@camstack/system 1.2.439 → 1.2.440

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BOWdLjoK.js");
-const require_device_ca = require("./device-ca-DHG9OW2m.js");
+const require_dist = require("./dist-BKhlcYz6.js");
+const require_device_ca = require("./device-ca-DNHjts4_.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -10,8 +10,11 @@ const require_builtins_composer_composer_addon = require("./builtins/composer/co
 require("./builtins/composer/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
 const require_builtins_console_logging_index = require("./builtins/console-logging/index.js");
+const require_prefix_range = require("./prefix-range-D_KueXbQ.js");
+const require_prefix_walk = require("./prefix-walk-Dv6MLZlM.js");
 const require_builtins_core_blocks_core_blocks_addon = require("./builtins/core-blocks/core-blocks.addon.js");
 require("./builtins/core-blocks/index.js");
+const require_retired_settings_keys = require("./retired-settings-keys-D_VwZiDt.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
 const require_builtins_hub_forwarder_index = require("./builtins/hub-forwarder/index.js");
@@ -22,21 +25,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-DEL_jeG0.js");
+const require_wal_maintenance = require("./wal-maintenance-C041zn6V.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https = require("./agent-https-DlpTMDqA.js");
-const require_constants = require("./constants-BRsjQwi-.js");
+const require_constants = require("./constants-CRI3QzT4.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-D7S5AJRU.js");
+const require_custom_action_registry = require("./custom-action-registry-BKmoaqG0.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-3Zc9G9MS.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DiGiI6Jp.js");
+const require_restore_archive = require("./restore-archive-49aZwkp8.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -48,13 +51,13 @@ node_path = require_chunk.__toESM(node_path);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_url = require("node:url");
+let _camstack_types_addon = require("@camstack/types/addon");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 node_util = require_chunk.__toESM(node_util);
 let node_events = require("node:events");
-let _camstack_types_addon = require("@camstack/types/addon");
 let node_http = require("node:http");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);
@@ -1174,23 +1177,23 @@ function formatSocketPlane(window) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-queue-report.ts
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null;
 }
 /** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
 function writerSocketsOf(broker) {
-	if (!isRecord$6(broker)) return void 0;
+	if (!isRecord$7(broker)) return void 0;
 	const transit = broker["transit"];
-	if (!isRecord$6(transit)) return void 0;
+	if (!isRecord$7(transit)) return void 0;
 	const transporter = transit["tx"];
-	if (!isRecord$6(transporter)) return void 0;
+	if (!isRecord$7(transporter)) return void 0;
 	const writer = transporter["writer"];
-	if (!isRecord$6(writer)) return void 0;
+	if (!isRecord$7(writer)) return void 0;
 	const sockets = writer["sockets"];
 	return sockets instanceof Map ? sockets : void 0;
 }
 function readSocket(nodeId, socket) {
-	if (typeof nodeId !== "string" || !isRecord$6(socket)) return void 0;
+	if (typeof nodeId !== "string" || !isRecord$7(socket)) return void 0;
 	const queuedBytes = socket["writableLength"];
 	const bytesWritten = socket["bytesWritten"];
 	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
@@ -6310,7 +6313,7 @@ async function resolveUncached(options) {
 }
 //#endregion
 //#region src/kernel/addon-class-resolver.ts
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6334,14 +6337,14 @@ function isRecord$5(value) {
 function isAddonConstructor(fn) {
 	if (typeof fn !== "function") return false;
 	const proto = fn.prototype;
-	if (!isRecord$5(proto)) return false;
+	if (!isRecord$6(proto)) return false;
 	return typeof proto["initialize"] === "function";
 }
 function resolveAddonClass(mod) {
 	let candidate = mod["default"];
-	if (isRecord$5(candidate) && "default" in candidate) candidate = candidate["default"];
+	if (isRecord$6(candidate) && "default" in candidate) candidate = candidate["default"];
 	if (isAddonConstructor(candidate)) return candidate;
-	if (isRecord$5(candidate)) {
+	if (isRecord$6(candidate)) {
 		const fn = Object.values(candidate).find(isAddonConstructor);
 		if (fn) return fn;
 	}
@@ -6350,7 +6353,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6448,9 +6451,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$4(value)) return void 0;
+	if (!isRecord$5(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$4(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$5(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -6600,7 +6603,7 @@ var AddonLoader = class {
 		}
 		if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$4(modUnknown) ? modUnknown : {};
+		const mod = isRecord$5(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -6616,7 +6619,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$4(modUnknown) ? modUnknown : {};
+		const mod = isRecord$5(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -11536,92 +11539,11 @@ async function runHubAddonBoot(steps) {
 }
 //#endregion
 //#region src/kernel/settings-door-view.ts
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asBlob(value) {
-	return isRecord$3(value) ? value : {};
-}
-function unwrapValue(parsed) {
-	if (!isRecord$3(parsed) || !("value" in parsed)) return parsed;
-	return parsed.value;
-}
-/**
-* Rows one page of a prefix read asks for.
