okengine 0.22.0 → 0.23.1

package/src/mcp/mcp.test.ts

@@ -15,6 +15,7 @@ import { asData, isDataEnvelope, MCP_DATA_KIND } from "./data.ts";
 import { authenticateMcpRequest, mintMcpSession, MCP_AUDIENCE } from "./session.ts";
 import { createMcpServer } from "./server.ts";
 import { createToolRuntime } from "./tools.ts";
+import { MCP_CLIENT_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION } from "./versions.ts";
 
 const SECRET = "mcp-test-secret";
 
@@ -314,4 +315,86 @@ describe("MCP HTTP server", () => {
     expect(callBody.result.structuredContent.kind).toBe("data");
     expect(callBody.result.structuredContent.content.manifest.app).toBe("skyport");
   });
+
+  test("initialize advertises 2024-11-05 and rejects a version the server does not implement", async () => {
+    const store = createSessionStore();
+    const issued = await mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId: "op1",
+      scopes: ["console:*"],
+    });
+    const server = createMcpServer({
+      sessions: store,
+      secret: SECRET,
+      context: {
+        getManifest: () => SAMPLE_MANIFEST,
+        listRuns: async () => [],
+      },
+    });
+    const headers = {
+      host: "127.0.0.1:6535",
+      authorization: `Bearer ${issued.accessToken}`,
+      "content-type": "application/json",
+    };
+    const init = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "initialize",
+          params: { protocolVersion: MCP_PROTOCOL_VERSION },
+        }),
+      }),
+    );
+    expect(init.status).toBe(200);
+    const initBody = (await init.json()) as { result: { protocolVersion: string } };
+    expect(initBody.result.protocolVersion).toBe("2024-11-05");
+    const omitted = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 2,
+          method: "initialize",
+          params: {},
+        }),
+      }),
+    );
+    const omittedBody = (await omitted.json()) as { result: { protocolVersion: string } };
+    expect(omittedBody.result.protocolVersion).toBe("2024-11-05");
+    const rejected = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 3,
+          method: "initialize",
+          params: { protocolVersion: MCP_CLIENT_PROTOCOL_VERSION },
+        }),
+      }),
+    );
+    expect(rejected.status).toBe(400);
+    const call = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 4,
+          method: "tools/call",
+          params: {
+            name: "oke.manifest.get",
+            arguments: {},
+            protocolVersion: MCP_PROTOCOL_VERSION,
+          },
+        }),
+      }),
+    );
+    expect(call.status).toBe(200);
+  });
 });

package/src/mcp/protocol.ts

@@ -129,8 +129,14 @@ export interface McpInitializeResult {
   readonly sessionId: string;
 }
 
-/** Supported MCP protocol version. */
-export const MCP_PROTOCOL_VERSION = "2024-11-05";
+/** Highest protocol version the servers implement (`2024-11-05`). */
+export {
+  MCP_PROTOCOL_VERSION,
+  MCP_SUPPORTED_PROTOCOL_VERSIONS,
+  acceptsMcpProtocolVersion,
+  negotiateMcpProtocolVersion,
+  protocolVersionOf,
+} from "./versions.ts";
 
 /**
  * Parse tools/call params.

package/src/mcp/server.ts

@@ -18,7 +18,9 @@ import { MCP_PORT, type ServerHandle } from "../runtime/types.ts";
 import { SessionError, type SessionStore } from "../auth/sessions.ts";
 import { asData } from "./data.ts";
 import {
-  MCP_PROTOCOL_VERSION,
+  acceptsMcpProtocolVersion,
+  negotiateMcpProtocolVersion,
+  protocolVersionOf,
   parseJsonRpcRequest,
   parseToolsCallParams,
   rpcError,
@@ -149,10 +151,20 @@ export function createMcpServer(options: CreateMcpServerOptions): McpServer {
 
