acmeserver

type Account struct {
	ID     string
	Status AccountStatus
	// The account key. KeyThumbprint is its RFC 7638 thumbprint, unique among accounts.
	Key                  crypto.PublicKey
	KeyThumbprint        string
	Contact              []string
	TermsOfServiceAgreed bool
	// The identity the host derived from a verified external account binding.
	ExternalAccountID string
	// The single-use claim on that binding, set when Config.SingleUseExternalAccounts is on.
	// Stores keep non-empty claims unique among accounts.
	ExternalAccountClaim string
	CreatedAt            time.Time
	// Increases on every successful update and guards concurrent modification.
	Revision uint64
}

type AccountStatus string

type AccountStore interface {
	// Stores a new account with revision 1. It returns ErrConflict when the ID, the key
	// thumbprint or a non-empty ExternalAccountClaim is already in use.
	CreateAccount(ctx context.Context, account *Account) error
	// Returns the account with the given ID or ErrNotFound.
	Account(ctx context.Context, id string) (*Account, error)
	// Returns the account whose key has the given thumbprint or ErrNotFound.
	AccountByKey(ctx context.Context, thumbprint string) (*Account, error)
	// Replaces the stored account when the revisions match and increments
	// account.Revision. It returns ErrRevisionMismatch, ErrNotFound or ErrConflict otherwise.
	UpdateAccount(ctx context.Context, account *Account) error
}

type AllowAll struct{}

type Authorization struct {
	ID         string
	AccountID  string
	OrderID    string
	Identifier Identifier
	Status     AuthorizationStatus
	Expires    time.Time
	// Marks a wildcard authorization. Identifier then holds the base name.
	Wildcard     bool
	ChallengeIDs []string
	// Records that the successful challenge also authorized a CA certificate for the identifier.
	CACertificate bool
	// The time after which the proof no longer covers a certificate, zero when unbounded.
	GrantExpires time.Time
	// The further names and network function type the successful challenge granted, see
	// ValidationGrant.
	GrantNames  []Identifier
	GrantNFType string
	// Marks an authorization the Policy granted without a challenge, see PreApprover. It never
	// lets the account revoke another account's certificate.
	PreApproved bool
	CreatedAt   time.Time
	Revision    uint64
}

type AuthorizationStatus string

type Certificate struct {
	// The base64url SHA-256 digest of the DER leaf, which names the certificate resource.
	ID        string
	AccountID string
	OrderID   string
	// The opaque reference returned by the host CA.
	CAReference string
	// Holds the DER leaf certificate followed by the DER issuer chain the client receives.
	Chain     [][]byte
	NotBefore time.Time
	NotAfter  time.Time
	Revoked   bool
	RevokedAt time.Time
	// The CRL reason code recorded at revocation.
	RevocationReason int
	// Identifies the revocation the host CA receives. It is committed with the reason before the
	// first CA call and reused by every retry, so the CA can deduplicate. It is cleared with the
	// reason when the CA refuses the revocation.
	RevocationOperationID string
	// When the revocation was recorded, before the CA call. RevokedAt is set after the CA succeeded.
	RevocationRequestedAt time.Time
	// The RFC 9773 identifier built from the leaf's authority key identifier and serial number.
	// It is empty when the leaf has no authority key identifier. Stores keep non-empty values
	// unique among certificates.
	RenewalID string
	// The order that claimed this certificate as its predecessor through replaces.
	ReplacedByOrderID string
	// The validation evidence the issuer received, kept for host audit needs.
	Validations []Validation
	CreatedAt   time.Time
	Revision    uint64
}

type CertificateStore interface {
	// Returns the certificate with the given ID or ErrNotFound.
	Certificate(ctx context.Context, id string) (*Certificate, error)
	// Returns the certificate with the given non-empty RenewalID or ErrNotFound.
	CertificateByRenewalID(ctx context.Context, renewalID string) (*Certificate, error)
	// Replaces the stored certificate when the revisions match and increments cert.Revision.
	UpdateCertificate(ctx context.Context, cert *Certificate) error
}

type Challenge struct {
	ID              string
	AuthorizationID string
	AccountID       string
	Type            ChallengeType
	Status          ChallengeStatus
	Token           string
	// The Authority Token a tkauth-01 response carried, see RFC 9448 section 4.
	AuthorityToken string
	// The account key thumbprint captured at response time, so a key rollover
	// does not change an in-flight validation.
	KeyThumbprint string
	Validated     time.Time
	// Records why validation failed.
	Error    *Problem
	Revision uint64
}

