@humwick/server 0.130.1 → 0.130.3

package/src/routes/projects.ts

@@ -1,4 +1,4 @@
-import { getProjectEntry, getProjectEntryChain, listProjectsAsync, resolveProjectAsync, resolveProjectEntriesAsync, retractProjectEntry, rootsForProjectAsync, searchProjectEntriesAsync, writeProjectEntry, ValidationError } from "../db";
+import { getProjectEntryAsync, getProjectEntryChainAsync, listProjectsAsync, resolveProjectAsync, resolveProjectEntriesAsync, retractProjectEntryAsync, rootsForProjectAsync, searchProjectEntriesAsync, writeProjectEntryAsync, ValidationError } from "../db";
 import { resolveProjectForCanonicalCwdAsync } from "../services/project";
 import { authContextFromRequest } from "../services/auth-context";
 import { callerProfile, resolveAgentWriteInject } from "../services/memory-identity";
@@ -14,7 +14,7 @@ import { PROJECT_ENTRY_INJECT_TIERS, PROJECT_ENTRY_KINDS, type ProjectEntry, typ
 //
 // #1940 Part 2 — manual/promoted entry CRUD from the dashboard. Mutations are thin wrappers
 // around the SAME db functions the audited `relay_project_write_entry`/`relay_project_retract`
-// MCP tools call (writeProjectEntry/retractProjectEntry, src/db/project-entries.ts) — one
+// MCP tools call (writeProjectEntryAsync/retractProjectEntryAsync, src/db/project-entries.ts) — one
 // write path for both surfaces, never a direct/duplicated DB write here. `ingested` entries
 // are refused because the CLAUDE.md ingest pipeline owns them. `steward` entries remain
 // operator-curatable: an edit adopts the replacement as `manual` input for a later sweep.
@@ -103,12 +103,12 @@ export const getProjectResolveRoute: Handler = async (req) => {
   }
 };
 
-export const getProjectEntryRoute: Handler = (req, params) => {
+export const getProjectEntryRoute: Handler = async (req, params) => {
   try {
     const id = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const entry = getProjectEntry(id);
+    const entry = await getProjectEntryAsync(id);
     if (!entry) return error("project entry not found", 404);
-    return json({ entry, chain: getProjectEntryChain(id) });
+    return json({ entry, chain: await getProjectEntryChainAsync(id) });
   } catch (err) {
     return error(err instanceof Error ? err.message : "projects route failed");
   }
@@ -130,8 +130,8 @@ function cleanAudience(value: unknown): ProjectEntryAudience | undefined {
 
 // Historical steward entries retain the same curation rights as manual entries (#3456).
 // Only the current active version is editable, preserving supersession and retraction.
-function loadEditableEntry(projectId: string, entryId: string): { entry: ProjectEntry } | { errorResponse: Response } {
-  const entry = getProjectEntry(entryId);
+async function loadEditableEntry(projectId: string, entryId: string): Promise<{ entry: ProjectEntry } | { errorResponse: Response }> {
+  const entry = await getProjectEntryAsync(entryId);
   if (!entry || entry.projectId !== projectId) return { errorResponse: error("project entry not found", 404) };
   if (!isEditableSource(entry.source)) {
     return { errorResponse: error(`${entry.source} entries are owned by the ingest pipeline and cannot be edited or removed here`, 409) };
@@ -170,7 +170,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
     // Use the same caller placement as MCP writes; dashboard callers fall back to project roots.
     // Areas stay optional because the dashboard has no areas input yet.
     const areas = await resolveWriteAreas(project, areaCallerFromCtx(authContextFromRequest(req)), parsed.body.areas, { requireDeclared: false });
-    const entry = writeProjectEntry({
+    const entry = await writeProjectEntryAsync({
       projectId: project.id,
       authorId: requestUserAddress(req),
       kind,
@@ -188,7 +188,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
       agentId: entry.authorId,
       metadata: projectEntryAuditMetadata(req, "relay_project_write_entry", project.id, entry.id),
     });
-    return json({ entry, ...(tier.note ? { injectNote: tier.note } : {}), ...areaDeliveryReport(entry) }, 201);
+    return json({ entry, ...(tier.note ? { injectNote: tier.note } : {}), ...await areaDeliveryReport(entry) }, 201);
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);
     return error(err instanceof Error ? err.message : "projects route failed");
@@ -196,7 +196,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
 };
 