-*
-* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
-* this read now names its own bound, so the engine's defensive cap is never the
-* thing that decides how much of the answer the caller gets.
-*/
-var PREFIX_PAGE_ROWS = 1e3;
-/**
-* Pages one prefix read may take before it refuses.
-*
-* 512 pages is 512 000 rows — three orders of magnitude past the largest live
-* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
-* still a bound, because a walk with no bound is the defect this file was
-* fixing, not one to reintroduce.
-*/
-var PREFIX_PAGE_BUDGET = 512;
-/**
-* Every row under `prefix`, or a throw — never the first 2 000 of them.
-*
-* **The defect.** This issued ONE `query` with no `limit`, and
-* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
-* and cuts the result there. On the live hub that fired 138 times in two hours
-* (`settings-store query truncated by a defensive row cap`, collection
-* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
-* ~1 019-device fleet with more than two stored keys per device puts one
-* addon's `<addonId>:` range past the cap. The engine warned; the door did not
-* notice, and handed its caller a short map that is **shape-identical to a
-* complete one**. Every device whose rows sort past the cap reads as "has no
-* stored settings", which is exactly what a device with none looks like.
-*
-* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
-* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
-* row (ids are unique, so a full page always advances) and no row can fall
-* between two pages the way an `OFFSET` walk drops rows under a concurrent
-* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
-* suffix, so the duplicate overwrites itself with its own value.
-*
-* `ORDER BY id` is not decoration — the cursor is only meaningful if the
-* engine returns the range in the order the cursor advances through. It is the
-* primary key, so the ordering is the range scan's own.
-*
-* @throws when the prefix cannot be expressed as a range and the collection is
-*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
-*   A throw is the point: a caller that cannot be answered completely must not
-*   be handed something that looks like a complete answer.
-*/
-async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
-	const range = require_wal_maintenance.prefixRange(prefix);
-	const result = {};
-	let cursor = range?.lo ?? null;
-	for (let page = 0;; page++) {
-		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
-		const rows = await door.query({
-			collection,
-			filter: {
-				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
-				orderBy: {
-					field: "id",
-					direction: "asc"
-				},
-				limit: PREFIX_PAGE_ROWS
-			}
-		});
-		for (const row of rows) {
-			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
-			if (!row.id.startsWith(prefix)) continue;
-			result[row.id.slice(prefix.length)] = decode(row.data);
-		}
-		if (rows.length < PREFIX_PAGE_ROWS) return result;
-		const last = rows[rows.length - 1];
-		if (last === void 0) return result;
-		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
-		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
-		cursor = last.id;
-	}
+	return isRecord$4(value) ? value : {};
 }
 /**
 * Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
@@ -11638,7 +11560,7 @@ async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
 * form opens, and the capability preferences once at boot.
