@hotmeshio/long-tail 0.5.11 → 0.6.0

package/build/routes/escalations/facets.js

@@ -0,0 +1,81 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerFacetRoutes = registerFacetRoutes;
+const api = __importStar(require("../../api/escalations"));
+/**
+ * Faceted-routing HTTP surface — pond search + batch claim. Each operation targets a
+ * single pond `role` and is RBAC-scoped to it (the api layer enforces the gate). These
+ * mirror the SDK `escalations.searchByFacets / claimGroups / claimByFacets`.
+ */
+function registerFacetRoutes(router) {
+    /**
+     * POST /api/escalations/search-by-facets
+     * Item-level faceted search over a pond, scoped to the caller's role.
+     * Body: FacetQuery — { role, status?, available?, facets?, orderBy?, limit?, offset? }
+     */
+    router.post('/search-by-facets', async (req, res) => {
+        const result = await api.searchByFacets(req.body ?? {}, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+    /**
+     * POST /api/escalations/claim-groups
+     * Batch-claim complete origin groups in priority order, assigned to the caller.
+     * Body: { query: FacetQuery, limit?, durationMinutes?, sizeFacet? }
+     */
+    router.post('/claim-groups', async (req, res) => {
+        const result = await api.claimGroups({
+            query: req.body?.query,
+            limit: req.body?.limit,
+            durationMinutes: req.body?.durationMinutes,
+            sizeFacet: req.body?.sizeFacet,
+        }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+    /**
+     * POST /api/escalations/claim-by-facets
+     * Batch-claim individual rows (FOR UPDATE SKIP LOCKED), assigned to the caller.
+     * Body: { query: FacetQuery, limit?, durationMinutes?, allOrNone? }
+     */
+    router.post('/claim-by-facets', async (req, res) => {
+        const result = await api.claimByFacets({
+            query: req.body?.query,
+            limit: req.body?.limit,
+            durationMinutes: req.body?.durationMinutes,
+            allOrNone: req.body?.allOrNone,
+        }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+}

package/build/routes/escalations/index.js

@@ -6,6 +6,7 @@ const bulk_1 = require("./bulk");
 const metadata_1 = require("./metadata");
 const single_1 = require("./single");
 const resolve_1 = require("./resolve");
+const facets_1 = require("./facets");
 const router = (0, express_1.Router)();
 // Registration order matters: literal paths before parameterized /:id routes.
 // GET /, /available, /types, /stats
@@ -15,6 +16,8 @@ const router = (0, express_1.Router)();
 (0, bulk_1.registerBulkRoutes)(router);
 // GET /by-metadata, POST /claim-by-metadata, POST /resolve-by-metadata
 (0, metadata_1.registerMetadataRoutes)(router);
+// POST /search-by-facets, /claim-groups, /claim-by-facets
+(0, facets_1.registerFacetRoutes)(router);
 // PATCH /:id/escalate, GET /by-workflow/:workflowId,
 // GET /:id, POST /:id/claim, POST /:id/release
 (0, single_1.registerSingleRoutes)(router);

