@camstack/system 1.2.439 → 1.2.441

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Ar as DEVICE_SETTINGS_CONTRIBUTION_METHODS, B as METHOD_ACCESS_MAP, Br as asString$1, Dr as errMsg$1, En as objectInputDeclaresRequiredDeviceId, Fr as ReadinessTimeoutError, Gn as scopesAllowDeviceCap, Kt as extractNestedAddonId, Nr as RUNTIME_DEFAULTS, Pr as ReadinessRegistry, Qt as interpolate, R as LOG_LEVEL_RANK, Rr as asJsonObject$1, Tn as objectInputDeclaresAddonId, Vn as resolveMethodAuth, Wn as scopesAllowAddon, Wr as createEvent$1, Yr as expandCapMethods, Zn as splitTranslationRef, _ as CatalogFileSchema, an as isVoidInput, d as CATALOG_LANGS, dn as lifecycleJobSchema, en as isArrayOutputSchema, fi as scopeKey, gn as looseSchema, hn as logLevelAtMost, in as isObjectInput, ir as supportedRuntimes, jn as procedureAuthKey, jr as DEVICE_STATUS_METHOD, kr as DATAPLANE_SECRET_HEADER$1, li as readinessKey, n as AGENT_MDNS_TXT_KEYS, oi as parseJsonObject, on as kebabToCamel$1, qr as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, rt as addonSettingsCapability, si as parseJsonUnknown, t as AGENT_MDNS_SERVICE_TYPE, tn as isCollectionArrayMethod, ui as resolveCapMount, vi as userError, yi as EventCategory$1, zr as asNumber } from "./dist-yI6kF6r6.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-46BUsWD1.mjs";
+import { $n as splitTranslationRef, Ar as errMsg$1, B as METHOD_ACCESS_MAP, Dn as objectInputDeclaresAddonId, Hr as asNumber, Ir as RUNTIME_DEFAULTS, Jt as extractNestedAddonId, Kn as scopesAllowAddon, Lr as ReadinessRegistry, Mr as DATAPLANE_SECRET_HEADER$1, Nn as procedureAuthKey, Nr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, On as objectInputDeclaresRequiredDeviceId, Pr as DEVICE_STATUS_METHOD, Qr as expandCapMethods, R as LOG_LEVEL_RANK, Rr as ReadinessTimeoutError, Si as EventCategory$1, Un as resolveMethodAuth, Ur as asString$1, Vr as asJsonObject$1, Xr as emitDownForOwnedCaps, _ as CatalogFileSchema, _n as logLevelAtMost, at as addonSettingsCapability, cn as kebabToCamel$1, d as CATALOG_LANGS, en as interpolate, fi as readinessKey, hi as scopeKey, li as parseJsonObject, n as AGENT_MDNS_TXT_KEYS, nn as isArrayOutputSchema, on as isObjectInput, pi as resolveCapMount, pn as lifecycleJobSchema, qn as scopesAllowDeviceCap, qr as createEvent$1, r as ALL_CAPABILITY_DEFINITIONS, rn as isCollectionArrayMethod, sn as isVoidInput, sr as supportedRuntimes, t as AGENT_MDNS_SERVICE_TYPE, ui as parseJsonUnknown, vn as looseSchema, xi as userError } from "./dist-BWvkuc31.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-D8Ri9TVz.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -9,9 +9,12 @@ import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";
 import "./builtins/composer/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
 import { ConsoleDestination, ConsoleLoggingAddon } from "./builtins/console-logging/index.mjs";
-import { CoreBlocksAddon } from "./builtins/core-blocks/core-blocks.addon.mjs";
+import { t as prefixRange } from "./prefix-range-Dl0znowN.mjs";
+import { t as loadPrefixed } from "./prefix-walk-DAOBSyH1.mjs";
+import { CoreBlocksAddon, c as createAddonSettingsStore } from "./builtins/core-blocks/core-blocks.addon.mjs";
 import "./builtins/core-blocks/index.mjs";
-import { DeviceManagerAddon, t as setWrapperActive } from "./builtins/device-manager/device-manager.addon.mjs";
+import { t as RETIRED_SETTINGS_KEYS } from "./retired-settings-keys-Bhwe4ymb.mjs";
+import { DeviceManagerAddon, n as readDeviceOrThrow, r as setWrapperActive, t as createDeviceSettingsStore } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
@@ -21,21 +24,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-xsvdT5Go.mjs";
+import { c as SqliteSettingsBackend } from "./wal-maintenance-B57SAp4a.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-U0d4uvn2.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-B92BjObl.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DJILnUSb.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DGwVc2uh.mjs";
+import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-CyUuhATc.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Cnd0bTB9.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CpdUO-uS.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-4ziluTU3.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -47,13 +50,13 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 import * as os$1 from "node:os";
