@nylorun/runtime 0.23.0-beta → 0.24.0-beta

package/dist/artifacts/service.d.ts

@@ -66,7 +66,8 @@ export declare function folderContent(ctx: TenantContext, id: string, version: n
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export declare function deleteArtifact(ctx: TenantContext, id: string, access: ArtifactAccess): Promise<{
     artifactId: string;

package/dist/artifacts/service.js

@@ -52,6 +52,7 @@ export function artifactView(row, versions) {
         name: row.name,
         contentType: row.contentType,
         ...(row.sessionId === null ? {} : { sessionId: row.sessionId }),
+        ...(row.environmentId === null ? {} : { environmentId: row.environmentId }),
         latestVersion: row.latestVersion,
         ...(row.labelsJson === null ? {} : { labels: JSON.parse(row.labelsJson) }),
         createdAt: row.createdAt,
@@ -194,6 +195,7 @@ export async function uploadArtifact(ctx, input, body, access, signal) {
                         : JSON.stringify(input.labels),
                     createdAt,
                     updatedAt: createdAt,
+                    environmentId: null,
                 };
                 version = {
                     artifactId,
@@ -278,11 +280,14 @@ export async function folderContent(ctx, id, version, access) {
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export async function deleteArtifact(ctx, id, access) {
     const keys = await ctx.store.tx(async (t) => {
         const found = await readableArtifact(t, id, access);
+        if (found.environmentId !== null)
+            fail(409, `Artifact ${id} holds Environment ${found.environmentId}'s disk versions: delete them with DELETE /v1/environments/{id}/versions/{version}, or delete the Environment.`);
         if (found.sessionId !== null)
             await lockedSession(t, found.sessionId, access);
         if (found.kind === "folder")

package/dist/artifacts/workspace.d.ts

@@ -22,7 +22,7 @@ export interface WorkspaceSession {
     /** The session that owns the workspace (one hop through `sandboxOwnerId`). */
     readonly ownerId: string;
     /** The sandbox resource the workspace belongs to, when the owner is attached to one. */
-    readonly sandboxId?: string;
+    readonly environmentId?: string;
     /** The session's pinned manifest: its sandbox capability carries the sandbox's spec. */
     readonly manifest: AgentManifest;
 }

package/dist/artifacts/workspace.js

@@ -24,7 +24,7 @@ export function sandboxWorkspaceReader(sandbox) {
                 id: session.ownerId,
                 activeTurnId: session.turnId,
                 manifest: session.manifest,
-                ...(session.sandboxId === undefined ? {} : { sandboxId: session.sandboxId }),
+                ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
             },
         };
     };

package/dist/core/flow-host.d.ts

@@ -2,6 +2,7 @@ import type { EffectOutcome } from "@nylorun/core/contracts";
 import { type JsonValue, type WorkflowManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import type { EffectDoc, Tx } from "../store/types.js";
+import { type TurnTiming } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export declare function deriveSessionId(workflowSessionId: string, path: string, ...parts: string[]): string;
 /**
@@ -59,15 +60,13 @@ export type FlowHostSession = {
     status: string;
     activeTurnId: string | null;
     info?: any;
-    vaultIds?: readonly string[];
-    credentialSelections?: readonly unknown[];
     creation?: unknown;
     waits?: unknown;
     lastOutput?: JsonValue;
     /** The turn `status`, `lastOutput` and `error` describe, once it ended. */
     lastTurnId?: string;
     error?: string;
-};
+} & TurnTiming;
 /** How a linked agent turn ended. */
 export type LinkedTurnEnd = {
     readonly turnId: string;

package/dist/core/flow-host.js

@@ -50,6 +50,7 @@
  */
 import { createHash } from "node:crypto";
 import { isVerdict } from "@nylorun/core/define";
+import { resumeTurn } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export function deriveSessionId(workflowSessionId, path, ...parts) {
     const digest = createHash("sha256")
@@ -237,6 +238,8 @@ export async function wakeLinkedWorkflow(input) {
             }
             : { value: input.output ?? null };
     await settleAgentEffect({ t, effect, outcome });
+    // A workflow paused on its agents' interactions goes on (R7.1, `tenant/turn-timing.ts`).
+    resumeTurn(workflow);
     workflow.status = "runnable";
     await t.put("sessions", workflow.id, workflow);
     await t.wake(workflow.id, {

