@camstack/system 1.2.461 → 1.2.462

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { An as isVoidInput, Bn as logLevelAtMost, Ca as userError, Ci as ReadinessTimeoutError, Fi as asString$1, Gi as defineRecordKinds, Hi as createEvent$1, In as lifecycleJobSchema, J as METHOD_ACCESS_MAP, Ji as expandCapMethods, K as LOG_LEVEL_RANK, Ki as emitDownForOwnedCaps, Mr as supportedRuntimes, Ni as asJsonObject$1, Pi as asNumber, Si as ReadinessRegistry, Ta as EventCategory$1, Tn as isCollectionArrayMethod, Vn as looseSchema, Xn as objectInputDeclaresAddonId, Zn as objectInputDeclaresRequiredDeviceId, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, bn as interpolate, bt as addonSettingsCapability, d as CATALOG_LANGS, fa as readinessKey, ga as scopeKey, ii as CALLER_STAMPED_CAPABILITIES$1, jn as kebabToCamel$1, kn as isObjectInput, la as parseJsonObject, ma as resolveCapMount, mn as extractNestedAddonId, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, ua as parseJsonUnknown, v as CatalogFileSchema, vr as scopesAllowDeviceCap, wa as withoutCallerStamp, wn as isArrayOutputSchema, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS } from "./dist-Wy8cTxg6.mjs";
+import { $r as errMsg$1, Ar as supportedRuntimes, Bi as createEvent$1, Ca as EventCategory$1, Cn as isCollectionArrayMethod, Dn as isObjectInput, J as METHOD_ACCESS_MAP, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Ki as expandCapMethods, Mi as asNumber, Ni as asString$1, On as isVoidInput, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Sa as withoutCallerStamp, Sn as isArrayOutputSchema, Sr as splitTranslationRef, Ui as defineRecordKinds, Wi as emitDownForOwnedCaps, Yn as objectInputDeclaresRequiredDeviceId, ai as DEVICE_STATUS_METHOD, bi as ReadinessRegistry, ca as parseJsonUnknown, d as CATALOG_LANGS, er as procedureAuthKey, fa as resolveCapMount, fn as extractNestedAddonId, fr as resolveMethodAuth, gr as scopesAllowDeviceCap, hr as scopesAllowAddon, ii as DEVICE_SETTINGS_CONTRIBUTION_METHODS, ji as asJsonObject$1, kn as kebabToCamel$1, ma as scopeKey, n as AGENT_MDNS_TXT_KEYS, ni as CALLER_STAMPED_CAPABILITIES$1, r as ALL_CAPABILITY_DEFINITIONS, ri as DATAPLANE_SECRET_HEADER$1, sa as parseJsonObject, t as AGENT_MDNS_SERVICE_TYPE, ua as readinessKey, v as CatalogFileSchema, vn as interpolate, vt as addonSettingsCapability, xa as userError, xi as ReadinessTimeoutError, yi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-8tWIDoWp.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-Bnkw8GyU.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BU_gnd-q.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -10,11 +10,9 @@ import { ComposerAddon } from "./builtins/composer/composer.addon.mjs";
 import "./builtins/composer/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
 import { ConsoleDestination, ConsoleLoggingAddon } from "./builtins/console-logging/index.mjs";
-import { t as prefixRange } from "./prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "./prefix-walk-DAOBSyH1.mjs";
 import { CoreBlocksAddon, o as createAddonSettingsStore } from "./builtins/core-blocks/core-blocks.addon.mjs";
 import "./builtins/core-blocks/index.mjs";
-import { t as RETIRED_SETTINGS_KEYS } from "./retired-settings-keys-Bhwe4ymb.mjs";
 import { DeviceManagerAddon, n as readDeviceOrThrow, r as setWrapperActive, t as createDeviceSettingsStore } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
@@ -27,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-Bj_MmDkr.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-BvzVehem.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-Iw3RSQup.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-BnkOdj9Q.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-CC7jpktS.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-CH5UXe_G.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-CJu0nhla.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Cuy7LUdz.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CM23Pq9B.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-BDua3jO6.mjs";
 import { n as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-Qhn5TOYZ.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -1178,23 +1176,23 @@ function formatSocketPlane(window) {
 }
 //#endregion
 //#region src/kernel/moleculer/mesh-queue-report.ts
-function isRecord$7(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null;
 }
 /** The shape `TcpWriter` keeps its sockets in. Anything else is not a mesh. */
