@rikalabs/akter 0.1.0-alpha.0

package/dist/runtime/payloads/versions.js

@@ -0,0 +1,240 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { descriptorOf } from "../../actor/descriptor.js";
+import {} from "../../members/payload.js";
+import { inReadOnlySnapshot } from "../database/snapshot.js";
+import { databaseTime } from "../turn/admission.js";
+import { textArray } from "../turn/outbox.js";
+/** How long a runtime's writer rows stay live without a refresh, by default. */
+export const DEFAULT_WRITER_WINDOW_MS = 120_000;
+/** A one-line operator-facing description of a payload problem. */
+export const formatPayloadProblem = (problem) => `${problem.actorType}/${problem.tag} (${problem.kind})  ${problem.problem}`;
+const keyOf = (declared) => `${declared.actorType}\u0000${declared.kind}\u0000${declared.tag}`;
+/**
+ * Compares declared chains with the versions the database may hold. A
+ * version recorded above a chain's current version is a rollback past a
+ * schema change. A chain that starts above version `v` can't read values of
+ * `v`: an event version counts as stored until `durable payloads clear` marks
+ * it cleared. Every stored event has a recorded version, because a runtime
+ * records what it writes before it takes a shard and the migration refused
+ * databases that held rows before it. Job versions are read from the
+ * outbox and dead letters directly. `writers` names the actor types whose
+ * turns this deployment runs: an event tag one of them no longer declares is
+ * refused while a subscription still has undelivered events of it.
+ */
+export const findPayloadProblems = Effect.fnUntraced(function* (declarations, writers = []) {
+    const sql = yield* SqlClient.SqlClient;
+    const problems = [];
+    const actorTypes = [
+        ...new Set([...declarations.map((d) => d.actorType), ...writers.map((w) => w.actorType)]),
+    ];
+    if (actorTypes.length === 0)
+        return problems;
+    const recorded = yield* sql `SELECT actor_type, kind, tag, version,
+      cleared_at_ms IS NOT NULL AS cleared
+    FROM actor_payload_versions WHERE actor_type IN ${sql.in(actorTypes)}`;
+    const byTag = new Map();
+    for (const row of recorded) {
+        const key = keyOf({ actorType: row.actor_type, kind: row.kind, tag: row.tag });
+        byTag.set(key, [...(byTag.get(key) ?? []), row]);
+    }
+    const seen = new Set();
+    for (const declared of declarations) {
+        const key = `${keyOf(declared)}\u0000${declared.chain.first}\u0000${declared.chain.current}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const { first, current } = declared.chain;
+        const versions = byTag.get(keyOf(declared)) ?? [];
+        const problem = (text) => problems.push({
+            actorType: declared.actorType,
+            kind: declared.kind,
+            tag: declared.tag,
+            problem: text,
+        });
+        const newest = Math.max(-1, ...versions.map((row) => row.version));
+        if (newest > current)
+            problem(`version ${newest} recorded above this chain's current version ${current}: a rollback past a payload schema change`);
+        if (first === 0)
+            continue;
+        if (declared.kind === "event") {
+            for (const row of versions)
+                if (row.version < first && !row.cleared)
+                    problem(`version ${row.version} may still be stored below this chain's first version ${first}; run durable payloads clear once its events are gone`);
+        }
+        else {
+            const [stored] = yield* sql `
+        SELECT min(v)::int AS version, count(*)::int AS rows FROM (
+          SELECT payload_version AS v FROM actor_outbox
+          WHERE kind = 'job' AND actor_type = ${declared.actorType} AND command = ${declared.tag}
+            AND payload_version < ${first}
+          UNION ALL
+          SELECT payload_version FROM actor_dead_letters
+          WHERE actor_type = ${declared.actorType} AND job = ${declared.tag}
+            AND payload_version < ${first}) stored`;
+            if (stored !== undefined && stored.version !== null)
+                problem(`version ${stored.version} stored in ${stored.rows} pending job or dead letter row${stored.rows === 1 ? "" : "s"} below this chain's first version ${first}`);