package/dist/core/provider.d.ts

@@ -9,7 +9,8 @@ export declare function gatewayModel(options: {
     model: string;
 }): ModelProvider;
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export declare function toolFixtureModel(): ModelProvider;

package/dist/core/provider.js

@@ -1,3 +1,4 @@
+import { fixtureAnswer } from "../gates/fixture-model.js";
 export function scriptedModel(output = "Scripted development response") {
     return async () => ({ output: [{ type: "text", text: output }] });
 }
@@ -23,43 +24,10 @@ export function gatewayModel(options) {
     };
 }
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export function toolFixtureModel() {
-    return async (effect) => {
-        const call = effect.input;
-        const last = call.prompt.at(-1);
-        if (last?.kind === "tool-result")
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `Order lookup complete: ${last.content.map((part) => (part.type === "text" ? part.text : JSON.stringify(part))).join(" ")}`,
-                    },
-                ],
-            };
-        const users = call.prompt.filter((p) => p.kind === "message" && p.role === "user");
-        if (users.length > 1)
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `I remember: ${users[0].content.map((part) => (part.type === "text" ? part.text : "")).join(" ")}`,
-                    },
-                ],
-            };
-        if (!call.tools.some((tool) => tool.name === "lookup_order"))
-            return { output: [{ type: "text", text: "Hello from the fixture model." }] };
-        return {
-            output: [
-                {
-                    type: "tool-call",
-                    id: "fixture_lookup",
-                    name: "lookup_order",
-                    args: { orderId: "demo-123" },
-                },
-            ],
-        };
-    };
+    return async (effect, signal) => fixtureAnswer(effect.input, signal);
 }

package/dist/core/sandbox-routes.d.ts

@@ -9,32 +9,13 @@ export type SandboxRouteSession = SessionSandboxRef & {
     readonly activeTurnId: string | null;
     readonly status: string;
 };
-/** A session together with a synchronous lookup over its sandbox owner chain. */
-export type SandboxRouteRead = {
-    readonly session: SandboxRouteSession;
-    readonly lookup: (id: string) => SessionSandboxRef | undefined;
-};
 export type SandboxRouteDeps = {
     readonly sandbox: Pick<WorkspacePort, "run">;
-    /** The session (rejects when missing) and its owner chain, read in one transaction. */
-    readonly session: (id: string) => Promise<SandboxRouteRead>;
+    /** The session; rejects when it is missing. */
+    readonly session: (id: string) => Promise<SandboxRouteSession>;
 };
 /**
  * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
  * Refused while the session has an active agent turn.
  */
 export declare function handleSessionSandboxTool(deps: SandboxRouteDeps, sessionId: string, toolName: string, body: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export declare function validateSandboxAttach(body: {
-    ownerUserId: string;
-    sandbox?: unknown;
-}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options?: {
-    opaque?: boolean;
-    inherit?: boolean;
-}): string | undefined;