 import { tmpdir } from "node:os";
 import { pathToFileURL } from "node:url";
+import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readErrorI18n, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import * as fs from "node:fs";
 import { accessSync, constants, createReadStream, createWriteStream, existsSync, readFileSync, readdirSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 import * as util from "node:util";
 import { promisify } from "node:util";
 import { once } from "node:events";
-import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readErrorI18n, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { createServer as createServer$1, request } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
@@ -1171,23 +1174,23 @@ function formatSocketPlane(window) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-queue-report.ts
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null;
 }
 /** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
 function writerSocketsOf(broker) {
-	if (!isRecord$6(broker)) return void 0;
+	if (!isRecord$7(broker)) return void 0;
 	const transit = broker["transit"];
-	if (!isRecord$6(transit)) return void 0;
+	if (!isRecord$7(transit)) return void 0;
 	const transporter = transit["tx"];
-	if (!isRecord$6(transporter)) return void 0;
+	if (!isRecord$7(transporter)) return void 0;
 	const writer = transporter["writer"];
-	if (!isRecord$6(writer)) return void 0;
+	if (!isRecord$7(writer)) return void 0;
 	const sockets = writer["sockets"];
 	return sockets instanceof Map ? sockets : void 0;
 }
 function readSocket(nodeId, socket) {
-	if (typeof nodeId !== "string" || !isRecord$6(socket)) return void 0;
+	if (typeof nodeId !== "string" || !isRecord$7(socket)) return void 0;
 	const queuedBytes = socket["writableLength"];
 	const bytesWritten = socket["bytesWritten"];
 	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
@@ -6307,7 +6310,7 @@ async function resolveUncached(options) {
 }
 //#endregion
 //#region src/kernel/addon-class-resolver.ts
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6331,14 +6334,14 @@ function isRecord$5(value) {
 function isAddonConstructor(fn) {
 	if (typeof fn !== "function") return false;
 	const proto = fn.prototype;
-	if (!isRecord$5(proto)) return false;
+	if (!isRecord$6(proto)) return false;
 	return typeof proto["initialize"] === "function";
 }
 function resolveAddonClass(mod) {
 	let candidate = mod["default"];
-	if (isRecord$5(candidate) && "default" in candidate) candidate = candidate["default"];
+	if (isRecord$6(candidate) && "default" in candidate) candidate = candidate["default"];
 	if (isAddonConstructor(candidate)) return candidate;
-	if (isRecord$5(candidate)) {
+	if (isRecord$6(candidate)) {
 		const fn = Object.values(candidate).find(isAddonConstructor);
 		if (fn) return fn;
 	}
@@ -6347,7 +6350,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6445,9 +6448,9 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function toAddonPackageManifest(value) {
-	if (!isRecord$4(value)) return void 0;
+	if (!isRecord$5(value)) return void 0;
 	if (!Array.isArray(value.addons)) return void 0;
-	if (!value.addons.every((a) => isRecord$4(a) && typeof a.id === "string")) return void 0;
+	if (!value.addons.every((a) => isRecord$5(a) && typeof a.id === "string")) return void 0;
 	return value;
 }
 /** Minimal no-op logger for default parameter */
@@ -6597,7 +6600,7 @@ var AddonLoader = class {
 		}
 		if (!fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$4(modUnknown) ? modUnknown : {};
+		const mod = isRecord$5(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -6613,7 +6616,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$4(modUnknown) ? modUnknown : {};
+		const mod = isRecord$5(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -11533,92 +11536,11 @@ async function runHubAddonBoot(steps) {
 }
 //#endregion
 //#region src/kernel/settings-door-view.ts
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asBlob(value) {
-	return isRecord$3(value) ? value : {};
-}
-function unwrapValue(parsed) {
-	if (!isRecord$3(parsed) || !("value" in parsed)) return parsed;
-	return parsed.value;
-}
-/**
-* Rows one page of a prefix read asks for.
