@humwick/server 0.130.1 → 0.130.3

package/src/routes/continuation-archives.ts

@@ -1,7 +1,7 @@
 // Auto-split from routes.ts (#299). Domain: continuation archives.
 import { isRecord } from "@humwick/sdk";
 import { resolveCallerAgentId } from "../agent-ref";
-import { archiveContinuationSegmentAsync, appendContinuationArchiveRefs, getAgent, listAgents, ValidationError } from "../db";
+import { archiveContinuationSegmentAsync, appendContinuationArchiveRefsAsync, getAgent, listAgents, ValidationError } from "../db";
 import { getComponentAuth } from "../security";
 import { cleanEpoch, cleanPositiveId, cleanString } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
@@ -21,7 +21,7 @@ export const postContinuationArchiveRoute: Handler = async (req) => {
       generation: cleanPositiveId(parsed.body.generation, "generation"),
       now: cleanEpoch(parsed.body.occurredAt, "occurredAt"),
     });
-    const envelope = appendContinuationArchiveRefs(agentId, [archive.ref]);
+    const envelope = await appendContinuationArchiveRefsAsync(agentId, [archive.ref]);
     return json({ archive, envelope }, 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/coordinator-teams.ts

@@ -4,7 +4,7 @@ import type { CoordinatorTeamSummary } from "../types";
 
 /** Connector discovery: no roster, plan, or per-team runtime queries. */
 export const getCoordinatorTeams: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "channel:read" });
+  const denied = (await authorizeRoute(req, { scope: "channel:read" }));
   if (denied) return denied;
   const teams: CoordinatorTeamSummary[] = (await listCoordinatorTeamsAsync()).filter(team => team.coordinatorId).map(team => ({
     id: team.id, coordinatorId: team.coordinatorId!, title: team.title ?? null, projectId: team.projectId, projectName: team.projectName,

package/src/routes/decisions.ts

@@ -48,7 +48,7 @@ export const postDecisionAnswerRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const body = isRecord(parsed.body) ? parsed.body : {};
   try {
-    return json(answerDecision(authContextFromRequest(req), id, { answers: body.answers, note: body.note }));
+    return json((await answerDecision(authContextFromRequest(req), id, { answers: body.answers, note: body.note })));
   } catch (err) {
     return routeError(err);
   }
@@ -59,7 +59,7 @@ export const postDecisionRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const ctx = authContextFromRequest(req);
-    return json(fileDecision(ctx, isRecord(parsed.body) ? parsed.body : {}, callerProjectId(ctx)), 201);
+    return json((await fileDecision(ctx, isRecord(parsed.body) ? parsed.body : {}, callerProjectId(ctx))), 201);
   } catch (err) {
     return routeError(err);
   }

package/src/routes/host-secret-files.ts

@@ -10,7 +10,7 @@ import { authorizeRoute, error, parseBody, type Handler } from "./_shared";
 export const postHostSecretFilesResolve: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const component = getComponentAuth(req);
   if (!isFullReachRequest(req) && !(component?.role === "orchestrator" && component.constraints?.orchestrators?.includes(orch.id))) return error("forbidden", 403);

package/src/routes/hosts.ts

@@ -14,7 +14,7 @@ function queryTags(value: string | null, field: string): string[] | undefined {
 }
 
 export const getHostsRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "hosts:read" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const query = new URL(req.url).searchParams;
   try {
@@ -44,7 +44,7 @@ export const getHostsRoute: Handler = async (req) => {
  * relay shows a rebuilding chart, not a stale one).
  */
 export const getHostUtilizationSeries: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:read" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const samples = readHostUtilizationSeries(params.id!);
   return json({ host: params.id!, window_ms: HOST_UTILIZATION_BUFFER_MS, samples });
@@ -54,7 +54,7 @@ export const getHostUtilizationSeries: Handler = async (req, params) => {
 // gateway write ops the MCP host tools already use (hosts.setLabel / hosts.setTags); this route is
 // just the HTTP door onto them, same shape as patchAgentLabel/patchAgentTags in agents.ts.
 export const patchHostLabel: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -81,7 +81,7 @@ export const patchHostLabel: Handler = async (req, params) => {
 };
 
