@humwick/server 0.130.1 → 0.130.3

package/src/routes/stats.ts

@@ -7,7 +7,7 @@ import { listPauses, pauseJob, resumeJobAsync } from "../maintenance/pauses";
 import { defaultIssueRepo } from "../config";
 import { listSpawnPolicies } from "../config-store";
 import { disabledBackingPolicyNames } from "../channel-policy-health";
-import { cancelMaintenanceRun, listMaintenanceJobs, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
+import { cancelMaintenanceRun, listMaintenanceJobsAsync, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
 import { claudeAppOAuthHealth } from "../claude-app/oauth-http";
 import { getConnector } from "../connectors";
 import { channelsHostEnsureHealthCheck } from "../connector-boot-health";
@@ -66,7 +66,7 @@ export const getHealthRoute: Handler = async () => {
 // #3606 — rolling 60 s load breakdown: callers by rate and CPU, emits, reader-pool ops.
 export const getHubMetricsRoute: Handler = () => json(hubMetricsReport());
 
-export const getMaintenanceJobs: Handler = () => json(listMaintenanceJobs());
+export const getMaintenanceJobs: Handler = async () => json(await listMaintenanceJobsAsync());
 
 // #1728 stage 0 — a POST-HOC diagnostic surface, not a live incident one: it reads the in-memory
 // run registry the scheduler maintains (see src/maintenance/scheduler.ts). That registry can only
@@ -87,7 +87,7 @@ export const postMaintenanceJobRun: Handler = async (req, params) => {
     const parsed = await parseBody<{ overridePause?: unknown }>(req);
     const overridePause = parsed.ok && parsed.body?.overridePause === true;
     const run = await runMaintenanceJobNow(params.id!, { overridePause });
-    return json({ run, jobs: listMaintenanceJobs() }, run.status === "failed" ? 500 : 202);
+    return json({ run, jobs: await listMaintenanceJobsAsync() }, run.status === "failed" ? 500 : 202);
   } catch (e) {
     if (e instanceof Error && e.message.includes("not found")) return error(e.message, 404);
     throw e;
@@ -110,7 +110,7 @@ export const postMaintenanceJobCancel: Handler = async (req, params) => {
   if (cancelledRunIds.length === 0) {
     return json({ ok: false, error: "maintenance job is not running", cancelledRunIds: [] }, 404);
   }
-  return json({ ok: true, cancelledRunIds, requester, jobs: listMaintenanceJobs() });
+  return json({ ok: true, cancelledRunIds, requester, jobs: await listMaintenanceJobsAsync() });
 };
 
 export const getMaintenancePauses: Handler = () => {
@@ -136,7 +136,7 @@ export const postMaintenanceJobPause: Handler = async (req, params) => {
     if (!result.ok) {
       return json({ ok: false, error: "maintenance job already paused", pause: result.pause }, 409);
     }
-    return json({ ok: true, pause: result.pause, jobs: listMaintenanceJobs() });
+    return json({ ok: true, pause: result.pause, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;
@@ -147,7 +147,7 @@ export const postMaintenanceJobResume: Handler = async (_req, params) => {
   try {
     const result = await resumeJobAsync({ jobId: params.id! });
     if (!result.resumed) return error("maintenance job is not paused", 404);
-    return json({ ok: true, ...result, jobs: listMaintenanceJobs() });
+    return json({ ok: true, ...result, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/task-http.ts