 function writerSocketsOf(broker) {
-	if (!isRecord$7(broker)) return void 0;
+	if (!isRecord$6(broker)) return void 0;
 	const transit = broker["transit"];
-	if (!isRecord$7(transit)) return void 0;
+	if (!isRecord$6(transit)) return void 0;
 	const transporter = transit["tx"];
-	if (!isRecord$7(transporter)) return void 0;
+	if (!isRecord$6(transporter)) return void 0;
 	const writer = transporter["writer"];
-	if (!isRecord$7(writer)) return void 0;
+	if (!isRecord$6(writer)) return void 0;
 	const sockets = writer["sockets"];
 	return sockets instanceof Map ? sockets : void 0;
 }
 function readSocket(nodeId, socket) {
-	if (typeof nodeId !== "string" || !isRecord$7(socket)) return void 0;
+	if (typeof nodeId !== "string" || !isRecord$6(socket)) return void 0;
 	const queuedBytes = socket["writableLength"];
 	const bytesWritten = socket["bytesWritten"];
 	if (typeof queuedBytes !== "number" || typeof bytesWritten !== "number") return void 0;
@@ -6085,7 +6083,6 @@ var IntegrationRegistry = class IntegrationRegistry {
 /**
 * Record kinds owned by cluster-agent (phase 4 — hub-main).
 */
-var CLUSTER_NODE_HISTORY_COLLECTION = "cluster-node-history";
 var NodePackageEntrySchema = z.object({
 	name: z.string(),
 	version: z.string().nullable()
@@ -6547,7 +6544,7 @@ async function resolveUncached(options) {
 }
 //#endregion
 //#region src/kernel/addon-class-resolver.ts
-function isRecord$6(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6571,14 +6568,14 @@ function isRecord$6(value) {
 function isAddonConstructor(fn) {
 	if (typeof fn !== "function") return false;
 	const proto = fn.prototype;
-	if (!isRecord$6(proto)) return false;
+	if (!isRecord$5(proto)) return false;
 	return typeof proto["initialize"] === "function";
 }
 function resolveAddonClass(mod) {
 	let candidate = mod["default"];
-	if (isRecord$6(candidate) && "default" in candidate) candidate = candidate["default"];
+	if (isRecord$5(candidate) && "default" in candidate) candidate = candidate["default"];
 	if (isAddonConstructor(candidate)) return candidate;
-	if (isRecord$6(candidate)) {
+	if (isRecord$5(candidate)) {
 		const fn = Object.values(candidate).find(isAddonConstructor);
 		if (fn) return fn;
 	}
@@ -6587,7 +6584,7 @@ function resolveAddonClass(mod) {
 }
 //#endregion
 //#region src/kernel/addon-loader.ts
-function isRecord$5(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -6685,12 +6682,12 @@ async function importAddonModuleFresh(entryPath) {
 * AddonPackageManifest + AddonDeclaration.
 */
 function isAddonPackageManifest(value) {
-	if (!isRecord$5(value)) return false;
+	if (!isRecord$4(value)) return false;
 	if (!Array.isArray(value.addons)) return false;
-	return value.addons.every((a) => isRecord$5(a) && typeof a.id === "string");
+	return value.addons.every((a) => isRecord$4(a) && typeof a.id === "string");
 }
 function toAddonPackageManifest(value) {
-	if (!isRecord$5(value)) return void 0;
+	if (!isRecord$4(value)) return void 0;
 	if (!isAddonPackageManifest(value)) return void 0;
 	return value;
 }
@@ -6855,7 +6852,7 @@ var AddonLoader = class {
 		}
 		if (!fs$1.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
 		const modUnknown = await importAddonModuleFresh(entryPath);
-		const mod = isRecord$5(modUnknown) ? modUnknown : {};
+		const mod = isRecord$4(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
 		this.addons.set(declaration.id, {
@@ -6871,7 +6868,7 @@ var AddonLoader = class {
 	/** Load addon from a direct path (for development/testing) */
 	async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
 		const modUnknown = await importAddonModuleFresh(modulePath);
-		const mod = isRecord$5(modUnknown) ? modUnknown : {};
+		const mod = isRecord$4(modUnknown) ? modUnknown : {};
 		const AddonClass = resolveAddonClass(mod);
 		if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
 		this.addons.set(addonId, {
@@ -11802,11 +11799,11 @@ async function runHubAddonBoot(steps) {
 }
 //#endregion
 //#region src/kernel/settings-door-view.ts
-function isRecord$4(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function asBlob(value) {
-	return isRecord$4(value) ? value : {};
+	return isRecord$3(value) ? value : {};
 }
 /**
 * Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
@@ -14375,7 +14372,7 @@ import_js_yaml.default;
 * so that file stays one class. The `console.*` calls are the documented
 * residuals described on `ConfigManager` (no logger exists yet at boot).
