@camstack/system 1.2.439 → 1.2.440

package/dist/kernel/addon-settings-store.d.ts

@@ -0,0 +1,43 @@
+/**
+* The ONE addon-level settings store (D870): collection `addon-settings`, one
+* row per field, id `<addonId>.<field>`, row data `{ addonId, key, value }` -
+* hub-main's layout, now also the forked runner's.
+*
+* Before D870 a runner kept a blob of its own (`<addonId>:addon-settings`,
+* key `root`) next to the hub-main rows, so the two processes read different
+* tables for the same addon. The rules are the per-device store's
+* ({@link ./device-settings-store.ts}): reads are three-way, a write is ONE
+* `transact`, a merge never reads, errors propagate.
+*/
+import type { ISettingsStoreProvider } from "@camstack/types";
+/** The door slice the module needs. */
+export type AddonSettingsDoor = Pick<ISettingsStoreProvider, "query" | "get" | "transact">;
+/** Three-way answer for an addon's whole settings record. */
+export type AddonSettingsRead = {
+	readonly kind: "present";
+	readonly value: Readonly<Record<string, unknown>>;
+} | {
+	readonly kind: "absent";
+} | {
+	readonly kind: "unreadable";
+	readonly error: string;
+};
+/** Three-way answer for one field. */
+export type AddonSettingKeyRead = {
+	readonly kind: "present";
+	readonly value: unknown;
+} | {
+	readonly kind: "absent";
+} | {
+	readonly kind: "unreadable";
+	readonly error: string;
+};
+export interface AddonSettingsStore {
+	/** Every field of the addon; `absent` when the store answered with no row. */
+	read(): Promise<AddonSettingsRead>;
+	/** ONE row, never the addon's whole range. */
+	readKey(key: string): Promise<AddonSettingKeyRead>;
+	/** Set the fields of `patch`; a field whose value is `undefined` is removed. ONE transaction, no read. */
+	merge(patch: Readonly<Record<string, unknown>>): Promise<void>;
+}
+export declare function createAddonSettingsStore(door: AddonSettingsDoor, addonId: string): AddonSettingsStore;

package/dist/kernel/config-manager.d.ts

@@ -117,25 +117,6 @@ export declare class ConfigManager {
 	/** Write (bulk-replace) config for an addon to addon_settings. */
 	setAddonConfig(addonId: string, config: Record<string, unknown>): void;
 	/**
-	* Read per-device overrides for a specific addon. Returns a flat record
-	* of field → value. Missing keys fall back to the addon-global value via
-	* `getAddonConfig(addonId)` — that composition is the resolver service's
-	* responsibility, not ConfigManager's.
-	* SYNC store only — THROWS without one (D675); async: {@link readAddonDeviceStrict}.
-	*/
-	getAddonDevice(addonId: string, deviceId: string): Record<string, unknown>;
-	/**
-	* Write (bulk-replace) per-device overrides for a specific addon.
-	* Throws if the settings store is not yet wired.
-	*/
-	setAddonDevice(addonId: string, deviceId: string, values: Record<string, unknown>): void;
-	/**
-	* Clear all per-device overrides for a specific addon/device pair.
-	* Resolution falls back to the addon-global value after this call.
-	* No-op if the settings store is not yet wired.
-	*/
-	clearAddonDevice(addonId: string, deviceId: string): void;
-	/**
 	* The device's persisted runtime-state blob. THROWS before the store is
 	* wired: a store not asked is not an empty row (D677, D675).
 	*/

