@humwick/server 0.130.2 → 0.130.4

package/src/routes/merges.ts

@@ -22,8 +22,8 @@ function actorFromRequest(req: Request): string {
     : "root";
 }
 
-export const getMergePauses: Handler = (req) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+export const getMergePauses: Handler = async (req) => {
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   return json({ pauses: listAutoMergePauses() });
 };
@@ -37,13 +37,13 @@ export const getMergePauses: Handler = (req) => {
  * indefinitely, and #2094's fast reclaim covers whatever the interlock misses.
  */
 export const getMergeDrain: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   return json(await workspaceMergeDrainStatusAsync());
 };
 
 export const postMergePause: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -54,7 +54,7 @@ export const postMergePause: Handler = async (req) => {
     const holder = cleanString(parsed.body.holder, "holder", { max: 240 }) ?? actorFromRequest(req);
     const reason = cleanString(parsed.body.reason, "reason", { max: 500 });
     const ttlMs = cleanTtlMs(parsed.body.ttlMs);
-    const result = pauseAutoMerge({ repoRoot, baseRef, holder, reason, ttlMs });
+    const result = (await pauseAutoMerge({ repoRoot, baseRef, holder, reason, ttlMs }));
     if (!result.ok) {
       return json({ error: "merge target already paused", pause: result.pause }, 409);
     }
@@ -66,7 +66,7 @@ export const postMergePause: Handler = async (req) => {
 };
 
 export const postMergePauseRenew: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -74,7 +74,7 @@ export const postMergePauseRenew: Handler = async (req) => {
     if (!isRecord(parsed.body)) return error("body required");
     const id = cleanString(parsed.body.id, "id", { required: true, max: 120 })!;
     const ttlMs = cleanTtlMs(parsed.body.ttlMs);
-    const pause = renewAutoMergePause(id, ttlMs);
+    const pause = (await renewAutoMergePause(id, ttlMs));
     return pause ? json({ pause }) : error("merge pause not found or expired", 404);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -83,7 +83,7 @@ export const postMergePauseRenew: Handler = async (req) => {
 };
 
 export const postMergePauseResume: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -93,7 +93,7 @@ export const postMergePauseResume: Handler = async (req) => {
     const repoRoot = cleanString(parsed.body.repoRoot, "repoRoot", { max: 1000 });
     const baseRef = cleanString(parsed.body.baseRef, "baseRef", { max: 240 });
     if (!id && !repoRoot) return error("id or repoRoot required", 400);
-    const released = resumeAutoMerge(id ? { id } : { repoRoot: repoRoot!, baseRef: baseRef ?? "main" });
+    const released = (await resumeAutoMerge(id ? { id } : { repoRoot: repoRoot!, baseRef: baseRef ?? "main" }));
     return json({ released });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -101,8 +101,8 @@ export const postMergePauseResume: Handler = async (req) => {
   }
 };
 
-export const getMergePauseById: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:read" });
+export const getMergePauseById: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "command:read" }));
   if (denied) return denied;
   const pause = getAutoMergePause(params.id!);
   return pause ? json(pause) : error("merge pause not found", 404);

package/src/routes/messages.ts

@@ -1,7 +1,8 @@
+import { sendMessageWithResultAsync, sendMessageAsync } from "../db/message-send";
 import { authorityDenied } from "../authority-audit";
 // Auto-split from routes.ts (#299). Domain: messages.
 import { MAX_BODY_BYTES } from "../config";
-import { ValidationError, applyMessageDeliveryActionAsync, claimMessageAsync, deleteMessageAsync, getAgent, getLatestMessageIdAsync, getMessage, getMessageAsync, getMessageDeliveryStatusAsync, getThreadAsync, listQueuedMessagesAsync, listRecentMessagesAsync, markReadAsync, pollMessagesAsync, recordMessageDeliveryAttemptAsync, renewMessageClaimAsync, sendMessage, sendMessageWithResult, setMessageReactionAsync } from "../db";
+import { ValidationError, applyMessageDeliveryActionAsync, claimMessageAsync, deleteMessageAsync, getAgent, getLatestMessageIdAsync, getMessage, getMessageAsync, getMessageDeliveryStatusAsync, getThreadAsync, listQueuedMessagesAsync, listRecentMessagesAsync, markReadAsync, pollMessagesAsync, recordMessageDeliveryAttemptAsync, renewMessageClaimAsync, setMessageReactionAsync, isChannelEgressTarget } from "../db";
 import { requestUserAddress, resolveActingUser, auditEvent, cleanAttachmentRefs, dispatchTaskCallbacksInBackground, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, parseQueryInt, reactionEmoji, sendReactionNotificationToAuthor, withPayloadAttachments, type Handler } from "./_shared";
 import { cleanMeta, cleanParams, cleanPositiveId, cleanString, optionalEnum } from "../validation";
 import { emitMessageClaimed, emitMessageDeleted, emitMessageDeliveryUpdated, emitMessageQueued, emitMessageReactionUpdated, emitNewMessage, emitTaskChanged } from "../sse";
@@ -12,12 +13,11 @@ import { authContextFromRequest } from "../services/auth-context";
 import { sendMessagesBatchService, sendMessageServiceAsync } from "../services/send-message";
 import { recordFanoutSuppression } from "../services/channel-suppression-receipt";
 import { fanOutToAgent } from "../services/agent-message-fanout";
-import { isChannelEgressTarget } from "../db";
 import { CHANNEL_SUPPRESSION_REASON, isDisallowedChannelContent } from "../db/channel-egress-allowlist.ts";
 import { settleParkedSelfResumeContinuation } from "../self-resume";
 import { AmbiguousTargetError, ServiceAuthError } from "../services/errors";
 import { reEvaluateChannelDelivery } from "../services/message-delivery-actions";
-import { isOtherHumanSink, messageVisibleTo } from "../message-visibility";
+import { isOtherHumanSink, messageVisibleTo, type MessageViewer } from "../message-visibility";
 import { messageViewerForRequest, visibleMessages } from "./message-viewer";
 import { type AgentSessionGuard, type Message, type PollQuery, type SendMessageInput } from "../types";
 