 */
-function isRecord$3(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Sections that live in config.yaml. Everything else goes to the settings-store. */
@@ -14466,7 +14463,7 @@ function setNested(obj, configPath, value) {
 		[head]: value
 	};
 	const existing = obj[head];
-	const child = isRecord$3(existing) ? existing : {};
+	const child = isRecord$2(existing) ? existing : {};
 	return {
 		...obj,
 		[head]: setNested(child, rest.join("."), value)
@@ -14723,7 +14720,7 @@ var SystemSettingsMirror = class {
 };
 //#endregion
 //#region src/kernel/config-manager.ts
-function isRecord$2(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorText(err) {
@@ -15082,7 +15079,7 @@ var ConfigManager = class {
 		const keys = configPath.split(".");
 		let current = this.bootstrapConfig;
 		for (const key of keys) {
-			if (!isRecord$2(current)) return void 0;
+			if (!isRecord$1(current)) return void 0;
 			current = current[key];
 		}
 		return current;
@@ -16151,7 +16148,7 @@ var RuntimeStateLoadError = class extends Error {
 		this.name = "RuntimeStateLoadError";
 	}
 };
-function isRecord$1(value) {
+function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage(err) {
@@ -16182,7 +16179,7 @@ async function loadRuntimeStateOrRefuse(load, logger, target) {
 	} catch (err) {
 		return refuse(errorMessage(err), err);
 	}
-	if (!isRecord$1(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
+	if (!isRecord(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
 	return answer;
 }
 //#endregion
@@ -23338,7 +23335,7 @@ function createSectionsStore(door) {
 //#endregion
 //#region src/kernel/moleculer/runner-addon-settings.ts
 /** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
-function createRunnerAddonSettings(client, addonId, before = async () => {}) {
+function createRunnerAddonSettings(client, addonId) {
 	if (client === void 0) {
 		const refuse = async () => {
 			throw new Error(`settings of "${addonId}": settings store not wired`);
@@ -23360,22 +23357,10 @@ function createRunnerAddonSettings(client, addonId, before = async () => {}) {
 		};
 	}
 	const door = {
-		query: async (input) => {
-			await before();
-			return client.query.query(input);
-		},
-		get: async (input) => {
-			await before();
-			return client.get.query(input);
-		},
-		set: async (input) => {
-			await before();
-			return client.set.mutate(input);
-		},
-		transact: async (input) => {
-			await before();
-			return client.transact.mutate(input);
-		}
+		query: (input) => client.query.query(input),
+		get: (input) => client.get.query(input),
+		set: (input) => client.set.mutate(input),
+		transact: (input) => client.transact.mutate(input)
 	};
 	const store = createAddonSettingsStore(door, addonId);
 	const sections = createSectionsStore(door);
@@ -23416,159 +23401,6 @@ function createRunnerAddonSettings(client, addonId, before = async () => {}) {
 	};
 }
 //#endregion
-//#region src/kernel/addon-refused-error.ts
-/**
-* A deterministic Init refusal (D877): an addon that says, in a typed way,
-* "I will not start, and here is why" - as opposed to a crash.
-*
-* The difference matters to the supervisor. A crash may be transient (a camera
-* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
-* repeats identically until somebody changes the world (runs a migration,
-* fixes a setting), so counting it toward the breaker only turns "waiting for
-* the operator" into a terminal `failed` with a stack trace nobody needed.
-* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
-* times in ten seconds and were marked `failed` as if they had crashed.
-*
-* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
-* process service parks the runner in `refused` with the reason and retries it
-* only when an operator acts.