 // PATCH /api/projects/:id/entries/:entryId — Edit (#1940 Part 2). There is no in-place UPDATE
-// in the ledger (writeProjectEntry only inserts); an edit is a new entry that `supersedes` the
+// in the ledger (writeProjectEntryAsync only inserts); an edit is a new entry that `supersedes` the
 // old one — the exact mechanism relay_project_write_entry's `supersedes` param already gives
 // agents. Omitted fields fall back to the current entry's value (a partial patch, not a
 // full-replace); an explicit `null` for `body` clears it.
@@ -206,7 +206,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
     const project = await resolveProjectAsync(ref);
     if (!project) return error("project not found", 404);
     const entryId = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const loaded = loadEditableEntry(project.id, entryId);
+    const loaded = await loadEditableEntry(project.id, entryId);
     if ("errorResponse" in loaded) return loaded.errorResponse;
     const { entry } = loaded;
 
@@ -234,7 +234,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
     );
     const areas = await resolveWriteAreas(project, areaCallerFromCtx(authContextFromRequest(req)), body.areas, { prior: entry.areas, requireDeclared: false });
 
-    const updated = writeProjectEntry({
+    const updated = await writeProjectEntryAsync({
       projectId: project.id,
       authorId: requestUserAddress(req),
       kind,
@@ -250,7 +250,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
       source: entry.source === "steward" ? "manual" : entry.source,
       originRef: entry.originRef,
       sensitivity: entry.sensitivity,
-      // Carry a POSITIVE prior TTL only: writeProjectEntry rejects invalid epochs, so a corrupt
+      // Carry a POSITIVE prior TTL only: writeProjectEntryAsync rejects invalid epochs, so a corrupt
       // legacy value cannot turn a partial dashboard edit into a failed adoption.
       ...(entry.expiresAt !== undefined && entry.expiresAt > 0 ? { expiresAt: entry.expiresAt } : {}),
     });
@@ -261,7 +261,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
       agentId: updated.authorId,
       metadata: projectEntryAuditMetadata(req, "relay_project_write_entry", project.id, updated.id, { supersedes: entry.id }),
     });
-    return json({ entry: updated, ...(tier.note ? { injectNote: tier.note } : {}), ...areaDeliveryReport(updated) });
+    return json({ entry: updated, ...(tier.note ? { injectNote: tier.note } : {}), ...await areaDeliveryReport(updated) });
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);
     return error(err instanceof Error ? err.message : "projects route failed");
@@ -276,10 +276,10 @@ export const deleteProjectEntryRoute: Handler = async (req, params) => {
     const project = await resolveProjectAsync(ref);
     if (!project) return error("project not found", 404);
     const entryId = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const loaded = loadEditableEntry(project.id, entryId);
+    const loaded = await loadEditableEntry(project.id, entryId);
     if ("errorResponse" in loaded) return loaded.errorResponse;
 
-    const retracted = retractProjectEntry(entryId);
+    const retracted = await retractProjectEntryAsync(entryId);
     if (!retracted) return error("project entry not found", 404);
     await auditEvent({
       kind: "state",

package/src/routes/prompt-templates.ts

@@ -21,21 +21,21 @@ function routeError(err: unknown): Response {
   return error(err instanceof Error ? err.message : "prompt template route failed");
 }
 