 */
 async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
-	const listed = await loadPrefixed(door, "system-settings", prefix, () => null);
+	const listed = await require_prefix_walk.loadPrefixed(door, "system-settings", prefix, () => null);
 	const result = {};
 	for (const suffix of Object.keys(listed).filter(mayRead)) {
 		const value = await door.get({
@@ -11649,106 +11571,34 @@ async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
 	}
 	return result;
 }
-async function replacePrefixed(door, collection, prefix, values, wrap) {
-	const range = require_wal_maintenance.prefixRange(prefix);
-	if (range !== null) await door.deleteWhere({
-		collection,
-		filter: { whereBetween: { id: [range.lo, range.hi] } }
-	});
-	for (const [key, value] of Object.entries(values)) {
-		if (value === void 0) continue;
-		await door.set({
-			collection,
-			key: `${prefix}${key}`,
-			value: wrap(key, value)
-		});
-	}
-}
 function createDoorSettingsView(addonId, door, sections) {
-	const addonPrefix = `${addonId}.`;
+	const addonStore = require_builtins_core_blocks_core_blocks_addon.createAddonSettingsStore(door, addonId);
+	const deviceStore = require_builtins_device_manager_device_manager_addon.createDeviceSettingsStore(door, addonId);
 	return {
 		async readAddonStore() {
-			return loadPrefixed(door, "addon-settings", addonPrefix);
-		},
-		async readAddonStoreKeyResult(key) {
-			try {
-				const row = await door.get({
-					collection: "addon-settings",
-					key: `${addonPrefix}${key}`
-				});
-				return row === void 0 ? { kind: "absent" } : {
-					kind: "present",
-					value: unwrapValue(row)
-				};
-			} catch (err) {
-				return {
-					kind: "unreadable",
-					reason: "store-read-failed",
-					error: err instanceof Error ? err.message : String(err)
-				};
+			const read = await addonStore.read();
+			switch (read.kind) {
+				case "present": return { ...read.value };
+				case "absent": return {};
+				case "unreadable": throw new Error(`settings of "${addonId}" could not be read: ${read.error}`);
 			}
 		},
-		async writeAddonStore(patch) {
-			await replacePrefixed(door, "addon-settings", addonPrefix, {
-				...await loadPrefixed(door, "addon-settings", addonPrefix),
-				...patch
-			}, (key, value) => ({
-				addonId,
-				key,
-				value
-			}));
+		async readAddonStoreKeyResult(key) {
+			const read = await addonStore.readKey(key);
+			return read.kind === "unreadable" ? {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: read.error
+			} : read;
 		},
+		writeAddonStore: (patch) => addonStore.merge(patch),
 		async readDeviceStore(deviceId) {
-			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
-		},
-		async readDeviceStoreBatch(deviceIds) {
-			const out = /* @__PURE__ */ new Map();
-			if (deviceIds.length === 0) return out;
-			for (const id of deviceIds) out.set(id, {});
-			const wanted = new Set(deviceIds);
-			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`);
-			for (const [suffix, value] of Object.entries(all)) {
-				const dot = suffix.indexOf(".");
-				if (dot <= 0) continue;
-				const deviceId = Number(suffix.slice(0, dot));
-				if (!Number.isInteger(deviceId) || !wanted.has(deviceId)) continue;
-				const blob = out.get(deviceId);
-				if (blob === void 0) continue;
-				blob[suffix.slice(dot + 1)] = value;
-			}
-			return out;
-		},
-		async listDeviceStoreIds() {
-			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`, () => null);
-			const ids = /* @__PURE__ */ new Set();
-			for (const suffix of Object.keys(all)) {
-				const dot = suffix.indexOf(".");
-				if (dot <= 0) continue;
-				const deviceId = Number(suffix.slice(0, dot));
-				if (Number.isInteger(deviceId) && deviceId > 0) ids.add(deviceId);
-			}
-			return [...ids].toSorted((a, b) => a - b);
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const scope = `${addonId}:${String(deviceId)}.`;
-			await replacePrefixed(door, "addon-device-settings", scope, {
-				...await loadPrefixed(door, "addon-device-settings", scope),
-				...patch
-			}, (key, value) => ({
-				addonId,
-				deviceId: String(deviceId),