@@ -1,4 +1,5 @@
-import { resolveActingUser, requestUserAddress, resolveActorLabel, error } from "./_shared";
+import { isRecord } from "@humwick/sdk";
+import { resolveActingUser, requestUserAddress, resolveActorLabel, error, parseBody, parseId } from "./_shared";
 import { ValidationError } from "../db/connection";
 import { authContextFromRequest } from "../services/auth-context";
 import { isRequestAuthorizedFor } from "../security";
@@ -25,3 +26,16 @@ export function taskEntityError(e: unknown): Response {
   }
   throw e;
 }
+
+export async function parseTaskMutation(req: Request, rawId: string | undefined): Promise<
+  { ok: true; id: number; body: Record<string, unknown> } | { ok: false; response: Response }
+> {
+  const id = parseId(rawId);
+  if (id === null) return { ok: false, response: error("invalid task id") };
+  const forbidden = await requireTaskMutationAuth(req, id);
+  if (forbidden) return { ok: false, response: forbidden };
+  const parsed = await parseBody<Record<string, unknown>>(req);
+  if (!parsed.ok) return { ok: false, response: error(parsed.error, parsed.status) };
+  if (!isRecord(parsed.body)) return { ok: false, response: error("JSON object body required") };
+  return { ok: true, id, body: parsed.body };
+}

package/src/routes/task-issues.ts

@@ -6,18 +6,13 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanString } from "../validation";
 import { isRecord } from "@humwick/sdk";
-import { error, json, parseBody, parseId, type Handler } from "./_shared";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { error, json, type Handler } from "./_shared";
+import { taskHttpActor as actorOf, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 
 export const postTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     // Same alias tolerance + attach-nothing rejection as relay_task_add_ref (#2214), one body.
     return json(await attachTaskRefs(id, {
@@ -33,14 +28,9 @@ export const postTaskRef: Handler = async (req, params) => {
   }
 };
 export const deleteTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await removeTaskEntityRefAsync(id, {
       issueRefId: cleanString(body.issueRefId, "issueRefId", { max: 120 }),
@@ -57,14 +47,9 @@ export const deleteTaskRef: Handler = async (req, params) => {
 // #833 — comment-on-Task writes THROUGH to the linked GitHub issue (discussion lives in
 // GitHub, never a relay table). Execution telemetry never reaches this path.
 export const postTaskComment: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const result = await commentOnTaskThrough({
       taskId: id,

package/src/routes/tasks.ts

@@ -2,9 +2,9 @@
 export { postTaskRef, deleteTaskRef, postTaskComment } from "./task-issues";
 import { createPlanTaskAsync, isPlanTaskCreate } from "../services/plan-task-create";
 import { prepareIssueTaskCreate, refreshTaskIssueUpdateAsync } from "../services/task-from-issue";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { taskHttpActor as actorOf, requireTaskMutationAuth, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 import { MAX_BODY_BYTES } from "../config";
-import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
+import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
 import { isRequestAuthorizedFor } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
 import { hasTaskReadAdminScope } from "../task-authz";
@@ -25,7 +25,7 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanEpoch, cleanMeta, cleanString, dependencyRefField, optionalEnum, taskIdField } from "../validation";
 import { emitMessageClaimed, emitTaskChanged } from "../sse";
-import { errMessage, isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
+import { isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
 import { type AgentSessionGuard, type TaskStatus, type TaskStatusInput } from "../types";
 
 async function taskDetailOr404(id: number) {
@@ -100,6 +100,7 @@ export const postTaskCreate: Handler = async (req) => {
       complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES),
       context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }),
       terminalStage: optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES),
+      onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }),
       doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }),
       teamId: cleanString(body.teamId, "teamId", { max: 200 }),
       projectId: cleanString(body.projectId, "projectId", { max: 120 }),
@@ -109,6 +110,7 @@ export const postTaskCreate: Handler = async (req) => {
       // Raw passthrough (same convention as `dispatch` above) — validated inside
       // createDeliverableTask (cleanTags / cleanTaskPriority), not at the route layer.
       tags: body.tags as string[] | undefined,
+      paths: body.paths as string[] | undefined,
       priority: body.priority as TaskPriority | undefined,
       // Same alias-tolerant normalization the MCP surface uses (#2214) — one home, both transports.
       issueRefs: issueRefsFromArgs(body),
@@ -148,21 +150,10 @@ export const postTaskCreate: Handler = async (req) => {
   }
 };
 