-function authorizePromptRead(req: Request): Response | null {
+async function authorizePromptRead(req: Request): Promise<Response | null> {
   const auth = getComponentAuth(req);
   if (auth && (hasComponentScope(auth, "system:admin") || hasComponentScope(auth, "agent:read"))) return null;
-  return authorizeRoute(req, { scope: "system:admin" });
+  return (await authorizeRoute(req, { scope: "system:admin" }));
 }
 
 export const getPromptTemplatesRoute: Handler = async (req) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const category = cleanString(new URL(req.url).searchParams.get("category"), "category", { max: 120 }) ?? undefined;
   return json({ templates: (await readPromptTemplates(category)).filter(entry => !memoryRetirementMessage(entry.slug)) });
 };
 
 export const getPromptTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const slug = slugParam(params);
   const retirement = memoryRetirementMessage(slug);
@@ -45,7 +45,7 @@ export const getPromptTemplateRoute: Handler = async (req, params) => {
 };
 
 export const putPromptTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -55,31 +55,31 @@ export const putPromptTemplateRoute: Handler = async (req, params) => {
       await mutatePrompt(authContextFromRequest(req), slug, parsed.body);
       return json(await readPromptTemplate(slug));
     }
-    const legacyDenied = authorizeRoute(req, { scope: "system:admin" });
+    const legacyDenied = (await authorizeRoute(req, { scope: "system:admin" }));
     if (legacyDenied) return legacyDenied;
     const template = cleanString(parsed.body?.template, "template", { required: true, max: 200_000 })!;
-    return json(updatePromptTemplate(slug, template));
+    return json((await updatePromptTemplate(slug, template)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const postPromptTemplateResetRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" }));
   if (denied) return denied;
   try {
     const slug = slugParam(params);
     if (versionedPromptsEnabled() && (await readPromptTemplate(slug))?.version !== undefined) return mutateRevision(req, slug, "adopt");
-    const legacyDenied = authorizeRoute(req, { scope: "system:admin" });
+    const legacyDenied = (await authorizeRoute(req, { scope: "system:admin" }));
     if (legacyDenied) return legacyDenied;
-    return json(resetPromptTemplate(slug));
+    return json((await resetPromptTemplate(slug)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const getPromptHistoryRoute: Handler = async (req, params) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const slug = slugParam(params);
   if (!versionedPromptsEnabled() || (await readPromptTemplate(slug))?.version === undefined) return error("versioned prompt not found", 404);
@@ -100,7 +100,7 @@ async function mutateRevision(req: Request, slug: string, action: "adopt" | "res
 }
 
 export const postPromptRevisionRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: "agent:write" }));
   if (denied) return denied;
   return mutateRevision(req, slugParam(params), new URL(req.url).pathname.endsWith("/restore") ? "restore" : "adopt");
 };

package/src/routes/provider-config.ts

@@ -6,7 +6,7 @@ import { cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { getCommand } from "../commands-db";
 import { deleteCommandAsync } from "../commands-write";
 import { emitCommand, error, json, parseBody, type Handler } from "./_shared";
-import { getProviderConfigEntry, listProviderConfigEntries, migrateLocalProviderConfigs, providerConfigPublic, setProviderConfig, VALID_PROVIDER_CONFIGS } from "../provider-config-store";
+import { getProviderConfigEntry, listProviderConfigEntries, migrateLocalProviderConfigsAsync, providerConfigPublic, setProviderConfigAsync, VALID_PROVIDER_CONFIGS } from "../provider-config-store";
 import { cleanProviderModelLimits } from "../provider-catalog-store";
 import { emitConfigChanged } from "../sse";
 import { setConfigAsync } from "../config-store-write";
@@ -28,9 +28,9 @@ export const getProvidersRoute: Handler = async () => {
   });
 };
 
-export const getProviderConfigsRoute: Handler = (req) => {
+export const getProviderConfigsRoute: Handler = async (req) => {
   const host = new URL(req.url).searchParams.get("host") ?? undefined;
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   const entries = listProviderConfigEntries(host);
   return json(Object.fromEntries(VALID_PROVIDER_CONFIGS.map((provider) => {
     return [provider, providerConfigPublic(entries[provider] ?? getProviderConfigEntry(provider, host))];
@@ -127,12 +127,12 @@ export const deleteProviderModelRoute: Handler = async (_req, params) => {
   }
 };
 