     switch (rpc.method) {
       case "initialize": {
+        const requested = protocolVersionOf(rpc.params);
+        const protocolVersion = negotiateMcpProtocolVersion(requested);
+        if (protocolVersion === undefined) {
+          return respond(
+            jsonRpcHttp(
+              rpcError(id, RpcErrorCode.invalidParams, "unsupported protocol version"),
+              400,
+            ),
+          );
+        }
         const sessionId = newMcpTransportSessionId();
         transportSessions.add(sessionId);
         const result: McpInitializeResult = {
-          protocolVersion: MCP_PROTOCOL_VERSION,
+          protocolVersion,
           capabilities: { tools: { listChanged: false } },
           serverInfo: { name: "okengine-mcp", version },
           sessionId,
@@ -182,6 +194,15 @@ export function createMcpServer(options: CreateMcpServerOptions): McpServer {
         );
       }
       case "tools/call": {
+        const requested = protocolVersionOf(rpc.params);
+        if (requested !== undefined && !acceptsMcpProtocolVersion(requested)) {
+          return respond(
+            jsonRpcHttp(
+              rpcError(id, RpcErrorCode.invalidParams, "unsupported protocol version"),
+              400,
+            ),
+          );
+        }
         const call = parseToolsCallParams(rpc.params);
         if (!call.ok) {
           return respond(jsonRpcHttp(rpcError(id, RpcErrorCode.invalidParams, call.message), 400));

package/src/mcp/session.ts

@@ -38,6 +38,8 @@ export interface MintMcpSessionOptions {
   readonly secret: string;
   readonly principalId: string;
   readonly scopes: Iterable<string>;
+  /** Tenant stamped on the access token. Omitted tokens have no tenant. */
+  readonly tenantId?: string | null;
   readonly now?: () => number;
 }
 
@@ -58,6 +60,7 @@ export async function mintMcpSession(options: MintMcpSessionOptions): Promise<Is
       id: options.principalId,
       plane: "operator",
       scopes: options.scopes,
+      ...(options.tenantId !== undefined ? { tenantId: options.tenantId } : {}),
     },
   );
 }

package/src/mcp/tools.ts

@@ -5,6 +5,7 @@
  * confirmation token (no session-level consent cache).
  */
 
+import { lazyRequire } from "../kernel/lazy-require.ts";
 import type { Manifest } from "../manifest/types.ts";
 import type { WideEvent } from "../runs/types.ts";
 import { authorizeToolCall, MCP_TOOL_POLICIES, type McpToolPolicy } from "./authorization.ts";
@@ -22,6 +23,16 @@ export interface McpContext {
   readonly getManifest: () => Manifest | null;
   /** List runs/traces (already operator-scoped by the provider). */
   readonly listRuns: () => Promise<readonly WideEvent[]>;
+  /** Agent runs for `oke.ai.runs.*`. Absent providers return an empty list. */
+  readonly listAgentRuns?: () => Promise<readonly unknown[]>;
+  /** One agent run plus follow events. */
+  readonly getAgentRun?: (
+    runId: string,
+  ) => Promise<{ readonly run: unknown; readonly events: readonly unknown[] } | undefined>;
+  /** Pending tool approvals. Resolve is not an MCP tool. */
+  readonly listApprovals?: () => Promise<readonly unknown[]>;
+  /** Decision catalogue: state, pending count, metrics, drift. */
+  readonly listDecisions?: (tenant?: string) => Promise<readonly unknown[]>;
   /**
    * Safe invoke adapter. Called only after confirmation. Must NOT receive
    * the caller's Bearer token — capabilities are passed as structured input.
@@ -144,6 +155,14 @@ export function createToolRuntime(
           return tracesList(ctx, args);
         case "oke.traces.get":
           return tracesGet(ctx, args);
+        case "oke.ai.runs.list":
+          return aiRunsList(ctx, requester, args);
+        case "oke.ai.runs.get":
+          return aiRunsGet(ctx, requester, args);
+        case "oke.ai.approvals.list":
+          return aiApprovalsList(ctx, requester, args);
+        case "oke.decisions.list":
+          return decisionsList(ctx, requester, args);
         case "oke.action.confirm":
           return actionConfirm(confirm, requester, args);
         case "oke.action.invoke":
@@ -243,6 +262,155 @@ async function tracesGet(ctx: McpContext, args: Record<string, unknown>): Promis
   return okData(freezeData({ run: projectRun(run) }), "store-record");
 }
 
