@camstack/system 1.2.118 → 1.2.120

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-C2_1HCpW.js");
+const require_dist = require("./dist-CX9qXYC4.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -25,7 +25,7 @@ const require_builtins_system_config_system_config_addon = require("./builtins/s
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CwBbX4Ut.js");
+const require_manifest_python_deps = require("./manifest-python-deps-76dZLxD0.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_lan_http_bind = require("./lan-http-bind-DmgpFP6_.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
@@ -2611,7 +2611,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -2709,9 +2709,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$1(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$2(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -2861,7 +2861,7 @@ var AddonLoader = class {
 		}
 		if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$1(modUnknown) ? modUnknown : {};
+		const mod = isRecord$2(modUnknown) ? modUnknown : {};
 		const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -2877,7 +2877,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$1(modUnknown) ? modUnknown : {};
+		const mod = isRecord$2(modUnknown) ? modUnknown : {};
 		const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -6646,6 +6646,145 @@ function isInfraCapability(name) {
 	return infraNames.has(name);
 }
 //#endregion
+//#region src/kernel/isolated-builtin-phase.ts
+var INFRA_NAMES = new Set(INFRA_CAPABILITIES.map((c) => c.name));
+function isolatedBuiltinPhase(capabilities) {
+	return capabilities.some((c) => INFRA_NAMES.has(c.name)) ? "infra" : "consumer";
+}
+function partitionIsolatedBuiltinIds(ids, capabilitiesOf) {
+	const infra = [];
+	const consumers = [];
+	for (const id of ids) if (isolatedBuiltinPhase(capabilitiesOf(id)) === "infra") infra.push(id);
+	else consumers.push(id);
+	return {
+		infra,
+		consumers
+	};
+}
+/**
+* Spawn of an infra isolate returns when the child process exists, not when
+* its UDS handshake has put the engine in the parent's `getCollection`.
+* In-process builtins that read the door before that handshake throw D44
+* ("nothing behind it") and are skipped for the rest of the boot.
+*/
+async function waitUntilReady(isReady, options) {
+	const deadline = Date.now() + options.timeoutMs;
+	for (;;) {
+		if (isReady()) return;
+		if (Date.now() >= deadline) throw new Error(`Timed out waiting for ${options.what}`);
+		await new Promise((resolve) => {
+			setTimeout(resolve, options.intervalMs);
+		});
+	}
+}
+//#endregion
+//#region src/kernel/settings-door-view.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asBlob(value) {
+	return isRecord$1(value) ? value : {};
+}
+function unwrapValue(parsed) {
+	if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
+	return parsed.value;
+}
+async function loadPrefixed(door, collection, prefix) {
+	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+	const rows = await door.query({
+		collection,
+		...range !== null ? { filter: { whereBetween: { id: [range.lo, range.hi] } } } : {}
+	});
+	const result = {};
+	for (const row of rows) {
+		if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+		if (!row.id.startsWith(prefix)) continue;
+		result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+	}
+	return result;
+}
+async function replacePrefixed(door, collection, prefix, values, wrap) {
+	const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(prefix);
+	if (range !== null) await door.deleteWhere({
+		collection,
+		filter: { whereBetween: { id: [range.lo, range.hi] } }
+	});
+	for (const [key, value] of Object.entries(values)) {
+		if (value === void 0) continue;
+		await door.set({
+			collection,
+			key: `${prefix}${key}`,
+			value: wrap(key, value)
+		});
+	}
+}
+function createDoorSettingsView(addonId, door, sections) {
+	const addonPrefix = `${addonId}.`;
+	return {
+		async readAddonStore() {
+			return loadPrefixed(door, "addon-settings", addonPrefix);
+		},
+		async writeAddonStore(patch) {
+			await replacePrefixed(door, "addon-settings", addonPrefix, {
+				...await loadPrefixed(door, "addon-settings", addonPrefix),
+				...patch
+			}, (key, value) => ({
+				addonId,
+				key,
+				value
+			}));
+		},
+		async readDeviceStore(deviceId) {
+			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
+		},
+		async writeDeviceStore(deviceId, patch) {
+			const scope = `${addonId}:${String(deviceId)}.`;