@@ -136,7 +136,7 @@ export const postMessageDeliveryAttempt: Handler = async (req, params) => {
     }, idempotencyKey);
     if (!result.ok) return error(result.error ?? "message not found", result.error === "message not found" ? 404 : 409);
     emitMessageDeliveryUpdated(result.message!);
-    if (status === "delivered") settleParkedSelfResumeContinuation(result.message!);
+    if (status === "delivered") (await settleParkedSelfResumeContinuation(result.message!));
     return json(await getMessageDeliveryStatusAsync(id), 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -222,13 +222,13 @@ export const postSystemBroadcast: Handler = async (req) => {
   const body = parsed.body;
   if (!body?.body) return error("body required");
   try {
-    const msg = sendMessage({
+    const msg = (await sendMessageAsync({
       from: "system",
       to: "broadcast",
       kind: "system",
       subject: body.subject ?? undefined,
       body: body.body,
-    });
+    }));
     emitNewMessage(msg);
     return json(msg, 201);
   } catch (e) {
@@ -351,7 +351,7 @@ export const getMessages: Handler = async (req) => {
   const channel = url.searchParams.get("channel") ?? undefined;
   // #3567 D6 — a non-admin reads only their own human sink; another human's inbox is a 403.
   const viewer = messageViewerForRequest(req);
-  if (forAgent && isOtherHumanSink(viewer, forAgent)) return authorityDenied(req, "you can only read your own messages", 403, forAgent, "read sink");
+  if (forAgent && isOtherHumanSink(viewer, forAgent)) return (await authorityDenied(req, "you can only read your own messages", 403, forAgent, "read sink"));
 
   // No agent filter — return all recent messages
   if (!forAgent) {
@@ -367,6 +367,12 @@ export const getMessages: Handler = async (req) => {
     channel,
     limit,
   };
+  return json(await pollAgentMessages(viewer, pollQuery));
+};
+
+/** Shared display/turn-delivery polling for GET messages and the liveness exchange (#3608). */
+export async function pollAgentMessages(viewer: MessageViewer | null, pollQuery: PollQuery): Promise<Message[]> {
+  const forAgent = pollQuery.for;
   //
   // #2335 (P1 privacy) — a poll whose `for` resolves to a channel-egress bridge is a DELIVERY poll by
   // construction: the only thing on the other end is a bridge about to forward what it receives into a
@@ -394,18 +400,18 @@ export const getMessages: Handler = async (req) => {
   // gets the COMPLETE set: `history` is still dashboard/thread-visible by definition, and this endpoint is
   // where the dashboard reads it. Suppressing there would evict it from the view (dashboard merge REPLACEs),
   // breaking the "no data loss" invariant — so the seam gates delivery, never display.
-  if (url.searchParams.get("delivery") !== "turn") return json(polled);
+  if (!pollQuery.turnDelivery) return polled;
   const delivered: Message[] = [];
   for (const msg of polled) fanOutToAgent(forAgent, msg, () => delivered.push(msg));
-  return json(delivered);
-};
+  return delivered;
+}
 
 export const getMessageById: Handler = async (req, params) => {
   const id = parseId(params.id);
   if (id === null) return error("invalid message id");
   const msg = await getMessageAsync(id);
   if (!msg) return error("message not found", 404);
-  return messageVisibleTo(messageViewerForRequest(req), msg) ? json(msg) : authorityDenied(req, "you can only read your own messages", 403, String(id), "read message");
+  return messageVisibleTo(messageViewerForRequest(req), msg) ? json(msg) : (await authorityDenied(req, "you can only read your own messages", 403, String(id), "read message"));
 };
 