+        }
+    }
+    for (const writer of writers) {
+        const removed = [
+            ...new Set(recorded
+                .filter((row) => row.actor_type === writer.actorType &&
+                row.kind === "event" &&
+                !writer.events.includes(row.tag))
+                .map((row) => row.tag)),
+        ];
+        for (const tag of removed) {
+            const [pending] = yield* sql `
+        SELECT s.subscriber_type, s.subscription FROM actor_subscriptions s
+        WHERE s.source_type = ${writer.actorType} AND ${tag} = ANY(s.events)
+          AND EXISTS (SELECT 1 FROM actor_events e
+            WHERE e.routing_key = s.routing_key AND e.tenant_id = s.tenant_id
+              AND e.actor_type = s.source_type AND e.actor_id = s.source_id
+              AND e.event = ${tag} AND e.sequence > s.delivered)
+        LIMIT 1`;
+            if (pending !== undefined)
+                problems.push({
+                    actorType: writer.actorType,
+                    kind: "event",
+                    tag,
+                    problem: `event class removed while subscription ${pending.subscriber_type}.${pending.subscription} has undelivered events of it`,
+                });
+        }
+    }
+    return problems;
+});
+/**
+ * Records the version each written class is written at, and marks every
+ * lower recorded version superseded. Writing a version again clears its
+ * `superseded` and `cleared` marks, since values of it are being stored anew.
+ */
+export const recordPayloadVersions = Effect.fnUntraced(function* (declarations) {
+    const written = declarations.filter((declared) => declared.writes);
+    if (written.length === 0)
+        return;
+    const sql = yield* SqlClient.SqlClient;
+    const now = yield* databaseTime;
+    yield* sql `WITH declared (actor_type, kind, tag, version) AS (
+      SELECT * FROM unnest(${textArray({ sql, values: written.map((d) => d.actorType) })},
+        ${textArray({ sql, values: written.map((d) => d.kind) })},
+        ${textArray({ sql, values: written.map((d) => d.tag) })},
+        ${textArray({ sql, values: written.map((d) => String(d.chain.writeVersion)) })}::int[])),
+    recorded AS (
+      INSERT INTO actor_payload_versions (actor_type, kind, tag, version, first_written_at_ms)
+      SELECT actor_type, kind, tag, version, ${now} FROM declared
+      ON CONFLICT (actor_type, kind, tag, version) DO UPDATE
+        SET superseded_at_ms = NULL, cleared_at_ms = NULL
+        WHERE actor_payload_versions.superseded_at_ms IS NOT NULL
+      RETURNING 1)
+    UPDATE actor_payload_versions v SET superseded_at_ms = ${now}
+    FROM declared d
+    WHERE v.actor_type = d.actor_type AND v.kind = d.kind AND v.tag = d.tag
+      AND v.version < d.version AND v.superseded_at_ms IS NULL`;
+});
+/** Upserts this runtime's writer row for each class it writes, stamped now, in one statement. */
+export const refreshWriters = Effect.fnUntraced(function* (runtimeId, windowMs, declarations) {
+    const written = declarations.filter((declared) => declared.writes);
+    if (written.length === 0)
+        return;
+    const sql = yield* SqlClient.SqlClient;
+    const now = yield* databaseTime;
+    yield* sql `INSERT INTO actor_payload_writers (runtime_id, actor_type, kind, tag, version,
+      window_ms, refreshed_at_ms)
+    SELECT DISTINCT ${runtimeId}, actor_type, kind, tag, version, ${windowMs}::bigint, ${now}::bigint
+    FROM unnest(${textArray({ sql, values: written.map((d) => d.actorType) })},
+      ${textArray({ sql, values: written.map((d) => d.kind) })},
+      ${textArray({ sql, values: written.map((d) => d.tag) })},
+      ${textArray({ sql, values: written.map((d) => String(d.chain.writeVersion)) })}::int[])
+      AS declared (actor_type, kind, tag, version)
+    ON CONFLICT (runtime_id, actor_type, kind, tag, version)
+    DO UPDATE SET refreshed_at_ms = EXCLUDED.refreshed_at_ms, window_ms = EXCLUDED.window_ms`;
+});
+/** Drops a stopping runtime's writer rows, so a clear need not wait out its window. */
+export const dropWriters = (runtimeId) => Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql `DELETE FROM actor_payload_writers WHERE runtime_id = ${runtimeId}`;
+});
+const definitionsOf = (actors) => actors.flatMap((actor) => {