package/dist/core/sandbox-routes.js

@@ -1,9 +1,9 @@
 /**
- * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`)
- * and the sandbox attach check of `PUT /v1/sessions/:id`.
+ * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`):
+ * a tool run in the sandbox of the session's Environment.
  */
 import { isSandboxToolName, } from "@nylorun/core/define";
-import { capabilityForSandbox, owningSandboxSessionId, sandboxSpecOf, sandboxWorkspaceOf, sandboxSpecsEqual, sessionSandboxSpec, } from "../sandbox/share.js";
+import { capabilityForSandbox, sandboxWorkspaceOf, sessionSandboxSpec, } from "../sandbox/share.js";
 export class SandboxRouteError extends Error {
     status;
     constructor(status, message) {
@@ -12,10 +12,8 @@ export class SandboxRouteError extends Error {
         this.name = "SandboxRouteError";
     }
 }
-function resolveSpec(session, lookup) {
-    const ownerId = owningSandboxSessionId(session, lookup);
-    const owner = ownerId === session.id ? session : lookup(ownerId) ?? session;
-    const spec = sessionSandboxSpec(owner) ?? sessionSandboxSpec(session);
+function resolveSpec(session) {
+    const spec = sessionSandboxSpec(session);
     if (!spec)
         throw new SandboxRouteError(404, "Session has no sandbox");
     return spec;
@@ -34,14 +32,14 @@ function toolInput(body) {
     const { requestId: _r, ...input } = record;
     return input;
 }
-async function runTool(deps, { session, lookup }, tool, input, signal) {
-    const spec = resolveSpec(session, lookup);
-    const workspace = sandboxWorkspaceOf(session, lookup);
+async function runTool(deps, session, tool, input, signal) {
+    const spec = resolveSpec(session);
+    const workspace = sandboxWorkspaceOf(session);
     const ref = {
         id: workspace.ownerId,
         activeTurnId: session.activeTurnId,
         manifest: session.manifest,
-        ...(workspace.sandboxId === undefined ? {} : { sandboxId: workspace.sandboxId }),
+        ...(workspace.environmentId === undefined ? {} : { environmentId: workspace.environmentId }),
     };
     return deps.sandbox.run(ref, capabilityForSandbox(spec), tool, input, signal);
 }
@@ -51,39 +49,8 @@ async function runTool(deps, { session, lookup }, tool, input, signal) {
  */
 export async function handleSessionSandboxTool(deps, sessionId, toolName, body, signal) {
     const read = await deps.session(sessionId);
-    if (read.session.activeTurnId)
+    if (read.activeTurnId)
         throw new SandboxRouteError(409, "Sandbox is unavailable while the session has an active agent turn");
     const tool = parseTool(toolName);
     return runTool(deps, read, tool, toolInput(body), signal);
 }
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export function validateSandboxAttach(body, newManifest, lookup, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options = {}) {
-    const request = body.sandbox;
-    const share = typeof request === "object" && request !== null && "session" in request
-        ? String(request.session)
-        : undefined;
-    if (!share)
-        return undefined;
-    const owner = lookup(share);
-    if (!owner || (options.opaque && owner.ownerUserId !== body.ownerUserId))
-        throw new SandboxRouteError(404, "Sandbox session not found");
-    if (owner.ownerUserId !== body.ownerUserId)
-        throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");
-    const ownerSpec = sessionSandboxSpec(owner);
-    if (!ownerSpec)
-        throw new SandboxRouteError(400, "Target session has no sandbox to share");
-    if (options.inherit)
-        return owningSandboxSessionId(owner, lookup);
-    const newSpec = sandboxSpecOf(newManifest);
-    if (!newSpec)
-        throw new SandboxRouteError(400, "Session must declare a sandbox identical to the shared session");
-    if (!sandboxSpecsEqual(ownerSpec, newSpec))
-        throw new SandboxRouteError(409, "Sandbox specs must be identical to share a sandbox");
-    return owningSandboxSessionId(owner, lookup);
-}

package/dist/execution/types.d.ts

@@ -72,7 +72,7 @@ export type AdvanceResult = {
     retryAfterMs: number;
 };
 /** A pod sandbox's timers. */
-export type SandboxTimer = "idle" | "ttl";
+export type SandboxTimer = "idle";
 /**
  * What `DurableExecution.sandbox` asks for: a reconcile, or a timer. A reconcile's `key` merges
  * repeated sends of one request (the outbox's `signal:<row id>`); without one, every send runs.