-				key,
-				value
-			}));
-		},
-		async clearDeviceStore(deviceId) {
-			const range = require_wal_maintenance.prefixRange(`${addonId}:${String(deviceId)}.`);
-			if (range === null) return;
-			await door.deleteWhere({
-				collection: "addon-device-settings",
-				filter: { whereBetween: { id: [range.lo, range.hi] } }
-			});
+			return require_builtins_device_manager_device_manager_addon.readDeviceOrThrow(deviceStore, deviceId);
 		},
+		readDeviceStoreBatch: (deviceIds) => deviceStore.readBatch(deviceIds),
+		listDeviceStoreIds: () => deviceStore.listIds(),
+		writeDeviceStore: (deviceId, patch) => deviceStore.merge(deviceId, patch),
+		clearDeviceStore: (deviceId) => deviceStore.clear(deviceId),
 		async readDeviceRuntimeState(deviceId) {
 			return asBlob(await door.get({
 				collection: "device-runtime-state",
@@ -14262,7 +14112,7 @@ import_js_yaml.default;
 * so that file stays one class. The `console.*` calls are the documented
 * residuals described on `ConfigManager` (no logger exists yet at boot).
 */
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Sections that live in config.yaml. Everything else goes to the settings-store. */
@@ -14353,7 +14203,7 @@ function setNested(obj, configPath, value) {
 		[head]: value
 	};
 	const existing = obj[head];
-	const child = isRecord$2(existing) ? existing : {};
+	const child = isRecord$3(existing) ? existing : {};
 	return {
 		...obj,
 		[head]: setNested(child, rest.join("."), value)
@@ -14386,8 +14236,10 @@ function loadYaml(configPath) {
 //#endregion
 //#region src/kernel/store-settings-view.ts
 function createStoreSettingsView(addonId, cm) {
+	const refuseDeviceSettings = async () => {
+		throw new Error(`device settings of addon "${addonId}" are served by the settings-store door only`);
+	};
 	const viewAddonConfig = () => !cm.hasSyncStore() ? (0, _camstack_types_addon.asJsonObject)(cm.getBootstrap(`addons.${addonId}`)) ?? {} : cm.getAddonConfig(addonId);
-	const viewAddonDevice = (deviceId) => !cm.hasSyncStore() ? {} : cm.getAddonDevice(addonId, deviceId);
 	return {
 		async readAddonStore() {
 			return viewAddonConfig();
@@ -14419,29 +14271,11 @@ function createStoreSettingsView(addonId, cm) {
 				...patch
 			});
 		},
-		async readDeviceStore(deviceId) {
-			return viewAddonDevice(String(deviceId));
-		},
-		async readDeviceStoreBatch(deviceIds) {
-			const out = /* @__PURE__ */ new Map();
-			for (const deviceId of deviceIds) try {
-				out.set(deviceId, viewAddonDevice(String(deviceId)));
-			} catch {
-				out.set(deviceId, {});
-			}
-			return out;
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const key = String(deviceId);
-			const existing = viewAddonDevice(key);
-			cm.setAddonDevice(addonId, key, {
-				...existing,
-				...patch
-			});
-		},
-		async clearDeviceStore(deviceId) {
-			cm.clearAddonDevice(addonId, String(deviceId));
-		},
+		readDeviceStore: refuseDeviceSettings,
+		readDeviceStoreBatch: refuseDeviceSettings,
+		listDeviceStoreIds: refuseDeviceSettings,
+		writeDeviceStore: refuseDeviceSettings,
+		clearDeviceStore: refuseDeviceSettings,
 		async readDeviceRuntimeState(deviceId) {
 			return cm.getDeviceRuntimeState(String(deviceId));
 		},
@@ -14626,7 +14460,7 @@ var SystemSettingsMirror = class {
 };
 //#endregion
 //#region src/kernel/config-manager.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorText(err) {
@@ -14815,7 +14649,7 @@ var ConfigManager = class {
 	async readAddonDeviceStrict(addonId, deviceId) {
 		const door = this.settingsDoor;
 		switch (this.backendMode()) {
-			case "store": return this.getAddonDevice(addonId, String(deviceId));
+			case "store": break;
 			case "door":
 				if (door === null) break;
 				try {
@@ -14833,34 +14667,6 @@ var ConfigManager = class {
 		this.settingsStore.setAllAddon(addonId, config);
 	}
 	/**
-	* Read per-device overrides for a specific addon. Returns a flat record
-	* of field → value. Missing keys fall back to the addon-global value via
-	* `getAddonConfig(addonId)` — that composition is the resolver service's
-	* responsibility, not ConfigManager's.