 export const getMessageThread: Handler = async (req, params) => {
@@ -415,7 +421,7 @@ export const getMessageThread: Handler = async (req, params) => {
   if (!thread.length) return error("message not found", 404);
   const viewer = messageViewerForRequest(req);
   const root = thread.find((message) => message.id === id);
-  if (root && !messageVisibleTo(viewer, root)) return authorityDenied(req, "you can only read your own messages", 403, String(id), "read thread");
+  if (root && !messageVisibleTo(viewer, root)) return (await authorityDenied(req, "you can only read your own messages", 403, String(id), "read thread"));
   return json(visibleMessages(viewer, thread));
 };
 
@@ -537,7 +543,7 @@ function channelReactionActor(actorId: string): Record<string, unknown> {
   };
 }
 
-function sendOutboundChannelReaction(parent: Message, actorId: string, emoji: string): void {
+async function sendOutboundChannelReaction(parent: Message, actorId: string, emoji: string): Promise<void> {
   if (!parent.channel) return;
   const target = telegramTargetFromMessage(parent);
   if (!target) return;
@@ -545,7 +551,7 @@ function sendOutboundChannelReaction(parent: Message, actorId: string, emoji: st
   const accountId = target.accountId ?? cleanString(payloadChannel.accountId, "payload.channel.accountId", { max: 200 }) ?? "default";
   const conversation = isRecord(parent.payload?.conversation) ? parent.payload.conversation : undefined;
   const now = Date.now();
-  const result = sendMessageWithResult({
+  const result = (await sendMessageWithResultAsync({
     from: actorId,
     to: parent.channel,
     kind: "channel.event",
@@ -580,7 +586,7 @@ function sendOutboundChannelReaction(parent: Message, actorId: string, emoji: st
         },
       },
     },
-  });
+  }));
   if (result.created) {
     if (result.message.deliveryStatus === "queued") emitMessageQueued(result.message);
     else emitNewMessage(result.message);
@@ -601,8 +607,8 @@ export const postMessageReaction: Handler = async (req, params) => {
     const result = await setMessageReactionAsync({ messageId: id, actorId, emoji, action });
     if (!result.ok) return error(result.error, result.error === "message not found" ? 404 : 400);
     emitMessageReactionUpdated(result.message);
-    if (action === "add") sendOutboundChannelReaction(result.message, actorId, emoji);
-    sendReactionNotificationToAuthor(result.message, actorId, emoji, action);
+    if (action === "add") (await sendOutboundChannelReaction(result.message, actorId, emoji));
+    (await sendReactionNotificationToAuthor(result.message, actorId, emoji, action));
     return json(result.message);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/orchestrator-bootstrap.ts

@@ -61,6 +61,8 @@ export const postOrchestratorBootstrap: Handler = async (req) => {
       version,
       pathPrefix: pathPrefix ?? [],
       token: bootstrapToken.record,
+      // The single-use credential itself, for a caller that runs `orchestrator install` without the shell command (`humwick init`, #2680).
+      bootstrapToken: bootstrapToken.token,
       expiresAt: bootstrapToken.record.expiresAt,
     }, 201);
   } catch (e) {
@@ -76,7 +78,7 @@ export const postOrchestratorBootstrapExchange: Handler = async (req) => {
     if (!isRecord(parsed.body)) return error("body required");
     const id = cleanString(parsed.body.id, "id", { required: true, max: 120 })!;
     const baseDir = cleanString(parsed.body.baseDir, "baseDir", { required: true, max: 500 })!;
-    const denied = authorizeRoute(req, { scope: "token:write", resource: { orchestratorId: id } });
+    const denied = (await authorizeRoute(req, { scope: "token:write", resource: { orchestratorId: id } }));
     if (denied) return denied;
     const auth = getComponentAuth(req);
     if (!auth || auth.role !== "orchestrator-bootstrap") return error("bootstrap token required", 403);

package/src/routes/orchestrator-host-registration.ts

@@ -8,6 +8,7 @@ import { conflictingHardwareFields, upsertHostFromRegistrationAsync, type HostRe
 import { auditEvent, cleanSafeNumber } from "./_shared";
 import { recordOrchestratorUtilization } from "./orchestrator-host-utilization";
 import { cleanString } from "../validation";
+import { reportRuntimeDependencyFailure } from "../services/runtime-dependency-alert";
 
