@humwick/server 0.130.2 → 0.130.3

package/src/routes/provider-quotas.ts

@@ -45,7 +45,7 @@ function cleanUnavailableWindows(value: unknown): ProviderQuotaWindowIdentity[]
   return windows;
 }
 
-function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
+export function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
   if (!isRecord(body)) return "JSON object body required";
   const provider = cleanString(body.provider, "provider", { required: true, max: 80 })!;
   const accountKey = cleanString(body.accountKey, "accountKey", { required: true, max: 240 })!;
@@ -122,7 +122,7 @@ export const postProviderQuotaRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanProviderQuotaUpdate(parsed.body);
   if (typeof input === "string") return error(input);
-  const providerWriteGate = authorizeProviderQuotaWrite(req, input);
+  const providerWriteGate = (await authorizeProviderQuotaWrite(req, input));
   if (providerWriteGate) return providerWriteGate;
   if ((VALID_QUOTA_CONFIG_PROVIDERS as readonly string[]).includes(input.provider) && getProviderQuotaConfig(input.provider).enabled === false) return json({ skipped: true, reason: "provider quota collection disabled" }, 202);
   const providerContext = authContextFromRequest(req);
@@ -218,19 +218,19 @@ function cleanPublisherLeaseBody(body: unknown): {
 
 const runnerLeaseHolderId = (sourceAgentId: string) => `runner:${sourceAgentId}`;
 
-function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Response | null {
+async function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
-  const denied = authorizeRoute(req, { scope: "quota:write" });
+  const denied = (await authorizeRoute(req, { scope: "quota:write" }));
   if (denied) return denied;
   return ctx.callerAgentId === sourceAgentId ? null : error("forbidden", 403);
 }
 
-function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Response | null {
+export async function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
   if (!input.sourceAgentId) return error("sourceAgentId required for provider quota writer", 403);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   // The authority fence is deliberately folded into providerQuotas.upsert. A pre-read here would
   // race lease transfer while the async writer is queued.
@@ -242,7 +242,7 @@ export const postProviderQuotaPublisherLeaseAcquireRoute: Handler = async (req)
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json(await acquireProviderQuotaLeaseAsync({
     provider: input.provider,
@@ -260,7 +260,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
   if (!input.leaseToken) return error("leaseToken required");
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json({
     released: await releaseProviderQuotaLeaseAsync({
@@ -275,7 +275,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
 export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -294,7 +294,7 @@ export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) =
 export const postProviderQuotaLeaseReleaseRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/run-command.ts

@@ -10,7 +10,7 @@ import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared"
 export const postRunCommand: Handler = async (req) => {
   // Require authentication even when the server permits credential-less development requests.
   if (!hasPresentedCredential(req) || !isAuthorized(req)) return error("authentication required", 401);
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/secrets-backup.ts

@@ -20,7 +20,7 @@ function backupError(cause: unknown): Response {
 /** Backup and restore move every secret at once: the operator only, never a secrets-scoped agent. */
 function operatorRoute(handle: (body: Record<string, unknown>, actor: string) => Promise<Response>): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required for vault backup and restore", 403);
     let body: unknown = {};
@@ -37,7 +37,7 @@ function operatorRoute(handle: (body: Record<string, unknown>, actor: string) =>
 }
 
 export const getVaultBackupRoute: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await vaultBackupStatus()); } catch (cause) { return backupError(cause); }
 };

package/src/routes/secrets-import.ts

@@ -9,7 +9,7 @@ import { authorizeRoute, error, isRootCredentialRequest, json, parseBody, type H
 
 function importRoute(preview: boolean): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     // Import is the operator's batch approval; a secrets-scoped agent may not approve its own migration.
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required to import secrets", 403);

package/src/routes/secrets-vault.ts

@@ -13,7 +13,7 @@ import { resolveHostProviderEnv } from "../secrets-vault/provider-env";
 import { isOrchestratorSelfReportAuthorized } from "../orchestrator-self-report-authz";
 
 export const getVaultMetadataRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   // health() opens a row, so a missing or wrong key answers 503 here instead of listing names that nothing can resolve.
   try {
@@ -49,7 +49,7 @@ function vaultWriteError(cause: unknown): Response {
 