-	* SYNC store only — THROWS without one (D675); async: {@link readAddonDeviceStrict}.
-	*/
-	getAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) throw this.refuseSyncRead("getAddonDevice", `addon "${addonId}" device "${deviceId}"`);
-		return this.settingsStore.getAddonDevice(addonId, deviceId);
-	}
-	/**
-	* Write (bulk-replace) per-device overrides for a specific addon.
-	* Throws if the settings store is not yet wired.
-	*/
-	setAddonDevice(addonId, deviceId, values) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setAddonDevice(addonId, deviceId, values);
-	}
-	/**
-	* Clear all per-device overrides for a specific addon/device pair.
-	* Resolution falls back to the addon-global value after this call.
-	* No-op if the settings store is not yet wired.
-	*/
-	clearAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) return;
-		this.settingsStore.clearAddonDevice(addonId, deviceId);
-	}
-	/**
 	* The device's persisted runtime-state blob. THROWS before the store is
 	* wired: a store not asked is not an empty row (D677, D675).
 	*/
@@ -14937,11 +14743,7 @@ var ConfigManager = class {
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
-			listDeviceStoreIds: async () => {
-				const list = active().listDeviceStoreIds;
-				if (list === void 0) throw new Error("listDeviceStoreIds is not available on this settings view");
-				return list.call(active());
-			},
+			listDeviceStoreIds: () => active().listDeviceStoreIds(),
 			writeDeviceStore: (deviceId, patch) => active().writeDeviceStore(deviceId, patch),
 			clearDeviceStore: (deviceId) => active().clearDeviceStore(deviceId),
 			getSection: (section) => active().getSection(section),
@@ -15017,7 +14819,7 @@ var ConfigManager = class {
 		const keys = configPath.split(".");
 		let current = this.bootstrapConfig;
 		for (const key of keys) {
-			if (!isRecord$1(current)) return void 0;
+			if (!isRecord$2(current)) return void 0;
 			current = current[key];
 		}
 		return current;
@@ -15868,27 +15670,6 @@ function asName(value) {
 	return typeof value === "string" && value.length > 0 ? value : null;
 }
 //#endregion
-//#region src/kernel/moleculer/settings-read-guard.ts
-/**
-* Merge `patch` over the current value and write it — unless the read failed,
-* in which case write NOTHING.
-*
-* Returns whether the write was attempted, so a caller can surface the refusal.
-*/
-async function readModifyWrite(input) {
-	const current = await input.read();
-	if (current.kind === "failed") {
-		input.onRefused(current.error);
-		return false;
-	}
-	const base = current.kind === "value" ? current.value : {};
-	await input.write({
-		...base,
-		...input.patch
-	});
-	return true;
-}
-//#endregion
 //#region src/kernel/moleculer/children-batch-loader.ts
 /**
 * Narrow an untyped cap answer to the fields the reconcile reads.