-
-
-
-
-
-
 export const patchTaskEntity: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     if (body.refreshIssue !== undefined) return json(await refreshTaskIssueUpdateAsync(id, body, actorOf(req)));
     const detail = await updateTaskEntityAsync(id, {
@@ -171,6 +162,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       ...(body.complexity !== undefined ? { complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES) } : {}),
       ...(body.context !== undefined ? { context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.latestSteer !== undefined ? { latestSteer: cleanString(body.latestSteer, "latestSteer", { max: MAX_BODY_BYTES }) ?? "" } : {}),
+      ...(body.onDeploy !== undefined ? { onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }) ?? "" } : {}),
       ...(body.doneWhen !== undefined ? { doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.dispatch !== undefined ? { dispatch: body.dispatch as TaskDispatch } : {}),
       ...(body.teamId !== undefined ? { teamId: cleanString(body.teamId, "teamId", { max: 200 }) ?? "" } : {}),
@@ -180,6 +172,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       // survive into updateDeliverableTask, which cleanString's `?? ""` collapse would erase.
       ...(body.terminalStage !== undefined ? { terminalStage: body.terminalStage === null ? null : optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES) } : {}),
       ...(body.tags !== undefined ? { tags: body.tags as string[] | null } : {}),
+      ...(body.paths !== undefined ? { paths: body.paths as string[] | null } : {}),
       ...(body.priority !== undefined ? { priority: body.priority as TaskPriority | null } : {}),
       actor: actorOf(req),
     });
@@ -190,14 +183,9 @@ export const patchTaskEntity: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStatus: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskStatusControl(id, {
       status: body.status as TaskStatus,
@@ -213,14 +201,9 @@ export const postTaskEntityStatus: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStage: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskEntityStageAsync(id, {
       deliverableStage: optionalEnum(body.deliverableStage, "deliverableStage", TASK_DELIVERABLE_STAGES) as any,
@@ -235,14 +218,9 @@ export const postTaskEntityStage: Handler = async (req, params) => {
 };
 
 export const postTaskEntityGate: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     return json(await recordTaskEntityGateAsync(id, {
       gate: cleanString(body.gate, "gate", { required: true, max: 120 })!,
@@ -345,14 +323,9 @@ export const deleteTaskRelated: Handler = async (req, params) => {
 };
 
 export const postTaskAssign: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await assignTaskEntityAgentAsync(id, cleanString(body.agentId, "agentId", { required: true, max: 200 })!, cleanString(body.role, "role", { max: 120 }), actorOf(req));
     return json(detail);
@@ -444,10 +417,6 @@ export const postWorkspaceWithdrawLand: Handler = async (req) => {
   }
 };
 
-
-
-
-
 export const postClaimTask: Handler = async (req, params) => {
   const id = parseId(params.id);
   if (id === null) return error("invalid task id");

package/src/routes/team-templates.ts

@@ -1,5 +1,5 @@
 import { authContextFromRequest } from "../services/auth-context";
-import { deleteTeamTemplate, getTeamTemplate, listTeamTemplates, saveTeamTemplate } from "../services/team-templates";
+import { deleteTeamTemplateAsync, getTeamTemplate, listTeamTemplates, saveTeamTemplateAsync } from "../services/team-templates";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
 
@@ -16,14 +16,14 @@ function slugParam(params: Record<string, string | undefined>): string {
   return cleanString(params.slug, "slug", { required: true, max: 120 })!;
 }
 
-export const getTeamTemplatesRoute: Handler = (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplatesRoute: Handler = async (req) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   return json({ templates: listTeamTemplates() });
 };
 