type ChallengeStatus string

type ChallengeType string

type Clock interface {
	Now() time.Time
}

type ClockFunc func() time.Time

type Config struct {
	// The absolute URL the handler is served under, including any path prefix.
	// It must use https unless AllowInsecureBaseURL is set.
	BaseURL string
	// Accepts an http BaseURL for tests and local examples.
	AllowInsecureBaseURL bool
	// Persists resources and background work.
	Store Store
	// Issues and consumes the single-use request nonces.
	Nonces NonceManager
	// Defaults to the system clock.
	Clock Clock
	// Receives operational events. It defaults to a logger that discards everything.
	Logger *slog.Logger
	// Optional directory metadata. Nothing is advertised when it is empty.
	Meta DirectoryMeta
	// Bounds the size of a request body in bytes. Zero selects DefaultMaxRequestBody.
	MaxRequestBody int64
	// Signs certificates for finalized orders.
	Issuer Issuer
	// Revokes issued certificates.
	Revoker Revoker
	// The RFC 5280 reason codes clients may request. Empty allows unspecified (0),
	// keyCompromise (1), affiliationChanged (3), superseded (4) and cessationOfOperation (5).
	// Only 0 to 5, 9 and 10 may be listed, because an ACME revocation is final and cannot be a
	// certificateHold (6).
	RevocationReasons []int
	// Learns about authenticated finalize and revokeCert requests the server refuses. Optional.
	Refusals RefusalRecorder
	// Limits how often clients may get nonces, create accounts and place orders. Optional. Without
	// it nothing is limited.
	Limits Limiter
	// The challenge types offered to clients. Only configured types appear in authorizations.
	Validators map[ChallengeType]Validator
	// Verifies external account bindings. Required when Meta.ExternalAccountRequired is set.
	ExternalAccounts ExternalAccountKeys
	// Binds each external account key identifier to at most one account. The claim is committed
	// with the account, and a later newAccount with the same identifier and another key is refused.
	SingleUseExternalAccounts bool
	// Reviews new accounts and orders. Defaults to AllowAll.
	Policy Policy
	// Reviews current issuance policy before dispatch, with the accepted CSR and validation evidence.
	IssuancePolicy IssuancePolicy
	// Refuses new accounts that do not agree to Meta.TermsOfService.
	RequireTermsOfServiceAgreed bool
	// Accepts IP identifiers as specified in RFC 8738.
	IPIdentifiers bool
	// Accepts TNAuthList identifiers as specified in RFC 9448. It needs a tkauth-01 validator.
	TNAuthListIdentifiers bool
	// Lets a certificate issued for a TNAuthList identifier outlive the Authority Token, as
	// ATIS-1000080 clause 6.3.8 specifies for STIR/SHAKEN. The token must still be valid when
	// signing starts. By default the token expiry bounds the certificate, as RFC 9447 section 7
	// recommends.
	TNAuthListCertificatesOutliveTokens bool
	// Accepts NfInstanceId identifiers of 5G network functions as described in 3GPP TS 33.310
	// Annex J. It needs a tkauth-01 validator.
	NfInstanceIDIdentifiers bool
	// The https URL offered as token-authority on tkauth-01 challenges, see RFC 9447 section 3.
	// It is optional, and clients fall back to their own configuration when it is empty.
	TokenAuthority string
	// How long a new order and its pending authorizations stay valid.
	OrderLifetime time.Duration
	// How long a validated authorization stays valid.
	AuthorizationLifetime time.Duration
	// Bounds the identifiers of one order.
	MaxIdentifiers int
	// Bounds the validation tasks one account may have waiting or running at the same time. A
	// challenge response beyond the bound is refused with rateLimited and a Retry-After header
	// until earlier validations finish, so one account cannot occupy every worker for long. Zero
	// selects the MaxIdentifiers in effect, which lets one full order validate at once.
	MaxPendingValidations int
	// Bounds a store write that has to finish after the client request it belongs to has ended,
	// such as recording a revocation the Revoker already carried out. Zero selects
	// DefaultDetachedWriteTimeout.
	DetachedWriteTimeout time.Duration
	// The certificate profiles advertised in the directory meta and accepted on new orders, see
	// draft-ietf-acme-profiles. Empty leaves the extension off. A new order that names a profile is
	// then refused with invalidProfile.
	Profiles []Profile
	// The profile an order gets when the client names none. It is required when Profiles is set
	// and must be one of them.
	DefaultProfile string
	// Serves RFC 9773 renewal information and accepts replaces on new orders when set.
	// LifetimeRenewal is the built-in advisor. Nil leaves the extension off.
	RenewalInfo RenewalAdvisor
	// Tunes Run and Ready.
	Workers WorkerConfig
}