-export const getProviderConfigRoute: Handler = (_req, params) => {
+export const getProviderConfigRoute: Handler = async (_req, params) => {
   const provider = optionalEnum(params.provider, "provider", VALID_PROVIDER_CONFIGS);
   if (!provider) return error("provider required");
   const host = new URL(_req.url).searchParams.get("host") ?? undefined;
   const includeSecrets = new URL(_req.url).searchParams.get("includeSecrets") === "1";
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   return json(providerConfigPublic(getProviderConfigEntry(provider, host), { maskEnv: !includeSecrets }));
 };
 
@@ -145,7 +145,7 @@ export const putProviderConfigRoute: Handler = async (req, params) => {
     if (!isRecord(parsed.body)) return error("provider config body must be an object");
     const host = new URL(req.url).searchParams.get("host") ?? undefined;
     const updatedBy = cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 });
-    const entry = setProviderConfig(provider, parsed.body, { host, updatedBy });
+    const entry = await setProviderConfigAsync(provider, parsed.body, { host, updatedBy });
     emitConfigChanged(entry.namespace, entry.key, entry.version);
     return json(providerConfigPublic(entry), entry.version === 1 ? 201 : 200);
   } catch (e) {

package/src/routes/provider-quota-config.ts

@@ -8,7 +8,7 @@ import { error, json, parseBody, type Handler } from "./_shared";
 import {
   getProviderQuotaConfig,
   listProviderQuotaConfigs,
-  setProviderQuotaConfig,
+  setProviderQuotaConfigAsync,
   VALID_QUOTA_CONFIG_PROVIDERS,
 } from "../provider-quota-config-store";
 import { cleanString, optionalEnum } from "../validation";
@@ -40,7 +40,7 @@ export const putProviderQuotaConfigRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
-    return json(setProviderQuotaConfig(provider, parsed.body, { updatedBy }));
+    return json(await setProviderQuotaConfigAsync(provider, parsed.body, { updatedBy }));
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/provider-quotas.ts

@@ -45,7 +45,7 @@ function cleanUnavailableWindows(value: unknown): ProviderQuotaWindowIdentity[]
   return windows;
 }
 
-function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
+export function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
   if (!isRecord(body)) return "JSON object body required";
   const provider = cleanString(body.provider, "provider", { required: true, max: 80 })!;
   const accountKey = cleanString(body.accountKey, "accountKey", { required: true, max: 240 })!;
@@ -122,7 +122,7 @@ export const postProviderQuotaRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanProviderQuotaUpdate(parsed.body);
   if (typeof input === "string") return error(input);
-  const providerWriteGate = authorizeProviderQuotaWrite(req, input);
+  const providerWriteGate = (await authorizeProviderQuotaWrite(req, input));
   if (providerWriteGate) return providerWriteGate;
   if ((VALID_QUOTA_CONFIG_PROVIDERS as readonly string[]).includes(input.provider) && getProviderQuotaConfig(input.provider).enabled === false) return json({ skipped: true, reason: "provider quota collection disabled" }, 202);
   const providerContext = authContextFromRequest(req);
@@ -218,19 +218,19 @@ function cleanPublisherLeaseBody(body: unknown): {
 
 const runnerLeaseHolderId = (sourceAgentId: string) => `runner:${sourceAgentId}`;
 
-function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Response | null {
+async function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
-  const denied = authorizeRoute(req, { scope: "quota:write" });
+  const denied = (await authorizeRoute(req, { scope: "quota:write" }));
   if (denied) return denied;
   return ctx.callerAgentId === sourceAgentId ? null : error("forbidden", 403);
 }
 
-function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Response | null {
+export async function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
   if (!input.sourceAgentId) return error("sourceAgentId required for provider quota writer", 403);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   // The authority fence is deliberately folded into providerQuotas.upsert. A pre-read here would
   // race lease transfer while the async writer is queued.
@@ -242,7 +242,7 @@ export const postProviderQuotaPublisherLeaseAcquireRoute: Handler = async (req)
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json(await acquireProviderQuotaLeaseAsync({
     provider: input.provider,
@@ -260,7 +260,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
   if (!input.leaseToken) return error("leaseToken required");
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json({
     released: await releaseProviderQuotaLeaseAsync({
@@ -275,7 +275,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
 export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -294,7 +294,7 @@ export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) =
 export const postProviderQuotaLeaseReleaseRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/run-command.ts