 export const patchHostTags: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -111,7 +111,7 @@ export const patchHostTags: Handler = async (req, params) => {
 // write is idempotent: an already-accepted host remains accepted and a later identity change still
 // traverses the registration tripwire.
 export const postAcceptHostHardware: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const host = await acceptHostHardwareAsync(params.id!);
   if (!host) return error("host not found", 404);
@@ -129,7 +129,7 @@ export const postAcceptHostHardware: Handler = async (req, params) => {
 };
 
 export const patchHostLandingPlacement: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -153,7 +153,7 @@ export const patchHostLandingPlacement: Handler = async (req, params) => {
 };
 
 export const patchHostAgentCap: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -177,7 +177,7 @@ export const patchHostAgentCap: Handler = async (req, params) => {
 };
 
 export const patchHostLandingCap: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -201,7 +201,7 @@ export const patchHostLandingCap: Handler = async (req, params) => {
 };
 
 export const patchHostGateBudget: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -217,7 +217,7 @@ export const patchHostGateBudget: Handler = async (req, params) => {
 };
 
 export const patchHostAdmission: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -232,7 +232,7 @@ export const patchHostAdmission: Handler = async (req, params) => {
 };
 
 export const getHostAdmission: Handler = async (req, params) => {
-  const denied = getComponentAuth(req) ? null : authorizeRoute(req, { scope: "hosts:read" });
+  const denied = getComponentAuth(req) ? null : (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const host = await getHostAsync(resolveHostId(params.id!) ?? params.id!);
   if (!host) return error("host not found", 404);

package/src/routes/inbox.ts

@@ -78,7 +78,8 @@ function normalizeChatHistoryImportInput(body: unknown): {
 export const getInboxStateRoute: Handler = async (req) => {
   const url = new URL(req.url);
   const operatorId = inboxOperatorId(req, url.searchParams.get("operatorId") ?? undefined);
-  return json(await getInboxStateAsync(operatorId));
+  const raw = url.searchParams.get("excludeOffline");
+  return json(await getInboxStateAsync(operatorId, { excludeOffline: raw === "1" || raw === "true" }));
 };
 
 export const patchInboxThreadState: Handler = async (req) => {
@@ -140,7 +141,7 @@ export const postChatHistoryImportRoute: Handler = async (req) => {
   try {
     const input = normalizeChatHistoryImportInput(parsed.body);
     if (resolveActingUser(req)?.source === "session") input.importedBy = requestUserAddress(req);
-    const denied = authorizeRoute(req, { scope: "agent:write", resource: { agentId: input.targetAgentId, spawnRequestId: input.targetSpawnRequestId } });
+    const denied = (await authorizeRoute(req, { scope: "agent:write", resource: { agentId: input.targetAgentId, spawnRequestId: input.targetSpawnRequestId } }));
     if (denied) return denied;
     const imported = await createChatHistoryImportAsync(input);
     return json(imported, 201);