type DirectoryMeta struct {
	// The URL of the current terms of service.
	TermsOfService string
	// The URL of the CA's website.
	Website string
	// The hostnames the CA recognizes in CAA issue and issuewild records.
	CAAIdentities []string
	// Tells clients that newAccount needs an external account binding.
	ExternalAccountRequired bool
}

type ErrorType string

type ExternalAccountKeys interface {
	// Returns the MAC key for the key identifier or ErrNotFound.
	MACKey(ctx context.Context, keyID string) ([]byte, error)
}

type GrantingValidator interface {
	Validator
	ValidateGrant(ctx context.Context, req ValidationRequest) (ValidationGrant, error)
}

type Identifier struct {
	Type  IdentifierType `json:"type"`
	Value string         `json:"value"`
}

type IdentifierType string

type IssuancePolicy interface {
	AuthorizeIssuance(ctx context.Context, req IssueRequest) error
}

type IssuanceState struct {
	OperationID  string
	AuthorizedAt time.Time
	Deadline     time.Time
	Validations  []Validation
}

type IssueRequest struct {
	OperationID string
	AccountID   string
	AccountURL  string
	OrderID     string
	// The parsed certificate request and its DER encoding. The signature and the identifier
	// set were already checked against the order. CSR.PublicKey is nil for a composite ML-DSA
	// key. Read that key with compositex509.ParsePKIXPublicKey from CSR.RawSubjectPublicKeyInfo
	// and certify it with compositex509.CreateCertificate. CSR.PublicKey is also nil for an
	// SLH-DSA key (RFC 9909), which the issuer certifies with RawSubjectPublicKeyInfo unchanged.
	CSR    *x509.CertificateRequest
	CSRDER []byte
	// The normalized identifiers the order covers.
	Identifiers []Identifier
	// The requested validity. Zero values mean the host decides. An authority token expiry
	// narrows NotAfter. The issuer may return a shorter validity, but the leaf must fit inside
	// the requested window and must be valid already unless NotBefore is in the future.
	NotBefore time.Time
	NotAfter  time.Time
	// How each identifier was validated.
	Validations []Validation
	// The earliest order, authorization or authority token expiry, after which new signing is
	// forbidden.
	Deadline time.Time
	// Allows only recovery of an existing result, never a new signing operation.
	RecoveryOnly bool
	// The Order.Profile name the certificate is issued under. It is empty when the server offered
	// no profiles when the order was created.
	Profile string
}

type IssueResult struct {
	// The DER leaf certificate followed by the DER issuer chain.
	Chain [][]byte
	// An opaque host CA reference retained with issued or unpublished results.
	CAReference string
	// Reports that the CA has not decided yet. The worker asks again after RetryAfter.
	Pending    bool
	RetryAfter time.Duration
	// A final refusal that becomes the order error.
	Rejected *Problem
}

type Issuer interface {
	Issue(ctx context.Context, req IssueRequest) (IssueResult, error)
}

type LifetimeRenewal struct {
	// Fractions of the lifetime at which the window starts and ends. Zero values mean two
	// thirds and five sixths.
	Start float64
	End   float64
	// Copied into every response.
	ExplanationURL string
	RetryAfter     time.Duration
	// Dates the window of a revoked certificate. Defaults to the system clock.
	Clock Clock
}

