okengine 0.22.0 → 0.23.0

package/src/mcp/ai-tools.test.ts

@@ -0,0 +1,202 @@
+/**
+ * Read-only AI and decision MCP tools.
+ *
+ * Same authorization shape as `oke.traces.*`: one of the declared scopes,
+ * no confirmation, and no resolve or promote tool.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createSessionStore } from "../auth/sessions.ts";
+import { Redacted } from "../kernel/redacted.ts";
+import type { Manifest } from "../manifest/types.ts";
+import { authorizeToolCall } from "./authorization.ts";
+import { mintMcpSession, authenticateMcpRequest } from "./session.ts";
+import { createToolRuntime, type McpContext } from "./tools.ts";
+
+const SECRET = "mcp-ai-secret";
+
+const runA = {
+  id: "run-a",
+  agent: "support",
+  tenant: "acme",
+  status: "interrupted",
+};
+const runB = {
+  id: "run-b",
+  agent: "support",
+  tenant: "other",
+  status: "finished",
+};
+
+describe("MCP AI and decision tools", () => {
+  test("traces scope cannot read agent runs, and there is no resolve tool", () => {
+    expect(
+      authorizeToolCall("oke.ai.runs.list", {}, ["mcp:traces:read"], { confirmed: true }).ok,
+    ).toBe(false);
+    const resolve = authorizeToolCall("oke.ai.approvals.resolve", {}, ["console:*"]);
+    expect(resolve.ok).toBe(false);
+    if (resolve.ok) return;
+    expect(resolve.reason).toBe("unknown-tool");
+    const promote = authorizeToolCall("oke.decisions.promote", {}, ["mcp:*"]);
+    expect(promote.ok).toBe(false);
+    if (promote.ok) return;
+    expect(promote.reason).toBe("unknown-tool");
+    expect(
+      authorizeToolCall("oke.ai.runs.list", {}, ["console:runs:read"], { confirmed: true }).ok,
+    ).toBe(true);
+  });
+
+  test("a tenant token sees only its tenant; an operator token sees every tenant", async () => {
+    const runtime = createToolRuntime({
+      getManifest: () => ({ oke: "1.0", app: "skyport" }) as Manifest,
+      listRuns: async () => [],
+      listAgentRuns: async () => [runA, runB],
+      getAgentRun: async (runId) => {
+        const run = [runA, runB].find((row) => row.id === runId);
+        if (!run) return undefined;
+        return { run, events: [{ seq: 1, event: { type: "RUN_FINISHED" } }] };
+      },
+      listApprovals: async () => [
+        { id: "a", tenant: "acme", tool: "refund" },
+        { id: "b", tenant: "other", tool: "refund" },
+      ],
+      listDecisions: async () => [
+        { name: "triage", tenant: "acme", state: "learning", pending: 1, drift: false },
+        { name: "other-call", tenant: "other", state: "learning", pending: 0, drift: false },
+      ],
+    });
+    const store = createSessionStore();
+    const issued = await mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId: "op",
+      scopes: ["mcp:ai:read", "mcp:decisions:read"],
+      tenantId: "acme",
+    });
+    const requester = await authenticateMcpRequest(store, SECRET, issued.accessToken);
+
+    const listed = await runtime.callTool(requester, "oke.ai.runs.list", {});
+    expect(listed.ok).toBe(true);
+    if (!listed.ok) return;
+    const runs = (listed.data.content as { runs: { id: string }[] }).runs;
+    expect(runs.map((row) => row.id)).toEqual(["run-a"]);
+
+    const foreign = await runtime.callTool(requester, "oke.ai.runs.get", { runId: "run-b" });
+    expect(foreign.ok).toBe(false);
+    const namedOther = await runtime.callTool(requester, "oke.ai.runs.list", { tenant: "other" });
+    expect(namedOther.ok).toBe(true);
+    if (!namedOther.ok) return;
+    expect((namedOther.data.content as { runs: unknown[] }).runs).toEqual([]);
+    expect(foreign.ok).toBe(false);
+
+    const got = await runtime.callTool(requester, "oke.ai.runs.get", {
+      runId: "run-a",
+      tenant: "acme",
+    });
+    expect(got.ok).toBe(true);
+    if (!got.ok) return;