package/src/routes/index.ts

@@ -70,6 +70,7 @@ import { postIssueLifecycleReopenRoute } from "./issue-lifecycle";
 import { deleteIssueRefRoute, getIssueRefRoute, listIssueRefsRoute, patchIssueRefRoute, postIssueRefRoute, resolveIssueRefRoute } from "./issue-refs";
 import { deleteProjectEntryRoute, getProjectEntriesRoute, getProjectEntryRoute, getProjectInjectionPreviewRoute, getProjectResolveRoute, getProjectRoute, getProjectsRoute, patchProjectEntryRoute, postProjectEntryRoute } from "./projects";
 import { getPromptHistoryRoute, postPromptRevisionRoute, getPromptTemplateRoute, getPromptTemplatesRoute, postPromptTemplateResetRoute, putPromptTemplateRoute } from "./prompt-templates";
+import { projectProfileInstructionsRoute } from "./project-profile-instructions";
 import { getRecipeByName, getRecipeInstanceArtifacts, getRecipeInstanceById, getRecipeInstances, getRecipes, postRecipeInstanceArtifacts, postRecipeStart, postRecipeStop } from "./recipes";
 import { getSettingRoute, getSettingsNamespaceRoute, getSettingsRoute, putSettingRoute, putSettingsDefaultRoute } from "./settings";
 import { postNotificationPreviewRoute } from "./notifications";
@@ -84,8 +85,8 @@ import { getMergeDrain, getMergePauseById, getMergePauses, postMergePause, postM
 import { postMcp } from "../mcp";
 import { postOrchestratorBootstrap, postOrchestratorBootstrapExchange } from "./orchestrator-bootstrap";
 import { getDeploysRoute } from "./deploys";
-import { getGateStatsRoute, getShippingBoardRoute, getShippingStatsRoute, postRedMainAbandonRoute } from "./shipping";
-import { getWorkflowCatalogRoute, getWorkflowDefinitionsRoute, getWorkflowRunBudgetRoute, getWorkflowRunRoute, getWorkflowRunsRoute, getWorkflowStatsRoute, patchWorkflowRunBudgetRoute, postWorkflowRunCancelRoute, postWorkflowRunResumeRoute, postWorkflowRunStartRoute } from "./workflows";
+import { getGateStatsRoute, getKnownFailuresRoute, getShippingBoardRoute, getShippingStatsRoute, postRedMainAbandonRoute } from "./shipping";
+import { getWorkflowCatalogRoute, getWorkflowDefinitionsRoute, getWorkflowRunBudgetRoute, getWorkflowRunRoute, getWorkflowRunsRoute, getWorkflowStatsRoute, patchWorkflowRunBudgetRoute, postWorkflowRunCancelRoute, postWorkflowRunPauseRoute, postWorkflowRunResumeRoute, postWorkflowRunStartRoute, postWorkflowRunUnpauseRoute } from "./workflows";
 import { getRestartEpochRoute, postRestartEpochAbandonRoute } from "./restart-epochs";
 import { getFleetConvergenceRoute } from "./fleet-convergence";
 import { postTimerMessageOperator } from "./kernel-timers-operator";
@@ -318,6 +319,7 @@ const routes: Route[] = [
   route("DELETE", "/api/commands/:id", deleteCommandById),
   route("POST", "/api/system/timer-message-cutover/:verb", postTimerMessageOperator),
   route("GET", "/api/agent-profiles", getAgentProfilesRoute),
+  route("GET", "/api/agent-profiles/:name/project-instructions", projectProfileInstructionsRoute),
   route("GET", "/api/agent-profiles/tool-groups", getAgentProfileToolGroupsRoute),
   route("POST", "/api/agent-profiles/preview", postAgentProfilePreviewRoute),
   route("GET", "/api/agent-profiles/:name/resolved", getResolvedAgentProfileRoute),
@@ -546,6 +548,11 @@ const routes: Route[] = [
   route("PATCH", "/api/issue-refs/:id", patchIssueRefRoute),
   route("DELETE", "/api/issue-refs/:id", deleteIssueRefRoute),
   route("GET", "/api/projects", getProjectsRoute),
+  route("GET", "/api/projects/:id/profile-instructions", projectProfileInstructionsRoute),
+  route("GET", "/api/projects/:id/profile-instructions/:profile", projectProfileInstructionsRoute),
+  route("PUT", "/api/projects/:id/profile-instructions/:profile", projectProfileInstructionsRoute),
+  route("GET", "/api/projects/:id/profile-instructions/:profile/history", projectProfileInstructionsRoute),
+  route("POST", "/api/projects/:id/profile-instructions/:profile/restore", projectProfileInstructionsRoute),
   route("POST", "/api/projects", postProjectOnboardRoute),
   route("POST", "/api/projects/:id/checkouts/bind", postProjectBindCheckoutRoute),
   route("POST", "/api/projects/:id/checkouts/unbind", postProjectUnbindCheckoutRoute),
@@ -592,6 +599,7 @@ const routes: Route[] = [
   route("POST", "/api/shipping/incidents/:id/abandon", postRedMainAbandonRoute),
   route("GET", "/api/shipping/board", getShippingBoardRoute),
   route("GET", "/api/shipping/stats", getShippingStatsRoute),
+  route("GET", "/api/shipping/known-failures", getKnownFailuresRoute),
   route("GET", "/api/gates/stats", getGateStatsRoute),
   route("GET", "/api/workflows/catalog", getWorkflowCatalogRoute),
   route("POST", "/api/workflows/runs", postWorkflowRunStartRoute),
@@ -600,6 +608,8 @@ const routes: Route[] = [
   route("GET", "/api/workflows/runs/:runId/budget", getWorkflowRunBudgetRoute),
   route("PATCH", "/api/workflows/runs/:runId/budget", patchWorkflowRunBudgetRoute),
   route("POST", "/api/workflows/runs/:runId/cancel", postWorkflowRunCancelRoute),
+  route("POST", "/api/workflows/runs/:runId/pause", postWorkflowRunPauseRoute),
+  route("POST", "/api/workflows/runs/:runId/unpause", postWorkflowRunUnpauseRoute),
   route("POST", "/api/workflows/runs/:runId/resume", postWorkflowRunResumeRoute),
   route("GET", "/api/workflows/stats", getWorkflowStatsRoute),
   route("GET", "/api/workflows/definitions", getWorkflowDefinitionsRoute),