package/build/routes/escalations/list.js

@@ -35,6 +35,21 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerListRoutes = registerListRoutes;
 const api = __importStar(require("../../api/escalations"));
+/**
+ * Parse a JSON-encoded query param (facets/block/range/exists/orderBy/roles) so the
+ * full faceted query rides on a GET URL — keeps the dashboard's copy-URL/curl path
+ * reproducible. Returns undefined on absent/invalid JSON (never throws to the caller).
+ */
+function jsonParam(v) {
+    if (typeof v !== 'string' || !v)
+        return undefined;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return undefined;
+    }
+}
 function registerListRoutes(router) {
     /**
      * POST /api/escalations
@@ -55,6 +70,13 @@ function registerListRoutes(router) {
             envelope: req.body?.envelope,
             metadata: req.body?.metadata,
             escalation_payload: req.body?.escalation_payload,
+            // Workflow-linkage (optional): an advert for a running workflow.
+            origin_id: req.body?.origin_id,
+            parent_id: req.body?.parent_id,
+            task_id: req.body?.task_id,
+            workflow_id: req.body?.workflow_id,
+            task_queue: req.body?.task_queue,
+            workflow_type: req.body?.workflow_type,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -76,6 +98,15 @@ function registerListRoutes(router) {
             offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
             sort_by: req.query.sort_by,
             order: req.query.order,
+            search: req.query.search,
+            // Faceted query elements (JSON-encoded on the URL).
+            roles: jsonParam(req.query.roles),
+            facets: jsonParam(req.query.facets),
+            block: jsonParam(req.query.block),
+            range: jsonParam(req.query.range),
+            exists: jsonParam(req.query.exists),
+            orderBy: jsonParam(req.query.orderBy),
+            available: req.query.available != null ? req.query.available === 'true' : undefined,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -94,6 +125,14 @@ function registerListRoutes(router) {
             offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
             sort_by: req.query.sort_by,
             order: req.query.order,
+            search: req.query.search,
+            // Faceted query elements (JSON-encoded on the URL).
+            roles: jsonParam(req.query.roles),
+            facets: jsonParam(req.query.facets),
+            block: jsonParam(req.query.block),
+            range: jsonParam(req.query.range),
+            exists: jsonParam(req.query.exists),
+            orderBy: jsonParam(req.query.orderBy),
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -105,6 +144,15 @@ function registerListRoutes(router) {
         const result = await api.listDistinctTypes();
         res.status(result.status).json(result.data ?? { error: result.error });
     });
+    /**
+     * GET /api/escalations/facet-keys
+     * Distinct top-level metadata facet keys visible to the caller (role-scoped).
+     * Powers the faceted-query UI's key autocomplete.
+     */
+    router.get('/facet-keys', async (req, res) => {
+        const result = await api.listFacetKeys(undefined, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
     /**
      * GET /api/escalations/stats
      * Aggregated escalation statistics.

package/build/routes/escalations/resolve.js

@@ -42,10 +42,28 @@ function registerResolveRoutes(router) {
      * waiting workflow in place. For webhook callers that know the deterministic
      * signal id. Literal single-segment path — registered before /:id/resolve so
      * it is never shadowed by the parameterized route.
-     * Body: { signalKey: string, resolverPayload: Record<string, any> }
+     * Body: { signalKey: string, resolverPayload: Record<string, any>, metadata?: Record<string, any> }
      */
     router.post('/resolve-by-signal-key', async (req, res) => {
-        const result = await api.resolveBySignalKey({ signalKey: req.body?.signalKey, resolverPayload: req.body?.resolverPayload }, req.auth);
+        const result = await api.resolveBySignalKey({
+            signalKey: req.body?.signalKey,
+            resolverPayload: req.body?.resolverPayload,
+            metadata: req.body?.metadata,
+        }, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+    /**
+     * POST /api/escalations/resolve-by-ids
+     * Resolve a SET of escalations by id in one guarded statement (set-based sibling of
+     * /:id/resolve). RBAC: scoped callers may only resolve rows whose role they hold.
+     * Body: { ids: string[], resolverPayload: Record<string, any>, metadata?: Record<string, any> }
+     */
+    router.post('/resolve-by-ids', async (req, res) => {
+        const result = await api.resolveByIds({
+            ids: req.body?.ids,
+            resolverPayload: req.body?.resolverPayload,
+            metadata: req.body?.metadata,
+        }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     /**
@@ -53,10 +71,10 @@ function registerResolveRoutes(router) {
      * Resolve a pending escalation with a human-provided payload. Routes by
      * escalation shape: efficient (signal_key) resumes the job in place; legacy
      * paths signal via routing metadata or re-run the original workflow.
-     * Body: { resolverPayload: Record<string, any> }
+     * Body: { resolverPayload: Record<string, any>, metadata?: Record<string, any> }
      */
     router.post('/:id/resolve', async (req, res) => {
-        const result = await api.resolveEscalation({ id: req.params.id, resolverPayload: req.body?.resolverPayload }, req.auth);
+        const result = await api.resolveEscalation({ id: req.params.id, resolverPayload: req.body?.resolverPayload, metadata: req.body?.metadata }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
 }