-*
-* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
-* this read now names its own bound, so the engine's defensive cap is never the
-* thing that decides how much of the answer the caller gets.
-*/
-var PREFIX_PAGE_ROWS = 1e3;
-/**
-* Pages one prefix read may take before it refuses.
-*
-* 512 pages is 512 000 rows — three orders of magnitude past the largest live
-* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
-* still a bound, because a walk with no bound is the defect this file was
-* fixing, not one to reintroduce.
-*/
-var PREFIX_PAGE_BUDGET = 512;
-/**
-* Every row under `prefix`, or a throw — never the first 2 000 of them.
-*
-* **The defect.** This issued ONE `query` with no `limit`, and
-* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
-* and cuts the result there. On the live hub that fired 138 times in two hours
-* (`settings-store query truncated by a defensive row cap`, collection
-* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
-* ~1 019-device fleet with more than two stored keys per device puts one
-* addon's `<addonId>:` range past the cap. The engine warned; the door did not
-* notice, and handed its caller a short map that is **shape-identical to a
-* complete one**. Every device whose rows sort past the cap reads as "has no
-* stored settings", which is exactly what a device with none looks like.
-*
-* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
-* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
-* row (ids are unique, so a full page always advances) and no row can fall
-* between two pages the way an `OFFSET` walk drops rows under a concurrent
-* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
-* suffix, so the duplicate overwrites itself with its own value.
-*
-* `ORDER BY id` is not decoration — the cursor is only meaningful if the
-* engine returns the range in the order the cursor advances through. It is the
-* primary key, so the ordering is the range scan's own.
-*
-* @throws when the prefix cannot be expressed as a range and the collection is
-*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
-*   A throw is the point: a caller that cannot be answered completely must not
-*   be handed something that looks like a complete answer.
-*/
-async function loadPrefixed(door, collection, prefix, decode = unwrapValue) {
-	const range = prefixRange(prefix);
-	const result = {};
-	let cursor = range?.lo ?? null;
-	for (let page = 0;; page++) {
-		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
-		const rows = await door.query({
-			collection,
-			filter: {
-				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
-				orderBy: {
-					field: "id",
-					direction: "asc"
-				},
-				limit: PREFIX_PAGE_ROWS
-			}
-		});
-		for (const row of rows) {
-			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
-			if (!row.id.startsWith(prefix)) continue;
-			result[row.id.slice(prefix.length)] = decode(row.data);
-		}
-		if (rows.length < PREFIX_PAGE_ROWS) return result;
-		const last = rows[rows.length - 1];
-		if (last === void 0) return result;
-		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
-		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
-		cursor = last.id;
-	}
+	return isRecord$4(value) ? value : {};
 }
 /**
 * Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
@@ -11646,106 +11568,34 @@ async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
 	}
 	return result;
 }
-async function replacePrefixed(door, collection, prefix, values, wrap) {
-	const range = prefixRange(prefix);
-	if (range !== null) await door.deleteWhere({
-		collection,
-		filter: { whereBetween: { id: [range.lo, range.hi] } }
-	});
-	for (const [key, value] of Object.entries(values)) {
-		if (value === void 0) continue;
-		await door.set({
-			collection,
-			key: `${prefix}${key}`,
-			value: wrap(key, value)
-		});
-	}
-}
 function createDoorSettingsView(addonId, door, sections) {
-	const addonPrefix = `${addonId}.`;