package/dist/kernel/device-settings-store.d.ts

@@ -0,0 +1,74 @@
+/**
+* The ONE per-device settings store (D870): collection `addon-device-settings`,
+* one row per field, id `<addonId>:<deviceId>.<field>`, row data
+* `{ addonId, deviceId, key, value }`.
+*
+* Every process reaches it through this module — hub-main with the settings
+* door, a forked runner with an adapter over its `settingsStore` client — so the
+* two views cannot disagree about where a device's settings live. This is the
+* only module that names the collection (guard: `check-device-settings-standard`).
+*
+* Rules the module holds, each one an incident:
+*  - A read is THREE-way. A failed read is `unreadable`, never `{}` (D49): every
+*    caller that merges would otherwise persist its patch alone and destroy the
+*    rest (the recorder configuration, 2026-07-31).
+*  - A write is ONE `transact` (upserts + deletes together). The old
+*    `deleteWhere` + N `set` window is where a reader, or a crash, saw a device
+*    with half its settings; on 2026-10-17 that window stopped all recordings.
+*  - A merge never reads: one row per field means two writers touching
+*    different fields cannot overwrite each other, and nothing needs a
+*    read-modify-write.
+*  - Errors propagate. Nothing here swallows one.
+*/
+import type { ISettingsStoreProvider } from "@camstack/types";
+/** The slice of the settings store the module needs; the door or a client adapter. */
+export type DeviceSettingsDoor = Pick<ISettingsStoreProvider, "query" | "transact" | "deleteWhere">;
+/** Three-way answer for one device's settings. */
+export type DeviceSettingsRead = {
+	readonly kind: "present";
+	readonly value: Readonly<Record<string, unknown>>;
+} | {
+	readonly kind: "absent";
+} | {
+	readonly kind: "unreadable";
+	readonly error: string;
+};
+/** One addon's view of the per-device settings store. */
+export interface DeviceSettingsStore {
+	/** The device's fields; `absent` when the store answered with no row. */
+	read(deviceId: number): Promise<DeviceSettingsRead>;
+	/**
+	* An entry for EVERY id asked for (`{}` for a device with no rows — the store
+	* answered). THROWS when the store could not be asked or answered partially.
+	*/
+	readBatch(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
+	/** Ids this addon holds at least one row for, ascending. Throws on a failed read. */
+	listIds(): Promise<readonly number[]>;
+	/**
+	* Set the fields of `patch`; a field whose value is `undefined` is removed.
+	* ONE transaction, no read.
+	*/
+	merge(deviceId: number, patch: Readonly<Record<string, unknown>>): Promise<void>;
+	/** Remove every field of this addon for the device (one statement). */
+	clear(deviceId: number): Promise<void>;
+}
+export declare function createDeviceSettingsStore(door: DeviceSettingsDoor, addonId: string): DeviceSettingsStore;
+/** The `Record` form of a read: `{}` for a store that answered with no row, a THROW for one that did not. */
+export declare function readDeviceOrThrow(store: Pick<DeviceSettingsStore, "read">, deviceId: number): Promise<Record<string, unknown>>;
+/**
+* Remove a device's rows for EVERY addon, in one statement (D865's central
+* delete). Matched on the device id each row carries, so no addon needs a
+* handler. Returns how many rows went.
+*/
+export declare function clearDeviceSettings(door: Pick<ISettingsStoreProvider, "deleteWhere">, deviceId: number): Promise<number>;
+/** One (addon, device) pair that holds at least one settings row. */
+export interface DeviceSettingsScope {
+	readonly deviceId: number;
+	readonly addonId: string;
+}
+/**
+* Every (addon, device) pair holding rows, across all addons - the admin
+* "deleted devices" listing. A keyset walk by primary key (never one query cut
+* at a row cap): a read that cannot be completed THROWS.
+*/
+export declare function listDeviceSettingsScopes(door: Pick<ISettingsStoreProvider, "query">): Promise<readonly DeviceSettingsScope[]>;