+    expect((got.data.content as { events: { seq: number }[] }).events[0]?.seq).toBe(1);
+
+    const approvals = await runtime.callTool(requester, "oke.ai.approvals.list", {
+      tenant: "acme",
+    });
+    expect(approvals.ok).toBe(true);
+    if (!approvals.ok) return;
+    expect(
+      (approvals.data.content as { rows: { id: string }[] }).rows.map((row) => row.id),
+    ).toEqual(["a"]);
+
+    const decisions = await runtime.callTool(requester, "oke.decisions.list", {});
+    expect(decisions.ok).toBe(true);
+    if (!decisions.ok) return;
+    expect(
+      (decisions.data.content as { decisions: { name: string }[] }).decisions.map(
+        (row) => row.name,
+      ),
+    ).toEqual(["triage"]);
+
+    const operatorIssued = await mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId: "root",
+      scopes: ["mcp:*"],
+    });
+    const operator = await authenticateMcpRequest(store, SECRET, operatorIssued.accessToken);
+    const allRuns = await runtime.callTool(operator, "oke.ai.runs.list", {});
+    expect(allRuns.ok).toBe(true);
+    if (!allRuns.ok) return;
+    expect((allRuns.data.content as { runs: { id: string }[] }).runs.map((row) => row.id)).toEqual([
+      "run-a",
+      "run-b",
+    ]);
+    const otherApprovals = await runtime.callTool(operator, "oke.ai.approvals.list", {
+      tenant: "other",
+    });
+    expect(otherApprovals.ok).toBe(true);
+    if (!otherApprovals.ok) return;
+    expect(
+      (otherApprovals.data.content as { rows: { id: string }[] }).rows.map((row) => row.id),
+    ).toEqual(["b"]);
+  });
+
+  test("every AI tool masks PII fields and redacted secrets", async () => {
+    const secret = Redacted.of("sk-live");
+    const manifest = {
+      oke: "1.0",
+      app: "skyport",
+      stores: {
+        app: {
+          tables: {
+            people: { columns: { email: { pii: true }, apiKey: { sensitive: true } } },
+          },
+        },
+      },
+    } as unknown as Manifest;
+    const ctx: McpContext = {
+      getManifest: () => manifest,
+      listRuns: async () => [],
+      listAgentRuns: async () => [
+        {
+          id: "run-a",
+          tenant: "acme",
+          args: { email: "a@b.co", apiKey: secret },
+          trail: [{ args: { email: "a@b.co" } }],
+        },
+      ],
+      getAgentRun: async () => ({
+        run: { id: "run-a", tenant: "acme", args: { email: "a@b.co", apiKey: secret } },
+        events: [{ seq: 1, event: { type: "CUSTOM", value: { email: "a@b.co", apiKey: secret } } }],
+      }),
+      listApprovals: async () => [
+        { id: "a", tenant: "acme", args: { email: "a@b.co", apiKey: secret } },
+      ],
+      listDecisions: async () => [
+        { name: "triage", tenant: "acme", input: { email: "a@b.co", apiKey: secret } },
+      ],
+    };
+    const runtime = createToolRuntime(ctx);
+    const store = createSessionStore();
+    const issued = await mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId: "op",
+      scopes: ["mcp:ai:read", "mcp:decisions:read"],
+      tenantId: "acme",
+    });
+    const requester = await authenticateMcpRequest(store, SECRET, issued.accessToken);
+    const blobs = [
+      await runtime.callTool(requester, "oke.ai.runs.list", {}),
+      await runtime.callTool(requester, "oke.ai.runs.get", { runId: "run-a" }),
+      await runtime.callTool(requester, "oke.ai.approvals.list", {}),
+      await runtime.callTool(requester, "oke.decisions.list", {}),
+    ];
+    for (const result of blobs) {
+      expect(result.ok).toBe(true);
+      if (!result.ok) continue;
+      const text = JSON.stringify(result.data.content);
+      expect(text).not.toContain("a@b.co");
+      expect(text).not.toContain("sk-live");
+      expect(text).toContain("[redacted]");
+    }
+  });
+});