+	const addonStore = createAddonSettingsStore(door, addonId);
+	const deviceStore = createDeviceSettingsStore(door, addonId);
 	return {
 		async readAddonStore() {
-			return loadPrefixed(door, "addon-settings", addonPrefix);
-		},
-		async readAddonStoreKeyResult(key) {
-			try {
-				const row = await door.get({
-					collection: "addon-settings",
-					key: `${addonPrefix}${key}`
-				});
-				return row === void 0 ? { kind: "absent" } : {
-					kind: "present",
-					value: unwrapValue(row)
-				};
-			} catch (err) {
-				return {
-					kind: "unreadable",
-					reason: "store-read-failed",
-					error: err instanceof Error ? err.message : String(err)
-				};
+			const read = await addonStore.read();
+			switch (read.kind) {
+				case "present": return { ...read.value };
+				case "absent": return {};
+				case "unreadable": throw new Error(`settings of "${addonId}" could not be read: ${read.error}`);
 			}
 		},
-		async writeAddonStore(patch) {
-			await replacePrefixed(door, "addon-settings", addonPrefix, {
-				...await loadPrefixed(door, "addon-settings", addonPrefix),
-				...patch
-			}, (key, value) => ({
-				addonId,
-				key,
-				value
-			}));
+		async readAddonStoreKeyResult(key) {
+			const read = await addonStore.readKey(key);
+			return read.kind === "unreadable" ? {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: read.error
+			} : read;
 		},
+		writeAddonStore: (patch) => addonStore.merge(patch),
 		async readDeviceStore(deviceId) {
-			return loadPrefixed(door, "addon-device-settings", `${addonId}:${String(deviceId)}.`);
-		},
-		async readDeviceStoreBatch(deviceIds) {
-			const out = /* @__PURE__ */ new Map();
-			if (deviceIds.length === 0) return out;
-			for (const id of deviceIds) out.set(id, {});
-			const wanted = new Set(deviceIds);
-			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`);
-			for (const [suffix, value] of Object.entries(all)) {
-				const dot = suffix.indexOf(".");
-				if (dot <= 0) continue;
-				const deviceId = Number(suffix.slice(0, dot));
-				if (!Number.isInteger(deviceId) || !wanted.has(deviceId)) continue;
-				const blob = out.get(deviceId);
-				if (blob === void 0) continue;
-				blob[suffix.slice(dot + 1)] = value;
-			}
-			return out;
-		},
-		async listDeviceStoreIds() {
-			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`, () => null);
-			const ids = /* @__PURE__ */ new Set();
-			for (const suffix of Object.keys(all)) {
-				const dot = suffix.indexOf(".");
-				if (dot <= 0) continue;
-				const deviceId = Number(suffix.slice(0, dot));
-				if (Number.isInteger(deviceId) && deviceId > 0) ids.add(deviceId);
-			}
-			return [...ids].toSorted((a, b) => a - b);
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const scope = `${addonId}:${String(deviceId)}.`;
-			await replacePrefixed(door, "addon-device-settings", scope, {
-				...await loadPrefixed(door, "addon-device-settings", scope),
-				...patch
-			}, (key, value) => ({
-				addonId,
-				deviceId: String(deviceId),
-				key,
-				value
-			}));
-		},
-		async clearDeviceStore(deviceId) {
-			const range = prefixRange(`${addonId}:${String(deviceId)}.`);
-			if (range === null) return;
-			await door.deleteWhere({
-				collection: "addon-device-settings",
-				filter: { whereBetween: { id: [range.lo, range.hi] } }
-			});
+			return readDeviceOrThrow(deviceStore, deviceId);
 		},
+		readDeviceStoreBatch: (deviceIds) => deviceStore.readBatch(deviceIds),
+		listDeviceStoreIds: () => deviceStore.listIds(),
+		writeDeviceStore: (deviceId, patch) => deviceStore.merge(deviceId, patch),
+		clearDeviceStore: (deviceId) => deviceStore.clear(deviceId),
 		async readDeviceRuntimeState(deviceId) {
 			return asBlob(await door.get({
 				collection: "device-runtime-state",
@@ -14259,7 +14109,7 @@ import_js_yaml.default;
 * so that file stays one class. The `console.*` calls are the documented
 * residuals described on `ConfigManager` (no logger exists yet at boot).