package/dist/kernel/legacy-blob-guard.d.ts

@@ -0,0 +1,58 @@
+/**
+* The boot guard of the D870 cut-over: an addon never starts on `absent`.
+*
+* Until `scripts/hub/migrate-device-store.ts --copy` has run, a forked addon's
+* settings still sit in its per-addon blobs (`<addonId>:addon-devices`,
+* `<addonId>:addon-settings` / `root`) while the standard rows are empty. New
+* code reads only the standard rows, so it would run on "no settings" - every
+* camera unconfigured, recording off, with nothing in a log. Instead the addon
+* REFUSES to start, and says why.
+*
+* Reads of an unwritten scoped table answer absent and create nothing, so the
+* guard costs two counts and a `get` on a hub that never had blobs, and it goes
+* quiet by itself once `--drop` removed the old tables.
+*/
+import type { IScopedLogger } from "@camstack/types";
+/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
+export declare function isRetiredRootKey(addonId: string, key: string): boolean;
+/** The client calls the guard uses. */
+export interface LegacyGuardClient {
+	readonly query: {
+		query(input: {
+			namespace?: string;
+			collection: string;
+			filter?: {
+				whereBetween: Record<string, [string, string]>;
+				orderBy: {
+					field: string;
+					direction: "asc" | "desc";
+				};
+				limit: number;
+			};
+		}): Promise<unknown>;
+	};
+	readonly get: {
+		query(input: {
+			namespace: string;
+			collection: string;
+			key: string;
+		}): Promise<unknown>;
+	};
+	readonly count: {
+		query(input: {
+			namespace?: string;
+			collection: string;
+			filter?: {
+				whereBetween: Record<string, [string, string]>;
+			};
+		}): Promise<unknown>;
+	};
+}
+export declare class UnmigratedSettingsError extends Error {
+	constructor(addonId: string, what: string);
+}
+/**
+* THROWS when the addon has blob settings and the standard store has none of
+* its own. A store that cannot be asked also throws: it is not "no blobs".
+*/
+export declare function assertLegacyBlobsMigrated(client: LegacyGuardClient, addonId: string, logger: IScopedLogger): Promise<void>;

package/dist/kernel/moleculer/runner-addon-settings.d.ts

@@ -0,0 +1,34 @@
+/**
+* The forked runner's addon-level `ctx.settings` methods (D870): the SAME
+* modules hub-main's view uses ({@link ../addon-settings-store.ts},
+* {@link ../sections-store.ts}) over this runner's settings-store client, so an
+* addon's settings are one set of rows whichever process asks.
+*/
+import type { AddonStoreRead, StoredKeyRead } from "@camstack/types";
+import { type AddonSettingsDoor } from "../addon-settings-store.js";
+import type { LegacyGuardClient } from "../legacy-blob-guard.js";
+import { type SectionsDoor } from "../sections-store.js";
+import type { RunnerSettingsClient } from "./runner-device-settings.js";
+/** The client calls the addon-level adapter uses, on top of the device ones. */
+export interface RunnerAddonSettingsClient extends RunnerSettingsClient {
+	readonly get: {
+		query: AddonSettingsDoor["get"];
+	};
+	readonly set: {
+		mutate: SectionsDoor["set"];
+	};
+	/** For the boot guard against unmigrated blobs (D870). */
+	readonly count: {
+		query: LegacyGuardClient["count"]["query"];
+	};
+}
+export interface RunnerAddonSettingsView {
+	readAddonStore(): Promise<Record<string, unknown>>;
+	readAddonStoreResult(): Promise<AddonStoreRead>;
+	readAddonStoreKeyResult(key: string): Promise<StoredKeyRead>;
+	writeAddonStore(patch: Record<string, unknown>): Promise<void>;
+	getSection(section: string): Promise<Record<string, unknown>>;
+	setSection(section: string, patch: Record<string, unknown>): Promise<void>;
+}
+/** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
+export declare function createRunnerAddonSettings(client: RunnerAddonSettingsClient | undefined, addonId: string, before?: () => Promise<void>): RunnerAddonSettingsView;