@@ -16023,7 +15804,7 @@ var RuntimeStateLoadError = class extends Error {
 		this.name = "RuntimeStateLoadError";
 	}
 };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage(err) {
@@ -16054,7 +15835,7 @@ async function loadRuntimeStateOrRefuse(load, logger, target) {
 	} catch (err) {
 		return refuse(errorMessage(err), err);
 	}
-	if (!isRecord(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
+	if (!isRecord$1(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
 	return answer;
 }
 //#endregion
@@ -23145,6 +22926,261 @@ function createRemoteProviderProxy(broker, serviceName, capName, nodeId, methods
 	return dispatcher;
 }
 //#endregion
+//#region src/kernel/sections-store.ts
+function createSectionsStore(door) {
+	return {
+		read: (section) => loadSystemSettingsPrefix(door, `${section}.`, (key) => storeMayAnswer(`${section}.${key}`)),
+		write: async (section, patch) => {
+			for (const [key, value] of Object.entries(patch)) await door.set({
+				collection: "system-settings",
+				key: `${section}.${key}`,
+				value
+			});
+		}
+	};
+}
+//#endregion
+//#region src/kernel/moleculer/runner-addon-settings.ts
+/** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
+function createRunnerAddonSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = async () => {
+			throw new Error(`settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readAddonStore: refuse,
+			readAddonStoreResult: async () => ({
+				kind: "failed",
+				error: "settings store not wired"
+			}),
+			readAddonStoreKeyResult: async () => ({
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: "settings store not wired"
+			}),
+			writeAddonStore: refuse,
+			getSection: refuse,
+			setSection: refuse
+		};
+	}
+	const door = {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		get: async (input) => {
+			await before();
+			return client.get.query(input);
+		},
+		set: async (input) => {
+			await before();
+			return client.set.mutate(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		}
+	};
+	const store = require_builtins_core_blocks_core_blocks_addon.createAddonSettingsStore(door, addonId);
+	const sections = createSectionsStore(door);
+	return {
+		readAddonStore: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return { ...read.value };
+				case "absent": return {};
+				case "unreadable": throw new Error(`settings of "${addonId}" could not be read: ${read.error}`);
+			}
+		},
+		readAddonStoreResult: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return {
+					kind: "value",
+					value: { ...read.value }
+				};
+				case "absent": return { kind: "missing" };
+				case "unreadable": return {
+					kind: "failed",
+					error: read.error
+				};
+			}
+		},
+		readAddonStoreKeyResult: async (key) => {
+			const read = await store.readKey(key);
+			return read.kind === "unreadable" ? {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: read.error
+			} : read;
+		},
+		writeAddonStore: (patch) => store.merge(patch),
+		getSection: (section) => sections.read(section),
+		setSection: (section, patch) => sections.write(section, patch)
+	};
+}
+//#endregion
+//#region src/kernel/legacy-blob-guard.ts
+/** Root keys retired long before D870: they never count as "settings still to migrate". */
+var OWN_RETIRED_ROOT_KEYS = new Set([
+	"recordingConfigs",
+	"recordingExports",
+	"recordingOpsLog",
+	"probeSnapshots",
+	"rtspTokens",
+	"profileMap"
+]);
+/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
+function isRetiredRootKey(addonId, key) {
+	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
+	return require_retired_settings_keys.RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
+}
+var UnmigratedSettingsError = class extends Error {
+	constructor(addonId, what) {
+		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		this.name = "UnmigratedSettingsError";
+	}
+};
+async function countOf(client, input) {
+	const n = await client.count.query(input);
+	if (typeof n !== "number") throw new Error("settings store answered a non-number to a count");
+	return n;
+}
+var LEGACY_PAGE = 500;
+var LEGACY_PAGE_BUDGET = 200;
+var ID_TAIL = "";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Does the addon's per-device blob table hold a row the copy would actually
+* migrate - a positive numeric id with a non-empty record? An addon whose rows
+* the copy skips anyway must not be refused for them.