package/build/routes/users.js

@@ -41,13 +41,14 @@ const router = (0, express_1.Router)();
 /**
  * GET /api/users
  * List users with optional filters.
- * Query: ?role=reviewer&roleType=admin&status=active&limit=50&offset=0
+ * Query: ?role=reviewer&roleType=admin&status=active&search=ada&limit=50&offset=0
  */
 router.get('/', async (req, res) => {
     const result = await api.listUsers({
         role: req.query.role,
         roleType: req.query.roleType,
         status: req.query.status,
+        search: req.query.search,
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
     });
@@ -99,15 +100,18 @@ router.get('/:id/roles', async (req, res) => {
 /**
  * POST /api/users/:id/roles
  * Add a role to a user.
- * Body: { role, type } — type must be superadmin, admin, or member
+ * Body: { role, type, read_scope?, write_scope? } — type must be superadmin,
+ * admin, or member. read_scope (self|all) and write_scope (none|self|all) refine
+ * a member's work surface; they default to all/all and are ignored for admin/superadmin.
  *
- * Scoping rules:
+ * Scoping rules (management tier):
  * - superadmin: can assign any role/type
  * - engineer: can assign up to admin type, but never superadmin type
  * - role/admin (non-builder): can only assign member/admin for roles they hold
+ * A caller who may assign a role may set any work-surface scope on it.
  */
 router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
-    const { role, type } = req.body || {};
+    const { role, type, read_scope, write_scope } = req.body || {};
     const userId = req.auth.userId;
     // Superadmin bypasses all scoping
     const { isSuperAdmin } = await Promise.resolve().then(() => __importStar(require('../services/user/rbac')));
@@ -129,7 +133,7 @@ router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
             }
         }
     }
-    const result = await api.addUserRole({ id: req.params.id, role, type });
+    const result = await api.addUserRole({ id: req.params.id, role, type, read_scope, write_scope });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/routes/workflows/invocation.js

@@ -66,19 +66,27 @@ router.post('/:type/invoke', async (req, res) => {
 // ── Workflow observation ────────────────────────────────────────────────────
 /**
  * GET /api/workflows/:workflowId/status
- * Get the status of a workflow. Only the workflowId is needed.
+ * Get the status of a workflow. Optional `app_id` query param selects the
+ * HotMesh namespace for resolution (default: durable).
  */
 router.get('/:workflowId/status', async (req, res) => {
-    const result = await api.getWorkflowStatus({ workflowId: req.params.workflowId });
+    const result = await api.getWorkflowStatus({
+        workflowId: req.params.workflowId,
+        appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
+    });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * GET /api/workflows/:workflowId/result
  * Return the workflow result if complete, or 202 if still running.
- * Never blocks — always returns immediately.
+ * Never blocks — always returns immediately. Optional `app_id` query param
+ * selects the HotMesh namespace for resolution (default: durable).
  */
 router.get('/:workflowId/result', async (req, res) => {
-    const result = await api.getWorkflowResult({ workflowId: req.params.workflowId });
+    const result = await api.getWorkflowResult({
+        workflowId: req.params.workflowId,
+        appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
+    });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**