package/dist/kernel/moleculer/runner-device-settings.d.ts

@@ -0,0 +1,39 @@
+/**
+* The forked runner's `ctx.settings` device methods (D870).
+*
+* A runner does not hold the settings door; it holds a tRPC client of the hub's
+* `settings-store` cap. This file adapts that client to the door slice the
+* per-device store needs and hands back the five view methods — the SAME module
+* hub-main's view uses, so a device's settings are one set of rows whichever
+* process asks. Before D870 the runner kept its own `<addonId>:addon-devices`
+* blob per device; a hub-side write to the rows was invisible to it.
+*/
+import { type DeviceSettingsDoor, type DeviceSettingsStore } from "../device-settings-store.js";
+/** The client calls the adapter uses. */
+export interface RunnerSettingsClient {
+	readonly query: {
+		query: DeviceSettingsDoor["query"];
+	};
+	readonly transact: {
+		mutate: DeviceSettingsDoor["transact"];
+	};
+	readonly deleteWhere: {
+		mutate: DeviceSettingsDoor["deleteWhere"];
+	};
+}
+/** The door slice the per-device store needs, over a tRPC client. */
+export declare function doorOverClient(client: RunnerSettingsClient, before?: () => Promise<void>): DeviceSettingsDoor;
+/** The per-device methods of a runner's `ctx.settings`. */
+export interface RunnerDeviceSettingsView {
+	readDeviceStore(deviceId: number): Promise<Record<string, unknown>>;
+	readDeviceStoreBatch: DeviceSettingsStore["readBatch"];
+	listDeviceStoreIds: DeviceSettingsStore["listIds"];
+	writeDeviceStore(deviceId: number, patch: Record<string, unknown>): Promise<void>;
+	clearDeviceStore(deviceId: number): Promise<void>;
+}
+/**
+* @param client the hub's `settingsStore` client, or `undefined` when the
+*   runner has none — every call then THROWS: a store that could not be asked
+*   is not an empty one.
+*/
+export declare function createRunnerDeviceSettings(client: RunnerSettingsClient | undefined, addonId: string, before?: () => Promise<void>): RunnerDeviceSettingsView;

package/dist/kernel/prefix-walk.d.ts

@@ -0,0 +1,39 @@
+/**
+* The keyset walk over one id prefix of a key/value collection, shared by the
+* settings door view and the per-device settings store. Split out of
+* `settings-door-view.ts` so the device store module does not import the view
+* that imports it.
+*/
+import type { ISettingsStoreProvider } from "@camstack/types";
+export declare function unwrapStoredValue(parsed: unknown): unknown;
+/**
+* Every row under `prefix`, or a throw — never the first 2 000 of them.
+*
+* **The defect.** This issued ONE `query` with no `limit`, and
+* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
+* and cuts the result there. On the live hub that fired 138 times in two hours
+* (`settings-store query truncated by a defensive row cap`, collection
+* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
+* ~1 019-device fleet with more than two stored keys per device puts one
+* addon's `<addonId>:` range past the cap. The engine warned; the door did not
+* notice, and handed its caller a short map that is **shape-identical to a
+* complete one**. Every device whose rows sort past the cap reads as "has no
+* stored settings", which is exactly what a device with none looks like.
+*
+* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
+* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
+* row (ids are unique, so a full page always advances) and no row can fall
+* between two pages the way an `OFFSET` walk drops rows under a concurrent
+* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
+* suffix, so the duplicate overwrites itself with its own value.
+*
+* `ORDER BY id` is not decoration — the cursor is only meaningful if the
+* engine returns the range in the order the cursor advances through. It is the
+* primary key, so the ordering is the range scan's own.
+*
+* @throws when the prefix cannot be expressed as a range and the collection is
+*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
+*   A throw is the point: a caller that cannot be answered completely must not
+*   be handed something that looks like a complete answer.
+*/
+export declare function loadPrefixed(door: Pick<ISettingsStoreProvider, "query">, collection: string, prefix: string, decode?: (data: unknown) => unknown): Promise<Record<string, unknown>>;