+function tenantArg(args: Record<string, unknown>): string | undefined {
+  return typeof args.tenant === "string" && args.tenant.length > 0 ? args.tenant : undefined;
+}
+
+function sameTenant(row: unknown, tenant: string | undefined): boolean {
+  if (!tenant) return true;
+  if (!row || typeof row !== "object") return false;
+  return (row as { tenant?: unknown }).tenant === tenant;
+}
+
+/** `console:*` and `mcp:*` may list every tenant. A named tool scope stays on its token. */
+function operatorTenantScope(scopes: readonly string[]): boolean {
+  return scopes.includes("console:*") || scopes.includes("mcp:*");
+}
+
+/**
+ * Tenant a read is allowed to see.
+ *
+ * The token's `tid` is the default. Naming another tenant, or listing every
+ * tenant, requires an operator scope. A non-operator token with no tenant
+ * sees nothing.
+ */
+function visibleTenant(
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): { readonly ok: true; readonly tenant: string | undefined } | { readonly ok: false } {
+  const requested = tenantArg(args);
+  const own = requester.claims.tid;
+  if (operatorTenantScope(requester.scopes)) {
+    return { ok: true, tenant: requested };
+  }
+  if (!own) return { ok: false };
+  if (requested !== undefined && requested !== own) return { ok: false };
+  return { ok: true, tenant: own };
+}
+
+function loadClassify(): typeof import("../elements/store/classify.ts") {
+  return lazyRequire(`${import.meta.dir}/../elements/store`, ["class", "ify"].join(""));
+}
+
+function loadRedacted(): typeof import("../kernel/redacted.ts") {
+  return lazyRequire(`${import.meta.dir}/../kernel`, ["redact", "ed"].join(""));
+}
+
+/**
+ * PII-classified and sensitive column names, plus {@link Redacted} values.
+ * Same mask token the Console traces projection uses.
+ */
+function maskAiValue(manifest: Manifest | null | undefined, value: unknown): unknown {
+  return maskPiiWalk(loadRedacted().maskRedactedDeep(value), classifiedFieldNames(manifest));
+}
+
+function classifiedFieldNames(manifest: Manifest | null | undefined): ReadonlySet<string> {
+  const names = new Set<string>();
+  if (!manifest?.stores) return names;
+  for (const store of Object.values(manifest.stores)) {
+    for (const table of Object.values(store.tables ?? {})) {
+      for (const [col, tags] of Object.entries(table.columns ?? {})) {
+        if (tags?.pii || tags?.sensitive) loadClassify().addPiiFieldName(names, col);
+      }
+    }
+  }
+  return names;
+}
+
+function maskPiiWalk(value: unknown, fields: ReadonlySet<string>): unknown {
+  if (fields.size === 0 || value === null || value === undefined) return value;
+  if (Array.isArray(value)) return value.map((item) => maskPiiWalk(item, fields));
+  if (typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = fields.has(key) ? loadClassify().PII_MASK : maskPiiWalk(child, fields);
+    }
+    return out;
+  }
+  return value;
+}
+
+async function aiRunsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const limit =
+    typeof args.limit === "number" && Number.isFinite(args.limit)
+      ? Math.min(200, Math.max(1, Math.floor(args.limit)))
+      : 50;
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ runs: [] }), "trace");
+  const all = (await ctx.listAgentRuns?.()) ?? [];
+  const runs = all
+    .filter((row) => sameTenant(row, scope.tenant))
+    .slice(0, limit)
+    .map((row) => maskAiValue(ctx.getManifest(), row));
+  return okData(freezeData({ runs }), "trace");
+}
+
+async function aiRunsGet(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const runId = String(args.runId ?? "");
+  const scope = visibleTenant(requester, args);
+  const found = scope.ok ? await ctx.getAgentRun?.(runId) : undefined;
+  if (!found || !sameTenant(found.run, scope.ok ? scope.tenant : undefined)) {
+    return {
+      ok: false,
+      code: "not-found",
+      message: `unknown run: ${runId}`,
+      data: asData({ runId }, "error"),
+    };
+  }
+  return okData(
+    freezeData({
+      run: maskAiValue(ctx.getManifest(), found.run),
+      events: maskAiValue(ctx.getManifest(), found.events),
+    }),
+    "store-record",
+  );
+}
+
+async function aiApprovalsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ rows: [] }), "store-record");
+  const all = (await ctx.listApprovals?.()) ?? [];
+  const rows = all
+    .filter((row) => sameTenant(row, scope.tenant))
+    .map((row) => maskAiValue(ctx.getManifest(), row));
+  return okData(freezeData({ rows }), "store-record");
+}
+
+async function decisionsList(
+  ctx: McpContext,
+  requester: McpRequester,
+  args: Record<string, unknown>,
+): Promise<ToolCallResult> {
+  const scope = visibleTenant(requester, args);
+  if (!scope.ok) return okData(freezeData({ decisions: [] }), "manifest");
+  const decisions = ((await ctx.listDecisions?.(scope.tenant)) ?? []).filter((row) =>
+    sameTenant(row, scope.tenant),
+  );
+  return okData(freezeData({ decisions: maskAiValue(ctx.getManifest(), decisions) }), "manifest");
+}
+
 function actionConfirm(
   confirm: ReturnType<typeof createConfirmationGate>,
   requester: McpRequester,