type LimitKind string

type LimitRequest struct {
	Kind LimitKind
	// The address of the client connection, taken from http.Request.RemoteAddr with IPv4-mapped
	// IPv6 addresses unmapped. It is the zero Addr when RemoteAddr holds no IP address. Forwarded
	// headers are never read, because any client can set them. A host behind a trusted reverse
	// proxy can rewrite RemoteAddr before the request reaches the handler.
	Client netip.Addr
	// For newAccount the account the request would create, not yet stored. For newOrder and
	// challengeResponse the account making the request.
	Account *Account
	// For newOrder the normalized identifiers of the order. For challengeResponse the identifier
	// of the authorization, with its wildcard prefix.
	Identifiers []Identifier
	// The certificate a new order replaces, checked against the account and the identifiers as
	// RFC 9773 section 5 requires. Empty when the order replaces nothing.
	Replaces string
	// For challengeResponse the validations of the account that are waiting or running before
	// this one. The server has already checked that it is below Config.MaxPendingValidations.
	PendingValidations int
}

type Limiter interface {
	Allow(ctx context.Context, req LimitRequest) error
}

type NonceManager interface {
	// Returns a fresh nonce in base64url form.
	Issue(ctx context.Context) (string, error)
	// Invalidates the nonce and reports whether it was valid. A nonce is valid exactly once.
	Consume(ctx context.Context, nonce string) (bool, error)
}

type Order struct {
	ID          string
	AccountID   string
	Status      OrderStatus
	Expires     time.Time
	Identifiers []Identifier
	// The requested validity. Zero values mean unset.
	NotBefore        time.Time
	NotAfter         time.Time
	AuthorizationIDs []string
	// Records why the order became invalid.
	Error *Problem
	// The DER request accepted at finalization. It never changes once set.
	CSR           []byte
	CertificateID string
	// The durable authorization decision made before the first CA call.
	Issuance *IssuanceState
	// A CA result withheld from clients and retained for host reconciliation.
	UnpublishedResult *IssueResult
	// The RFC 9773 identifier of the certificate this order replaces, set when the client sent
	// replaces and Config.RenewalInfo is enabled. Stores mark that certificate replaced by this
	// order when the order is created.
	Replaces string
	// The certificate profile selected when the order was created, see draft-ietf-acme-profiles.
	// It is empty when the server offered no profiles at that time.
	Profile   string
	CreatedAt time.Time
	Revision  uint64
}

type OrderStatus string

type OrderStore interface {
	// Stores an order together with its authorizations and challenges, all at revision 1.
	// It returns ErrConflict when any ID is already in use. When order.Replaces is set, the
	// same operation marks the certificate with that RenewalID as replaced by the order,
	// returning ErrNotFound when no such certificate exists and ErrAlreadyReplaced when an order
	// that is not invalid at order.CreatedAt already replaced it, see RFC 9773 section 5.
	CreateOrder(ctx context.Context, order *Order, authzs []*Authorization, challenges []*Challenge) error
	// Returns the order with the given ID or ErrNotFound.
	Order(ctx context.Context, id string) (*Order, error)
	// Returns up to limit order IDs of the account in creation order, starting after the
	// given ID. An empty after starts at the beginning.
	OrderIDs(ctx context.Context, accountID, after string, limit int) ([]string, error)
	// Returns the authorization with the given ID or ErrNotFound.
	Authorization(ctx context.Context, id string) (*Authorization, error)
	// Replaces the stored authorization when the revisions match and increments authz.Revision.
	// When the authorization reaches a terminal status, the same operation marks its order invalid
	// with Error set to InvalidAuthorizationProblem() unless issuance was already dispatched.
	UpdateAuthorization(ctx context.Context, authz *Authorization) error
	// Reports whether the account holds a valid unexpired authorization that is not PreApproved
	// for every identifier, read in one consistent snapshot. Revocation by another account relies
	// on it.
	AuthorizedFor(ctx context.Context, accountID string, identifiers []Identifier, now time.Time) (bool, error)
	// Returns the challenge with the given ID or ErrNotFound.
	Challenge(ctx context.Context, id string) (*Challenge, error)
}

type Policy interface {
	// Reviews a new account. The key, contacts and external account identity are set.
	NewAccount(ctx context.Context, account *Account) error
	// Reviews a new order after identifier normalization. The policy may change NotBefore and
	// NotAfter. Any other change, or a NotAfter no later than NotBefore, fails the request with
	// serverInternal.
	NewOrder(ctx context.Context, account *Account, order *Order) error
}

type PreApprover interface {
	// Returns the identifiers of a new order that need no challenge. It runs after NewOrder has
	// accepted the order, which it must not change. Each returned identifier must be one of
	// order.Identifiers, wildcard names included. A returned *Problem refuses the order and any
	// other error, or an identifier the order does not contain, is reported as serverInternal.
	PreApprove(ctx context.Context, account *Account, order *Order) ([]Identifier, error)
}