package/build/sdk/index.d.ts

@@ -82,6 +82,12 @@ export declare function createClient(options?: LTClientOptions): {
             envelope?: string;
             metadata?: Record<string, any>;
             escalation_payload?: string;
+            origin_id?: string;
+            parent_id?: string;
+            task_id?: string;
+            workflow_id?: string;
+            task_queue?: string;
+            workflow_type?: string;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         list: (input: {
             status?: string;
@@ -95,7 +101,8 @@ export declare function createClient(options?: LTClientOptions): {
             offset?: number;
             sort_by?: string;
             order?: string;
-        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+            search?: string;
+        } & import("../api/escalations/list").FacetInput, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         listAvailable: (input: {
             role?: string;
             type?: string;
@@ -105,8 +112,10 @@ export declare function createClient(options?: LTClientOptions): {
             offset?: number;
             sort_by?: string;
             order?: string;
-        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+            search?: string;
+        } & import("../api/escalations/list").FacetInput, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         listTypes: typeof escalationsApi.listDistinctTypes;
+        listFacetKeys: (input: unknown, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         getStats: (input: {
             period?: string;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
@@ -129,6 +138,17 @@ export declare function createClient(options?: LTClientOptions): {
         resolve: (input: {
             id: string;
             resolverPayload: Record<string, any>;
+            metadata?: Record<string, any>;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        resolveBySignalKey: (input: {
+            signalKey: string;
+            resolverPayload: Record<string, any>;
+            metadata?: Record<string, any>;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        resolveByIds: (input: {
+            ids: string[];
+            resolverPayload: Record<string, any>;
+            metadata?: Record<string, any>;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
         releaseExpired: typeof escalationsApi.releaseExpiredClaims;
         updatePriority: (input: {
@@ -174,6 +194,19 @@ export declare function createClient(options?: LTClientOptions): {
             assignee?: string;
             metadata?: Record<string, any>;
         }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        searchByFacets: (input: import("..").FacetQuery, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        claimGroups: (input: {
+            query: import("..").FacetQuery;
+            limit?: number;
+            durationMinutes?: number;
+            sizeFacet?: string;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
+        claimByFacets: (input: {
+            query: import("..").FacetQuery;
+            limit?: number;
+            durationMinutes?: number;
+            allOrNone?: boolean;
+        }, auth?: LTApiAuth) => Promise<LTApiResult<any>>;
     };
     workflows: {
         invoke: (input: {

package/build/sdk/index.js

@@ -117,6 +117,7 @@ function createClient(options = {}) {
             list: bindAuth(escalationsApi.listEscalations, auth),
             listAvailable: bindAuth(escalationsApi.listAvailableEscalations, auth),
             listTypes: escalationsApi.listDistinctTypes,
+            listFacetKeys: bindAuth(escalationsApi.listFacetKeys, auth),
             getStats: bindAuth(escalationsApi.getEscalationStats, auth),
             get: bindAuth(escalationsApi.getEscalation, auth),
             getByWorkflowId: escalationsApi.getEscalationsByWorkflowId,
@@ -124,6 +125,8 @@ function createClient(options = {}) {
             claim: bindAuth(escalationsApi.claimEscalation, auth),
             release: bindAuth(escalationsApi.releaseEscalation, auth),
             resolve: bindAuth(escalationsApi.resolveEscalation, auth),
+            resolveBySignalKey: bindAuth(escalationsApi.resolveBySignalKey, auth),
+            resolveByIds: bindAuth(escalationsApi.resolveByIds, auth),
             releaseExpired: escalationsApi.releaseExpiredClaims,
             updatePriority: bindAuth(escalationsApi.updatePriority, auth),
             bulkClaim: bindAuth(escalationsApi.bulkClaim, auth),
@@ -133,6 +136,10 @@ function createClient(options = {}) {
             findByMetadata: bindAuth(escalationsApi.findByMetadata, auth),
             claimByMetadata: bindAuth(escalationsApi.claimByMetadata, auth),
             resolveByMetadata: bindAuth(escalationsApi.resolveByMetadata, auth),
+            // Faceted-routing surface (pond search + batch claim), RBAC-scoped to the caller's role.
+            searchByFacets: bindAuth(escalationsApi.searchByFacets, auth),
+            claimGroups: bindAuth(escalationsApi.claimGroups, auth),
+            claimByFacets: bindAuth(escalationsApi.claimByFacets, auth),
         },
         // ── Workflows ──────────────────────────────────────────────────────────
         workflows: {