package/src/mcp/authorization.ts

@@ -133,6 +133,72 @@ export const MCP_TOOL_POLICIES: readonly McpToolPolicy[] = [
     },
     params: [{ name: "runId", maxLength: 128 }],
   },
+  {
+    name: "oke.ai.runs.list",
+    scopes: ["mcp:ai:read", "console:runs:read"],
+    mutability: "read",
+    description: "List agent runs as inert data. Approvals stay in the Console.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "integer", minimum: 1, maximum: 200 },
+        tenant: { type: "string" },
+      },
+      additionalProperties: false,
+    },
+    params: [
+      { name: "limit", maxLength: 3 },
+      { name: "tenant", maxLength: 128 },
+    ],
+  },
+  {
+    name: "oke.ai.runs.get",
+    scopes: ["mcp:ai:read", "console:runs:read"],
+    mutability: "read",
+    description: "Return one agent run record and its follow events as inert data.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        runId: { type: "string", minLength: 1 },
+        tenant: { type: "string" },
+      },
+      required: ["runId"],
+      additionalProperties: false,
+    },
+    params: [
+      { name: "runId", maxLength: 128 },
+      { name: "tenant", maxLength: 128 },
+    ],
+  },
+  {
+    name: "oke.ai.approvals.list",
+    scopes: ["mcp:ai:read", "console:runs:read"],
+    mutability: "read",
+    description: "List pending tool approvals as inert data. Resolve stays in the Console.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tenant: { type: "string" },
+      },
+      additionalProperties: false,
+    },
+    params: [{ name: "tenant", maxLength: 128 }],
+  },
+  {
+    name: "oke.decisions.list",
+    scopes: ["mcp:decisions:read", "console:runs:read"],
+    mutability: "read",
+    description:
+      "List decisions with state, pending count, certificate metrics, and drift. Promote stays in the CLI.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tenant: { type: "string" },
+      },
+      additionalProperties: false,
+    },
+    params: [{ name: "tenant", maxLength: 128 }],
+  },
   {
     name: "oke.action.invoke",
     scopes: ["mcp:action:invoke", "console:flows:invoke"],

package/src/mcp/session.ts

@@ -38,6 +38,8 @@ export interface MintMcpSessionOptions {
   readonly secret: string;
   readonly principalId: string;
   readonly scopes: Iterable<string>;
+  /** Tenant stamped on the access token. Omitted tokens have no tenant. */
+  readonly tenantId?: string | null;
   readonly now?: () => number;
 }
 
@@ -58,6 +60,7 @@ export async function mintMcpSession(options: MintMcpSessionOptions): Promise<Is
       id: options.principalId,
       plane: "operator",
       scopes: options.scopes,
+      ...(options.tenantId !== undefined ? { tenantId: options.tenantId } : {}),
     },
   );
 }

package/src/mcp/tools.ts

@@ -5,6 +5,7 @@
  * confirmation token (no session-level consent cache).
  */
 
+import { lazyRequire } from "../kernel/lazy-require.ts";
 import type { Manifest } from "../manifest/types.ts";
 import type { WideEvent } from "../runs/types.ts";
 import { authorizeToolCall, MCP_TOOL_POLICIES, type McpToolPolicy } from "./authorization.ts";
@@ -22,6 +23,16 @@ export interface McpContext {
   readonly getManifest: () => Manifest | null;
   /** List runs/traces (already operator-scoped by the provider). */
   readonly listRuns: () => Promise<readonly WideEvent[]>;
+  /** Agent runs for `oke.ai.runs.*`. Absent providers return an empty list. */
+  readonly listAgentRuns?: () => Promise<readonly unknown[]>;
+  /** One agent run plus follow events. */
+  readonly getAgentRun?: (
+    runId: string,
+  ) => Promise<{ readonly run: unknown; readonly events: readonly unknown[] } | undefined>;
+  /** Pending tool approvals. Resolve is not an MCP tool. */
+  readonly listApprovals?: () => Promise<readonly unknown[]>;
+  /** Decision catalogue: state, pending count, metrics, drift. */
+  readonly listDecisions?: (tenant?: string) => Promise<readonly unknown[]>;
   /**
    * Safe invoke adapter. Called only after confirmation. Must NOT receive
    * the caller's Bearer token — capabilities are passed as structured input.
@@ -144,6 +155,14 @@ export function createToolRuntime(
           return tracesList(ctx, args);
         case "oke.traces.get":
           return tracesGet(ctx, args);
+        case "oke.ai.runs.list":
+          return aiRunsList(ctx, requester, args);
+        case "oke.ai.runs.get":
+          return aiRunsGet(ctx, requester, args);
+        case "oke.ai.approvals.list":
+          return aiApprovalsList(ctx, requester, args);
+        case "oke.decisions.list":
+          return decisionsList(ctx, requester, args);
         case "oke.action.confirm":
           return actionConfirm(confirm, requester, args);
         case "oke.action.invoke":
@@ -243,6 +262,155 @@ async function tracesGet(ctx: McpContext, args: Record<string, unknown>): Promis
   return okData(freezeData({ run: projectRun(run) }), "store-record");
 }
 