+    const payloads = descriptorOf(actor)?.definitionPayloads;
+    return payloads === undefined ? [] : [payloads];
+});
+/** `durable payloads check`: the startup check for `actors`, read-only. */
+export const checkPayloads = (actors) => Effect.suspend(() => {
+    const definitions = definitionsOf(actors);
+    return inReadOnlySnapshot(findPayloadProblems(definitions.flatMap((d) => d.declarations), definitions.flatMap((d) => {
+        const actorType = d.declarations[0]?.actorType;
+        return actorType === undefined
+            ? []
+            : [
+                {
+                    actorType,
+                    events: d.declarations
+                        .filter((declared) => declared.kind === "event")
+                        .map((declared) => declared.tag),
+                },
+            ];
+    })));
+});
+/**
+ * `durable payloads clear`: marks each superseded event version of `actors`
+ * cleared once its retention horizon has passed, no runtime can still write
+ * it, and no event of it remains. The version row is locked first, the
+ * writer rows are read again after the scan, and each statement of the
+ * transaction reads a fresh snapshot, so a writer that registers during the
+ * scan fails the clear instead of racing it. A writer counts as live until
+ * its window and then the longest command timeout have passed.
+ */
+export const clearPayloads = (actors) => Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const definitions = definitionsOf(actors);
+    const commandTimeoutMs = Math.max(0, ...definitions.map((d) => d.commandTimeoutMs));
+    const results = [];
+    for (const definition of definitions)
+        for (const declared of definition.declarations) {
+            if (declared.kind !== "event")
+                continue;
+            const now = yield* databaseTime;
+            const due = yield* sql `SELECT version FROM actor_payload_versions
+          WHERE actor_type = ${declared.actorType} AND kind = 'event' AND tag = ${declared.tag}
+            AND cleared_at_ms IS NULL AND superseded_at_ms IS NOT NULL
+            AND superseded_at_ms + ${definition.keepEventsMs}::bigint <= ${now}
+          ORDER BY version`;
+            for (const { version } of due) {
+                const writing = Effect.gen(function* () {
+                    const at = yield* databaseTime;
+                    return yield* sql `SELECT 1 FROM actor_payload_writers
+              WHERE actor_type = ${declared.actorType} AND kind = 'event' AND tag = ${declared.tag}
+                AND version = ${version}
+                AND refreshed_at_ms + window_ms + ${commandTimeoutMs}::bigint > ${at}
+              LIMIT 1`;
+                });
+                const outcome = yield* sql.withTransaction(Effect.gen(function* () {
+                    const locked = yield* sql `SELECT 1 FROM actor_payload_versions
+                WHERE actor_type = ${declared.actorType} AND kind = 'event' AND tag = ${declared.tag}
+                  AND version = ${version} AND cleared_at_ms IS NULL
+                  AND superseded_at_ms IS NOT NULL
+                FOR UPDATE`;
+                    if (locked.length === 0)
+                        return undefined;
+                    if ((yield* writing).length > 0)
+                        return "writer";
+                    const stored = yield* sql `SELECT 1 FROM actor_events
+                WHERE actor_type = ${declared.actorType} AND event = ${declared.tag}
+                  AND payload_version = ${version}
+                LIMIT 1`;
+                    if (stored.length > 0)
+                        return "stored";
+                    if ((yield* writing).length > 0)
+                        return "writer";
+                    yield* sql `UPDATE actor_payload_versions SET cleared_at_ms = ${yield* databaseTime}
+                WHERE actor_type = ${declared.actorType} AND kind = 'event' AND tag = ${declared.tag}
+                  AND version = ${version}`;
+                    return "cleared";
+                }));
+                if (outcome !== undefined)
+                    results.push({ actorType: declared.actorType, tag: declared.tag, version, outcome });
+            }
+        }
+    return results;
+});