+*/
+async function hasMigratableDeviceRow(client, addonId) {
+	let cursor = "";
+	for (let page = 0; page < LEGACY_PAGE_BUDGET; page++) {
+		const rows = await client.query.query({
+			namespace: addonId,
+			collection: "addon-devices",
+			filter: {
+				whereBetween: { id: [cursor, ID_TAIL] },
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: LEGACY_PAGE
+			}
+		});
+		if (!Array.isArray(rows)) throw new Error("settings store answered a non-list to a query");
+		let lastId = cursor;
+		for (const row of rows) {
+			if (!isRecord(row) || typeof row["id"] !== "string") continue;
+			lastId = row["id"];
+			const id = Number(row["id"]);
+			const data = row["data"];
+			if (Number.isInteger(id) && id > 0 && isRecord(data) && Object.keys(data).length > 0) return true;
+		}
+		if (rows.length < LEGACY_PAGE || lastId === cursor) return false;
+		cursor = lastId;
+	}
+	throw new Error(`addon "${addonId}": more legacy blob pages than the guard will read`);
+}
+/**
+* THROWS when the addon has blob settings and the standard store has none of
+* its own. A store that cannot be asked also throws: it is not "no blobs".
+*/
+async function assertLegacyBlobsMigrated(client, addonId, logger) {
+	const legacyDevices = await hasMigratableDeviceRow(client, addonId);
+	const root = await client.get.query({
+		namespace: addonId,
+		collection: "addon-settings",
+		key: "root"
+	});
+	const legacySettings = isRecord(root) && Object.keys(root).some((key) => !isRetiredRootKey(addonId, key));
+	if (!legacyDevices && !legacySettings) return;
+	const rangeOf = (prefix) => {
+		const range = require_prefix_range.prefixRange(prefix);
+		if (range === null) throw new Error(`no id range for addon "${addonId}"`);
+		return { whereBetween: { id: [range.lo, range.hi] } };
+	};
+	const newDevices = await countOf(client, {
+		collection: "addon-device-settings",
+		filter: rangeOf(`${addonId}:`)
+	});
+	const newSettings = await countOf(client, {
+		collection: "addon-settings",
+		filter: rangeOf(`${addonId}.`)
+	});
+	const problems = [];
+	if (legacyDevices && newDevices === 0) problems.push("per-device blobs");
+	if (legacySettings && newSettings === 0) problems.push("an addon settings blob");
+	if (problems.length === 0) return;
+	const error = new UnmigratedSettingsError(addonId, problems.join(" and "));
+	logger.error(error.message, { meta: {
+		addonId,
+		newDevices,
+		newSettings
+	} });
+	throw error;
+}
+//#endregion
+//#region src/kernel/moleculer/runner-device-settings.ts
+/**
+* The forked runner's `ctx.settings` device methods (D870).
+*
+* A runner does not hold the settings door; it holds a tRPC client of the hub's
+* `settings-store` cap. This file adapts that client to the door slice the
+* per-device store needs and hands back the five view methods — the SAME module
+* hub-main's view uses, so a device's settings are one set of rows whichever
+* process asks. Before D870 the runner kept its own `<addonId>:addon-devices`
+* blob per device; a hub-side write to the rows was invisible to it.
+*/
+/** The door slice the per-device store needs, over a tRPC client. */
+function doorOverClient(client, before = async () => {}) {
+	return {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		},
+		deleteWhere: async (input) => {
+			await before();
+			return client.deleteWhere.mutate(input);
+		}
+	};
+}
+/**
+* @param client the hub's `settingsStore` client, or `undefined` when the
+*   runner has none — every call then THROWS: a store that could not be asked
+*   is not an empty one.