+function tenantArg(args: Record<string, unknown>): string | undefined {
+  return typeof args.tenant === "string" && args.tenant.length > 0 ? args.tenant : undefined;
+}
+
+function sameTenant(row: unknown, tenant: string | undefined): boolean {
+  if (!tenant) return true;
+  if (!row || typeof row !== "object") return false;
+  return (row as { tenant?: unknown }).tenant === tenant;
+}
+
+/** `console:*` and `mcp:*` may list every tenant. A named tool scope stays on its token. */
+function operatorTenantScope(scopes: readonly string[]): boolean {
+  return scopes.includes("console:*") || scopes.includes("mcp:*");
+}
+
+/**
+ * Tenant a read is allowed to see.
+ *
+ * The token's `tid` is the default. Naming another tenant, or listing every
+ * tenant, requires an operator scope. A non-operator token with no tenant
+ * sees nothing.
+ */
+function visibleTenant(
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): { readonly ok: true; readonly tenant: string | undefined } | { readonly ok: false } {
+  const requested = tenantArg(args);
+  const own = requester.claims.tid;
+  if (operatorTenantScope(requester.scopes)) {
+    return { ok: true, tenant: requested };
+  }
+  if (!own) return { ok: false };
+  if (requested !== undefined && requested !== own) return { ok: false };
+  return { ok: true, tenant: own };
+}
+
+function loadClassify(): typeof import("../elements/store/classify.ts") {
+  return lazyRequire(`${import.meta.dir}/../elements/store`, ["class", "ify"].join(""));
+}
+
+function loadRedacted(): typeof import("../kernel/redacted.ts") {
+  return lazyRequire(`${import.meta.dir}/../kernel`, ["redact", "ed"].join(""));
+}
+
+/**
+ * PII-classified and sensitive column names, plus {@link Redacted} values.
+ * Same mask token the Console traces projection uses.
+ */
+function maskAiValue(manifest: Manifest | null | undefined, value: unknown): unknown {
+  return maskPiiWalk(loadRedacted().maskRedactedDeep(value), classifiedFieldNames(manifest));
+}
+
+function classifiedFieldNames(manifest: Manifest | null | undefined): ReadonlySet<string> {
+  const names = new Set<string>();
+  if (!manifest?.stores) return names;
+  for (const store of Object.values(manifest.stores)) {
+    for (const table of Object.values(store.tables ?? {})) {
+      for (const [col, tags] of Object.entries(table.columns ?? {})) {
+        if (tags?.pii || tags?.sensitive) loadClassify().addPiiFieldName(names, col);
+      }
+    }
+  }
+  return names;
+}
+
+function maskPiiWalk(value: unknown, fields: ReadonlySet<string>): unknown {
+  if (fields.size === 0 || value === null || value === undefined) return value;
+  if (Array.isArray(value)) return value.map((item) => maskPiiWalk(item, fields));
+  if (typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = fields.has(key) ? loadClassify().PII_MASK : maskPiiWalk(child, fields);
+    }
+    return out;
+  }
+  return value;
+}
+
+async function aiRunsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const limit =
+    typeof args.limit === "number" && Number.isFinite(args.limit)
+      ? Math.min(200, Math.max(1, Math.floor(args.limit)))
+      : 50;
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ runs: [] }), "trace");
+  const all = (await ctx.listAgentRuns?.()) ?? [];
+  const runs = all
+    .filter((row) => sameTenant(row, scope.tenant))
+    .slice(0, limit)
+    .map((row) => maskAiValue(ctx.getManifest(), row));
+  return okData(freezeData({ runs }), "trace");
+}
+
+async function aiRunsGet(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const runId = String(args.runId ?? "");
+  const scope = visibleTenant(requester, args);
+  const found = scope.ok ? await ctx.getAgentRun?.(runId) : undefined;
+  if (!found || !sameTenant(found.run, scope.ok ? scope.tenant : undefined)) {
+    return {
+      ok: false,
+      code: "not-found",
+      message: `unknown run: ${runId}`,
+      data: asData({ runId }, "error"),
+    };
+  }
+  return okData(
+    freezeData({
+      run: maskAiValue(ctx.getManifest(), found.run),
+      events: maskAiValue(ctx.getManifest(), found.events),
+    }),
+    "store-record",
+  );
+}
+
+async function aiApprovalsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ rows: [] }), "store-record");
+  const all = (await ctx.listApprovals?.()) ?? [];
+  const rows = all
+    .filter((row) => sameTenant(row, scope.tenant))
+    .map((row) => maskAiValue(ctx.getManifest(), row));
+  return okData(freezeData({ rows }), "store-record");
+}
+
+async function decisionsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ decisions: [] }), "manifest");
+  const decisions = ((await ctx.listDecisions?.(scope.tenant)) ?? []).filter((row) =>
+    sameTenant(row, scope.tenant),
+  );
+  return okData(freezeData({ decisions: maskAiValue(ctx.getManifest(), decisions) }), "manifest");
+}
+
 function actionConfirm(
   confirm: ReturnType<typeof createConfirmationGate>,
   requester: McpRequester,