-export const getTeamTemplateRoute: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplateRoute: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const template = getTeamTemplate(slugParam(params));
@@ -34,32 +34,32 @@ export const getTeamTemplateRoute: Handler = (req, params) => {
 };
 
 export const postTeamTemplateRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate(parsed.body ?? {}, updatedBy(req)), 201);
+    return json(await saveTeamTemplateAsync(parsed.body ?? {}, updatedBy(req)), 201);
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const putTeamTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
+    return json(await saveTeamTemplateAsync({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
   } catch (err) {
     return routeError(err);
   }
 };
 
-export const deleteTeamTemplateRoute: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const deleteTeamTemplateRoute: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const slug = slugParam(params);
-  return json({ slug, deleted: deleteTeamTemplate(slug, updatedBy(req)) });
+  return json({ slug, deleted: await deleteTeamTemplateAsync(slug, updatedBy(req)) });
 };

package/src/routes/teams-config.ts

@@ -1,4 +1,4 @@
-import { getTeamsConfig, setTeamsConfig } from "../teams-config-store";
+import { getTeamsConfig, setTeamsConfigAsync } from "../teams-config-store";
 import { cleanString } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
 import { isRecord } from "@humwick/sdk";
@@ -11,5 +11,5 @@ export const putTeamsConfigRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
-  return json(setTeamsConfig(parsed.body, { updatedBy }));
+  return json(await setTeamsConfigAsync(parsed.body, { updatedBy }));
 };

package/src/routes/teams.ts

@@ -43,9 +43,9 @@ export const getMyTeamRoute: Handler = (req) => {
 };
 
 // #3725 — a signed-in member lists the teams their agent scope can see; machine callers stay admin-only.
-export const getTeamsRoute: Handler = (req) => {
+export const getTeamsRoute: Handler = async (req) => {
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" }));
   if (denied) return denied;
   try {
     const status = optionalEnum(new URL(req.url).searchParams.get("status") ?? undefined, "status", TEAM_STATUSES) as Team["status"] | undefined;
@@ -67,7 +67,7 @@ export const getTeamsRoute: Handler = (req) => {
 };
 
 export const getTeamOutcomesRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const recentLimit = parseQueryInt(new URL(req.url).searchParams.get("recentLimit"), { min: 1, max: 50, clamp: true }) ?? undefined;
@@ -83,11 +83,11 @@ export const putMyTeamBriefRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(setCallerTeamBrief(authContextFromRequest(req), {
+    return json((await setCallerTeamBrief(authContextFromRequest(req), {
       title: cleanString(body.title, "title", { max: 240 }),
       brief: cleanString(body.brief, "brief", { max: 16_000 }),
       definitionOfDone: cleanString(body.definitionOfDone, "definitionOfDone", { max: 4000 }),
-    }));
+    })));
   } catch (err) {
     return routeError(err);
   }
@@ -98,28 +98,28 @@ export const postMyTeamDissolveRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
+    return json(await dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const postTeamDissolveByIdRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const id = params.id!;
     if (!getTeam(id)) return error("team not found", 404);
-    return json(dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
+    return json(await dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "teams:write" });
+  const denied = (await authorizeRoute(req, { scope: "teams:write" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -132,7 +132,7 @@ export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
 export const getTeamSpawnDelegationRoute: Handler = async (req, params) => {
   // #3725 — the grant names projects and launches across the tree; a member's session may not read it.
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" });
+  const denied = (await authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" }));
   if (denied) return denied;
   try {
     const state = await getTeamSpawnDelegation(authContextFromRequest(req), params.id!);