package/src/mcp/versions.ts

@@ -0,0 +1,60 @@
+/**
+ * MCP protocol versions.
+ *
+ * The app and docs servers implement `initialize`, `ping`, `tools/list`, and
+ * `tools/call`. That is the 2024-11-05 tools surface, so they advertise
+ * {@link MCP_PROTOCOL_VERSION} and reject any other client version.
+ *
+ * The outbound client is separate. It probes external servers with
+ * {@link MCP_CLIENT_PROTOCOL_VERSION} (`_meta` on each request) and falls
+ * back to a 2024-11-05 `initialize`. That constant is not the server
+ * advertisement.
+ */
+
+/** Versions the app and docs servers implement, newest last. */
+export const MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2024-11-05"] as const;
+
+/** Highest protocol version the servers implement and advertise. */
+export const MCP_PROTOCOL_VERSION: (typeof MCP_SUPPORTED_PROTOCOL_VERSIONS)[number] = "2024-11-05";
+
+/** Version the outbound MCP client probes first. Not the server advertisement. */
+export const MCP_CLIENT_PROTOCOL_VERSION = "2026-07-28";
+
+/** `initialize` dialect the outbound client falls back to. */
+export const MCP_LEGACY_PROTOCOL_VERSION = "2024-11-05";
+
+const ACCEPTED: readonly string[] = MCP_SUPPORTED_PROTOCOL_VERSIONS;
+
+/**
+ * Whether a client-offered protocol version is one this server implements.
+ *
+ * @param version - `initialize` or `tools/call` protocol version
+ */
+export function acceptsMcpProtocolVersion(version: string): boolean {
+  return ACCEPTED.includes(version);
+}
+
+/**
+ * Pick the protocol version for an `initialize` result.
+ *
+ * An omitted client version gets the highest version this server implements.
+ * A supported client version is echoed. Anything else has no overlap.
+ *
+ * @param requested - Client `protocolVersion`, when present
+ */
+export function negotiateMcpProtocolVersion(requested: string | undefined): string | undefined {
+  if (requested === undefined) return MCP_PROTOCOL_VERSION;
+  if (acceptsMcpProtocolVersion(requested)) return requested;
+  return undefined;
+}
+
+/**
+ * Read `params.protocolVersion` when the client sent one.
+ *
+ * @param params - JSON-RPC params
+ */
+export function protocolVersionOf(params: unknown): string | undefined {
+  if (params === null || typeof params !== "object" || Array.isArray(params)) return undefined;
+  const version = (params as { protocolVersion?: unknown }).protocolVersion;
+  return typeof version === "string" && version.length > 0 ? version : undefined;
+}

package/src/plugins/index.ts

@@ -24,6 +24,7 @@ export {
   type MagicLinkOptions,
 } from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
+export { mena, menaChannels, type MenaChannelOptions } from "./mena.ts";
 export {
   createPhoneStore,
   otp,