package/src/release/http-graph.test.ts

@@ -19,6 +19,8 @@ describe("okengine/http static import graph", () => {
     expect(forbiddenHttpGraphHits(["src/elements/store/search-runtime.ts"])).toEqual([
       "hybrid-search runtime",
     ]);
+    expect(forbiddenHttpGraphHits(["src/kernel/fx.ts"])).toEqual(["fx runtime"]);
+    expect(forbiddenHttpGraphHits(["src/kernel/fx-decide.ts"])).toEqual([]);
     expect(forbiddenHttpGraphHits(["src/elements/store/search-lsh.ts"])).toEqual([]);
     expect(forbiddenHttpGraphHits(["src/kernel/app.ts"])).toEqual([]);
   });

package/src/release/http-graph.ts

@@ -39,6 +39,11 @@ export const HTTP_STATIC_GRAPH_FORBIDDEN: readonly HttpGraphForbidden[] = [
       specifier.includes("search-runtime.js") ||
       /(^|\/)search-runtime$/.test(specifier),
   },
+  {
+    id: "fx runtime",
+    test: (specifier) =>
+      specifier.endsWith("/fx.ts") || specifier.endsWith("/fx.js") || /(^|\/)fx$/.test(specifier),
+  },
 ];
 
 /** Metafile slice this gate reads. */

package/src/release/measure.ts

@@ -288,7 +288,7 @@ if (!artifact) { console.error("no output"); process.exit(1); }
 const raw = await artifact.arrayBuffer();
 process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
 `;
-  const proc = Bun.spawn(["bun", "-e", probe], {
+  const proc = Bun.spawn([process.execPath, "-e", probe], {
     cwd: ROOT,
     stdout: "pipe",
     stderr: "pipe",
@@ -316,20 +316,45 @@ process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
  * first download when a shared chunk loads with it.
  */
 export async function measureClientGzipBytes(): Promise<number> {
-  const entry = `${import.meta.dir}/../client/budget-entry.ts`;
-  const result = await Bun.build({
-    entrypoints: [entry],
-    minify: true,
-    target: "browser",
-    format: "esm",
+  const entry = resolve(ROOT, "src/client/budget-entry.ts");
+  // `bun test` sets NODE_ENV=test. An in-process Bun.build then inlines that
+  // and the gzip drifts from `bun run budgets`. Spawn once, production, so
+  // both callers share this number.
+  const probe = `
+const result = await Bun.build({
+  entrypoints: ${JSON.stringify([entry])},
+  minify: true,
+  target: "browser",
+  format: "esm",
+});
+if (!result.success) {
+  console.error(result.logs.map(String).join("\\n"));
+  process.exit(1);
+}
+const artifact = result.outputs[0];
+if (!artifact) { console.error("no output"); process.exit(1); }
+const raw = await artifact.arrayBuffer();
+process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
+`;
+  const proc = Bun.spawn([process.execPath, "-e", probe], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { ...process.env, NODE_ENV: "production" },
   });
-  if (!result.success) {
-    throw new Error(`client build failed:\n${result.logs.map(String).join("\n")}`);
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`client build failed:\n${stderr || stdout}`);
   }
-  const artifact = result.outputs[0];
-  if (!artifact) throw new Error("client build produced no output");
-  const raw = await artifact.arrayBuffer();
-  return Bun.gzipSync(new Uint8Array(raw)).byteLength;
+  const n = Number(stdout.trim());
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new Error(`client measure produced ${stdout}`);
+  }
+  return n;
 }
 