package/src/routes/tokens.ts

@@ -1,18 +1,25 @@
+import { upsertIntegrationRegistryAsync, upsertTokenProfileAsync, updateTokenProfileAsync, deleteTokenProfileAsync } from "../db/runtime-tail-async";
 // Auto-split from routes.ts (#299). Domain: tokens.
 import { revokeUserSession, sessionUserIdOf } from "../auth/session";
 import { withSessionCookie } from "../auth/session-cookie";
 import { APPROVAL_MODES, SPAWN_PROVIDERS, isRecord, userSinkId } from "@humwick/sdk";
-import { ValidationError, getOrchestrator, upsertIntegrationRegistry } from "../db";
+import { ValidationError, getOrchestrator } from "../db";
 import { auditEvent, authAuditMetadata, authorizeRoute, error, isRootCredentialRequest, json, parseBody, resolveActingUser, type Handler } from "./_shared";
 import { cleanString, cleanStringArray, cleanTokenConstraints, optionalEnum } from "../validation";
-import { deleteTokenProfile, getToken, getTokenProfile, listTokenProfiles, listTokens, updateTokenProfile, upsertTokenProfile } from "../token-db";
-import { createTokenAsync, handoffTokenAsync, revokeTokenAsync } from "../token-db-write";
+import { getToken, getTokenProfile, listTokenProfiles, listTokens } from "../token-db";
+import { createTokenAsync, revokeTokenAsync } from "../token-db-write";
 import { getComponentAuth, getIntegrationAuth, isAuthorized } from "../security";
-import { issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken } from "../runtime-tokens";
+import { handoffRunnerTokenAsync, issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken, type RunnerTokenMintRefusal } from "../runtime-tokens";
 import { type SpawnProvider } from "../types";
 
 export const getTokens: Handler = () => json(listTokens());
 