 // The machine fingerprint an orchestrator reports at registration (§3.5). Lenient/observability-grade
 // like `cleanQueuedSpawns`: a malformed blob yields `undefined` (treated as "no fingerprint", never a
@@ -118,6 +119,7 @@ export async function linkOrchestratorHost(orchestratorId: string, hostname: str
     const result = await upsertHostFromRegistrationAsync({ orchestratorId, hostname, hardware });
     await emitHostRegistrationEvents(result.events);
     await recordOrchestratorUtilization(orchestratorId, result.host.id, body);
+    await reportRuntimeDependencyFailure(result.host.id, hostname, body);
   } catch (err) {
     // Additive over the orchestrator row; log so it is visible, then let the heartbeat path retry.
     console.warn(`[relay] host registration for orchestrator ${orchestratorId} (${hostname}) failed; will self-heal on next heartbeat:`, err);

package/src/routes/orchestrator-host-utilization.ts

@@ -247,11 +247,11 @@ export async function recordOrchestratorUtilization(
   const sample = cleanHostUtilizationSample(raw, now);
   if (!sample) return false;
   const gateArming = cleanGateArming(isRecord(body) ? body.gateArming : undefined, now);
-  return recordHostUtilization({
+  return (await recordHostUtilization({
     hostId,
     orchestratorId,
     machine: { ...toMachineSample(sample), ...(gateArming ? { gateArming } : {}) },
     daemon: toDaemonSample(sample),
     now,
-  });
+  }));
 }

package/src/routes/orchestrator-proxy.ts

@@ -153,8 +153,8 @@ export const getOrchestratorSessions: Handler = (req, params) => proxyOrchestrat
 
 export const getOrchestratorVersion: Handler = (req, params) => proxyOrchestratorGet(req, params.id!, "/api/version");
 
-export const getOrchestratorLogs: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "logs:read", resource: { orchestratorId: params.id!, logsRead: true } });
+export const getOrchestratorLogs: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "logs:read", resource: { orchestratorId: params.id!, logsRead: true } }));
   return denied ?? proxyOrchestratorGet(req, params.id!, `/api/logs/${encodeURIComponent(params.session!)}`);
 };
 

package/src/routes/orchestrator.ts

@@ -1,3 +1,4 @@
+import { deleteOrchestratorAsync } from "../db/runtime-tail-async";
 import { cleanBrowserInventory, reconcileBrowserInventory } from "../services/browser-inventory";
 // Auto-split from routes.ts (#299). Domain: orchestrator.
 import { APPROVAL_MODES, SPAWN_PROVIDERS, VALID_WORKSPACE_MODES, fireAndForget, isRecord } from "@humwick/sdk";
@@ -6,7 +7,7 @@ import { CONTRACT_VERSIONS, parseRuntimeCapabilities, parseRuntimeContracts, par
 import { notifyAgentOffline, notifyAgentSpawnQueued } from "../agent-lifecycle-events";
 import { diagnoseReportedExit } from "../services/reported-exit-death";
 import { VERSION } from "../config";
-import { ValidationError, deleteOrchestrator, effectiveProviderCatalogListAsync, getAgent, getOrchestrator, getOrchestratorAsync, listOrchestrators, listOrchestratorsAsync, orchestratorHeartbeatAsync, recordAgentExitDiagnosticsAsync, reportOrchestratorRosterAsync, setOrchestratorUpgradeStateAsync, upsertOrchestratorAsync } from "../db";
+import { ValidationError, effectiveProviderCatalogListAsync, getAgent, getOrchestrator, getOrchestratorAsync, listOrchestrators, listOrchestratorsAsync, orchestratorHeartbeatAsync, recordAgentExitDiagnosticsAsync, reportOrchestratorRosterAsync, setOrchestratorUpgradeStateAsync, upsertOrchestratorAsync } from "../db";
 import { reconcileOrchestratorSchedulerCommands } from "../services/scheduler-recovery.ts";
 import { recoverRegisteredOrchestrator } from "../services/orchestrator-registration-recovery";
 import { recoverOrchestratorLegacyLandings } from "../services/orchestrator-landing-recovery";
@@ -24,10 +25,9 @@ import { serializeCommandForRead } from "../services/dispatch-command";
 import { isOrchestratorRegistrationAuthorized } from "../security";
 import { isOrchestratorSelfReportAuthorized } from "../orchestrator-self-report-authz";
 import { getHostProviderSetting } from "../host-provider-store";
-import { hostDisabledFromValue } from "../host-provider-enablement";
+import { hostDisabledFromValue, isHostSwitchableProvider } from "../host-provider-enablement";
 import { seedHostProviders } from "../services/host-providers";
-import { isHostSwitchableProvider } from "../host-provider-enablement";
-import { type ManagedAgent, type ManagedSessionExitDiagnostics, type OrchestratorRuntimeInput, type QueuedSpawn, type RegisterOrchestratorInput, type SpawnApprovalMode, type SpawnProvider } from "../types";
+import { type ManagedAgent, type ManagedSessionExitDiagnostics, type Orchestrator, type OrchestratorRuntimeInput, type QueuedSpawn, type RegisterOrchestratorInput, type SpawnApprovalMode, type SpawnProvider } from "../types";
 import { restartSpawnParamsForAgentAsync } from "../services/restart-spawn";
 import { cleanProjectToolchain } from "../project-toolchain";
 import { cleanHostTools } from "../host-tools";
@@ -215,8 +215,17 @@ function orchestratorSelfReportDenied(req: Request, orchestratorId: string): Res
   return error("forbidden: only the orchestrator itself may report its host state", 403);
 }
 