package/build/services/diagnostics/index.d.ts

@@ -17,6 +17,21 @@ export interface StreamSummary {
     pending: number;
     in_flight: number;
 }
+/** A large string field replaced with a bounded summary instead of the full payload. */
+export interface TruncatedString {
+    bytes: number;
+    preview: string;
+    truncated: true;
+}
+/** Pointer to the stream browser for the raw, untruncated message payloads. */
+export interface RawMessagesHint {
+    hint: string;
+    jid: string;
+}
+/** A stream message whose large `message` payload may have been summarized. */
+export type SummarizedStreamMessage = Omit<StreamMessage, 'message'> & {
+    message: string | TruncatedString;
+};
 export interface JobDiagnosis {
     workflow_id: string;
     app_id: string;
@@ -32,18 +47,37 @@ export interface JobDiagnosis {
     stream_summary: StreamSummary;
     escalation: EscalationSummary;
     findings: Finding[];
-    execution_events: unknown[];
     /** Total events before any cap was applied (execution_events may be truncated to the most recent `maxEvents`). */
     total_events: number;
     events_truncated: boolean;
-    stream_messages: {
-        worker: StreamMessage[];
-        engine: StreamMessage[];
+    /**
+     * Full event timeline — present only when `include` contains `'events'` (or
+     * `verbosity: 'full'`). Large string attributes are summarized to
+     * `{ bytes, preview, truncated }`. Omitted by default to keep the verdict compact.
+     */
+    execution_events?: unknown[];
+    /**
+     * Raw engine + worker stream messages — present only when `include` contains
+     * `'streams'` (or `verbosity: 'full'`). Large `message` payloads are summarized.
+     * Omitted by default; see `raw_messages` for where to fetch the full payloads.
+     */
+    stream_messages?: {
+        worker: SummarizedStreamMessage[];
+        engine: SummarizedStreamMessage[];
     };
+    /** Pointer to `list_stream_messages` for the raw payloads (present when streams are omitted). */
+    raw_messages?: RawMessagesHint;
 }
-export declare function diagnoseJob(workflowId: string, appId?: string, options?: {
+export type DiagnoseVerbosity = 'summary' | 'full';
+export type DiagnoseSection = 'events' | 'streams';
+export interface DiagnoseOptions {
     maxEvents?: number;
-}): Promise<JobDiagnosis>;
+    /** Heavy sections to include in the response. Default: none (verdict only). */
+    include?: DiagnoseSection[];
+    /** Shorthand: `'full'` includes both events and streams; `'summary'` (default) includes neither. */
+    verbosity?: DiagnoseVerbosity;
+}
+export declare function diagnoseJob(workflowId: string, appId?: string, options?: DiagnoseOptions): Promise<JobDiagnosis>;
 export declare function findStalledJobs(params: {
     appId?: string;
     idleMinutes?: number;