@@ -10,7 +10,7 @@ import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared"
 export const postRunCommand: Handler = async (req) => {
   // Require authentication even when the server permits credential-less development requests.
   if (!hasPresentedCredential(req) || !isAuthorized(req)) return error("authentication required", 401);
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/secrets-backup.ts

@@ -20,7 +20,7 @@ function backupError(cause: unknown): Response {
 /** Backup and restore move every secret at once: the operator only, never a secrets-scoped agent. */
 function operatorRoute(handle: (body: Record<string, unknown>, actor: string) => Promise<Response>): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required for vault backup and restore", 403);
     let body: unknown = {};
@@ -37,7 +37,7 @@ function operatorRoute(handle: (body: Record<string, unknown>, actor: string) =>
 }
 
 export const getVaultBackupRoute: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await vaultBackupStatus()); } catch (cause) { return backupError(cause); }
 };

package/src/routes/secrets-import.ts

@@ -9,7 +9,7 @@ import { authorizeRoute, error, isRootCredentialRequest, json, parseBody, type H
 
 function importRoute(preview: boolean): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     // Import is the operator's batch approval; a secrets-scoped agent may not approve its own migration.
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required to import secrets", 403);

package/src/routes/secrets-vault.ts

@@ -13,7 +13,7 @@ import { resolveHostProviderEnv } from "../secrets-vault/provider-env";
 import { isOrchestratorSelfReportAuthorized } from "../orchestrator-self-report-authz";
 
 export const getVaultMetadataRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   // health() opens a row, so a missing or wrong key answers 503 here instead of listing names that nothing can resolve.
   try {
@@ -49,7 +49,7 @@ function vaultWriteError(cause: unknown): Response {
 
 /** The operator creates a new secret straight from the dashboard; the value is never echoed or logged. */
 export const postVaultSecretRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -60,7 +60,7 @@ export const postVaultSecretRoute: Handler = async (req) => {
 
 /** #3558 — the operator sets a new version of an existing secret (`:name` is `NAME` or `project:<id>:NAME`). */
 export const putVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -72,7 +72,7 @@ export const putVaultSecretRoute: Handler = async (req, params) => {
 
 /** #3554 — the operator deletes every version of one secret. */
 export const deleteVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await deleteOperatorSecret(operatorActor(req), params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
@@ -91,7 +91,7 @@ export const getVaultAuditRoute: Handler = async (req, params) => {
 export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   // Plaintext keys: only this orchestrator's own host credential (or admin), never a runner token with command:write.
   if (!isOrchestratorSelfReportAuthorized(req, orch.id)) return error("forbidden", 403);
@@ -105,14 +105,14 @@ export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
 };
 
 export const getVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await getSecretMetadata(params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
 export const patchVaultMetadataRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/settings.ts

@@ -4,7 +4,7 @@ import { ValidationError } from "../db";
 import { getConfig } from "../config-store";
 import { setConfigAsync } from "../config-store-write";
 import { getUserSettingAsync, setUserSettingAsync } from "../user-settings-async";
-import { ensureProviderConfigDescriptors, migrateLocalProviderConfigs } from "../provider-config-store";
+import { ensureProviderConfigDescriptors, migrateLocalProviderConfigsAsync } from "../provider-config-store";
 import { ensureNotificationSettingDescriptors } from "../notification-settings-store";
 import { NOTIFICATIONS_NAMESPACE } from "../notification-settings";
 import { getSettingDescriptor, listSettingDescriptors, validateSettingValue, PROVIDER_CONFIG_NAMESPACE } from "../settings/registry";
@@ -23,7 +23,7 @@ type SettingEnvelope = SettingEntry;
 // as before the migration (back-compat). Server-runtime/bootstrap/browser tiers ignore this.
 