+// #2410 — the list is polled by every open dashboard and the per-host `providerCatalog` (a
+// deprecated host snapshot, stored in the row and again in `meta`) was ~85% of a 515 KB response
+// nothing reads: the hub owns the model catalog. It stays on the row (`GET /:id`) and in the DB.
+function withoutHostCatalog(orch: Orchestrator): Orchestrator {
+  const { providerCatalog: _snapshot, ...row } = orch;
+  const { providerCatalog: _metaSnapshot, ...meta } = orch.meta;
+  return { ...row, meta };
+}
+
 export const getOrchestrators: Handler = async () => {
-  return json(await listOrchestratorsAsync());
+  return json((await listOrchestratorsAsync()).map(withoutHostCatalog));
 };
 
 export const getOrchestratorById: Handler = async (_req, params) => {
@@ -239,7 +248,7 @@ export const postOrchestratorHeartbeat: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: params.id! } });
+    const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: params.id! } }));
     if (denied) return denied;
     // #1797 round 2 (F1) — same self-report claim as the roster PATCH: this writes the host's
     // reported version/providers/capabilities, which the upgrade reconcile then acts on.
@@ -292,7 +301,7 @@ export const patchOrchestratorAgents: Handler = async (req, params) => {
   try {
     const orch = getOrchestrator(params.id!);
     if (!orch) return error("orchestrator not found", 404);
-    const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+    const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
     if (denied) return denied;
     // #1797 round 2 (F1) — this roster IS the input to the managed-state reconcile; the scope +
     // resource check above cannot establish that the caller IS this orchestrator. See the helper.
@@ -344,7 +353,7 @@ export const patchOrchestratorAgents: Handler = async (req, params) => {
     if (queuedSpawns) {
       for (const queued of queuedSpawns) {
         if (!queued.spawnedBy) continue;
-        notifyAgentSpawnQueued({
+        await notifyAgentSpawnQueued({
           parent: queued.spawnedBy,
           spawnRequestId: queued.spawnRequestId,
           provider: queued.provider,
@@ -357,7 +366,7 @@ export const patchOrchestratorAgents: Handler = async (req, params) => {
     // between the ack and this call, so reconciles still run in request order. Running it after
     // the exit-audit loop below (which awaits the async gateway per exited agent) let a stale,
     // superseded roster from a slow request land AFTER a newer report's reconcile and overwrite it.
-    getLifecycleManager().onOrchestratorManagedAgentsReported(params.id!, cleaned, exitedAgents);
+    (await getLifecycleManager().onOrchestratorManagedAgentsReported(params.id!, cleaned, exitedAgents));
     for (const exited of exitedAgents) {
       const agent = await recordAgentExitDiagnosticsAsync(exited.agentId, exited);
       if (agent) {
@@ -370,7 +379,7 @@ export const patchOrchestratorAgents: Handler = async (req, params) => {
         // #636 — classify the death from the captured exit diagnostics + agent state and ride the
         // verdict on the terminal event (also persisted as a crash report inside notifyAgentOffline).
         // Exit diagnostics remain on replay; the shared generation ledger dedups the parent notice.
-        notifyAgentOffline(exited.agentId, exitReason(exited), diagnoseReportedExit(agent, exitReason(exited), exited));
+        (await notifyAgentOffline(exited.agentId, exitReason(exited), diagnoseReportedExit(agent, exitReason(exited), exited)));
       }
       await auditEvent({
         clientId: [
@@ -550,9 +559,9 @@ export const postOrchestratorAction: Handler = async (req, params) => {
     if (action === "migrate-provider-config") {
       // #1259 — fleet-wide host action: a command:fleet-scoped token may cross its own
       // cwd/orchestrator sandbox pin for this action only.
-      const denied = authorizeFleetRoute(req, { orchestratorId: orch.id });
+      const denied = (await authorizeFleetRoute(req, { orchestratorId: orch.id }));
       if (denied) return denied;
-      const command = dispatchProviderConfigMigration(orch, "dashboard");
+      const command = (await dispatchProviderConfigMigration(orch, "dashboard"));
       if (!command) return error(`orchestrator ${orch.id} does not support provider-config migration; upgrade it first`, 409);
       await auditEvent({
         clientId: `server-orchestrator-migrate-provider-config-${orch.id}-${command.id}`,
@@ -570,7 +579,7 @@ export const postOrchestratorAction: Handler = async (req, params) => {
     if (action === "upgrade") {
       // #1259 — fleet-wide host action: a command:fleet-scoped token may cross its own
       // cwd/orchestrator sandbox pin for this action only.
-      const denied = authorizeFleetRoute(req, { orchestratorId: orch.id });
+      const denied = (await authorizeFleetRoute(req, { orchestratorId: orch.id }));
       if (denied) return denied;
       const targetVersion = cleanString(parsed.body.targetVersion, "targetVersion", { max: 80 }) ?? VERSION;
       if (!ORCH_UPGRADE_SEMVER_RE.test(targetVersion)) return error("targetVersion must be a semver like 0.10.20");
@@ -657,8 +666,8 @@ export const postOrchestratorAction: Handler = async (req, params) => {
     // command:fleet; "shutdown" is NOT in that enumeration and stays on the constrained path.
     const resource = { orchestratorId: orch.id, agentId, policyName, spawnRequestId };
     const denied = action === "restart"
-      ? authorizeFleetRoute(req, resource)
-      : authorizeRoute(req, { scope: "command:write", resource });
+      ? (await authorizeFleetRoute(req, resource))
+      : (await authorizeRoute(req, { scope: "command:write", resource }));
     if (denied) return denied;
     const agent = action === "restart" && agentId ? getAgent(agentId) : undefined;
     const restartSpawn = agent ? await restartSpawnParamsForAgentAsync(agent, orch, policyName, spawnRequestId) : undefined;
@@ -690,10 +699,10 @@ export const postOrchestratorAction: Handler = async (req, params) => {
   }
 };
 