 */
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Sections that live in config.yaml. Everything else goes to the settings-store. */
@@ -14350,7 +14200,7 @@ function setNested(obj, configPath, value) {
 		[head]: value
 	};
 	const existing = obj[head];
-	const child = isRecord$2(existing) ? existing : {};
+	const child = isRecord$3(existing) ? existing : {};
 	return {
 		...obj,
 		[head]: setNested(child, rest.join("."), value)
@@ -14383,8 +14233,10 @@ function loadYaml(configPath) {
 //#endregion
 //#region src/kernel/store-settings-view.ts
 function createStoreSettingsView(addonId, cm) {
+	const refuseDeviceSettings = async () => {
+		throw new Error(`device settings of addon "${addonId}" are served by the settings-store door only`);
+	};
 	const viewAddonConfig = () => !cm.hasSyncStore() ? asJsonObject(cm.getBootstrap(`addons.${addonId}`)) ?? {} : cm.getAddonConfig(addonId);
-	const viewAddonDevice = (deviceId) => !cm.hasSyncStore() ? {} : cm.getAddonDevice(addonId, deviceId);
 	return {
 		async readAddonStore() {
 			return viewAddonConfig();
@@ -14416,29 +14268,11 @@ function createStoreSettingsView(addonId, cm) {
 				...patch
 			});
 		},
-		async readDeviceStore(deviceId) {
-			return viewAddonDevice(String(deviceId));
-		},
-		async readDeviceStoreBatch(deviceIds) {
-			const out = /* @__PURE__ */ new Map();
-			for (const deviceId of deviceIds) try {
-				out.set(deviceId, viewAddonDevice(String(deviceId)));
-			} catch {
-				out.set(deviceId, {});
-			}
-			return out;
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const key = String(deviceId);
-			const existing = viewAddonDevice(key);
-			cm.setAddonDevice(addonId, key, {
-				...existing,
-				...patch
-			});
-		},
-		async clearDeviceStore(deviceId) {
-			cm.clearAddonDevice(addonId, String(deviceId));
-		},
+		readDeviceStore: refuseDeviceSettings,
+		readDeviceStoreBatch: refuseDeviceSettings,
+		listDeviceStoreIds: refuseDeviceSettings,
+		writeDeviceStore: refuseDeviceSettings,
+		clearDeviceStore: refuseDeviceSettings,
 		async readDeviceRuntimeState(deviceId) {
 			return cm.getDeviceRuntimeState(String(deviceId));
 		},
@@ -14623,7 +14457,7 @@ var SystemSettingsMirror = class {
 };
 //#endregion
 //#region src/kernel/config-manager.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorText(err) {
@@ -14812,7 +14646,7 @@ var ConfigManager = class {
 	async readAddonDeviceStrict(addonId, deviceId) {
 		const door = this.settingsDoor;
 		switch (this.backendMode()) {
-			case "store": return this.getAddonDevice(addonId, String(deviceId));
+			case "store": break;
 			case "door":
 				if (door === null) break;
 				try {
@@ -14830,34 +14664,6 @@ var ConfigManager = class {
 		this.settingsStore.setAllAddon(addonId, config);
 	}
 	/**
-	* Read per-device overrides for a specific addon. Returns a flat record
-	* of field → value. Missing keys fall back to the addon-global value via
-	* `getAddonConfig(addonId)` — that composition is the resolver service's
-	* responsibility, not ConfigManager's.
-	* SYNC store only — THROWS without one (D675); async: {@link readAddonDeviceStrict}.
-	*/
-	getAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) throw this.refuseSyncRead("getAddonDevice", `addon "${addonId}" device "${deviceId}"`);
-		return this.settingsStore.getAddonDevice(addonId, deviceId);
-	}
-	/**
-	* Write (bulk-replace) per-device overrides for a specific addon.
-	* Throws if the settings store is not yet wired.
-	*/
-	setAddonDevice(addonId, deviceId, values) {
-		if (this.settingsStore === null) throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-		this.settingsStore.setAddonDevice(addonId, deviceId, values);
-	}
-	/**
-	* Clear all per-device overrides for a specific addon/device pair.
-	* Resolution falls back to the addon-global value after this call.
-	* No-op if the settings store is not yet wired.
-	*/
-	clearAddonDevice(addonId, deviceId) {
-		if (this.settingsStore === null) return;
-		this.settingsStore.clearAddonDevice(addonId, deviceId);
-	}
-	/**
 	* The device's persisted runtime-state blob. THROWS before the store is
 	* wired: a store not asked is not an empty row (D677, D675).
 	*/
@@ -14934,11 +14740,7 @@ var ConfigManager = class {
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
-			listDeviceStoreIds: async () => {
-				const list = active().listDeviceStoreIds;
-				if (list === void 0) throw new Error("listDeviceStoreIds is not available on this settings view");
-				return list.call(active());
-			},
+			listDeviceStoreIds: () => active().listDeviceStoreIds(),
 			writeDeviceStore: (deviceId, patch) => active().writeDeviceStore(deviceId, patch),
 			clearDeviceStore: (deviceId) => active().clearDeviceStore(deviceId),
 			getSection: (section) => active().getSection(section),
@@ -15014,7 +14816,7 @@ var ConfigManager = class {
 		const keys = configPath.split(".");
 		let current = this.bootstrapConfig;
 		for (const key of keys) {
-			if (!isRecord$1(current)) return void 0;
+			if (!isRecord$2(current)) return void 0;
 			current = current[key];
 		}
 		return current;
@@ -15865,27 +15667,6 @@ function asName(value) {
 	return typeof value === "string" && value.length > 0 ? value : null;
 }
 //#endregion
-//#region src/kernel/moleculer/settings-read-guard.ts
-/**
-* Merge `patch` over the current value and write it — unless the read failed,
-* in which case write NOTHING.