-*/
-var AddonRefusedError = class extends Error {
-	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
-	code;
-	/** What the operator does about it. */
-	remedy;
-	constructor(code, message, remedy, options) {
-		super(message, options);
-		this.name = "AddonRefusedError";
-		this.code = code;
-		this.remedy = remedy;
-	}
-};
-/**
-* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
-* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
-*/
-function findAddonRefusal(err) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = err;
-	while (current !== null && current !== void 0 && !seen.has(current)) {
-		if (current instanceof AddonRefusedError) return current;
-		seen.add(current);
-		current = current instanceof Error ? current.cause : void 0;
-	}
-	return null;
-}
-//#endregion
-//#region src/kernel/legacy-blob-guard.ts
-/** Root keys retired long before D870: they never count as "settings still to migrate". */
-var OWN_RETIRED_ROOT_KEYS = new Set([
-	"recordingConfigs",
-	"recordingExports",
-	"recordingOpsLog",
-	"probeSnapshots",
-	"rtspTokens",
-	"profileMap"
-]);
-/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
-function isRetiredRootKey(addonId, key) {
-	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
-	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
-}
-/** Stable `code` of the D870 refusal. */
-var UNMIGRATED_SETTINGS_CODE = "unmigrated-settings";
-/** The remedy the refusal (and the update pre-flight) names. */
-var UNMIGRATED_SETTINGS_REMEDY = "Run scripts/hub/migrate-device-store.ts --copy --apply (D870), then restart the addon.";
-var UnmigratedSettingsError = class extends AddonRefusedError {
-	constructor(addonId, what) {
-		super(UNMIGRATED_SETTINGS_CODE, `addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`, UNMIGRATED_SETTINGS_REMEDY);
-		this.name = "UnmigratedSettingsError";
-	}
-};
-async function countOf(client, input) {
-	const n = await client.count.query(input);
-	if (typeof n !== "number") throw new Error("settings store answered a non-number to a count");
-	return n;
-}
-var LEGACY_PAGE = 500;
-var LEGACY_PAGE_BUDGET = 200;
-var ID_TAIL = "";
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Does the addon's per-device blob table hold a row the copy would actually
-* migrate - a positive numeric id with a non-empty record? An addon whose rows
-* the copy skips anyway must not be refused for them.
-*/
-async function hasMigratableDeviceRow(client, addonId) {
-	let cursor = "";
-	for (let page = 0; page < LEGACY_PAGE_BUDGET; page++) {
-		const rows = await client.query.query({
-			namespace: addonId,
-			collection: "addon-devices",
-			filter: {
-				whereBetween: { id: [cursor, ID_TAIL] },
-				orderBy: {
-					field: "id",
-					direction: "asc"
-				},
-				limit: LEGACY_PAGE
-			}
-		});
-		if (!Array.isArray(rows)) throw new Error("settings store answered a non-list to a query");
-		let lastId = cursor;
-		for (const row of rows) {
-			if (!isRecord(row) || typeof row["id"] !== "string") continue;
-			lastId = row["id"];
-			const id = Number(row["id"]);
-			const data = row["data"];
-			if (Number.isInteger(id) && id > 0 && isRecord(data) && Object.keys(data).length > 0) return true;
-		}
-		if (rows.length < LEGACY_PAGE || lastId === cursor) return false;
-		cursor = lastId;
-	}
-	throw new Error(`addon "${addonId}": more legacy blob pages than the guard will read`);
-}
-/**
-* THROWS when the addon has blob settings and the standard store has none of
-* its own. A store that cannot be asked also throws: it is not "no blobs".
