PUBLIC_URL says.

pub fn sweep_devices(&self) -> Result<(usize, usize)>

Removes ephemeral devices idle for longer than Config::ephemeral_device_ttl, and enrolments that expired over an hour ago. Answers how many of each went.

pub fn start_background(&self) -> Vec<JoinHandle<()>>

Starts background work: the first Claude CLI status check, its refresh loop, backups, the device sweep, and draining a queue no worker is left to take. All of it is best-effort — none of it may take the sync API down.

pub async fn serve(&self) -> Result<()>

Binds cfg.addr and serves until SIGTERM or ctrl-c, then shuts down gracefully so an in-flight merge isn’t cut off mid-write, and empties the WAL into the database file (Store::checkpoint_all).

pub async fn serve_with_shutdown<F>( &self, listener: TcpListener, shutdown: F, ) -> Result<()>

where F: Future<Output = ()> + Send + 'static,

Serves on an already-bound listener until shutdown resolves, in whichever transport cfg.tls names (see server/tls.rs; plain HTTP, the default, still goes through axum::serve directly, unchanged).

Once the transport is ready, records a start leaf in the audit log: the server’s own doing, so its actor is crate::audit::leaf::Actor::Server, and its subject the version that started. Here rather than in Server::new so that only a server that got its port, and its certificate, records one: one that failed to bind because another was still running, or to load its key, leaves nothing. Best-effort — a store the audit table somehow cannot be written to still serves sync, the same way a failed backup does not take the server down.