package/dist/gates/contract.d.ts

@@ -1,6 +1,6 @@
 /**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
+ * The gates service's wire format (blueprint §15, P1.1). Not in the published OpenAPI documents:
+ * harnesses call it, and its bodies are published in `@nylorun/core/harness-api` (R4.5).
  *
  * `POST /nylorun/v1/model-calls`
  * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
@@ -22,31 +22,10 @@
  * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
  * need not be live: a user cancel makes it stale, and still stops its call.
  */
-import { z } from "zod";
 import type { ModelGateOutcome } from "./model-gate.js";
-export declare const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export declare const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export declare const MAX_MODEL_CALL_BYTES: number;
-export declare const ModelCallBodySchema: z.ZodObject<{
-    effectId: z.ZodString;
-    invocationId: z.ZodString;
-    call: z.ZodObject<{
-        prompt: z.ZodArray<z.ZodUnknown>;
-        tools: z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-        }, z.core.$loose>>;
-    }, z.core.$loose>;
-}, z.core.$strict>;
-export type ModelCallBody = z.infer<typeof ModelCallBodySchema>;
 export interface ModelCallResponse {
     readonly outcome: ModelGateOutcome;
 }
-/** An error answer: `{error: {code, message}}`. */
-export interface GateErrorBody {
-    readonly error: {
-        readonly code: "gate_unauthorized" | "gate_forbidden" | "run_stale" | "invalid_request" | "gate_conflict";
-        readonly message: string;
-    };
-}

package/dist/gates/contract.js

@@ -1,38 +1,3 @@
-/**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
- *
- * `POST /nylorun/v1/model-calls`
- * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
- *   <effect id>`, and optionally `Nylorun-Tenant: <tenant id>`, which must then be the token's
- *   Tenant. Core's credential (`NYLORUN_GATES_TOKEN`) is refused: only a run calls the model.
- * - Body: `ModelCallBody`, at most `MAX_MODEL_CALL_BYTES`. It names no session, turn or agent:
- *   the gate takes them from the token, and refuses a body that names them.
- * - `200 {outcome}` once the call has finished, whether the outcome is a candidate or a
- *   failure; nothing is sent while it runs. `401 gate_unauthorized` for a missing, malformed,
- *   expired or foreign token, `409 run_stale` when the token's lease is no longer the
- *   session's (a cancel, a new turn, a takeover), `400 invalid_request` for a malformed Tenant
- *   header or a bad body, `409 gate_conflict` when a different request already runs under the
- *   same key.
- * - With an `Idempotency-Key` the call outlives its client (P1.2): a re-send with the same key
- *   and body joins it, or gets its outcome for 30 minutes. Without one, a client that goes
- *   away aborts the call.
- *
- * `POST /nylorun/v1/model-calls/{key}/cancel` (same headers): aborts the keyed call; `204`
- * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
- * need not be live: a user cancel makes it stale, and still stops its call.
- */
-import { z } from "zod";
-export const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export const MAX_MODEL_CALL_BYTES = 32 * 1024 * 1024;
-export const ModelCallBodySchema = z.strictObject({
-    effectId: z.string().min(1),
-    invocationId: z.string().min(1),
-    call: z.looseObject({
-        prompt: z.array(z.unknown()),
-        tools: z.array(z.looseObject({ name: z.string() })),
-    }),
-});

package/dist/gates/egress-credentials.d.ts

@@ -27,6 +27,13 @@ export interface EgressCredentials {
     /** Tests: the port requests are sent to, instead of 443. */
     readonly upstreamPort?: number;
 }
+/** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
+export declare const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
+/** What one terminated connection did so far (R7.3): requests read, credentials set (ids). */
+export interface EgressTally {
+    requests: number;
+    readonly credentialIds: Set<string>;
+}
 export interface CredentialTerminator {
     /**
      * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
@@ -39,6 +46,8 @@ export interface CredentialTerminator {
             address: string;
             family: number;
         }[];
+        /** Counted as requests are served, read when the connection closes. */
+        readonly tally: EgressTally;
     }): Promise<void>;
 }
 export declare function credentialTerminator(options: {