package/build/services/diagnostics/index.js

@@ -88,10 +88,39 @@ const ORPHANED_SIGNALS = (appId) => `
 `;
 /** Default cap on events returned in the payload — keeps a high-activity workflow from returning a huge response. */
 const DEFAULT_MAX_EVENTS = 500;
+/** Strings larger than this (UTF-8 bytes) are summarized rather than returned in full. */
+const LARGE_STRING_BYTES = 1024;
+/** How many leading characters of a summarized string to keep as a preview. */
+const PREVIEW_CHARS = 200;
+/** Recursion depth cap for summarizing nested event attributes. */
+const SUMMARIZE_MAX_DEPTH = 6;
+/** Replace an over-threshold string with a bounded summary; pass small strings through unchanged. */
+function summarizeString(value) {
+    const bytes = Buffer.byteLength(value, 'utf8');
+    if (bytes <= LARGE_STRING_BYTES)
+        return value;
+    return { bytes, preview: value.slice(0, PREVIEW_CHARS), truncated: true };
+}
+/** Recursively summarize large string leaves in an event attribute tree (result/output/input/error payloads). */
+function summarizeDeep(value, depth = 0) {
+    if (typeof value === 'string')
+        return summarizeString(value);
+    if (value === null || typeof value !== 'object' || depth >= SUMMARIZE_MAX_DEPTH)
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => summarizeDeep(v, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = summarizeDeep(v, depth + 1);
+    }
+    return out;
+}
 // ── diagnoseJob ──────────────────────────────────────────────────────────────
 async function diagnoseJob(workflowId, appId = 'durable', options = {}) {
     const pool = (0, db_1.getPool)();
     const maxEvents = Math.max(options.maxEvents ?? DEFAULT_MAX_EVENTS, 1);
+    const includeEvents = options.verbosity === 'full' || !!options.include?.includes('events');
+    const includeStreams = options.verbosity === 'full' || !!options.include?.includes('streams');
     let resolved;
     try {
         resolved = await (0, resolve_1.resolveWorkflowHandle)(workflowId);
@@ -135,7 +164,7 @@ async function diagnoseJob(workflowId, appId = 'durable', options = {}) {
     const findings = execution
         ? (0, patterns_1.matchPatterns)(execution, workerMessages, engineMessages, escalationRow)
         : [{ condition: 'export_unavailable', confidence: 0.9, severity: 'warning', evidence: ['Execution export unavailable — job may have expired or HotMesh engine is not running'], guidance: [] }];
-    return {
+    const diagnosis = {
         workflow_id: workflowId,
         app_id: appId,
         status,
@@ -153,11 +182,33 @@ async function diagnoseJob(workflowId, appId = 'durable', options = {}) {
             created_at: escalationRow?.created_at ?? null,
         },
         findings,
-        execution_events: cappedEvents,
         total_events: events.length,
         events_truncated: eventsTruncated,
-        stream_messages: { worker: workerMessages, engine: engineMessages },
     };
+    // Heavy sections are opt-in. Large string payloads are summarized either way
+    // so an included section can't reintroduce the 100–200KB blow-up.
+    if (includeEvents) {
+        diagnosis.execution_events = cappedEvents.map((e) => e && typeof e === 'object'
+            ? { ...e, attributes: summarizeDeep(e.attributes) }
+            : e);
+    }
+    if (includeStreams) {
+        diagnosis.stream_messages = {
+            worker: summarizeMessages(workerMessages),
+            engine: summarizeMessages(engineMessages),
+        };
+    }
+    else {
+        diagnosis.raw_messages = {
+            hint: 'Use list_stream_messages (Control Plane) filtered by jid (and aid/dad) for the full raw message payloads.',
+            jid: workflowId,
+        };
+    }
+    return diagnosis;
+}
+/** Summarize the large `message` payload of each stream message; everything else passes through. */
+function summarizeMessages(messages) {
+    return messages.map((m) => ({ ...m, message: summarizeString(m.message) }));
 }
 // ── findStalledJobs ──────────────────────────────────────────────────────────
 async function findStalledJobs(params) {
@@ -200,9 +251,7 @@ function notFound(workflowId, appId) {
         stream_summary: { worker_total: 0, engine_total: 0, dead_lettered: 0, pending: 0, in_flight: 0 },
         escalation: { exists: false, id: null, status: null, signal_key: null, role: null, type: null, created_at: null },
         findings: [{ condition: 'not_found', confidence: 1, severity: 'critical', evidence: ['Workflow ID not found — no task record or job entity'], guidance: [] }],
-        execution_events: [],
         total_events: 0,
         events_truncated: false,
-        stream_messages: { worker: [], engine: [] },
     };
 }