package/dist/kernel/sections-store.d.ts

@@ -0,0 +1,20 @@
+/**
+* Settings SECTIONS (D870): a section is the `system-settings` rows under
+* `<section>.` - one place for every process. A forked runner used to keep a
+* `sections` blob table of its own that nobody else wrote, so `getSection('server')`
+* answered `{}` there and the real values in hub-main.
+*
+* A section a bootstrap file owns (`auth`, `server`, ...) is answered only for
+* the keys the store may answer ({@link storeMayAnswer}); the rest of such a
+* section is env + config.yaml and lives in the hub process alone.
+*/
+import type { ISettingsStoreProvider } from "@camstack/types";
+/** The door slice sections need. */
+export type SectionsDoor = Pick<ISettingsStoreProvider, "query" | "get" | "set">;
+export interface SectionsStore {
+	/** Stored keys of a section, or a throw when the store cannot be asked. */
+	read(section: string): Promise<Record<string, unknown>>;
+	/** Set each key of `patch`. Errors propagate; no read, so no lost update. */
+	write(section: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
+}
+export declare function createSectionsStore(door: SectionsDoor): SectionsStore;

package/dist/kernel/settings-door-view.d.ts

@@ -13,7 +13,7 @@
 * forked-runner namespaced tables. Device-manager still lives here.
 */
 import type { ISettingsStoreProvider } from "@camstack/types";
-import type { SettingsViewBackend } from "./config-manager.js";
+import type { SettingsViewBackend } from "./settings-view-types.js";
 /**
 * Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
 *
@@ -28,7 +28,7 @@ import type { SettingsViewBackend } from "./config-manager.js";
 * (D675). These reads are small and rare: a section's handful of keys when a
 * form opens, and the capability preferences once at boot.
 */
-export declare function loadSystemSettingsPrefix(door: ISettingsStoreProvider, prefix: string, mayRead?: (suffix: string) => boolean): Promise<Record<string, unknown>>;
+export declare function loadSystemSettingsPrefix(door: Pick<ISettingsStoreProvider, "query" | "get">, prefix: string, mayRead?: (suffix: string) => boolean): Promise<Record<string, unknown>>;
 /**
 * The `system-settings` section surface a door-backed view delegates to.
 * `getSection` is ASYNC: it reads the section through the door (D675) — a