package/src/routes/integrations.ts

@@ -1,7 +1,10 @@
+import { upsertIntegrationRegistryAsync, ingestIntegrationEventAsync } from "../db/runtime-tail-async";
+import { sendMessageWithResultAsync } from "../db/message-send";
+import type { IntegrationRegistryInput } from "../db/integrations";
 // Auto-split from routes.ts (#299). Domain: integrations.
 import { INTEGRATION_RATE_LIMIT_PER_MINUTE, MAX_BODY_BYTES, getIntegrationTokens, type IntegrationTokenConfig } from "../config";
 import { VALID_ARTIFACT_KINDS, VALID_ARTIFACT_ROLES, VALID_TASK_STATUSES, agentSessionStatus, authorizeRoute, cleanAttachmentRefs, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, reactionEmoji, sendReactionNotificationToAuthor, validateChannelAttachmentSourceRef, withPayloadAttachments, type Handler } from "./_shared";
-import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, ingestIntegrationEvent, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationRegistry, listIntegrationTaskStats, resolveChannelRoutesAsync, sendMessageWithResult, setMessageReactionAsync, upsertChannelBindingAsync, upsertIntegrationRegistry, validateAgentSession } from "../db";
+import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationTaskStatsAsync, reconcileIntegrationRegistryAsync, resolveChannelRoutesAsync, setMessageReactionAsync, upsertChannelBindingAsync, validateAgentSession } from "../db";
 import { cleanMeta, cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { emitChannelActivity, emitMessageQueued, emitMessageReactionUpdated, emitNewMessage, emitTaskChanged } from "../sse";
 import { getComponentAuth, getIntegrationAuth, hasIntegrationScope, isRequestAuthorizedFor } from "../security";
@@ -256,24 +259,7 @@ function normalizeIntegrationEvent(body: unknown): IntegrationEventInput {
   };
 }
 
-function normalizeIntegrationRegistryInput(name: string, body: unknown): {
-  name: string;
-  displayName?: string;
-  description?: string;
-  enabled?: boolean;
-  scopes?: string[];
-  targets?: string[];
-  channels?: string[];
-  type?: string;
-  icon?: string;
-  accentColor?: string;
-  tags?: string[];
-  homepageUrl?: string;
-  repositoryUrl?: string;
-  docsUrl?: string;
-  manifest?: Record<string, unknown>;
-  source: "api";
-} {
+function normalizeIntegrationRegistryInput(name: string, body: unknown): IntegrationRegistryInput & { source: "api" } {
   if (!isRecord(body)) throw new ValidationError("body must be an object");
   if (body.enabled !== undefined && typeof body.enabled !== "boolean") throw new ValidationError("enabled must be a boolean");
   return {
@@ -364,40 +350,30 @@ function safeCallbackHost(url: string | undefined): string | undefined {
   }
 }
 