+			await replacePrefixed(door, "addon-device-settings", scope, {
+				...await loadPrefixed(door, "addon-device-settings", scope),
+				...patch
+			}, (key, value) => ({
+				addonId,
+				deviceId: String(deviceId),
+				key,
+				value
+			}));
+		},
+		async clearDeviceStore(deviceId) {
+			const range = require_builtins_sqlite_storage_sqlite_settings_addon.prefixRange(`${addonId}:${String(deviceId)}.`);
+			if (range === null) return;
+			await door.deleteWhere({
+				collection: "addon-device-settings",
+				filter: { whereBetween: { id: [range.lo, range.hi] } }
+			});
+		},
+		async readDeviceRuntimeState(deviceId) {
+			return asBlob(await door.get({
+				collection: "device-runtime-state",
+				key: String(deviceId)
+			}));
+		},
+		async writeDeviceRuntimeState(deviceId, data) {
+			await door.set({
+				collection: "device-runtime-state",
+				key: String(deviceId),
+				value: data
+			});
+		},
+		async clearDeviceRuntimeState(deviceId) {
+			await door.delete({
+				collection: "device-runtime-state",
+				key: String(deviceId)
+			});
+		},
+		async getSection(section) {
+			return sections.getSection(section);
+		},
+		async setSection(section, patch) {
+			await sections.setSection(section, patch);
+		}
+	};
+}
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -9115,6 +9254,7 @@ var ConfigManager = class ConfigManager {
 	configPath;
 	bootstrapConfig;
 	settingsStore = null;
+	settingsDoor = null;
 	runtimeState;
 	runtimeStatePath;
 	constructor(configPath) {
@@ -9135,6 +9275,14 @@ var ConfigManager = class ConfigManager {
 	setSettingsStore(store) {
 		this.settingsStore = store;
 	}
+	/**
+	* Wire the async `settings-store` door. Used when the engine is isolated
+	* (no sync `ISettingsStore` handle on hub-main). {@link createSettingsView}
+	* prefers the sync store when both are present.
+	*/
+	setSettingsDoor(door) {
+		this.settingsDoor = door;
+	}
 	get(configPath) {
 		return this.resolveConfigValue(configPath);
 	}
@@ -9155,8 +9303,21 @@ var ConfigManager = class ConfigManager {
 	* Throws if the settings store is not yet wired.
 	*/
 	set(key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setSystem(key, value);
+		if (this.settingsStore !== null) {
+			this.settingsStore.setSystem(key, value);
+			return;
+		}
+		if (this.settingsDoor !== null) {
+			this.settingsDoor.set({
+				collection: "system-settings",
+				key,
+				value
+			}).catch((err) => {
+				console.error("[ConfigManager] isolated settings-store write failed", err);
+			});
+			return;
+		}
+		throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 	}
 	/**
 	* Bulk-read all keys that belong to a logical section.
@@ -9277,6 +9438,19 @@ var ConfigManager = class ConfigManager {
 		this.settingsStore.clearDeviceRuntimeState(deviceId);
 	}
 	createSettingsView(addonId) {
+		if (this.settingsStore === null && this.settingsDoor !== null) {
+			const door = this.settingsDoor;
+			return createDoorSettingsView(addonId, door, {
+				getSection: (section) => this.getSection(section),
+				setSection: async (section, patch) => {
+					for (const [key, value] of Object.entries(patch)) await door.set({
+						collection: "system-settings",
+						key: `${section}.${key}`,
+						value
+					});
+				}
+			});
+		}
 		const cm = this;
 		return {
 			async readAddonStore() {
@@ -94992,6 +95166,7 @@ exports.createAuthenticatedFileServer = require_file_data_plane.createAuthentica
 exports.createBroker = createBroker;
 exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
 exports.createCoreCapService = createCoreCapService;
+exports.createDoorSettingsView = createDoorSettingsView;
 exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
 exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
 exports.createHubService = createHubService;
@@ -95111,6 +95286,7 @@ exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
+exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
 exports.loadTlsCert = require_lan_http_bind.loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
@@ -95118,6 +95294,7 @@ exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapServi
 exports.parseCapAction = require_manifest_python_deps.parseCapAction;
 exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
 exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
+exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_lan_http_bind.readExtraSans;
@@ -95150,6 +95327,7 @@ exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough
 exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