-*
-* Returns whether the write was attempted, so a caller can surface the refusal.
-*/
-async function readModifyWrite(input) {
-	const current = await input.read();
-	if (current.kind === "failed") {
-		input.onRefused(current.error);
-		return false;
-	}
-	const base = current.kind === "value" ? current.value : {};
-	await input.write({
-		...base,
-		...input.patch
-	});
-	return true;
-}
-//#endregion
 //#region src/kernel/moleculer/children-batch-loader.ts
 /**
 * Narrow an untyped cap answer to the fields the reconcile reads.
@@ -16020,7 +15801,7 @@ var RuntimeStateLoadError = class extends Error {
 		this.name = "RuntimeStateLoadError";
 	}
 };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage(err) {
@@ -16051,7 +15832,7 @@ async function loadRuntimeStateOrRefuse(load, logger, target) {
 	} catch (err) {
 		return refuse(errorMessage(err), err);
 	}
-	if (!isRecord(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
+	if (!isRecord$1(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
 	return answer;
 }
 //#endregion
@@ -23142,6 +22923,261 @@ function createRemoteProviderProxy(broker, serviceName, capName, nodeId, methods
 	return dispatcher;
 }
 //#endregion
+//#region src/kernel/sections-store.ts
+function createSectionsStore(door) {
+	return {
+		read: (section) => loadSystemSettingsPrefix(door, `${section}.`, (key) => storeMayAnswer(`${section}.${key}`)),
+		write: async (section, patch) => {
+			for (const [key, value] of Object.entries(patch)) await door.set({
+				collection: "system-settings",
+				key: `${section}.${key}`,
+				value
+			});
+		}
+	};
+}
+//#endregion
+//#region src/kernel/moleculer/runner-addon-settings.ts
+/** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
+function createRunnerAddonSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = async () => {
+			throw new Error(`settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readAddonStore: refuse,
+			readAddonStoreResult: async () => ({
+				kind: "failed",
+				error: "settings store not wired"
+			}),
+			readAddonStoreKeyResult: async () => ({
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: "settings store not wired"
+			}),
+			writeAddonStore: refuse,
+			getSection: refuse,
+			setSection: refuse
+		};
+	}
+	const door = {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		get: async (input) => {
+			await before();
+			return client.get.query(input);
+		},
+		set: async (input) => {
+			await before();
+			return client.set.mutate(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		}
+	};
+	const store = createAddonSettingsStore(door, addonId);
+	const sections = createSectionsStore(door);
+	return {
+		readAddonStore: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return { ...read.value };
+				case "absent": return {};
+				case "unreadable": throw new Error(`settings of "${addonId}" could not be read: ${read.error}`);
+			}
+		},
+		readAddonStoreResult: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return {
+					kind: "value",
+					value: { ...read.value }
+				};
+				case "absent": return { kind: "missing" };
+				case "unreadable": return {
+					kind: "failed",
+					error: read.error
+				};
+			}
+		},
+		readAddonStoreKeyResult: async (key) => {
+			const read = await store.readKey(key);
+			return read.kind === "unreadable" ? {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: read.error
+			} : read;
+		},
+		writeAddonStore: (patch) => store.merge(patch),
+		getSection: (section) => sections.read(section),
+		setSection: (section, patch) => sections.write(section, patch)
+	};
+}
+//#endregion
+//#region src/kernel/legacy-blob-guard.ts
+/** Root keys retired long before D870: they never count as "settings still to migrate". */
+var OWN_RETIRED_ROOT_KEYS = new Set([
+	"recordingConfigs",
+	"recordingExports",
+	"recordingOpsLog",
+	"probeSnapshots",
+	"rtspTokens",
+	"profileMap"
+]);
+/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
+function isRetiredRootKey(addonId, key) {
+	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
+	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
+}
+var UnmigratedSettingsError = class extends Error {
+	constructor(addonId, what) {
+		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		this.name = "UnmigratedSettingsError";
+	}
+};
+async function countOf(client, input) {
+	const n = await client.count.query(input);
+	if (typeof n !== "number") throw new Error("settings store answered a non-number to a count");
+	return n;
+}
+var LEGACY_PAGE = 500;
+var LEGACY_PAGE_BUDGET = 200;
+var ID_TAIL = "";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Does the addon's per-device blob table hold a row the copy would actually
+* migrate - a positive numeric id with a non-empty record? An addon whose rows
+* the copy skips anyway must not be refused for them.