-function reconcileIntegrationRegistry(configured: Map<string, IntegrationTokenConfig>, observedStats: Map<string, ReturnType<typeof listIntegrationTaskStats>[number]>): Map<string, ReturnType<typeof listIntegrationRegistry>[number]> {
-  for (const config of configured.values()) {
-    upsertIntegrationRegistry({
-      name: config.name,
-      displayName: config.displayName,
-      description: config.description,
-      scopes: config.scopes,
-      targets: config.targets,
-      channels: config.channels,
-      type: config.type,
-      icon: config.icon,
-      accentColor: config.accentColor,
-      tags: config.tags,
-      homepageUrl: config.homepageUrl,
-      repositoryUrl: config.repositoryUrl,
-      docsUrl: config.docsUrl,
-      manifest: config.manifest,
-      source: "env",
-    });
-  }
-  for (const stats of observedStats.values()) {
-    upsertIntegrationRegistry({
-      name: stats.source,
-      enabled: true,
-      source: "observed",
-    });
-  }
-  return new Map(listIntegrationRegistry().map((integration) => [integration.name, integration]));
+async function reconcileRegistry(configured: Map<string, IntegrationTokenConfig>, observedSources: string[]) {
+  const registry = await reconcileIntegrationRegistryAsync([...configured.values()].map((config) => ({
+    name: config.name,
+    displayName: config.displayName,
+    description: config.description,
+    scopes: config.scopes,
+    targets: config.targets,
+    channels: config.channels,
+    type: config.type,
+    icon: config.icon,
+    accentColor: config.accentColor,
+    tags: config.tags,
+    homepageUrl: config.homepageUrl,
+    repositoryUrl: config.repositoryUrl,
+    docsUrl: config.docsUrl,
+    manifest: config.manifest,
+  })), observedSources);
+  return new Map(registry.map((integration) => [integration.name, integration]));
 }
 
-export const getIntegrations: Handler = () => {
+export const getIntegrations: Handler = async () => {
   const configured = new Map(getIntegrationTokens().map((integration) => [integration.name, integration]));
-  const observedStats = new Map(listIntegrationTaskStats().map((stats) => [stats.source, stats]));
-  const registry = reconcileIntegrationRegistry(configured, observedStats);
+  const observedStats = new Map((await listIntegrationTaskStatsAsync()).map((stats) => [stats.source, stats]));
+  const registry = await reconcileRegistry(configured, [...observedStats.keys()]);
   const names = [...new Set([...configured.keys(), ...observedStats.keys(), ...registry.keys()])].sort((a, b) => a.localeCompare(b));
   const now = Date.now();
 
@@ -451,7 +427,7 @@ export const putIntegrationRegistryRoute: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(upsertIntegrationRegistry(normalizeIntegrationRegistryInput(name, parsed.body)));
+    return json((await upsertIntegrationRegistryAsync(normalizeIntegrationRegistryInput(name, parsed.body))));
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;
@@ -523,7 +499,7 @@ async function applyInboundChannelReaction(payload: Record<string, unknown>): Pr
   const result = await setMessageReactionAsync({ messageId: parent.id, actorId, emoji, action });
   if (result.ok) {
     emitMessageReactionUpdated(result.message);
-    sendReactionNotificationToAuthor(result.message, actorId, emoji, action);
+    (await sendReactionNotificationToAuthor(result.message, actorId, emoji, action));
   }
 }
 