+// #3775 — a rate-limited runner token mint is a 429 with Retry-After; any other refusal stays 403.
+function mintRefused(refusal: RunnerTokenMintRefusal): Response {
+  if (refusal.retryAfterSeconds === undefined) return error(refusal.error, 403);
+  return Response.json({ error: refusal.error, retryAfterSeconds: refusal.retryAfterSeconds }, { status: 429, headers: { "Retry-After": String(refusal.retryAfterSeconds) } });
+}
+
 export const getTokenMe: Handler = (req) => {
   const component = getComponentAuth(req);
   if (component) {
@@ -103,11 +110,12 @@ export const postRuntimeTokenRenew: Handler = async (req) => {
   const auth = getComponentAuth(req);
   if (!auth?.jti) return error("scoped runtime token required", 403);
   if (auth.role !== "provider") return error("provider runtime token required", 403);
-  const renewed = await handoffTokenAsync({
+  const renewed = await handoffRunnerTokenAsync(auth.sub, {
     jti: auth.jti,
     allowedProfileIds: ["provider-agent", "provider-interactive"],
     createdBy: `renew:${auth.jti}`,
   });
+  if (renewed && "retryAfterSeconds" in renewed) return mintRefused({ error: "runtime token mint rate limited", ...renewed });
   if (!renewed) return error("runtime token cannot be renewed", 403);
   await auditEvent({
     // Keyed by the successor, so a replayed handoff (#1245) records one renewal.
@@ -151,7 +159,7 @@ export const postRuntimeTokenRemint: Handler = async (req) => {
     throw e;
   }
   const result = await remintRunnerRuntimeToken(auth, `remint:${auth.jti}`);
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   if ("unchanged" in result) return json(result);
   await auditEvent({
     clientId: "server-runtime-token-remint-" + result.record.jti,
@@ -169,7 +177,7 @@ export const postRuntimeTokenRemint: Handler = async (req) => {
 export const postOrchestratorRunnerToken: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -180,7 +188,7 @@ export const postOrchestratorRunnerToken: Handler = async (req, params) => {
     orchestratorId: orch.id,
     createdBy: `orchestrator-remint:${orch.id}`,
   });
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   await auditEvent({
     clientId: "server-runner-token-remint-" + result.record.jti,
     kind: "state",
@@ -212,7 +220,7 @@ export const postInteractiveRunnerRuntimeToken: Handler = async (req) => {
     // (`isRootCredentialRequest` above), which can mint any token it likes anyway — the value is
     // pinned into the signature so every LATER, scoped read of it is unforgeable.
     const approvalMode = optionalEnum(parsed.body.approvalMode, "approvalMode", APPROVAL_MODES);
-    const runtimeToken = issueInteractiveRunnerRuntimeToken({
+    const runtimeToken = (await issueInteractiveRunnerRuntimeToken({
       provider,
       cwd,
       runnerId,
@@ -221,7 +229,7 @@ export const postInteractiveRunnerRuntimeToken: Handler = async (req) => {
       host,
       ...(approvalMode ? { approvalMode } : {}),
       createdBy: `interactive:${runnerId}`,
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-interactive-" + runnerId + "-" + Date.now(),
       kind: "state",
@@ -256,13 +264,13 @@ export const postMcpRuntimeToken: Handler = async (req) => {
     const agentId = cleanString(parsed.body.agentId, "agentId", { max: 240 });
     const targets = cleanStringArray(parsed.body.targets, "targets", { itemMax: 80, maxItems: 50 });
     const channels = cleanStringArray(parsed.body.channels, "channels", { itemMax: 80, maxItems: 50 });
-    const runtimeToken = issueMcpRuntimeToken({
+    const runtimeToken = (await issueMcpRuntimeToken({
       sessionId,
       agentId,
       targets,
       channels,
       createdBy: `mcp:${sessionId}`,
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-mcp-" + sessionId + "-" + Date.now(),
       kind: "state",
@@ -295,19 +303,19 @@ export const postIntegrationRuntimeToken: Handler = async (req) => {
     const name = cleanString(parsed.body.name, "name", { required: true, max: 120 })!;
     const targets = cleanStringArray(parsed.body.targets, "targets", { itemMax: 80, maxItems: 50 });
     const channels = cleanStringArray(parsed.body.channels, "channels", { itemMax: 80, maxItems: 50 });
-    const runtimeToken = issueIntegrationRuntimeToken({
+    const runtimeToken = (await issueIntegrationRuntimeToken({
       name,
       targets,
       channels,
       createdBy: `integration:${name}`,
-    });
-    upsertIntegrationRegistry({
+    }));
+    (await upsertIntegrationRegistryAsync({
       name,
       scopes: runtimeToken.record.scope,
       targets,
       channels,
       source: "api",
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-integration-" + name + "-" + Date.now(),
       kind: "state",
@@ -337,7 +345,7 @@ export const postTokenProfile: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const input = cleanTokenProfileInput(parsed.body);
-    return json(upsertTokenProfile({
+    return json((await upsertTokenProfileAsync({
       id: input.id,
       name: input.name!,
       description: input.description,
@@ -346,7 +354,7 @@ export const postTokenProfile: Handler = async (req) => {
       constraints: input.constraints,
       ttlSeconds: input.ttlSeconds,
       createdBy: input.createdBy,
-    }), 201);
+    })), 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     if (e instanceof Error) return error(e.message, 400);
@@ -359,7 +367,7 @@ export const patchTokenProfile: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const patch = cleanTokenProfileInput(parsed.body, true);
-    const updated = updateTokenProfile(params.id!, {
+    const updated = (await updateTokenProfileAsync(params.id!, {
       name: patch.name,
       description: patch.description,
       role: patch.role,
@@ -367,7 +375,7 @@ export const patchTokenProfile: Handler = async (req, params) => {
       constraints: patch.constraints,
       ttlSeconds: patch.ttlSeconds,
       createdBy: patch.createdBy,
-    });
+    }));
     return updated ? json(updated) : error("token profile not found", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -376,8 +384,8 @@ export const patchTokenProfile: Handler = async (req, params) => {
   }
 };
 
-export const deleteTokenProfileRoute: Handler = (_req, params) => {
-  return deleteTokenProfile(params.id!) ? json({ ok: true }) : error("token profile not found or built-in", 404);
+export const deleteTokenProfileRoute: Handler = async (_req, params) => {
+  return (await deleteTokenProfileAsync(params.id!)) ? json({ ok: true }) : error("token profile not found or built-in", 404);
 };
 
 export const postTokenRevoke: Handler = async (req, params) => {