 exports.validateUploadedTls = require_lan_http_bind.validateUploadedTls;
+exports.waitUntilReady = waitUntilReady;
 exports.writeExtraSans = require_lan_http_bind.writeExtraSans;
 exports.writePendingRestart = writePendingRestart;
 exports.writeTlsMode = require_lan_http_bind.writeTlsMode;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-DCTpBXm4.mjs";
+import { At as asNumber, B as extractNestedAddonId, Bt as parseJsonUnknown$1, Dt as ReadinessTimeoutError, Et as ReadinessRegistry, Ft as expandCapMethods, Gt as EventCategory$1, H as isArrayOutputSchema, Ht as resolveCapMount, J as lifecycleJobSchema, K as isVoidInput, Mt as createEvent, Nt as emitDownForOwnedCaps, Q as looseSchema, St as DEVICE_STATUS_METHOD, U as isCollectionArrayMethod, Ut as scopeKey, Vt as readinessKey, W as isObjectInput, Z as logLevelAtMost, bt as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, it as procedureAuthKey, jt as asString$1, kt as asJsonObject$1, ot as scopesAllowAddon, q as kebabToCamel, st as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as objectInputDeclaresAddonId, vt as errMsg$1, xt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, y as addonSettingsCapability, zt as parseJsonObject } from "./dist-DNbsZxNv.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -16,7 +16,7 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { SqliteSettingsAddon, o as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
+import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-SGdbr9D5.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, At as buildHeapSample, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, Dt as HEAP_WATCH_INTERVAL_MS, E as ipcParentLink, Et as HEAP_RECLAIM_TRIGGER_MB, F as createUdsLogger, Ft as strandedMb, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, Mt as shouldReclaim, N as createUdsEventBus, Nt as startHeapWatch, O as HUB_CAP_FWD_ACTION, Ot as HEAP_WATCH_WARN_RATIO, P as udsChildLogToWorkerEntry, Pt as startRunnerHeapWatch, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, jt as createV8Reclaimer, k as HUB_CAP_FWD_SERVICE, kt as RUNNER_HEAP_WATCH_INTERVAL_MS, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-DZSNlHjU.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { C as evaluateExistingCert, S as SERVER_AUTH_OID, _ as CA_COMMON_NAME, a as closeLanHttp, b as LEAF_RENEWAL_WINDOW_DAYS, c as readExtraSans, d as writeExtraSans, f as writeTlsMode, g as reissueTlsLeaf, h as loadTlsCert, i as bindPendingLanHttp, l as readTlsAccessStatus, m as ensureTlsCert, n as allFamiliesListenHost, o as readLanHttpState, p as validateUploadedTls, r as applyLanHttp, s as registerLanHttpHandler, t as DEFAULT_LAN_HTTP_PORT, u as readTlsMode, v as collectCertIdentity, x as MAX_LEAF_VALIDITY_DAYS, y as CA_VALIDITY_DAYS } from "./lan-http-bind-jKrj6OjQ.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
@@ -2604,7 +2604,7 @@ async function ensureAddonNativePrebuilds(addonDir, options) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -2702,9 +2702,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$1(value)) return void 0;
+	if (!isRecord$2(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$1(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$2(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -2854,7 +2854,7 @@ var AddonLoader = class {
 		}
 		if (!fs$17.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$1(modUnknown) ? modUnknown : {};
+		const mod = isRecord$2(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -2870,7 +2870,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$1(modUnknown) ? modUnknown : {};
+		const mod = isRecord$2(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -6639,6 +6639,145 @@ function isInfraCapability(name) {
 	return infraNames.has(name);
 }
 //#endregion
+//#region src/kernel/isolated-builtin-phase.ts
+var INFRA_NAMES = new Set(INFRA_CAPABILITIES.map((c) => c.name));
+function isolatedBuiltinPhase(capabilities) {
+	return capabilities.some((c) => INFRA_NAMES.has(c.name)) ? "infra" : "consumer";
+}
+function partitionIsolatedBuiltinIds(ids, capabilitiesOf) {
+	const infra = [];
+	const consumers = [];
+	for (const id of ids) if (isolatedBuiltinPhase(capabilitiesOf(id)) === "infra") infra.push(id);
+	else consumers.push(id);
+	return {
+		infra,
+		consumers
+	};
+}
+/**
+* Spawn of an infra isolate returns when the child process exists, not when
+* its UDS handshake has put the engine in the parent's `getCollection`.