@@ -535,7 +511,7 @@ export const postChannelEvent: Handler = async (req, params) => {
     if (!channel) return error("channel not found", 404);
     const sessionError = requireChannelSession(req, parsed.body, channel);
     if (sessionError) return sessionError;
-    const denied = authorizeRoute(req, { scope: "channel:write", resource: { channel: channel.id } });
+    const denied = (await authorizeRoute(req, { scope: "channel:write", resource: { channel: channel.id } }));
     if (denied) return denied;
     const input = normalizeChannelEventBody(parsed.body);
     validateChannelEnvelope(input.payload, channel);
@@ -547,7 +523,7 @@ export const postChannelEvent: Handler = async (req, params) => {
     await applyInboundChannelReaction(input.payload);
     const bindings = await resolveChannelRoutesAsync(channel.id, input.conversationId);
     if (!bindings.length) return error("channel has no binding", 409);
-    const results = bindings.map((binding) => sendMessageWithResult({
+    const results = await Promise.all(bindings.map(async (binding) => (await sendMessageWithResultAsync({
       from: channel.agentId,
       to: messageTargetForChannelTarget(binding.target, binding),
       kind: "channel.event",
@@ -556,7 +532,7 @@ export const postChannelEvent: Handler = async (req, params) => {
       payload: input.payload,
       idempotencyKey: scopedChannelIdempotencyKey(input.idempotencyKey, binding),
       claimable: false,
-    }));
+    }))));
     for (const result of results) {
       if (!result.created) continue;
       if (result.message.deliveryStatus === "queued") emitMessageQueued(result.message);
@@ -624,7 +600,7 @@ export const postIntegrationEvent: Handler = async (req) => {
       return error("integration token cannot target this task", 403);
     }
     const input = await resolveIntegrationEventTarget({ ...normalized, source: normalized.source ?? integrationName });
-    const result = ingestIntegrationEvent(input, integrationName);
+    const result = (await ingestIntegrationEventAsync(input, integrationName));
     if (result.message) emitNewMessage(result.message);
     emitTaskChanged(result.task, result.created ? "task.created" : "task.updated");
     dispatchTaskCallbacksInBackground(result.task.id, result.created ? "task.created" : "task.updated");

package/src/routes/issue-activity.ts

@@ -31,7 +31,7 @@ export const postIssueActivityRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     if (!isRecord(parsed.body)) throw new ValidationError("issue activity body required");
-    const event = recordAndEmitIssueActivity({
+    const event = (await recordAndEmitIssueActivity({
       agentId: cleanString(parsed.body.agentId, "agentId", { required: true, max: 200 })!,
       action: cleanAction(parsed.body.action),
       issueRefId: cleanString(parsed.body.issueRefId, "issueRefId", { max: 120 }),
@@ -42,7 +42,7 @@ export const postIssueActivityRoute: Handler = async (req) => {
       title: cleanString(parsed.body.title, "title", { max: 200 }),
       body: cleanString(parsed.body.body, "body", { max: 1000 }),
       metadata: cleanMeta(parsed.body.metadata),
-    });
+    }));
     return json({ event }, 201);
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);

package/src/routes/issue-associations.ts

@@ -37,7 +37,7 @@ export const postIssueAssociationRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(associateIssueRef(cleanAssociationBody(parsed.body)));
+    return json((await associateIssueRef(cleanAssociationBody(parsed.body))));
   } catch (err) {
     return routeError(err);
   }
@@ -56,9 +56,9 @@ export const getIssueAssociationEntityIssuesRoute: Handler = (_req, params) => {
   }
 };
 
-export const getIssueAssociationIssueEntitiesRoute: Handler = (_req, params) => {
+export const getIssueAssociationIssueEntitiesRoute: Handler = async (_req, params) => {
   try {
-    const issueRef = resolveAssociationIssueRef({ issueRefId: cleanString(params.issueRefId, "issueRefId", { required: true, max: 120 })! });
+    const issueRef = (await resolveAssociationIssueRef({ issueRefId: cleanString(params.issueRefId, "issueRefId", { required: true, max: 120 })! }));
     return json({ issueRef, entities: listIssueEntities(issueRef.id) });
   } catch (err) {
     return routeError(err);
@@ -69,7 +69,7 @@ export const deleteIssueAssociationRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(removeIssueAssociation(cleanAssociationBody(parsed.body)));
+    return json((await removeIssueAssociation(cleanAssociationBody(parsed.body))));
   } catch (err) {
     return routeError(err);
   }

package/src/routes/issue-refs.ts

@@ -1,4 +1,4 @@
-import { deleteIssueRefMapping, getIssueRef, listIssueRefs, patchIssueRefMapping, resolveIssueRefMapping, upsertIssueRefMapping, type ListIssueRefsOptions } from "../services/issue-refs";
+import { deleteIssueRefMappingAsync, getIssueRef, listIssueRefsAsync, patchIssueRefMappingAsync, resolveIssueRefMappingAsync, upsertIssueRefMappingAsync, type ListIssueRefsOptions } from "../services/issue-refs";
 import { getIssueRefByExternalKey, issueRefClosedCompleted, issueRefForRefString } from "../db/issue-refs";
 import { advanceTerminalPlanRefsAsync } from "../services/plan-terminal-refs";
 import { cleanEnum, cleanString, optionalEnum } from "../validation";
@@ -53,7 +53,7 @@ function cleanResolveBody(body: unknown) {
   return body;
 }
 