-export const deleteOrchestratorById: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin", resource: { orchestratorId: params.id! } });
+export const deleteOrchestratorById: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin", resource: { orchestratorId: params.id! } }));
   if (denied) return denied;
-  const deleted = deleteOrchestrator(params.id!);
+  const deleted = (await deleteOrchestratorAsync(params.id!));
   if (!deleted) return error("orchestrator not found", 404);
   return json({ ok: true });
 };

package/src/routes/pairs.ts

@@ -1,6 +1,7 @@
+import { sendPairMessageAsync, rejectPairAsync, endPairAsync, createPairAsync, acceptPairAsync, getPairAsync, listPairsAsync } from "../db/pairs-async";
 // Auto-split from routes.ts (#299). Domain: pairs.
 import { MAX_BODY_BYTES } from "../config";
-import { ValidationError, acceptPair, createPair, endPair, getPair, listAgents, listPairs, rejectPair, sendPairMessage } from "../db";
+import { ValidationError, getPair, listAgents, listPairs } from "../db";
 import { resolveCallerAgentId } from "../agent-ref";
 import { getComponentAuth, hasComponentScope } from "../security";
 import { auditEvent, authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
@@ -59,7 +60,7 @@ export const postPair: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const result = createPair(normalizeCreatePairInput(parsed.body));
+    const result = (await createPairAsync(normalizeCreatePairInput(parsed.body)));
     if (!result.ok) return pairError(result);
     emitNewMessage(result.invite);
     await auditEvent({
@@ -96,7 +97,7 @@ export const getPairs: Handler = async (req) => {
     ? resolveCallerAgentId(component.constraints, listAgents)
     : undefined;
   if (!(agentId && callerAgentId === agentId && component && hasComponentScope(component, "agent:read"))) {
-    const denied = authorizeRoute(req, { scope: "pairs:read" });
+    const denied = (await authorizeRoute(req, { scope: "pairs:read" }));
     if (denied) return denied;
   }
 
@@ -115,7 +116,7 @@ export const postAcceptPair: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const result = acceptPair(params.id!, normalizePairActionInput(parsed.body));
+    const result = (await acceptPairAsync(params.id!, normalizePairActionInput(parsed.body)));
     if (!result.ok) return pairError(result);
     for (const notice of result.notices) emitNewMessage(notice);
     await auditEvent({
@@ -140,7 +141,7 @@ export const postRejectPair: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const result = rejectPair(params.id!, normalizePairActionInput(parsed.body));
+    const result = (await rejectPairAsync(params.id!, normalizePairActionInput(parsed.body)));
     if (!result.ok) return pairError(result);
     emitNewMessage(result.notice);
     await auditEvent({
@@ -165,7 +166,7 @@ export const postHangupPair: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const result = endPair(params.id!, normalizePairActionInput(parsed.body));
+    const result = (await endPairAsync(params.id!, normalizePairActionInput(parsed.body)));
     if (!result.ok) return pairError(result);
     if (result.notice) emitNewMessage(result.notice);
     await auditEvent({
@@ -190,7 +191,7 @@ export const postPairMessage: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    const result = sendPairMessage(params.id!, normalizePairMessageInput(parsed.body));
+    const result = (await sendPairMessageAsync(params.id!, normalizePairMessageInput(parsed.body)));
     if (!result.ok) return pairError(result);
     emitNewMessage(result.message);
     await auditEvent({
@@ -211,4 +212,3 @@ export const postPairMessage: Handler = async (req, params) => {
     throw e;
   }
 };
-import { getPairAsync, listPairsAsync } from "../db/pairs-async";