+*/
+async function hasMigratableDeviceRow(client, addonId) {
+	let cursor = "";
+	for (let page = 0; page < LEGACY_PAGE_BUDGET; page++) {
+		const rows = await client.query.query({
+			namespace: addonId,
+			collection: "addon-devices",
+			filter: {
+				whereBetween: { id: [cursor, ID_TAIL] },
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: LEGACY_PAGE
+			}
+		});
+		if (!Array.isArray(rows)) throw new Error("settings store answered a non-list to a query");
+		let lastId = cursor;
+		for (const row of rows) {
+			if (!isRecord(row) || typeof row["id"] !== "string") continue;
+			lastId = row["id"];
+			const id = Number(row["id"]);
+			const data = row["data"];
+			if (Number.isInteger(id) && id > 0 && isRecord(data) && Object.keys(data).length > 0) return true;
+		}
+		if (rows.length < LEGACY_PAGE || lastId === cursor) return false;
+		cursor = lastId;
+	}
+	throw new Error(`addon "${addonId}": more legacy blob pages than the guard will read`);
+}
+/**
+* THROWS when the addon has blob settings and the standard store has none of
+* its own. A store that cannot be asked also throws: it is not "no blobs".
+*/
+async function assertLegacyBlobsMigrated(client, addonId, logger) {
+	const legacyDevices = await hasMigratableDeviceRow(client, addonId);
+	const root = await client.get.query({
+		namespace: addonId,
+		collection: "addon-settings",
+		key: "root"
+	});
+	const legacySettings = isRecord(root) && Object.keys(root).some((key) => !isRetiredRootKey(addonId, key));
+	if (!legacyDevices && !legacySettings) return;
+	const rangeOf = (prefix) => {
+		const range = prefixRange(prefix);
+		if (range === null) throw new Error(`no id range for addon "${addonId}"`);
+		return { whereBetween: { id: [range.lo, range.hi] } };
+	};
+	const newDevices = await countOf(client, {
+		collection: "addon-device-settings",
+		filter: rangeOf(`${addonId}:`)
+	});
+	const newSettings = await countOf(client, {
+		collection: "addon-settings",
+		filter: rangeOf(`${addonId}.`)
+	});
+	const problems = [];
+	if (legacyDevices && newDevices === 0) problems.push("per-device blobs");
+	if (legacySettings && newSettings === 0) problems.push("an addon settings blob");
+	if (problems.length === 0) return;
+	const error = new UnmigratedSettingsError(addonId, problems.join(" and "));
+	logger.error(error.message, { meta: {
+		addonId,
+		newDevices,
+		newSettings
+	} });
+	throw error;
+}
+//#endregion
+//#region src/kernel/moleculer/runner-device-settings.ts
+/**
+* The forked runner's `ctx.settings` device methods (D870).
+*
+* A runner does not hold the settings door; it holds a tRPC client of the hub's
+* `settings-store` cap. This file adapts that client to the door slice the
+* per-device store needs and hands back the five view methods — the SAME module
+* hub-main's view uses, so a device's settings are one set of rows whichever
+* process asks. Before D870 the runner kept its own `<addonId>:addon-devices`
+* blob per device; a hub-side write to the rows was invisible to it.
+*/
+/** The door slice the per-device store needs, over a tRPC client. */
+function doorOverClient(client, before = async () => {}) {
+	return {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		},
+		deleteWhere: async (input) => {
+			await before();
+			return client.deleteWhere.mutate(input);
+		}
+	};
+}
+/**
+* @param client the hub's `settingsStore` client, or `undefined` when the
+*   runner has none — every call then THROWS: a store that could not be asked
+*   is not an empty one.