-export const listIssueRefsRoute: Handler = (req) => {
+export const listIssueRefsRoute: Handler = async (req) => {
   try {
     const url = new URL(req.url);
     const rawLimit = parseQueryInt(url.searchParams.get("limit"), { min: 1, max: 500, clamp: true });
@@ -64,7 +64,7 @@ export const listIssueRefsRoute: Handler = (req) => {
       status: optionalEnum(url.searchParams.get("status") ?? undefined, "status", ISSUE_REF_STATUSES) as IssueRefStatus | undefined,
       limit: rawLimit ?? undefined,
     };
-    return json({ issueRefs: listIssueRefs(opts) });
+    return json({ issueRefs: await listIssueRefsAsync(opts) });
   } catch (err) {
     return error(err instanceof Error ? err.message : "issue refs route failed");
   }
@@ -76,7 +76,7 @@ export const postIssueRefRoute: Handler = async (req) => {
   try {
     const body = cleanUpsertBody(parsed.body);
     const before = getIssueRefByExternalKey(body.provider, body.repo, body.externalKey);
-    const issueRef = upsertIssueRefMapping(body);
+    const issueRef = await upsertIssueRefMappingAsync(body);
     // #2520 — a completed close cached here propagates to the plan nodes bound to this ref.
     if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id });
     return json({ issueRef });
@@ -98,7 +98,7 @@ export const resolveIssueRefRoute: Handler = async (req) => {
       ? issueRefForRefString(ref, cleanString(value.defaultRepo ?? value.repo, "defaultRepo", { max: 500 }))
       : getIssueRefByExternalKey(cleanProvider(value.provider), cleanString(value.repo, "repo", { required: true, max: 500 })!, cleanString(value.externalKey, "externalKey", { required: true, max: 240 })!);
     const issueRef = ref
-      ? resolveIssueRefMapping({
+      ? await resolveIssueRefMappingAsync({
         ref,
         defaultRepo: cleanString(value.defaultRepo ?? value.repo, "defaultRepo", { max: 500 }),
         provider: optionalEnum(value.provider, "provider", ISSUE_PROVIDERS, "github") as IssueProvider,
@@ -107,7 +107,7 @@ export const resolveIssueRefRoute: Handler = async (req) => {
         closeReason: cleanCloseReason(value.closeReason),
         statusSyncedAt: cleanTimestamp(value.statusSyncedAt),
       })
-      : resolveIssueRefMapping({
+      : await resolveIssueRefMappingAsync({
         provider: cleanProvider(value.provider),
         repo: cleanString(value.repo, "repo", { required: true, max: 500 })!,
         externalKey: cleanString(value.externalKey, "externalKey", { required: true, max: 240 })!,
@@ -142,7 +142,7 @@ export const patchIssueRefRoute: Handler = async (req, params) => {
   try {
     const id = cleanString(params.id, "id", { required: true, max: 120 })!;
     const before = getIssueRef(id);
-    const issueRef = patchIssueRefMapping(id, cleanPatchBody(parsed.body));
+    const issueRef = await patchIssueRefMappingAsync(id, cleanPatchBody(parsed.body));
     if (!issueRef) return error("issue ref not found", 404);
     // #2520 — a completed close cached here propagates to the plan nodes bound to this ref.
     if (issueRefClosedCompleted(before, issueRef)) await advanceTerminalPlanRefsAsync({ issueRefId: issueRef.id });
@@ -152,9 +152,9 @@ export const patchIssueRefRoute: Handler = async (req, params) => {
   }
 };
 