+*/
+function createRunnerDeviceSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = () => {
+			throw new Error(`device settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readDeviceStore: async () => refuse(),
+			readDeviceStoreBatch: async () => refuse(),
+			listDeviceStoreIds: async () => refuse(),
+			writeDeviceStore: async () => refuse(),
+			clearDeviceStore: async () => refuse()
+		};
+	}
+	const store = require_builtins_device_manager_device_manager_addon.createDeviceSettingsStore(doorOverClient(client, before), addonId);
+	return {
+		readDeviceStore: (deviceId) => require_builtins_device_manager_device_manager_addon.readDeviceOrThrow(store, deviceId),
+		readDeviceStoreBatch: (ids) => store.readBatch(ids),
+		listDeviceStoreIds: () => store.listIds(),
+		writeDeviceStore: (deviceId, patch) => store.merge(deviceId, patch),
+		clearDeviceStore: (deviceId) => store.clear(deviceId)
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/addon-context-factory.ts
 /** This runtime's node id, regardless of mode (broker.nodeID or the UDS child nodeId). */
 function runtimeNodeId(runtime) {
@@ -23411,20 +23447,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		}
 		return r.kind === "value" ? r.value : {};
 	};
-	/** Read-modify-write that REFUSES to write when the read failed. */
-	const mergeBlob = async (coll, key, patch, namespace) => {
-		await readModifyWrite({
-			read: () => readBlobResult(coll, key, namespace),
-			write: (next) => writeBlob(coll, key, next, namespace),
-			patch,
-			onRefused: (error) => {
-				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
-					error,
-					patchKeys: Object.keys(patch)
-				} });
-			}
-		});
-	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -23447,38 +23469,24 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 			} });
 		}
 	};
-	const rmwChains = /* @__PURE__ */ new Map();
-	const serializeRmw = (coll, key, op) => {
-		const chainKey = `${coll}/${key}`;
-		const next = (rmwChains.get(chainKey) ?? Promise.resolve()).catch(() => void 0).then(op);
-		rmwChains.set(chainKey, next);
-		next.finally(() => {
-			if (rmwChains.get(chainKey) === next) rmwChains.delete(chainKey);
-		}).catch(() => void 0);
-		return next;
+	const deviceSettingsClient = Reflect.get(api, "settingsStore");
+	let blobsChecked = null;
+	const bootGuard = () => {
+		const client = deviceSettingsClient;
+		if (client === void 0) return Promise.resolve();
+		blobsChecked ??= assertLegacyBlobsMigrated({
+			get: { query: (input) => client.get.query(input) },
+			query: { query: (input) => client.query.query(input) },
+			count: { query: (input) => client.count.query(input) }
+		}, addonId, scopedLogger).catch((err) => {
+			blobsChecked = null;
+			throw err;
+		});
+		return blobsChecked;
 	};
 	const settingsView = {
-		async readAddonStore() {
-			return readBlob("addon-settings", "root", addonId);
-		},
-		readAddonStoreResult: () => readBlobResult("addon-settings", "root", addonId),
-		async writeAddonStore(patch) {
-			return serializeRmw("addon-settings", "root", async () => {
-				await mergeBlob("addon-settings", "root", patch, addonId);
-			});
-		},
-		async readDeviceStore(deviceId) {
-			return readBlob("addon-devices", String(deviceId), addonId);
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const key = String(deviceId);
-			return serializeRmw("addon-devices", key, async () => {
-				await mergeBlob("addon-devices", key, patch, addonId);
-			});
-		},
-		async clearDeviceStore(deviceId) {
-			await writeBlob("addon-devices", String(deviceId), {}, addonId);
-		},
+		...createRunnerAddonSettings(deviceSettingsClient, addonId, bootGuard),
+		...createRunnerDeviceSettings(deviceSettingsClient, addonId, bootGuard),
 		async readDeviceRuntimeState(deviceId) {
 			return readBlob("device-runtime-state", String(deviceId));
 		},
@@ -23487,14 +23495,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async clearDeviceRuntimeState(deviceId) {
 			await writeBlob("device-runtime-state", String(deviceId), {});
-		},
-		async getSection(section) {
-			return readBlob("sections", section);
-		},
-		async setSection(section, patch) {
-			return serializeRmw("sections", section, async () => {
-				await mergeBlob("sections", section, patch);
-			});
 		}
 	};
 	const readinessRegistry = () => runtime.mode === "broker" ? getOrInitReadinessRegistry(runtime.broker, scopedEventBus, scopedLogger) : getOrInitReadinessRegistryForClient(runtime.client, scopedEventBus, scopedLogger, nodeId);