 export const getSettingsRoute: Handler = async (req) => {
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors();
   ensureNotificationSettingDescriptors();
   return json({ settings: await listVisibleSettings(req) });
@@ -31,7 +31,7 @@ export const getSettingsRoute: Handler = async (req) => {
 
 export const getSettingsNamespaceRoute: Handler = async (req, params) => {
   const namespace = normalizeConfigPathParam(params.namespace, "namespace");
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors();
   if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors();
   const settings = await listVisibleSettings(req);
@@ -41,7 +41,7 @@ export const getSettingsNamespaceRoute: Handler = async (req, params) => {
 export const getSettingRoute: Handler = async (req, params) => {
   const namespace = normalizeConfigPathParam(params.namespace, "namespace");
   const key = normalizeConfigPathParam(params.key, "key");
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors(namespace === PROVIDER_CONFIG_NAMESPACE ? [key] : []);
   if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors([key]);
   const descriptor = getSettingDescriptor(namespace, key);
@@ -70,7 +70,7 @@ export async function setRegisteredSettingValue(namespace: string, key: string,
   const validation = validateSettingValue(namespace, key, merged);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
   if (descriptor.tier === "user") return setUserSettingAsync(DEFAULT_USER_ID, namespace, key, merged, updatedBy);
-  return setConfigAsync(namespace, key, merged, updatedBy);
+  return (await setConfigAsync(namespace, key, merged, updatedBy));
 }
 
 async function putSetting(req: Request, namespaceRaw: string | undefined, keyRaw: string | undefined): Promise<Response> {
@@ -82,7 +82,7 @@ async function putSetting(req: Request, namespaceRaw: string | undefined, keyRaw
   if (!Object.prototype.hasOwnProperty.call(parsed.body, "value")) return error("value required", 400);
 
   try {
-    migrateLocalProviderConfigs();
+    await migrateLocalProviderConfigsAsync();
     ensureProviderConfigDescriptors(namespace === PROVIDER_CONFIG_NAMESPACE ? [key] : []);
     if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors([key]);
     const descriptor = getSettingDescriptor(namespace, key);

package/src/routes/shipping.ts

@@ -5,12 +5,13 @@ import { readGateStatsAsync, resolveProjectAsync } from "../db";
 import { getShippingBoard } from "../services/shipping-board";
 import { getShippingStats } from "../services/shipping-stats";
 import { abandonRedMainIncident } from "../services/red-main-incident";
+import { baseKnownFailures } from "../db/land-boundaries";
 import { OpError } from "@humwick/kernel/contract";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, resolveActorLabel, type Handler } from "./_shared";
 
 export const postRedMainAbandonRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<{ reason?: unknown }>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -23,6 +24,13 @@ export const postRedMainAbandonRoute: Handler = async (req, params) => {
   }
 };
 
+// #3362 §11: what a builder's delivery gate holds out of unrelated runs. agent:read, so every agent token reads it.
+export const getKnownFailuresRoute: Handler = async (req) => {
+  const remote = new URL(req.url).searchParams.get("remote")?.trim();
+  if (!remote || !/^[\w.-]+\/[\w.-]+$/.test(remote)) return error("remote must be owner/repo", 400);
+  return json({ failures: baseKnownFailures(remote) });
+};
+
 /** A `projectId` query names a project by id or slug; absent means all projects. */
 async function projectFilter(req: Request): Promise<{ projectId?: string } | Response> {
   const ref = new URL(req.url).searchParams.get("projectId")?.trim();