 /** The operator creates a new secret straight from the dashboard; the value is never echoed or logged. */
 export const postVaultSecretRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -60,7 +60,7 @@ export const postVaultSecretRoute: Handler = async (req) => {
 
 /** #3558 — the operator sets a new version of an existing secret (`:name` is `NAME` or `project:<id>:NAME`). */
 export const putVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -72,7 +72,7 @@ export const putVaultSecretRoute: Handler = async (req, params) => {
 
 /** #3554 — the operator deletes every version of one secret. */
 export const deleteVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await deleteOperatorSecret(operatorActor(req), params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
@@ -91,7 +91,7 @@ export const getVaultAuditRoute: Handler = async (req, params) => {
 export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   // Plaintext keys: only this orchestrator's own host credential (or admin), never a runner token with command:write.
   if (!isOrchestratorSelfReportAuthorized(req, orch.id)) return error("forbidden", 403);
@@ -105,14 +105,14 @@ export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
 };
 
 export const getVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await getSecretMetadata(params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
 export const patchVaultMetadataRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/settings.ts

@@ -70,7 +70,7 @@ export async function setRegisteredSettingValue(namespace: string, key: string,
   const validation = validateSettingValue(namespace, key, merged);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
   if (descriptor.tier === "user") return setUserSettingAsync(DEFAULT_USER_ID, namespace, key, merged, updatedBy);
-  return setConfigAsync(namespace, key, merged, updatedBy);
+  return (await setConfigAsync(namespace, key, merged, updatedBy));
 }
 
 async function putSetting(req: Request, namespaceRaw: string | undefined, keyRaw: string | undefined): Promise<Response> {

package/src/routes/shipping.ts

@@ -5,12 +5,13 @@ import { readGateStatsAsync, resolveProjectAsync } from "../db";
 import { getShippingBoard } from "../services/shipping-board";
 import { getShippingStats } from "../services/shipping-stats";
 import { abandonRedMainIncident } from "../services/red-main-incident";
+import { baseKnownFailures } from "../db/land-boundaries";
 import { OpError } from "@humwick/kernel/contract";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, resolveActorLabel, type Handler } from "./_shared";
 
 export const postRedMainAbandonRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<{ reason?: unknown }>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -23,6 +24,13 @@ export const postRedMainAbandonRoute: Handler = async (req, params) => {
   }
 };
 
+// #3362 §11: what a builder's delivery gate holds out of unrelated runs. agent:read, so every agent token reads it.
+export const getKnownFailuresRoute: Handler = async (req) => {
+  const remote = new URL(req.url).searchParams.get("remote")?.trim();
+  if (!remote || !/^[\w.-]+\/[\w.-]+$/.test(remote)) return error("remote must be owner/repo", 400);
+  return json({ failures: baseKnownFailures(remote) });
+};
+
 /** A `projectId` query names a project by id or slug; absent means all projects. */
 async function projectFilter(req: Request): Promise<{ projectId?: string } | Response> {
   const ref = new URL(req.url).searchParams.get("projectId")?.trim();