type Problem struct {
	Type   ErrorType
	Detail string
	// Overrides the default HTTP status of the type when it is not zero.
	Status int
	// Names the identifier a subproblem refers to.
	Identifier  *Identifier
	Subproblems []*Problem
	// Lists the supported signature algorithms in a badSignatureAlgorithm problem.
	Algorithms []string
	// Sets the Retry-After header. It is not serialized.
	RetryAfter time.Duration
}

type Profile struct {
	// The name clients send in the newOrder profile member. It has 1 to 64 ASCII letters, digits,
	// dots, underscores or hyphens and starts with a letter or digit.
	Name string
	// A human-readable description the server publishes as plain text at <BaseURL>profiles/<Name>.
	Description string
	// An absolute https URL of a description published elsewhere. Exactly one of Description and
	// URL is set.
	URL string
}

type ProfileChooser interface {
	// Returns the profile for an order whose client named none, or "" for the default.
	DefaultProfile(ctx context.Context, account *Account) (string, error)
}

type Refusal struct {
	Kind RefusalKind
	// The requesting account. It is empty for a revocation signed with the certificate key.
	AccountID string
	// The order a finalize request was for and the identifiers it covers.
	OrderID     string
	Identifiers []Identifier
	// The DER certificate request of a finalize request, when it was valid base64url.
	CSR []byte
	// The DER certificate of a revocation request, when it was valid base64url, and the reason
	// code it asked for.
	Certificate []byte
	Reason      int
	// The answer the client receives. The recorder must not change it.
	Problem *Problem
}

type RefusalKind string

type RefusalRecorder interface {
	RecordRefusal(ctx context.Context, refusal Refusal) error
}

type RenewalAdvisor interface {
	RenewalInfo(ctx context.Context, cert *Certificate) (RenewalInfo, error)
}

type RenewalInfo struct {
	// The window in which the client should renew. End must be later than Start.
	Start time.Time
	End   time.Time
	// An optional page explaining the window.
	ExplanationURL string
	// How long clients wait before asking again. Zero means DefaultRenewalRetryAfter.
	RetryAfter time.Duration
}

type RetryableError struct {
	Problem *Problem
	Err     error
}

type RevokeRequest struct {
	// Stable across retries until the CA accepts or refuses the revocation. It is stored before the
	// first call and discarded when Revoke returns a *Problem.
	OperationID string
	Certificate *x509.Certificate
	DER         []byte
	// The CRL reason code recorded with the operation. A retry keeps the recorded reason.
	Reason int
	// The account that requested the revocation. Empty when the certificate key signed the request.
	AccountID string
}

type Revoker interface {
	Revoke(ctx context.Context, req RevokeRequest) error
}

type Server struct {
	// contains filtered or unexported fields
}

type Store interface {
	AccountStore
	OrderStore
	CertificateStore
	WorkStore
}

type Task struct {
	ID        string
	Kind      TaskKind
	TargetID  string
	AccountID string
	// The earliest time a worker may claim the task.
	RunAt time.Time
	// The number of claims so far.
	Attempts int
	// The end of the current lease. Zero when no worker holds the task.
	LeaseUntil time.Time
	// Increases on every claim. Completion calls must present the current value.
	Fence     uint64
	CreatedAt time.Time
}

type TaskKind string

type Validation struct {
	Identifier Identifier
	Type       ChallengeType
	Validated  time.Time
	// Reports that the validation authorized a CA certificate rather than an end-entity one.
	CACertificate bool
	// The latest acceptable certificate expiry under this proof, zero when unbounded.
	GrantExpires time.Time
	// Further names the certificate may carry and the network function type, both granted by an
	// authority token, see ValidationGrant.
	Names  []Identifier
	NFType string
	// Reports that the Policy authorized the identifier without a challenge. Type is then empty
	// and Validated is when the order was created.
	PreApproved bool
}