package/dist/runtime/peering/authority.d.ts

@@ -0,0 +1,42 @@
+import { DateTime, Duration, Effect, Redacted } from "effect";
+import { type RunnerCredentials } from "./credentials.ts";
+/** Options for one runner certificate. */
+export interface IssueOptions {
+    readonly deployment: string;
+    /** Default 90 days. */
+    readonly validFor?: Duration.Input;
+    /** Default five minutes before now, so a peer whose clock runs behind accepts it at once. */
+    readonly notBefore?: DateTime.DateTime;
+}
+/**
+ * A certificate authority that issues runner certificates for development
+ * stacks and tests. Hosted and production deployments issue from a managed
+ * authority instead, whose key never sits in a process's memory.
+ */
+export interface RunnerAuthority {
+    /** The authority's own certificate, PEM: what every runner of its deployments trusts. */
+    readonly certificate: string;
+    readonly key: Redacted.Redacted<string>;
+    /** A fresh key and certificate for one deployment's runners, with this authority as `ca`. */
+    readonly issue: (options: IssueOptions) => Effect.Effect<RunnerCredentials>;
+}
+/** Creates and restores development certificate authorities for runner peering. */
+export declare const RunnerAuthority: {
+    /**
+     * A new authority with a fresh P-256 key. Its name carries a random suffix
+     * so an incoming and an outgoing authority never share a name.
+     */
+    make: (options?: {
+        readonly name?: string;
+        readonly validFor?: Duration.Input;
+    }) => Effect.Effect<RunnerAuthority, never, never>;
+    /**
+     * An authority saved earlier, so runners started before and after a
+     * restart keep trusting each other. Refuses a key that does not match the
+     * certificate, or a certificate that is not an authority.
+     */
+    from: (options: {
+        readonly certificate: string;
+        readonly key: Redacted.Redacted<string>;
+    }) => Effect.Effect<RunnerAuthority, never, never>;
+};