package/src/routes/spawn-policy.ts

@@ -1,3 +1,4 @@
+import { upsertManagedAgentStateAsync } from "../db/lifecycle-tail-async";
 // Auto-split from routes.ts (#299). Domain: spawn-policy.
 import { ValidationError, getCrashReport, getManagedPolicyTimelineAsync, getOrchestrator } from "../db";
 import { auditEvent, authAuditMetadata, dashboardAttribution, emitCommand, error, json, parseBody, parseQueryInt, spawnRequestId, type Handler } from "./_shared";
@@ -6,7 +7,7 @@ import { SYSTEM_LAUNCH } from "../runtime-tokens";
 import { cleanString } from "../validation";
 import { hostSpawnsDrained } from "../db/spawn-host-cap";
 import { createCommandAsync } from "../commands-write";
-import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies, upsertManagedAgentState } from "../config-store";
+import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies } from "../config-store";
 import { deleteConfigAsync, setConfigAsync } from "../config-store-write";
 import { managedSpawnReservationCurrent, restoreDrainedSpawnReservation } from "../managed-spawn-reservation";
 import { emitConfigChanged, emitManagedAgentStateChanged } from "../sse";
@@ -72,7 +73,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
   if (stewardDeny) return error(`steward spawn refused: ${stewardDeny}`, 409);
   const requestId = spawnRequestId();
   const existing = getManagedAgentState(policy.name);
-  const state = upsertManagedAgentState({
+  const state = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "starting",
     orchestratorId: policy.orchestratorId,
@@ -82,7 +83,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     // An operator start deliberately retries a failed policy after correcting its launch.
     restartCount: existing?.restartCount ?? 0,
     consecutiveFailures: 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, state as unknown as Record<string, unknown>);
   const policySnapshot = JSON.stringify(policy);
   const spawnParams = await buildManagedSpawnParamsAsync(policy, requestId, { createdBy: "managed-agent", authority: SYSTEM_LAUNCH });
@@ -93,7 +94,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     return error("managed policy start was superseded", 409);
   }
   if (hostSpawnsDrained(orch.agentId)) {
-    restoreDrainedSpawnReservation(policy, requestId, existing);
+    (await restoreDrainedSpawnReservation(policy, requestId, existing));
     return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
   }
   const command = await createCommandAsync({
@@ -131,7 +132,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     })
     : undefined;
   if (action === "restart" && hostSpawnsDrained(orch.agentId)) return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
-  const nextState = upsertManagedAgentState({
+  const nextState = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "stopping",
     agentId: state?.agentId,
@@ -143,7 +144,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     lastStopAt: Date.now(),
     restartCount: state?.restartCount ?? 0,
     consecutiveFailures: state?.consecutiveFailures ?? 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, nextState as unknown as Record<string, unknown>);
   const command = await createCommandAsync({
     type: action === "restart" ? "agent.restart" : "agent.shutdown",
@@ -209,7 +210,7 @@ export const putSpawnPolicyRoute: Handler = async (req, params) => {
     const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
     const entry = await setConfigAsync("spawn-policy", params.name!, value, updatedBy);
     emitConfigChanged(entry.namespace, entry.key, entry.version);
-    getLifecycleManager().onConfigChanged("spawn-policy", entry.key);
+    (await getLifecycleManager().onConfigChanged("spawn-policy", entry.key));
     return json(entry, entry.version === 1 ? 201 : 200);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/sse.ts

@@ -5,13 +5,13 @@ import { isOtherHumanSink } from "../message-visibility";
 import { canViewAgentRoute, error, type Handler } from "./_shared";
 import { messageViewerForRequest } from "./message-viewer";
 
-export const getEvents: Handler = (req) => {
+export const getEvents: Handler = async (req) => {
   const url = new URL(req.url);
   const agentId = url.searchParams.get("for") || null;
   const lastEventId = Number(req.headers.get("last-event-id") ?? "");
   // #3567 D6 — a signed-in human streams their own messages and notifications only.
   const viewer = messageViewerForRequest(req) ?? undefined;
-  if (agentId && isOtherHumanSink(viewer, agentId)) return authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream");
+  if (agentId && isOtherHumanSink(viewer, agentId)) return (await authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream"));
   if (agentId && !canViewAgentRoute(req, agentId)) return error("agent not found", 404);
   return createSSEStream(agentId, Number.isSafeInteger(lastEventId) && lastEventId > 0 ? lastEventId : 0,
     url.searchParams.get("agentStatus") === "delta", viewer);

package/src/routes/team-templates.ts

@@ -16,14 +16,14 @@ function slugParam(params: Record<string, string | undefined>): string {
   return cleanString(params.slug, "slug", { required: true, max: 120 })!;
 }
 
-export const getTeamTemplatesRoute: Handler = (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplatesRoute: Handler = async (req) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   return json({ templates: listTeamTemplates() });
 };
 
-export const getTeamTemplateRoute: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplateRoute: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const template = getTeamTemplate(slugParam(params));
@@ -34,7 +34,7 @@ export const getTeamTemplateRoute: Handler = (req, params) => {
 };
 
 export const postTeamTemplateRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -46,7 +46,7 @@ export const postTeamTemplateRoute: Handler = async (req) => {
 };
 
 export const putTeamTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -58,7 +58,7 @@ export const putTeamTemplateRoute: Handler = async (req, params) => {
 };
 
 export const deleteTeamTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const slug = slugParam(params);
   return json({ slug, deleted: await deleteTeamTemplateAsync(slug, updatedBy(req)) });

package/src/routes/teams.ts

@@ -43,9 +43,9 @@ export const getMyTeamRoute: Handler = (req) => {
 };
 