type ValidationGrant struct {
	// Allows the order to be finalized with a certificate request that asks for a CA
	// certificate, see RFC 9448 section 6.
	CACertificate bool
	// Bounds the validity of certificates issued on this proof, see RFC 9447 section 7. The zero
	// value leaves the validity to the order and the issuer.
	Expires time.Time
	// Further names the certificate may carry on this proof, such as the sans of a 3GPP NF
	// Certificate Authority Token. Each is a normalized dns, ip or uri identifier.
	Names []Identifier
	// The RFC 9310 network function type the proof attests, empty when it attests none.
	NFType string
}

type ValidationRequest struct {
	Challenge  Challenge
	Identifier Identifier
	// Marks a wildcard authorization. Identifier then holds the base name.
	Wildcard bool
	// The token joined with the account key thumbprint, see RFC 8555 section 8.1.
	KeyAuthorization string
	// The RFC 7638 thumbprint of the account key captured when the client responded.
	AccountKeyThumbprint string
	// The Authority Token of a tkauth-01 response, empty for every other challenge type.
	AuthorityToken string
}

type Validator interface {
	Validate(ctx context.Context, req ValidationRequest) error
}

type WorkStore interface {
	// Stores the challenge when its revision matches and enqueues the task in the same
	// operation. It returns ErrConflict when the task ID is in use.
	AcceptChallenge(ctx context.Context, challenge *Challenge, task *Task) error
	// Stores the order when its revision matches and enqueues the task in the same operation.
	FinalizeOrder(ctx context.Context, order *Order, task *Task) error
	// Stores order.Issuance as the durable dispatch decision after checking the task fence and the
	// revision and status of the order, the account and every authorization.
	BeginIssuance(ctx context.Context, task *Task, order *Order, account *Account, authzs []*Authorization) error
	// Leases the runnable task with the earliest RunAt, increments its fence and attempts
	// and returns a copy. It returns ErrNotFound when no task is runnable at now.
	ClaimTask(ctx context.Context, now, leaseUntil time.Time) (*Task, error)
	// Releases the lease and stores task.RunAt for a later claim.
	RescheduleTask(ctx context.Context, task *Task) error
	// Stores the challenge when its revision matches and releases the lease with task.RunAt for
	// a later claim, all in one operation. It records the error of a validation attempt that
	// will be retried.
	RetryValidation(ctx context.Context, task *Task, challenge *Challenge) error
	// Removes the task without touching any resource.
	FinishTask(ctx context.Context, task *Task) error
	// Stores the challenge, authorization and order when every revision matches and removes the
	// task, all in one operation. The order revision advances even when its fields are unchanged.
	CompleteValidation(ctx context.Context, task *Task, challenge *Challenge, authz *Authorization, order *Order) error
	// Stores the order when its revision matches, creates the certificate when it is not nil
	// and removes the task, all in one operation. It returns ErrConflict when the certificate
	// ID or a non-empty RenewalID is in use.
	CompleteIssuance(ctx context.Context, task *Task, order *Order, cert *Certificate) error
	// Counts tasks that were runnable at or before the given time and hold no lease past it.
	PendingTasks(ctx context.Context, before time.Time) (int, error)
	// Counts tasks that hold a lease past the given time.
	LeasedTasks(ctx context.Context, now time.Time) (int, error)
	// Counts the validation tasks of an account that have not finished, waiting or leased.
	AccountValidations(ctx context.Context, accountID string) (int, error)
}

type WorkerConfig struct {
	// The number of tasks processed at the same time. Defaults to 4.
	Concurrency int
	// How often an idle worker looks for work. Defaults to one second.
	PollInterval time.Duration
	// How long a claimed task stays leased. A task run never continues past its lease, so no other
	// worker can take the task while it runs. It must be at least twice TaskTimeout and defaults to
	// two minutes or twice TaskTimeout, whichever is longer.
	Lease time.Duration
	// Bounds each phase of a task separately: one validator or issuer call and the store
	// operations that record its outcome. A task run uses several of these budgets in
	// sequence within its lease. Defaults to 30 seconds or half the lease, whichever is shorter.
	TaskTimeout time.Duration
	// Limits validation and pre-dispatch policy retries to five by default without limiting issuance recovery.
	MaxAttempts int
	// The first retry delay, doubled on every further attempt. Defaults to five seconds.
	RetryDelay time.Duration
	// How long accepted work may wait unclaimed before Ready reports a problem. Defaults to
	// one minute.
	StaleAfter time.Duration
	// Marks that another process runs Run against the same store, which silences the warning
	// logged when work is accepted while Run is inactive here.
	External bool
}