package/dist/runtime/peering/authority.js

@@ -0,0 +1,132 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
+import { Clock, DateTime, Duration, Effect, Redacted } from "effect";
+import { identity } from "./credentials.js";
+const tlv = (tag, ...parts) => {
+    const body = Buffer.concat(parts);
+    const length = body.length < 0x80
+        ? Buffer.from([body.length])
+        : (() => {
+            const bytes = [];
+            for (let rest = body.length; rest > 0; rest = Math.floor(rest / 256))
+                bytes.unshift(rest % 256);
+            return Buffer.from([0x80 | bytes.length, ...bytes]);
+        })();
+    return Buffer.concat([Buffer.from([tag]), length, body]);
+};
+const sequence = (...parts) => tlv(0x30, ...parts);
+const oid = (dotted) => {
+    const [first, second, ...rest] = dotted.split(".").map(Number);
+    const bytes = [first * 40 + second];
+    for (const arc of rest) {
+        const groups = [arc & 0x7f];
+        for (let value = arc >>> 7; value > 0; value >>>= 7)
+            groups.unshift(0x80 | (value & 0x7f));
+        bytes.push(...groups);
+    }
+    return tlv(0x06, Buffer.from(bytes));
+};
+const integer = (bytes) => tlv(0x02, (bytes[0] & 0x80) !== 0 ? Buffer.concat([Buffer.from([0]), bytes]) : bytes);
+const time = (millis) => {
+    const text = DateTime.formatIso(DateTime.makeUnsafe(millis)).replace(/[-:T]|\.\d+/gu, "");
+    return Number(text.slice(0, 4)) < 2050
+        ? tlv(0x17, Buffer.from(text.slice(2)))
+        : tlv(0x18, Buffer.from(text));
+};
+const name = (common) => sequence(tlv(0x31, sequence(oid("2.5.4.3"), tlv(0x0c, Buffer.from(common)))));
+const extension = (id, critical, value) => sequence(oid(id), ...(critical ? [tlv(0x01, Buffer.from([0xff]))] : []), tlv(0x04, value));
+const keyId = (key) => createHash("sha1")
+    .update(key.export({ type: "spki", format: "der" }))
+    .digest();
+const ECDSA_SHA256 = sequence(oid("1.2.840.10045.4.3.2"));
+/**
+ * A DER X.509 v3 certificate for `subject`, signed with ECDSA P-256 and
+ * SHA-256 by `issuer`. The serial is random, positive and minimally encoded,
+ * because strict parsers such as BoringSSL reject a leading zero byte; key identifiers let
+ * TLS stacks tell apart two authorities that share a name during a rotation.
+ */
+const build = (options) => {
+    const serial = randomBytes(16);
+    serial[0] = (serial[0] & 0x3f) | 0x40;
+    const tbs = sequence(tlv(0xa0, integer(Buffer.from([2]))), integer(serial), ECDSA_SHA256, name(options.issuer), sequence(time(options.notBefore), time(options.notAfter)), name(options.subject), options.publicKey.export({ type: "spki", format: "der" }), tlv(0xa3, sequence(...options.extensions)));
+    const der = sequence(tbs, ECDSA_SHA256, tlv(0x03, Buffer.from([0]), sign("sha256", tbs, options.signer)));
+    return `-----BEGIN CERTIFICATE-----\n${der
+        .toString("base64")
+        .match(/.{1,64}/gu)
+        .join("\n")}\n-----END CERTIFICATE-----\n`;
+};
+const pem = (key) => key.export({ type: "pkcs8", format: "pem" }).toString();
+const SKEW = 5 * 60 * 1000;
+const authority = (certificate, signer) => {
+    const issuer = new X509Certificate(certificate).subject.replace(/^CN=/u, "");
+    const issuerId = keyId(createPublicKey(signer));
+    return {
+        certificate,
+        key: Redacted.make(pem(signer)),
+        issue: (options) => Effect.gen(function* () {
+            const uri = identity(options.deployment);
+            const pair = generateKeyPairSync("ec", { namedCurve: "P-256" });
+            const notBefore = options.notBefore === undefined
+                ? (yield* Clock.currentTimeMillis) - SKEW
+                : DateTime.toEpochMillis(options.notBefore);
+            return {
+                ca: certificate,
+                certificate: build({
+                    subject: `akter runner ${options.deployment}`,
+                    issuer,
+                    publicKey: pair.publicKey,
+                    signer,
+                    notBefore,
+                    notAfter: notBefore +
+                        Duration.toMillis(Duration.fromInputUnsafe(options.validFor ?? "90 days")),
+                    extensions: [
+                        extension("2.5.29.19", true, sequence()),
+                        extension("2.5.29.15", true, tlv(0x03, Buffer.from([7, 0x80]))),
+                        extension("2.5.29.37", false, sequence(oid("1.3.6.1.5.5.7.3.1"), oid("1.3.6.1.5.5.7.3.2"))),
+                        extension("2.5.29.17", false, sequence(tlv(0x86, Buffer.from(uri)))),
+                        extension("2.5.29.14", false, tlv(0x04, keyId(pair.publicKey))),
+                        extension("2.5.29.35", false, sequence(tlv(0x80, issuerId))),
+                    ],
+                }),
+                key: Redacted.make(pem(pair.privateKey)),
+            };
+        }),
+    };
+};
+/** Creates and restores development certificate authorities for runner peering. */
+export const RunnerAuthority = {
+    /**
+     * A new authority with a fresh P-256 key. Its name carries a random suffix
+     * so an incoming and an outgoing authority never share a name.
+     */
+    make: (options) => Effect.gen(function* () {
+        const pair = generateKeyPairSync("ec", { namedCurve: "P-256" });
+        const subject = `${options?.name ?? "akter runner authority"} ${randomBytes(4).toString("hex")}`;
+        const notBefore = (yield* Clock.currentTimeMillis) - SKEW;
+        return authority(build({
+            subject,
+            issuer: subject,
+            publicKey: pair.publicKey,
+            signer: pair.privateKey,
+            notBefore,
+            notAfter: notBefore +
+                Duration.toMillis(Duration.fromInputUnsafe(options?.validFor ?? "3650 days")),
+            extensions: [
+                extension("2.5.29.19", true, sequence(tlv(0x01, Buffer.from([0xff])))),
+                extension("2.5.29.15", true, tlv(0x03, Buffer.from([1, 0x06]))),
+                extension("2.5.29.14", false, tlv(0x04, keyId(pair.publicKey))),
+            ],
+        }), pair.privateKey);
+    }),
+    /**
+     * An authority saved earlier, so runners started before and after a
+     * restart keep trusting each other. Refuses a key that does not match the
+     * certificate, or a certificate that is not an authority.
+     */
+    from: (options) => Effect.sync(() => {
+        const parsed = new X509Certificate(options.certificate);
+        const signer = createPrivateKey(Redacted.value(options.key));
+        if (!parsed.ca || !parsed.checkPrivateKey(signer))
+            throw new Error("Runner authority needs a CA certificate and its matching key");
+        return authority(options.certificate, signer);
+    }),
+};