+*/
+function createRunnerDeviceSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = () => {
+			throw new Error(`device settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readDeviceStore: async () => refuse(),
+			readDeviceStoreBatch: async () => refuse(),
+			listDeviceStoreIds: async () => refuse(),
+			writeDeviceStore: async () => refuse(),
+			clearDeviceStore: async () => refuse()
+		};
+	}
+	const store = createDeviceSettingsStore(doorOverClient(client, before), addonId);
+	return {
+		readDeviceStore: (deviceId) => readDeviceOrThrow(store, deviceId),
+		readDeviceStoreBatch: (ids) => store.readBatch(ids),
+		listDeviceStoreIds: () => store.listIds(),
+		writeDeviceStore: (deviceId, patch) => store.merge(deviceId, patch),
+		clearDeviceStore: (deviceId) => store.clear(deviceId)
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/addon-context-factory.ts
 /** This runtime's node id, regardless of mode (broker.nodeID or the UDS child nodeId). */
 function runtimeNodeId(runtime) {
@@ -23408,20 +23444,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		}
 		return r.kind === "value" ? r.value : {};
 	};
-	/** Read-modify-write that REFUSES to write when the read failed. */
-	const mergeBlob = async (coll, key, patch, namespace) => {
-		await readModifyWrite({
-			read: () => readBlobResult(coll, key, namespace),
-			write: (next) => writeBlob(coll, key, next, namespace),
-			patch,
-			onRefused: (error) => {
-				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
-					error,
-					patchKeys: Object.keys(patch)
-				} });
-			}
-		});
-	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -23444,38 +23466,24 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 			} });
 		}
 	};
-	const rmwChains = /* @__PURE__ */ new Map();
-	const serializeRmw = (coll, key, op) => {
-		const chainKey = `${coll}/${key}`;
-		const next = (rmwChains.get(chainKey) ?? Promise.resolve()).catch(() => void 0).then(op);
-		rmwChains.set(chainKey, next);
-		next.finally(() => {
-			if (rmwChains.get(chainKey) === next) rmwChains.delete(chainKey);
-		}).catch(() => void 0);
-		return next;
+	const deviceSettingsClient = Reflect.get(api, "settingsStore");
+	let blobsChecked = null;
+	const bootGuard = () => {
+		const client = deviceSettingsClient;
+		if (client === void 0) return Promise.resolve();
+		blobsChecked ??= assertLegacyBlobsMigrated({
+			get: { query: (input) => client.get.query(input) },
+			query: { query: (input) => client.query.query(input) },
+			count: { query: (input) => client.count.query(input) }
+		}, addonId, scopedLogger).catch((err) => {
+			blobsChecked = null;
+			throw err;
+		});
+		return blobsChecked;
 	};
 	const settingsView = {
-		async readAddonStore() {
-			return readBlob("addon-settings", "root", addonId);
-		},
-		readAddonStoreResult: () => readBlobResult("addon-settings", "root", addonId),
-		async writeAddonStore(patch) {
-			return serializeRmw("addon-settings", "root", async () => {
-				await mergeBlob("addon-settings", "root", patch, addonId);
-			});
-		},
-		async readDeviceStore(deviceId) {
-			return readBlob("addon-devices", String(deviceId), addonId);
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const key = String(deviceId);
-			return serializeRmw("addon-devices", key, async () => {
-				await mergeBlob("addon-devices", key, patch, addonId);
-			});
-		},
-		async clearDeviceStore(deviceId) {
-			await writeBlob("addon-devices", String(deviceId), {}, addonId);
-		},
+		...createRunnerAddonSettings(deviceSettingsClient, addonId, bootGuard),
+		...createRunnerDeviceSettings(deviceSettingsClient, addonId, bootGuard),
 		async readDeviceRuntimeState(deviceId) {
 			return readBlob("device-runtime-state", String(deviceId));
 		},
@@ -23484,14 +23492,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async clearDeviceRuntimeState(deviceId) {
 			await writeBlob("device-runtime-state", String(deviceId), {});
-		},
-		async getSection(section) {
-			return readBlob("sections", section);
-		},
-		async setSection(section, patch) {
-			return serializeRmw("sections", section, async () => {
-				await mergeBlob("sections", section, patch);
-			});
 		}
 	};
 	const readinessRegistry = () => runtime.mode === "broker" ? getOrInitReadinessRegistry(runtime.broker, scopedEventBus, scopedLogger) : getOrInitReadinessRegistryForClient(runtime.client, scopedEventBus, scopedLogger, nodeId);