package/src/routes/project-profile-instructions.ts

@@ -6,7 +6,7 @@ import { PromptVersionConflictError } from "../prompt-version-errors";
 import { listProjectProfileInstructions, mutateProjectProfileInstructions, projectProfileInstructionHistory, readProjectProfileInstructions } from "../services/project-profile-instructions";
 
 export const projectProfileInstructionsRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: req.method === "GET" ? "agent:read" : "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: req.method === "GET" ? "agent:read" : "agent:write" }));
   if (denied) return denied;
   try {
     const projectId = cleanString(params.id, "projectId", { max: 200 });

package/src/routes/project-trust.ts

@@ -32,7 +32,7 @@ export const postProjectTrustApproveRoute: Handler = async (req, params) => {
     const mode = optionalEnum(body.mode, "mode", ["fingerprint", "commit"] as const);
     if (mode && !approvedValue.startsWith(mode === "commit" ? "commit:" : "sha256:")) return error(`approved value must be prefixed "${mode === "commit" ? "commit:" : "sha256:"}" for ${mode} review`, 400);
 
-    const approval = approveProfileProjectTrust({ name, capability, repoKey, value: approvedValue, by: requestUserAddress(req) });
+    const approval = (await approveProfileProjectTrust({ name, capability, repoKey, value: approvedValue, by: requestUserAddress(req) }));
     await auditEvent({
       kind: "state",
       title: `Project trust approved: ${name} / ${capability}`,

package/src/routes/projects.ts

@@ -1,4 +1,4 @@
-import { getProjectEntry, getProjectEntryChain, listProjectsAsync, resolveProjectAsync, resolveProjectEntriesAsync, retractProjectEntry, rootsForProjectAsync, searchProjectEntriesAsync, writeProjectEntry, ValidationError } from "../db";
+import { getProjectEntryAsync, getProjectEntryChainAsync, listProjectsAsync, resolveProjectAsync, resolveProjectEntriesAsync, retractProjectEntryAsync, rootsForProjectAsync, searchProjectEntriesAsync, writeProjectEntryAsync, ValidationError } from "../db";
 import { resolveProjectForCanonicalCwdAsync } from "../services/project";
 import { authContextFromRequest } from "../services/auth-context";
 import { callerProfile, resolveAgentWriteInject } from "../services/memory-identity";
@@ -14,7 +14,7 @@ import { PROJECT_ENTRY_INJECT_TIERS, PROJECT_ENTRY_KINDS, type ProjectEntry, typ
 //
 // #1940 Part 2 — manual/promoted entry CRUD from the dashboard. Mutations are thin wrappers
 // around the SAME db functions the audited `relay_project_write_entry`/`relay_project_retract`
-// MCP tools call (writeProjectEntry/retractProjectEntry, src/db/project-entries.ts) — one
+// MCP tools call (writeProjectEntryAsync/retractProjectEntryAsync, src/db/project-entries.ts) — one
 // write path for both surfaces, never a direct/duplicated DB write here. `ingested` entries
 // are refused because the CLAUDE.md ingest pipeline owns them. `steward` entries remain
 // operator-curatable: an edit adopts the replacement as `manual` input for a later sweep.
@@ -103,12 +103,12 @@ export const getProjectResolveRoute: Handler = async (req) => {
   }
 };
 
-export const getProjectEntryRoute: Handler = (req, params) => {
+export const getProjectEntryRoute: Handler = async (req, params) => {
   try {
     const id = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const entry = getProjectEntry(id);
+    const entry = await getProjectEntryAsync(id);
     if (!entry) return error("project entry not found", 404);
-    return json({ entry, chain: getProjectEntryChain(id) });
+    return json({ entry, chain: await getProjectEntryChainAsync(id) });
   } catch (err) {
     return error(err instanceof Error ? err.message : "projects route failed");
   }
@@ -130,8 +130,8 @@ function cleanAudience(value: unknown): ProjectEntryAudience | undefined {
 