package/dist/runtime/peering/credentials.d.ts

@@ -0,0 +1,21 @@
+import type { Redacted } from "effect";
+/**
+ * PEM material one runner presents to and trusts from its peers.
+ *
+ * `ca` holds every certificate authority a peer may chain to; during a CA
+ * rotation it holds both the outgoing and the incoming authority.
+ * `certificate` is this runner's chain, leaf first, and `key` its private key.
+ */
+export interface RunnerCredentials {
+    readonly ca: string;
+    readonly certificate: string;
+    readonly key: Redacted.Redacted<string>;
+}
+/** The URI prefix every Akter runner identity starts with. */
+export declare const PREFIX = "spiffe://akter/";
+/**
+ * The URI subject alternative name that marks a certificate as belonging to
+ * `deployment`'s runners. Peers accept a certificate only when it carries
+ * exactly this one Akter identity.
+ */
+export declare const identity: (deployment: string) => string;

package/dist/runtime/peering/credentials.js

@@ -0,0 +1,13 @@
+const DEPLOYMENT = /^[A-Za-z0-9._-]{1,128}$/u;
+/** The URI prefix every Akter runner identity starts with. */
+export const PREFIX = "spiffe://akter/";
+/**
+ * The URI subject alternative name that marks a certificate as belonging to
+ * `deployment`'s runners. Peers accept a certificate only when it carries
+ * exactly this one Akter identity.
+ */
+export const identity = (deployment) => {
+    if (!DEPLOYMENT.test(deployment) || deployment === "." || deployment === "..")
+        throw new Error("Runner deployment must be 1 to 128 characters of letters, digits, '.', '_' or '-'");
+    return `${PREFIX}deployment/${deployment}`;
+};

package/dist/runtime/peering/transport.d.ts

@@ -0,0 +1,51 @@
+import { Context, Duration, Effect, Layer } from "effect";
+import { Runners, ShardingConfig } from "effect/cluster";
+import { RpcSerialization } from "effect/rpc";
+import { SocketServer } from "effect/socket";
+import { type RunnerCredentials } from "./credentials.ts";
+declare const PeerHealth_base: Context.ServiceClass<PeerHealth, "@rikalabs/akter/runtime/peering/transport/PeerHealth", {
+    readonly healthy: Effect.Effect<boolean>;
+}>;
+/**
+ * Whether this runner can still peer: false once its current certificate has
+ * expired, or once no credential load has succeeded for longer than the
+ * transport's `unhealthyAfter`. Readiness reports `peering` while it is false.
+ */
+export declare class PeerHealth extends PeerHealth_base {
+}
+/** Peer transport options for `Runner.mtls`. */
+export interface MutualTlsOptions<E> {
+    /** The deployment every peer must belong to; its identity is `Runner.identity(deployment)`. */
+    readonly deployment: string;
+    /**
+     * Reads this runner's credentials. It runs once before the listener opens
+     * and again every `refreshEvery`, so replacing what it reads rotates the
+     * certificate, key, or trusted authorities without a restart.
+     */
+    readonly credentials: Effect.Effect<RunnerCredentials, E>;
+    /** Default 1 minute. */
+    readonly refreshEvery?: Duration.Input;
+    /** How long one credential load may take before it counts as failed. Default 10 seconds. */
+    readonly refreshTimeout?: Duration.Input;
+    /**
+     * How long loads may keep failing, or hanging, before readiness reports
+     * `peering`. Default 5 minutes. An expired current certificate reports
+     * `peering` at once.
+     */
+    readonly unhealthyAfter?: Duration.Input;
+}
+/**
+ * Runner-to-runner TCP with mutual TLS 1.3. Each side presents its
+ * deployment's certificate and accepts a peer only when the peer's chain
+ * reaches a trusted authority, is within its validity window, and carries
+ * exactly this deployment's identity; a plaintext peer, a peer without a
+ * certificate, and a peer of another deployment never reach the runner's RPC
+ * handler. Credentials are reloaded every `refreshEvery`: new connections use
+ * the latest valid ones, established connections keep the session they
+ * authenticated, and credentials that fail validation are logged and
+ * ignored while the previous ones stay in use. A runner whose certificate has
+ * expired, or whose loads have failed for `unhealthyAfter`, stops reporting
+ * ready.
+ */
+export declare const mtls: <E>(options: MutualTlsOptions<E>) => Layer.Layer<PeerHealth | Runners.RpcClientProtocol | SocketServer.SocketServer, SocketServer.SocketServerError, RpcSerialization.RpcSerialization | ShardingConfig.ShardingConfig>;
+export {};