package/src/plugins/mena.ts

@@ -0,0 +1,56 @@
+/**
+ * MENA channel plugin — Taqnyat, Unifonic, and Msegat behind one plugin.
+ *
+ * Drivers stay the protocol adapters. `fx.sendOtp`, `fx.verifyOtp`, and
+ * `fx.deliverOtp` remain supported Channel methods.
+ */
+
+import { openMsegatChannel } from "../drivers/channel-msegat.ts";
+import { openTaqnyatChannel } from "../drivers/channel-taqnyat.ts";
+import { openTaqnyatMailChannel } from "../drivers/channel-taqnyat-mail.ts";
+import { openTaqnyatWhatsAppChannel } from "../drivers/channel-taqnyat-whatsapp.ts";
+import { openUnifonicChannel } from "../drivers/channel-unifonic.ts";
+import type { ChannelDriver, ChannelOpenOptions } from "../drivers/channel-types.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+
+export {
+  openMsegatChannel,
+  openTaqnyatChannel,
+  openTaqnyatMailChannel,
+  openTaqnyatWhatsAppChannel,
+  openUnifonicChannel,
+};
+
+/** Which MENA providers to open. Omitted providers are skipped. */
+export interface MenaChannelOptions {
+  readonly sms?: ChannelOpenOptions;
+  readonly unifonic?: ChannelOpenOptions;
+  readonly msegat?: ChannelOpenOptions;
+  readonly mail?: ChannelOpenOptions;
+  readonly whatsapp?: ChannelOpenOptions;
+}
+
+/**
+ * Open the MENA drivers that have options.
+ *
+ * @param options - Per-provider credentials (`bearerToken` / `sender` / …)
+ */
+export function menaChannels(options: MenaChannelOptions = {}): ChannelDriver[] {
+  const drivers: ChannelDriver[] = [];
+  if (options.sms) drivers.push(openTaqnyatChannel(options.sms));
+  if (options.unifonic) drivers.push(openUnifonicChannel(options.unifonic));
+  if (options.msegat) drivers.push(openMsegatChannel(options.msegat));
+  if (options.mail) drivers.push(openTaqnyatMailChannel(options.mail));
+  if (options.whatsapp) drivers.push(openTaqnyatWhatsAppChannel(options.whatsapp));
+  return drivers;
+}
+
+/**
+ * Headline plugin. Attach with `.plug(mena())`. Drivers come from
+ * {@link menaChannels}; this registration is the product name.
+ *
+ * @param options - Unused today; reserved for plugin config
+ */
+export function mena(options: MenaChannelOptions = {}): PluginDef {
+  return plugin("mena", { version: "1", config: options });
+}

package/src/release/http-graph.test.ts

@@ -19,6 +19,8 @@ describe("okengine/http static import graph", () => {
     expect(forbiddenHttpGraphHits(["src/elements/store/search-runtime.ts"])).toEqual([
       "hybrid-search runtime",
     ]);
+    expect(forbiddenHttpGraphHits(["src/kernel/fx.ts"])).toEqual(["fx runtime"]);
+    expect(forbiddenHttpGraphHits(["src/kernel/fx-decide.ts"])).toEqual([]);
     expect(forbiddenHttpGraphHits(["src/elements/store/search-lsh.ts"])).toEqual([]);
     expect(forbiddenHttpGraphHits(["src/kernel/app.ts"])).toEqual([]);
   });

package/src/release/http-graph.ts

@@ -39,6 +39,11 @@ export const HTTP_STATIC_GRAPH_FORBIDDEN: readonly HttpGraphForbidden[] = [
       specifier.includes("search-runtime.js") ||
       /(^|\/)search-runtime$/.test(specifier),
   },
+  {
+    id: "fx runtime",
+    test: (specifier) =>
+      specifier.endsWith("/fx.ts") || specifier.endsWith("/fx.js") || /(^|\/)fx$/.test(specifier),
+  },
 ];
 
 /** Metafile slice this gate reads. */

package/src/release/measure.ts

@@ -288,7 +288,7 @@ if (!artifact) { console.error("no output"); process.exit(1); }
 const raw = await artifact.arrayBuffer();
 process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
 `;
-  const proc = Bun.spawn(["bun", "-e", probe], {
+  const proc = Bun.spawn([process.execPath, "-e", probe], {
     cwd: ROOT,
     stdout: "pipe",
     stderr: "pipe",
@@ -316,20 +316,45 @@ process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
  * first download when a shared chunk loads with it.
  */
 export async function measureClientGzipBytes(): Promise<number> {
-  const entry = `${import.meta.dir}/../client/budget-entry.ts`;
-  const result = await Bun.build({
-    entrypoints: [entry],
-    minify: true,
-    target: "browser",
-    format: "esm",
+  const entry = resolve(ROOT, "src/client/budget-entry.ts");
+  // `bun test` sets NODE_ENV=test. An in-process Bun.build then inlines that
+  // and the gzip drifts from `bun run budgets`. Spawn once, production, so
+  // both callers share this number.
+  const probe = `
+const result = await Bun.build({
+  entrypoints: ${JSON.stringify([entry])},
+  minify: true,
+  target: "browser",
+  format: "esm",
+});
+if (!result.success) {
+  console.error(result.logs.map(String).join("\\n"));
+  process.exit(1);
+}
+const artifact = result.outputs[0];
+if (!artifact) { console.error("no output"); process.exit(1); }
+const raw = await artifact.arrayBuffer();
+process.stdout.write(String(Bun.gzipSync(new Uint8Array(raw)).byteLength));
+`;
+  const proc = Bun.spawn([process.execPath, "-e", probe], {
+    cwd: ROOT,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { ...process.env, NODE_ENV: "production" },
   });
-  if (!result.success) {
-    throw new Error(`client build failed:\n${result.logs.map(String).join("\n")}`);
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  if (exitCode !== 0) {
+    throw new Error(`client build failed:\n${stderr || stdout}`);
   }
-  const artifact = result.outputs[0];
-  if (!artifact) throw new Error("client build produced no output");
-  const raw = await artifact.arrayBuffer();
-  return Bun.gzipSync(new Uint8Array(raw)).byteLength;
+  const n = Number(stdout.trim());
+  if (!Number.isFinite(n) || n <= 0) {
+    throw new Error(`client measure produced ${stdout}`);
+  }
+  return n;
 }
 