 // #3725 — a signed-in member lists the teams their agent scope can see; machine callers stay admin-only.
-export const getTeamsRoute: Handler = (req) => {
+export const getTeamsRoute: Handler = async (req) => {
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" }));
   if (denied) return denied;
   try {
     const status = optionalEnum(new URL(req.url).searchParams.get("status") ?? undefined, "status", TEAM_STATUSES) as Team["status"] | undefined;
@@ -67,7 +67,7 @@ export const getTeamsRoute: Handler = (req) => {
 };
 
 export const getTeamOutcomesRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const recentLimit = parseQueryInt(new URL(req.url).searchParams.get("recentLimit"), { min: 1, max: 50, clamp: true }) ?? undefined;
@@ -83,11 +83,11 @@ export const putMyTeamBriefRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(setCallerTeamBrief(authContextFromRequest(req), {
+    return json((await setCallerTeamBrief(authContextFromRequest(req), {
       title: cleanString(body.title, "title", { max: 240 }),
       brief: cleanString(body.brief, "brief", { max: 16_000 }),
       definitionOfDone: cleanString(body.definitionOfDone, "definitionOfDone", { max: 4000 }),
-    }));
+    })));
   } catch (err) {
     return routeError(err);
   }
@@ -98,28 +98,28 @@ export const postMyTeamDissolveRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
+    return json(await dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const postTeamDissolveByIdRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const id = params.id!;
     if (!getTeam(id)) return error("team not found", 404);
-    return json(dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
+    return json(await dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "teams:write" });
+  const denied = (await authorizeRoute(req, { scope: "teams:write" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -132,7 +132,7 @@ export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
 export const getTeamSpawnDelegationRoute: Handler = async (req, params) => {
   // #3725 — the grant names projects and launches across the tree; a member's session may not read it.
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" });
+  const denied = (await authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" }));
   if (denied) return denied;
   try {
     const state = await getTeamSpawnDelegation(authContextFromRequest(req), params.id!);