package/dist/kernel/settings-view-types.d.ts

@@ -12,12 +12,10 @@ export interface AddonSettingsView {
 	readAddonStoreKeyResult?(key: string): Promise<StoredKeyRead>;
 	writeAddonStore(patch: Record<string, unknown>): Promise<void>;
 	readDeviceStore(deviceId: number): Promise<Record<string, unknown>>;
-	/** See `IAddonContext['settings'].readDeviceStoreBatch` — optional there and
-	*  here for the same reason: only the door-backed view can answer it in one
-	*  range scan, and a caller must fall back rather than refuse. */
-	readDeviceStoreBatch?(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
-	/** See `IAddonContext['settings'].listDeviceStoreIds` — door-backed views only. */
-	listDeviceStoreIds?(): Promise<readonly number[]>;
+	/** See `IAddonContext['settings'].readDeviceStoreBatch`. */
+	readDeviceStoreBatch(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
+	/** See `IAddonContext['settings'].listDeviceStoreIds`. */
+	listDeviceStoreIds(): Promise<readonly number[]>;
 	writeDeviceStore(deviceId: number, patch: Record<string, unknown>): Promise<void>;
 	clearDeviceStore(deviceId: number): Promise<void>;
 	getSection(section: string): Promise<Record<string, unknown>>;
@@ -44,15 +42,8 @@ export interface AddonSettingsView {
 /**
 * A CONCRETE backend behind {@link ConfigManager.createSettingsView} — the
 * sync-`ISettingsStore` one or the async-door one.
-*
-* `readDeviceStoreBatch` is required here and optional on
-* {@link AddonSettingsView} because both of these can answer it, so the view
-* the kernel hands an addon never has to decide whether the method exists.
-* The optionality on the public interface stays for the implementation that
-* genuinely cannot batch: a forked runner's UDS-backed view.
 */
 export interface SettingsViewBackend extends AddonSettingsView {
-	readDeviceStoreBatch(deviceIds: readonly number[]): Promise<ReadonlyMap<number, Record<string, unknown>>>;
 	readAddonStoreKeyResult(key: string): Promise<StoredKeyRead>;
 }
 export interface ISettingsStore {
@@ -70,26 +61,10 @@ export interface ISettingsStore {
 	getAllDevice(deviceId: string): Record<string, unknown>;
 	setDevice(deviceId: string, key: string, value: unknown): void;
 	/**
-	* Multi-level addon settings: per-device overrides for a specific addon.
-	*
-	* Resolution chain when the frontend asks for the effective value of a
-	* field on a given device:
-	*   1. schema default (from `ConfigUISchema.field.default`)
-	*   2. `getAllAddon(addonId)`           — addon global value
-	*   3. `getAddonDevice(addonId, devId)` — per-device override (wins)
-	*
-	* Only fields declared with `scope: 'device'` in the addon's
-	* `ConfigUISchema` should ever be persisted here.
-	*/
-	getAddonDevice(addonId: string, deviceId: string): Record<string, unknown>;
-	setAddonDevice(addonId: string, deviceId: string, values: Record<string, unknown>): void;
-	clearAddonDevice(addonId: string, deviceId: string): void;
-	/**
 	* Per-device runtime state — the whole cap-slice map as ONE row in the
 	* `device-runtime-state` collection.
 	*
-	* These are separate from `getAddonDevice`/`setAddonDevice` because runtime
-	* state is not an addon's config: it belongs to the device, it is replaced
+	* Runtime state is not an addon's config: it belongs to the device, it is replaced
 	* wholesale on every flush, and it is written orders of magnitude more often.
 	* It USED to share that keyspace under a synthetic `__device-state` addonId,
 	* which cost one row (and one INSERT) per cap slice per flush and left the

package/dist/kernel/store-settings-view.d.ts

@@ -5,9 +5,6 @@ export interface StoreViewHost {
 	getBootstrap(configPath: string): unknown;
 	getAddonConfig(addonId: string): Record<string, unknown>;
 	setAddonConfig(addonId: string, config: Record<string, unknown>): void;
-	getAddonDevice(addonId: string, deviceId: string): Record<string, unknown>;
-	setAddonDevice(addonId: string, deviceId: string, values: Record<string, unknown>): void;
-	clearAddonDevice(addonId: string, deviceId: string): void;
 	getDeviceRuntimeState(deviceId: string): Record<string, unknown>;
 	setDeviceRuntimeState(deviceId: string, blob: Record<string, unknown>): void;
 	clearDeviceRuntimeState(deviceId: string): void;

package/dist/prefix-range-D_KueXbQ.js

@@ -0,0 +1,27 @@
+//#region src/builtins/sqlite-storage/prefix-range.ts
+var MAX_ASCII = 127;
+/**
+* @returns the range for `prefix`, or `null` when the caller must fall back to
+*   a `LIKE` scan (empty prefix — which is the whole table and has no upper
+*   bound — or any byte outside ASCII).
+*/
+function prefixRange(prefix) {
+	if (prefix.length === 0) return null;
+	for (let i = 0; i < prefix.length; i++) {
+		const code = prefix.charCodeAt(i);
+		if (code === 0 || code > MAX_ASCII) return null;
+	}
+	const last = prefix.charCodeAt(prefix.length - 1);
+	if (last >= MAX_ASCII) return null;
+	return {
+		lo: prefix,
+		hi: prefix.slice(0, -1) + String.fromCharCode(last + 1)
+	};
+}
+//#endregion
+Object.defineProperty(exports, "prefixRange", {
+	enumerable: true,
+	get: function() {
+		return prefixRange;
+	}
+});