+* In-process builtins that read the door before that handshake throw D44
+* ("nothing behind it") and are skipped for the rest of the boot.
+*/
+async function waitUntilReady(isReady, options) {
+	const deadline = Date.now() + options.timeoutMs;
+	for (;;) {
+		if (isReady()) return;
+		if (Date.now() >= deadline) throw new Error(`Timed out waiting for ${options.what}`);
+		await new Promise((resolve) => {
+			setTimeout(resolve, options.intervalMs);
+		});
+	}
+}
+//#endregion
+//#region src/kernel/settings-door-view.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asBlob(value) {
+	return isRecord$1(value) ? value : {};
+}
+function unwrapValue(parsed) {
+	if (!isRecord$1(parsed) || !("value" in parsed)) return parsed;
+	return parsed.value;
+}
+async function loadPrefixed(door, collection, prefix) {
+	const range = prefixRange(prefix);
+	const rows = await door.query({
+		collection,
+		...range !== null ? { filter: { whereBetween: { id: [range.lo, range.hi] } } } : {}
+	});
+	const result = {};
+	for (const row of rows) {
+		if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+		if (!row.id.startsWith(prefix)) continue;
+		result[row.id.slice(prefix.length)] = unwrapValue(row.data);
+	}
+	return result;
+}
+async function replacePrefixed(door, collection, prefix, values, wrap) {
+	const range = prefixRange(prefix);
+	if (range !== null) await door.deleteWhere({
+		collection,
+		filter: { whereBetween: { id: [range.lo, range.hi] } }
+	});
+	for (const [key, value] of Object.entries(values)) {
+		if (value === void 0) continue;
+		await door.set({
+			collection,
+			key: `${prefix}${key}`,
+			value: wrap(key, value)
+		});
+	}
+}
+function createDoorSettingsView(addonId, door, sections) {
+	const addonPrefix = `${addonId}.`;
+	return {
+		async readAddonStore() {
+			return loadPrefixed(door, "addon-settings", addonPrefix);
+		},
+		async writeAddonStore(patch) {
+			await replacePrefixed(door, "addon-settings", addonPrefix, {
+				...await loadPrefixed(door, "addon-settings", addonPrefix),
+				...patch
+			}, (key, value) => ({
+				addonId,
+				key,
+				value
+			}));
+		},
+		async readDeviceStore(deviceId) {
+			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
+		},
+		async writeDeviceStore(deviceId, patch) {
+			const scope = `${addonId}:${String(deviceId)}.`;
+			await replacePrefixed(door, "addon-device-settings", scope, {
+				...await loadPrefixed(door, "addon-device-settings", scope),
+				...patch
+			}, (key, value) => ({
+				addonId,
+				deviceId: String(deviceId),
+				key,
+				value
+			}));
+		},
+		async clearDeviceStore(deviceId) {
+			const range = prefixRange(`${addonId}:${String(deviceId)}.`);
+			if (range === null) return;
+			await door.deleteWhere({
+				collection: "addon-device-settings",
+				filter: { whereBetween: { id: [range.lo, range.hi] } }
+			});
+		},
+		async readDeviceRuntimeState(deviceId) {
+			return asBlob(await door.get({
+				collection: "device-runtime-state",
+				key: String(deviceId)
+			}));
+		},
+		async writeDeviceRuntimeState(deviceId, data) {
+			await door.set({
+				collection: "device-runtime-state",
+				key: String(deviceId),
+				value: data
+			});
+		},
+		async clearDeviceRuntimeState(deviceId) {
+			await door.delete({
+				collection: "device-runtime-state",
+				key: String(deviceId)
+			});
+		},
+		async getSection(section) {
+			return sections.getSection(section);
+		},
+		async setSection(section, patch) {
+			await sections.setSection(section, patch);
+		}
+	};
+}
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -9108,6 +9247,7 @@ var ConfigManager = class ConfigManager {
 	configPath;
 	bootstrapConfig;
 	settingsStore = null;
+	settingsDoor = null;
 	runtimeState;
 	runtimeStatePath;
 	constructor(configPath) {
@@ -9128,6 +9268,14 @@ var ConfigManager = class ConfigManager {
 	setSettingsStore(store) {
 		this.settingsStore = store;
 	}
+	/**
+	* Wire the async `settings-store` door. Used when the engine is isolated
+	* (no sync `ISettingsStore` handle on hub-main). {@link createSettingsView}
+	* prefers the sync store when both are present.