-export const deleteIssueRefRoute: Handler = (_req, params) => {
+export const deleteIssueRefRoute: Handler = async (_req, params) => {
   try {
-    const deleted = deleteIssueRefMapping(cleanString(params.id, "id", { required: true, max: 120 })!);
+    const deleted = await deleteIssueRefMappingAsync(cleanString(params.id, "id", { required: true, max: 120 })!);
     if (!deleted) return error("issue ref not found", 404);
     return json({ deleted });
   } catch (err) {

package/src/routes/kernel-timers-operator.ts

@@ -22,7 +22,7 @@ export const postTimerMessageOperator: Handler = async (req, params) => {
   // Unlike routine routes in allow-unauth development mode, the migration trigger always requires
   // an actual credential. This keeps "authenticated" a property of the action, not deployment mode.
   if (!hasPresentedCredential(req)) return error("authentication required", 401);
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const actor = resolveActorLabel(req);
   if (!actor) return error("authenticated operator identity required", 403);

package/src/routes/memory.ts

@@ -7,7 +7,7 @@ import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared"
 // that area's memories (src/memory-area-injection.ts).
 export const postAgentAreaEntered: Handler = async (req, params) => {
   const agentId = params.id!;
-  const denied = authorizeRoute(req, { scope: "agent:write", resource: { agentId } });
+  const denied = (await authorizeRoute(req, { scope: "agent:write", resource: { agentId } }));
   if (denied) return denied;
   const ctx = authContextFromRequest(req);
   if (ctx.actor.kind !== "system" && ctx.callerAgentId !== agentId) return error("forbidden: only the agent's own runner may report its area touches", 403);

package/src/routes/merges.ts

@@ -22,8 +22,8 @@ function actorFromRequest(req: Request): string {
     : "root";
 }
 
-export const getMergePauses: Handler = (req) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+export const getMergePauses: Handler = async (req) => {
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   return json({ pauses: listAutoMergePauses() });
 };
@@ -37,13 +37,13 @@ export const getMergePauses: Handler = (req) => {
  * indefinitely, and #2094's fast reclaim covers whatever the interlock misses.
  */
 export const getMergeDrain: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   return json(await workspaceMergeDrainStatusAsync());
 };
 
 export const postMergePause: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -54,7 +54,7 @@ export const postMergePause: Handler = async (req) => {
     const holder = cleanString(parsed.body.holder, "holder", { max: 240 }) ?? actorFromRequest(req);
     const reason = cleanString(parsed.body.reason, "reason", { max: 500 });
     const ttlMs = cleanTtlMs(parsed.body.ttlMs);
-    const result = pauseAutoMerge({ repoRoot, baseRef, holder, reason, ttlMs });
+    const result = (await pauseAutoMerge({ repoRoot, baseRef, holder, reason, ttlMs }));
     if (!result.ok) {
       return json({ error: "merge target already paused", pause: result.pause }, 409);
     }
@@ -66,7 +66,7 @@ export const postMergePause: Handler = async (req) => {
 };
 
 export const postMergePauseRenew: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -74,7 +74,7 @@ export const postMergePauseRenew: Handler = async (req) => {
     if (!isRecord(parsed.body)) return error("body required");
     const id = cleanString(parsed.body.id, "id", { required: true, max: 120 })!;
     const ttlMs = cleanTtlMs(parsed.body.ttlMs);
-    const pause = renewAutoMergePause(id, ttlMs);
+    const pause = (await renewAutoMergePause(id, ttlMs));
     return pause ? json({ pause }) : error("merge pause not found or expired", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -83,7 +83,7 @@ export const postMergePauseRenew: Handler = async (req) => {
 };
 
 export const postMergePauseResume: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -93,7 +93,7 @@ export const postMergePauseResume: Handler = async (req) => {
     const repoRoot = cleanString(parsed.body.repoRoot, "repoRoot", { max: 1000 });
     const baseRef = cleanString(parsed.body.baseRef, "baseRef", { max: 240 });
     if (!id && !repoRoot) return error("id or repoRoot required", 400);
-    const released = resumeAutoMerge(id ? { id } : { repoRoot: repoRoot!, baseRef: baseRef ?? "main" });
+    const released = (await resumeAutoMerge(id ? { id } : { repoRoot: repoRoot!, baseRef: baseRef ?? "main" }));
     return json({ released });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -101,8 +101,8 @@ export const postMergePauseResume: Handler = async (req) => {
   }
 };
 
-export const getMergePauseById: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+export const getMergePauseById: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   const pause = getAutoMergePause(params.id!);
   return pause ? json(pause) : error("merge pause not found", 404);