package/dist/prefix-range-Dl0znowN.mjs

@@ -0,0 +1,22 @@
+//#region src/builtins/sqlite-storage/prefix-range.ts
+var MAX_ASCII = 127;
+/**
+* @returns the range for `prefix`, or `null` when the caller must fall back to
+*   a `LIKE` scan (empty prefix — which is the whole table and has no upper
+*   bound — or any byte outside ASCII).
+*/
+function prefixRange(prefix) {
+	if (prefix.length === 0) return null;
+	for (let i = 0; i < prefix.length; i++) {
+		const code = prefix.charCodeAt(i);
+		if (code === 0 || code > MAX_ASCII) return null;
+	}
+	const last = prefix.charCodeAt(prefix.length - 1);
+	if (last >= MAX_ASCII) return null;
+	return {
+		lo: prefix,
+		hi: prefix.slice(0, -1) + String.fromCharCode(last + 1)
+	};
+}
+//#endregion
+export { prefixRange as t };

package/dist/prefix-walk-DAOBSyH1.mjs

@@ -0,0 +1,88 @@
+import { t as prefixRange } from "./prefix-range-Dl0znowN.mjs";
+//#region src/kernel/prefix-walk.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrapStoredValue(parsed) {
+	if (!isRecord(parsed) || !("value" in parsed)) return parsed;
+	return parsed.value;
+}
+/**
+* Rows one page of a prefix read asks for.
+*
+* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
+* this read now names its own bound, so the engine's defensive cap is never the
+* thing that decides how much of the answer the caller gets.
+*/
+var PREFIX_PAGE_ROWS = 1e3;
+/**
+* Pages one prefix read may take before it refuses.
+*
+* 512 pages is 512 000 rows — three orders of magnitude past the largest live
+* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
+* still a bound, because a walk with no bound is the defect this file was
+* fixing, not one to reintroduce.
+*/
+var PREFIX_PAGE_BUDGET = 512;
+/**
+* Every row under `prefix`, or a throw — never the first 2 000 of them.
+*
+* **The defect.** This issued ONE `query` with no `limit`, and
+* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
+* and cuts the result there. On the live hub that fired 138 times in two hours
+* (`settings-store query truncated by a defensive row cap`, collection
+* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
+* ~1 019-device fleet with more than two stored keys per device puts one
+* addon's `<addonId>:` range past the cap. The engine warned; the door did not
+* notice, and handed its caller a short map that is **shape-identical to a
+* complete one**. Every device whose rows sort past the cap reads as "has no
+* stored settings", which is exactly what a device with none looks like.
+*
+* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
+* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
+* row (ids are unique, so a full page always advances) and no row can fall
+* between two pages the way an `OFFSET` walk drops rows under a concurrent
+* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
+* suffix, so the duplicate overwrites itself with its own value.
+*
+* `ORDER BY id` is not decoration — the cursor is only meaningful if the
+* engine returns the range in the order the cursor advances through. It is the
+* primary key, so the ordering is the range scan's own.
+*
+* @throws when the prefix cannot be expressed as a range and the collection is
+*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
+*   A throw is the point: a caller that cannot be answered completely must not
+*   be handed something that looks like a complete answer.
+*/
+async function loadPrefixed(door, collection, prefix, decode = unwrapStoredValue) {
+	const range = prefixRange(prefix);
+	const result = {};
+	let cursor = range?.lo ?? null;
+	for (let page = 0;; page++) {
+		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
+		const rows = await door.query({
+			collection,
+			filter: {
+				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: PREFIX_PAGE_ROWS
+			}
+		});
+		for (const row of rows) {
+			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+			if (!row.id.startsWith(prefix)) continue;
+			result[row.id.slice(prefix.length)] = decode(row.data);
+		}
+		if (rows.length < PREFIX_PAGE_ROWS) return result;
+		const last = rows[rows.length - 1];
+		if (last === void 0) return result;
+		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
+		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
+		cursor = last.id;
+	}
+}
+//#endregion
+export { unwrapStoredValue as n, loadPrefixed as t };