package/dist/gates/egress-credentials.js

@@ -12,10 +12,14 @@
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
  * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
+ * Each connection keeps a tally for its `egress.connection` event (R7.3): how many requests it
+ * read and which credentials it set, by id.
  */
 import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
+/** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
+export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
 /** Headers that describe one hop and are never forwarded. */
 const HOP_BY_HOP = new Set([
     "connection",
@@ -74,6 +78,7 @@ export function credentialTerminator(options) {
             return;
         }
         const { sandboxId, host } = at;
+        at.tally.requests += 1;
         const release = await credentials.release(sandboxId, host);
         if (release.status === "refused") {
             logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
@@ -82,8 +87,10 @@ export function credentialTerminator(options) {
         }
         const header = release.status === "released" ? release.header.toLowerCase() : undefined;
         const headers = forwardable(req.rawHeaders, header);
-        if (release.status === "released")
+        if (release.status === "released") {
             headers[header] = [release.value];
+            at.tally.credentialIds.add(release.credentialId);
+        }
         const upstream = request({
             host,
             port: credentials.upstreamPort ?? 443,
@@ -111,7 +118,7 @@ export function credentialTerminator(options) {
     }
     return {
         async terminate(client, target) {
-            const { sandboxId, host, addresses } = target;
+            const { sandboxId, host, addresses, tally } = target;
             const leaf = await credentials.leaf(host);
             if (client.destroyed)
                 return;
@@ -128,13 +135,13 @@ export function credentialTerminator(options) {
                 lookup,
                 ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
             });
-            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            client.write(CONNECT_ESTABLISHED);
             const tls = new TLSSocket(client, {
                 isServer: true,
                 secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
                 ALPNProtocols: ["http/1.1"],
             });
-            terminated.set(tls, { sandboxId, host, agent });
+            terminated.set(tls, { sandboxId, host, agent, tally });
             tls.on("error", () => tls.destroy());
             tls.on("close", () => {
                 agent.destroy();

package/dist/gates/egress.d.ts

@@ -1,5 +1,6 @@
 import { type Server } from "node:http";
 import { type Socket } from "node:net";
+import type { EventPayload, EventWriter } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
@@ -15,6 +16,22 @@ export interface EgressSandboxes {
         readonly allow: readonly string[];
     } | undefined>;
 }
+/** The session and turn holding an Environment: turns are serial per Environment, so one at most. */
+export interface EgressHolder {
+    readonly sessionId: string;
+    readonly turnId: string;
+}
+/** One connection's record (R7.3): `egress.connection`'s payload, `environment.egress`'s too. */
+export type EgressConnection = EventPayload<"egress.connection">;
+/** Where egress-gate records connections (R7.3). */
+export interface EgressRecord {
+    /** The session whose turn holds the Environment now; `undefined` between turns. */
+    holder(environmentId: string): Promise<EgressHolder | undefined>;
+    /** Writes `connection` to `holder`'s session log, or to the Environment's stream without one. */
+    write(holder: EgressHolder | undefined, connection: EgressConnection): Promise<void>;
+}
+/** egress-gate as the writer of its events (R4.9): the gate saw the connection itself. */
+export declare const EGRESS_WRITER: EventWriter;
 /** Ports a tunnel may open. */
 export declare const EGRESS_PORTS: readonly number[];
 /** Tunnels one sandbox may hold open at once. */
@@ -49,6 +66,8 @@ export interface StartEgressGateOptions {
     readonly dial?: (address: string, port: number) => Socket;
     /** The vault and keys, for hosts an `environment_secret` is bound to (R2c). None: tunnels only. */
     readonly credentials?: EgressCredentials;
+    /** Where connections are recorded (R7.3). None: they are only logged. */
+    readonly record?: EgressRecord;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */
@@ -70,6 +89,14 @@ export declare function startEgressGate(options: StartEgressGateOptions): Promis
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * sandbox, or one deleted, lost or expired, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token.
  */
 export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;
+/**
+ * `EgressRecord` over the Tenant's record (R7.3). The holder is the session on the Environment
+ * whose body has an `activeTurnId` (turns are serial per Environment). With a holder, the write
+ * is `egress.connection` on its session log, at that turn, under the session row's lock; without
+ * one, `environment.egress` on the Environment's stream, under its row's lock. A deleted
+ * Environment gets nothing.
+ */
+export declare function storeEgressRecord(store: SessionStore): EgressRecord;