package/src/routes/spawn-policy.ts

@@ -1,3 +1,4 @@
+import { upsertManagedAgentStateAsync } from "../db/lifecycle-tail-async";
 // Auto-split from routes.ts (#299). Domain: spawn-policy.
 import { ValidationError, getCrashReport, getManagedPolicyTimelineAsync, getOrchestrator } from "../db";
 import { auditEvent, authAuditMetadata, dashboardAttribution, emitCommand, error, json, parseBody, parseQueryInt, spawnRequestId, type Handler } from "./_shared";
@@ -6,7 +7,7 @@ import { SYSTEM_LAUNCH } from "../runtime-tokens";
 import { cleanString } from "../validation";
 import { hostSpawnsDrained } from "../db/spawn-host-cap";
 import { createCommandAsync } from "../commands-write";
-import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies, upsertManagedAgentState } from "../config-store";
+import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies } from "../config-store";
 import { deleteConfigAsync, setConfigAsync } from "../config-store-write";
 import { managedSpawnReservationCurrent, restoreDrainedSpawnReservation } from "../managed-spawn-reservation";
 import { emitConfigChanged, emitManagedAgentStateChanged } from "../sse";
@@ -72,7 +73,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
   if (stewardDeny) return error(`steward spawn refused: ${stewardDeny}`, 409);
   const requestId = spawnRequestId();
   const existing = getManagedAgentState(policy.name);
-  const state = upsertManagedAgentState({
+  const state = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "starting",
     orchestratorId: policy.orchestratorId,
@@ -82,7 +83,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     // An operator start deliberately retries a failed policy after correcting its launch.
     restartCount: existing?.restartCount ?? 0,
     consecutiveFailures: 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, state as unknown as Record<string, unknown>);
   const policySnapshot = JSON.stringify(policy);
   const spawnParams = await buildManagedSpawnParamsAsync(policy, requestId, { createdBy: "managed-agent", authority: SYSTEM_LAUNCH });
@@ -93,7 +94,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     return error("managed policy start was superseded", 409);
   }
   if (hostSpawnsDrained(orch.agentId)) {
-    restoreDrainedSpawnReservation(policy, requestId, existing);
+    (await restoreDrainedSpawnReservation(policy, requestId, existing));
     return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
   }
   const command = await createCommandAsync({
@@ -131,7 +132,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     })
     : undefined;
   if (action === "restart" && hostSpawnsDrained(orch.agentId)) return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
-  const nextState = upsertManagedAgentState({
+  const nextState = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "stopping",
     agentId: state?.agentId,
@@ -143,7 +144,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     lastStopAt: Date.now(),
     restartCount: state?.restartCount ?? 0,
     consecutiveFailures: state?.consecutiveFailures ?? 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, nextState as unknown as Record<string, unknown>);
   const command = await createCommandAsync({
     type: action === "restart" ? "agent.restart" : "agent.shutdown",
@@ -209,7 +210,7 @@ export const putSpawnPolicyRoute: Handler = async (req, params) => {
     const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
     const entry = await setConfigAsync("spawn-policy", params.name!, value, updatedBy);
     emitConfigChanged(entry.namespace, entry.key, entry.version);
-    getLifecycleManager().onConfigChanged("spawn-policy", entry.key);
+    (await getLifecycleManager().onConfigChanged("spawn-policy", entry.key));
     return json(entry, entry.version === 1 ? 201 : 200);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/sse.ts

@@ -5,13 +5,13 @@ import { isOtherHumanSink } from "../message-visibility";
 import { canViewAgentRoute, error, type Handler } from "./_shared";
 import { messageViewerForRequest } from "./message-viewer";
 
-export const getEvents: Handler = (req) => {
+export const getEvents: Handler = async (req) => {
   const url = new URL(req.url);
   const agentId = url.searchParams.get("for") || null;
   const lastEventId = Number(req.headers.get("last-event-id") ?? "");
   // #3567 D6 — a signed-in human streams their own messages and notifications only.
   const viewer = messageViewerForRequest(req) ?? undefined;
-  if (agentId && isOtherHumanSink(viewer, agentId)) return authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream");
+  if (agentId && isOtherHumanSink(viewer, agentId)) return (await authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream"));
   if (agentId && !canViewAgentRoute(req, agentId)) return error("agent not found", 404);
   return createSSEStream(agentId, Number.isSafeInteger(lastEventId) && lastEventId > 0 ? lastEventId : 0,
     url.searchParams.get("agentStatus") === "delta", viewer);