 // Historical steward entries retain the same curation rights as manual entries (#3456).
 // Only the current active version is editable, preserving supersession and retraction.
-function loadEditableEntry(projectId: string, entryId: string): { entry: ProjectEntry } | { errorResponse: Response } {
-  const entry = getProjectEntry(entryId);
+async function loadEditableEntry(projectId: string, entryId: string): Promise<{ entry: ProjectEntry } | { errorResponse: Response }> {
+  const entry = await getProjectEntryAsync(entryId);
   if (!entry || entry.projectId !== projectId) return { errorResponse: error("project entry not found", 404) };
   if (!isEditableSource(entry.source)) {
     return { errorResponse: error(`${entry.source} entries are owned by the ingest pipeline and cannot be edited or removed here`, 409) };
@@ -170,7 +170,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
     // Use the same caller placement as MCP writes; dashboard callers fall back to project roots.
     // Areas stay optional because the dashboard has no areas input yet.
     const areas = await resolveWriteAreas(project, areaCallerFromCtx(authContextFromRequest(req)), parsed.body.areas, { requireDeclared: false });
-    const entry = writeProjectEntry({
+    const entry = await writeProjectEntryAsync({
       projectId: project.id,
       authorId: requestUserAddress(req),
       kind,
@@ -188,7 +188,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
       agentId: entry.authorId,
       metadata: projectEntryAuditMetadata(req, "relay_project_write_entry", project.id, entry.id),
     });
-    return json({ entry, ...(tier.note ? { injectNote: tier.note } : {}), ...areaDeliveryReport(entry) }, 201);
+    return json({ entry, ...(tier.note ? { injectNote: tier.note } : {}), ...await areaDeliveryReport(entry) }, 201);
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);
     return error(err instanceof Error ? err.message : "projects route failed");
@@ -196,7 +196,7 @@ export const postProjectEntryRoute: Handler = async (req, params) => {
 };
 
 // PATCH /api/projects/:id/entries/:entryId — Edit (#1940 Part 2). There is no in-place UPDATE
-// in the ledger (writeProjectEntry only inserts); an edit is a new entry that `supersedes` the
+// in the ledger (writeProjectEntryAsync only inserts); an edit is a new entry that `supersedes` the
 // old one — the exact mechanism relay_project_write_entry's `supersedes` param already gives
 // agents. Omitted fields fall back to the current entry's value (a partial patch, not a
 // full-replace); an explicit `null` for `body` clears it.
@@ -206,7 +206,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
     const project = await resolveProjectAsync(ref);
     if (!project) return error("project not found", 404);
     const entryId = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const loaded = loadEditableEntry(project.id, entryId);
+    const loaded = await loadEditableEntry(project.id, entryId);
     if ("errorResponse" in loaded) return loaded.errorResponse;
     const { entry } = loaded;
 
@@ -234,7 +234,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
     );
     const areas = await resolveWriteAreas(project, areaCallerFromCtx(authContextFromRequest(req)), body.areas, { prior: entry.areas, requireDeclared: false });
 
-    const updated = writeProjectEntry({
+    const updated = await writeProjectEntryAsync({
       projectId: project.id,
       authorId: requestUserAddress(req),
       kind,
@@ -250,7 +250,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
       source: entry.source === "steward" ? "manual" : entry.source,
       originRef: entry.originRef,
       sensitivity: entry.sensitivity,
-      // Carry a POSITIVE prior TTL only: writeProjectEntry rejects invalid epochs, so a corrupt
+      // Carry a POSITIVE prior TTL only: writeProjectEntryAsync rejects invalid epochs, so a corrupt
       // legacy value cannot turn a partial dashboard edit into a failed adoption.
       ...(entry.expiresAt !== undefined && entry.expiresAt > 0 ? { expiresAt: entry.expiresAt } : {}),
     });
@@ -261,7 +261,7 @@ export const patchProjectEntryRoute: Handler = async (req, params) => {
       agentId: updated.authorId,
       metadata: projectEntryAuditMetadata(req, "relay_project_write_entry", project.id, updated.id, { supersedes: entry.id }),
     });
-    return json({ entry: updated, ...(tier.note ? { injectNote: tier.note } : {}), ...areaDeliveryReport(updated) });
+    return json({ entry: updated, ...(tier.note ? { injectNote: tier.note } : {}), ...await areaDeliveryReport(updated) });
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);
     return error(err instanceof Error ? err.message : "projects route failed");
@@ -276,10 +276,10 @@ export const deleteProjectEntryRoute: Handler = async (req, params) => {
     const project = await resolveProjectAsync(ref);
     if (!project) return error("project not found", 404);
     const entryId = cleanString(params.entryId, "entryId", { required: true, max: 120 })!;
-    const loaded = loadEditableEntry(project.id, entryId);
+    const loaded = await loadEditableEntry(project.id, entryId);
     if ("errorResponse" in loaded) return loaded.errorResponse;
 
-    const retracted = retractProjectEntry(entryId);
+    const retracted = await retractProjectEntryAsync(entryId);
     if (!retracted) return error("project entry not found", 404);
     await auditEvent({
       kind: "state",