 /**
@@ -438,7 +463,7 @@ process.stdout.write(String(ms));
 `;
   const samples: number[] = [];
   for (let i = 0; i < 7; i++) {
-    const proc = Bun.spawn(["bun", "-e", probe], {
+    const proc = Bun.spawn([process.execPath, "-e", probe], {
       cwd: ROOT,
       stdout: "pipe",
       stderr: "pipe",

package/src/runs/collect.ts

@@ -13,7 +13,7 @@ import type { Trigger } from "../kernel/triggers.ts";
 import type { FlowPlane } from "../manifest/types.ts";
 import { cacheDimensionOf, type RunTelemetry } from "../kernel/run-telemetry.ts";
 import { okid } from "../okid.ts";
-import type { RunError, WideEvent } from "./types.ts";
+import type { RunError, RunHttpFrame, WideEvent } from "./types.ts";
 
 /** Inputs for {@link collectWideEvent}. */
 export interface CollectWideEventInput {
@@ -42,6 +42,8 @@ export interface CollectWideEventInput {
   readonly input?: unknown;
   /** Flow return value when the run completed with an output. */
   readonly output?: unknown;
+  /** HTTP wire frame when the trigger was `http`. */
+  readonly http?: RunHttpFrame;
   /** Optional parent run id (causal chain). */
   readonly parentId?: string;
   /** Optional run id (generated when omitted). */
@@ -123,6 +125,7 @@ export function collectWideEvent(input: CollectWideEventInput): WideEvent {
     error,
     ...(input.input !== undefined ? { input: input.input } : {}),
     ...(input.output !== undefined ? { output: input.output } : {}),
+    ...(input.http !== undefined ? { http: input.http } : {}),
     effects: [...input.ledger.entries],
     logs: [...input.telemetry.logs],
     durationMs,

package/src/runs/parquet.test.ts

@@ -12,7 +12,13 @@ import { join } from "node:path";
 
 import { duckPath, openDuckDB } from "./duckdb.ts";
 import { createRunsRuntime } from "./runtime.ts";
-import { readParquet, wideEventToRow, writeParquet, type ParquetRow } from "./parquet.ts";
+import {
+  readParquet,
+  rowToWideEvent,
+  wideEventToRow,
+  writeParquet,
+  type ParquetRow,
+} from "./parquet.ts";
 import type { WideEvent } from "./types.ts";
 
 const temps: string[] = [];
@@ -62,6 +68,26 @@ async function writeLegacyParquet(path: string, rows: readonly ParquetRow[]): Pr
   }
 }
 
+describe("parquet http frame", () => {
+  test("round-trips a frame and omits a null column", () => {
+    const event = sample("framed", null);
+    const framed = {
+      ...event,
+      http: {
+        request: {
+          method: "GET",
+          path: "/tasks",
+          query: { limit: "20" },
+          headers: { accept: "application/json" },
+        },
+        response: { status: 200, headers: { "content-type": "application/json" } },
+      },
+    };
+    expect(rowToWideEvent(wideEventToRow(framed)).http).toEqual(framed.http);
+    expect(rowToWideEvent(wideEventToRow(event)).http).toBeUndefined();
+  });
+});
+
 describe("parquet error_code types", () => {
   test("readParquet unions all-null JSON error_code with VARCHAR Unauthorized", async () => {
     const dir = await tmpDir();