 /**
@@ -438,7 +463,7 @@ process.stdout.write(String(ms));
 `;
   const samples: number[] = [];
   for (let i = 0; i < 7; i++) {
-    const proc = Bun.spawn(["bun", "-e", probe], {
+    const proc = Bun.spawn([process.execPath, "-e", probe], {
       cwd: ROOT,
       stdout: "pipe",
       stderr: "pipe",

package/src/runs/collect.ts

@@ -13,7 +13,7 @@ import type { Trigger } from "../kernel/triggers.ts";
 import type { FlowPlane } from "../manifest/types.ts";
 import { cacheDimensionOf, type RunTelemetry } from "../kernel/run-telemetry.ts";
 import { okid } from "../okid.ts";
-import type { RunError, WideEvent } from "./types.ts";
+import type { RunError, RunHttpFrame, WideEvent } from "./types.ts";
 
 /** Inputs for {@link collectWideEvent}. */
 export interface CollectWideEventInput {
@@ -42,6 +42,8 @@ export interface CollectWideEventInput {
   readonly input?: unknown;
   /** Flow return value when the run completed with an output. */
   readonly output?: unknown;
+  /** HTTP wire frame when the trigger was `http`. */
+  readonly http?: RunHttpFrame;
   /** Optional parent run id (causal chain). */
   readonly parentId?: string;
   /** Optional run id (generated when omitted). */
@@ -123,6 +125,7 @@ export function collectWideEvent(input: CollectWideEventInput): WideEvent {
     error,
     ...(input.input !== undefined ? { input: input.input } : {}),
     ...(input.output !== undefined ? { output: input.output } : {}),
+    ...(input.http !== undefined ? { http: input.http } : {}),
     effects: [...input.ledger.entries],
     logs: [...input.telemetry.logs],
     durationMs,

package/src/runs/parquet.test.ts

@@ -12,7 +12,13 @@ import { join } from "node:path";
 
 import { duckPath, openDuckDB } from "./duckdb.ts";
 import { createRunsRuntime } from "./runtime.ts";
-import { readParquet, wideEventToRow, writeParquet, type ParquetRow } from "./parquet.ts";
+import {
+  readParquet,
+  rowToWideEvent,
+  wideEventToRow,
+  writeParquet,
+  type ParquetRow,
+} from "./parquet.ts";
 import type { WideEvent } from "./types.ts";
 
 const temps: string[] = [];
@@ -62,6 +68,26 @@ async function writeLegacyParquet(path: string, rows: readonly ParquetRow[]): Pr
   }
 }
 
+describe("parquet http frame", () => {
+  test("round-trips a frame and omits a null column", () => {
+    const event = sample("framed", null);
+    const framed = {
+      ...event,
+      http: {
+        request: {
+          method: "GET",
+          path: "/tasks",
+          query: { limit: "20" },
+          headers: { accept: "application/json" },
+        },
+        response: { status: 200, headers: { "content-type": "application/json" } },
+      },
+    };
+    expect(rowToWideEvent(wideEventToRow(framed)).http).toEqual(framed.http);
+    expect(rowToWideEvent(wideEventToRow(event)).http).toBeUndefined();
+  });
+});
+
 describe("parquet error_code types", () => {
   test("readParquet unions all-null JSON error_code with VARCHAR Unauthorized", async () => {
     const dir = await tmpDir();