package/src/routes/tokens.ts

@@ -1,11 +1,12 @@
+import { upsertIntegrationRegistryAsync, upsertTokenProfileAsync, updateTokenProfileAsync, deleteTokenProfileAsync } from "../db/runtime-tail-async";
 // Auto-split from routes.ts (#299). Domain: tokens.
 import { revokeUserSession, sessionUserIdOf } from "../auth/session";
 import { withSessionCookie } from "../auth/session-cookie";
 import { APPROVAL_MODES, SPAWN_PROVIDERS, isRecord, userSinkId } from "@humwick/sdk";
-import { ValidationError, getOrchestrator, upsertIntegrationRegistry } from "../db";
+import { ValidationError, getOrchestrator } from "../db";
 import { auditEvent, authAuditMetadata, authorizeRoute, error, isRootCredentialRequest, json, parseBody, resolveActingUser, type Handler } from "./_shared";
 import { cleanString, cleanStringArray, cleanTokenConstraints, optionalEnum } from "../validation";
-import { deleteTokenProfile, getToken, getTokenProfile, listTokenProfiles, listTokens, updateTokenProfile, upsertTokenProfile } from "../token-db";
+import { getToken, getTokenProfile, listTokenProfiles, listTokens } from "../token-db";
 import { createTokenAsync, revokeTokenAsync } from "../token-db-write";
 import { getComponentAuth, getIntegrationAuth, isAuthorized } from "../security";
 import { handoffRunnerTokenAsync, issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken, type RunnerTokenMintRefusal } from "../runtime-tokens";
@@ -176,7 +177,7 @@ export const postRuntimeTokenRemint: Handler = async (req) => {
 export const postOrchestratorRunnerToken: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -219,7 +220,7 @@ export const postInteractiveRunnerRuntimeToken: Handler = async (req) => {
     // (`isRootCredentialRequest` above), which can mint any token it likes anyway — the value is
     // pinned into the signature so every LATER, scoped read of it is unforgeable.
     const approvalMode = optionalEnum(parsed.body.approvalMode, "approvalMode", APPROVAL_MODES);
-    const runtimeToken = issueInteractiveRunnerRuntimeToken({
+    const runtimeToken = (await issueInteractiveRunnerRuntimeToken({
       provider,
       cwd,
       runnerId,
@@ -228,7 +229,7 @@ export const postInteractiveRunnerRuntimeToken: Handler = async (req) => {
       host,
       ...(approvalMode ? { approvalMode } : {}),
       createdBy: `interactive:${runnerId}`,
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-interactive-" + runnerId + "-" + Date.now(),
       kind: "state",
@@ -263,13 +264,13 @@ export const postMcpRuntimeToken: Handler = async (req) => {
     const agentId = cleanString(parsed.body.agentId, "agentId", { max: 240 });
     const targets = cleanStringArray(parsed.body.targets, "targets", { itemMax: 80, maxItems: 50 });
     const channels = cleanStringArray(parsed.body.channels, "channels", { itemMax: 80, maxItems: 50 });
-    const runtimeToken = issueMcpRuntimeToken({
+    const runtimeToken = (await issueMcpRuntimeToken({
       sessionId,
       agentId,
       targets,
       channels,
       createdBy: `mcp:${sessionId}`,
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-mcp-" + sessionId + "-" + Date.now(),
       kind: "state",
@@ -302,19 +303,19 @@ export const postIntegrationRuntimeToken: Handler = async (req) => {
     const name = cleanString(parsed.body.name, "name", { required: true, max: 120 })!;
     const targets = cleanStringArray(parsed.body.targets, "targets", { itemMax: 80, maxItems: 50 });
     const channels = cleanStringArray(parsed.body.channels, "channels", { itemMax: 80, maxItems: 50 });
-    const runtimeToken = issueIntegrationRuntimeToken({
+    const runtimeToken = (await issueIntegrationRuntimeToken({
       name,
       targets,
       channels,
       createdBy: `integration:${name}`,
-    });
-    upsertIntegrationRegistry({
+    }));
+    (await upsertIntegrationRegistryAsync({
       name,
       scopes: runtimeToken.record.scope,
       targets,
       channels,
       source: "api",
-    });
+    }));
     await auditEvent({
       clientId: "server-runtime-token-integration-" + name + "-" + Date.now(),
       kind: "state",
@@ -344,7 +345,7 @@ export const postTokenProfile: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const input = cleanTokenProfileInput(parsed.body);
-    return json(upsertTokenProfile({
+    return json((await upsertTokenProfileAsync({
       id: input.id,
       name: input.name!,
       description: input.description,
@@ -353,7 +354,7 @@ export const postTokenProfile: Handler = async (req) => {
       constraints: input.constraints,
       ttlSeconds: input.ttlSeconds,
       createdBy: input.createdBy,
-    }), 201);
+    })), 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     if (e instanceof Error) return error(e.message, 400);
@@ -366,7 +367,7 @@ export const patchTokenProfile: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const patch = cleanTokenProfileInput(parsed.body, true);
-    const updated = updateTokenProfile(params.id!, {
+    const updated = (await updateTokenProfileAsync(params.id!, {
       name: patch.name,
       description: patch.description,
       role: patch.role,
@@ -374,7 +375,7 @@ export const patchTokenProfile: Handler = async (req, params) => {
       constraints: patch.constraints,
       ttlSeconds: patch.ttlSeconds,
       createdBy: patch.createdBy,
-    });
+    }));
     return updated ? json(updated) : error("token profile not found", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -383,8 +384,8 @@ export const patchTokenProfile: Handler = async (req, params) => {
   }
 };
 
-export const deleteTokenProfileRoute: Handler = (_req, params) => {
-  return deleteTokenProfile(params.id!) ? json({ ok: true }) : error("token profile not found or built-in", 404);
+export const deleteTokenProfileRoute: Handler = async (_req, params) => {
+  return (await deleteTokenProfileAsync(params.id!)) ? json({ ok: true }) : error("token profile not found or built-in", 404);
 };
 
 export const postTokenRevoke: Handler = async (req, params) => {