+	*/
+	setSettingsDoor(door) {
+		this.settingsDoor = door;
+	}
 	get(configPath) {
 		return this.resolveConfigValue(configPath);
 	}
@@ -9148,8 +9296,21 @@ var ConfigManager = class ConfigManager {
 	* Throws if the settings store is not yet wired.
 	*/
 	set(key, value) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setSystem(key, value);
+		if (this.settingsStore !== null) {
+			this.settingsStore.setSystem(key, value);
+			return;
+		}
+		if (this.settingsDoor !== null) {
+			this.settingsDoor.set({
+				collection: "system-settings",
+				key,
+				value
+			}).catch((err) => {
+				console.error("[ConfigManager] isolated settings-store write failed", err);
+			});
+			return;
+		}
+		throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
 	}
 	/**
 	* Bulk-read all keys that belong to a logical section.
@@ -9270,6 +9431,19 @@ var ConfigManager = class ConfigManager {
 		this.settingsStore.clearDeviceRuntimeState(deviceId);
 	}
 	createSettingsView(addonId) {
+		if (this.settingsStore === null && this.settingsDoor !== null) {
+			const door = this.settingsDoor;
+			return createDoorSettingsView(addonId, door, {
+				getSection: (section) => this.getSection(section),
+				setSection: async (section, patch) => {
+					for (const [key, value] of Object.entries(patch)) await door.set({
+						collection: "system-settings",
+						key: `${section}.${key}`,
+						value
+					});
+				}
+			});
+		}
 		const cm = this;
 		return {
 			async readAddonStore() {
@@ -94816,4 +94990,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, MAX_LEAF_VALIDITY_DAYS, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createDoorSettingsView, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readLanHttpState, readPendingRestart, readTlsAccessStatus, readTlsMode, readinessKey, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-manager.d.ts

@@ -1,5 +1,5 @@
 import { AppConfig } from './config-schema.js';
-import { FeatureManifest } from '@camstack/types';
+import { FeatureManifest, ISettingsStoreProvider } from '@camstack/types';
 export interface AddonSettingsView {
     readAddonStore(): Promise<Record<string, unknown>>;
     writeAddonStore(patch: Record<string, unknown>): Promise<void>;
@@ -76,6 +76,7 @@ export declare class ConfigManager {
     private readonly configPath;
     private bootstrapConfig;
     private settingsStore;
+    private settingsDoor;
     private runtimeState;
     private readonly runtimeStatePath;
     constructor(configPath: string);
@@ -85,6 +86,12 @@ export declare class ConfigManager {
      * Before this call, runtime reads/writes fall back to bootstrap + defaults.
      */
     setSettingsStore(store: ISettingsStore): void;
+    /**
+     * Wire the async `settings-store` door. Used when the engine is isolated
+     * (no sync `ISettingsStore` handle on hub-main). {@link createSettingsView}
+     * prefers the sync store when both are present.
+     */
+    setSettingsDoor(door: ISettingsStoreProvider): void;
     /**
      * Get a config value by dot-notation path.
      * Priority: bootstrap config (yaml) → settings-store → RUNTIME_DEFAULTS fallback.

package/dist/kernel/index.d.ts

@@ -21,6 +21,9 @@ export type { CapabilityRouter, CapabilityRouterFactory, ConfigReader, ProviderO
 export { CustomActionRegistry, type CustomActionEntry } from './custom-action-registry.js';
 export { INFRA_CAPABILITIES, isInfraCapability } from './infra-capabilities.js';
 export type { InfraCapability } from './infra-capabilities.js';
+export { isolatedBuiltinPhase, partitionIsolatedBuiltinIds, waitUntilReady, } from './isolated-builtin-phase.js';
+export type { IsolatedBuiltinPhase, IsolatedBuiltinWaves, CapabilityName, WaitUntilReadyOptions, } from './isolated-builtin-phase.js';
+export { createDoorSettingsView } from './settings-door-view.js';
 export { ConfigManager } from './config-manager.js';
 export type { ISettingsStore } from './config-manager.js';
 export { bootstrapSchema, RUNTIME_DEFAULTS, DEFAULT_DATA_PATH } from './config-schema.js';