-*/
-async function assertLegacyBlobsMigrated(client, addonId, logger) {
-	const legacyDevices = await hasMigratableDeviceRow(client, addonId);
-	const root = await client.get.query({
-		namespace: addonId,
-		collection: "addon-settings",
-		key: "root"
-	});
-	const legacySettings = isRecord(root) && Object.keys(root).some((key) => !isRetiredRootKey(addonId, key));
-	if (!legacyDevices && !legacySettings) return;
-	const rangeOf = (prefix) => {
-		const range = prefixRange(prefix);
-		if (range === null) throw new Error(`no id range for addon "${addonId}"`);
-		return { whereBetween: { id: [range.lo, range.hi] } };
-	};
-	const newDevices = await countOf(client, {
-		collection: "addon-device-settings",
-		filter: rangeOf(`${addonId}:`)
-	});
-	const newSettings = await countOf(client, {
-		collection: "addon-settings",
-		filter: rangeOf(`${addonId}.`)
-	});
-	const problems = [];
-	if (legacyDevices && newDevices === 0) problems.push("per-device blobs");
-	if (legacySettings && newSettings === 0) problems.push("an addon settings blob");
-	if (problems.length === 0) return;
-	const error = new UnmigratedSettingsError(addonId, problems.join(" and "));
-	logger.error(error.message, { meta: {
-		addonId,
-		newDevices,
-		newSettings
-	} });
-	throw error;
-}
-//#endregion
 //#region src/kernel/moleculer/runner-device-settings.ts
 /**
 * The forked runner's `ctx.settings` device methods (D870).
@@ -23581,20 +23413,11 @@ async function assertLegacyBlobsMigrated(client, addonId, logger) {
 * blob per device; a hub-side write to the rows was invisible to it.
 */
 /** The door slice the per-device store needs, over a tRPC client. */
-function doorOverClient(client, before = async () => {}) {
+function doorOverClient(client) {
 	return {
-		query: async (input) => {
-			await before();
-			return client.query.query(input);
-		},
-		transact: async (input) => {
-			await before();
-			return client.transact.mutate(input);
-		},
-		deleteWhere: async (input) => {
-			await before();
-			return client.deleteWhere.mutate(input);
-		}
+		query: (input) => client.query.query(input),
+		transact: (input) => client.transact.mutate(input),
+		deleteWhere: (input) => client.deleteWhere.mutate(input)
 	};
 }
 /**
@@ -23602,7 +23425,7 @@ function doorOverClient(client, before = async () => {}) {
 *   runner has none — every call then THROWS: a store that could not be asked
 *   is not an empty one.
 */
-function createRunnerDeviceSettings(client, addonId, before = async () => {}) {
+function createRunnerDeviceSettings(client, addonId) {
 	if (client === void 0) {
 		const refuse = () => {
 			throw new Error(`device settings of "${addonId}": settings store not wired`);
@@ -23615,7 +23438,7 @@ function createRunnerDeviceSettings(client, addonId, before = async () => {}) {
 			clearDeviceStore: async () => refuse()
 		};
 	}
-	const store = createDeviceSettingsStore(doorOverClient(client, before), addonId);
+	const store = createDeviceSettingsStore(doorOverClient(client), addonId);
 	return {
 		readDeviceStore: (deviceId) => readDeviceOrThrow(store, deviceId),
 		readDeviceStoreBatch: (ids) => store.readBatch(ids),
@@ -23914,23 +23737,9 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		}
 	};
 	const deviceSettingsClient = Reflect.get(api, "settingsStore");
-	let blobsChecked = null;
-	const bootGuard = () => {
-		const client = deviceSettingsClient;
-		if (client === void 0) return Promise.resolve();
-		blobsChecked ??= assertLegacyBlobsMigrated({
-			get: { query: (input) => client.get.query(input) },
-			query: { query: (input) => client.query.query(input) },
-			count: { query: (input) => client.count.query(input) }
-		}, addonId, scopedLogger).catch((err) => {
-			blobsChecked = null;
-			throw err;
-		});
-		return blobsChecked;
-	};
 	const settingsView = {
-		...createRunnerAddonSettings(deviceSettingsClient, addonId, bootGuard),
-		...createRunnerDeviceSettings(deviceSettingsClient, addonId, bootGuard),
+		...createRunnerAddonSettings(deviceSettingsClient, addonId),
+		...createRunnerDeviceSettings(deviceSettingsClient, addonId),
 		async readDeviceRuntimeState(deviceId) {
 			return readBlob("device-runtime-state", String(deviceId));
 		},
@@ -26604,6 +26413,50 @@ function createProcessService(parentNodeId, dataDir, deps, parentTcpPort, parent
 	};
 }
 //#endregion
+//#region src/kernel/addon-refused-error.ts
+/**
+* A deterministic Init refusal (D877): an addon that says, in a typed way,
+* "I will not start, and here is why" - as opposed to a crash.
+*
+* The difference matters to the supervisor. A crash may be transient (a camera
+* dropping mid-handshake) and is bounded by the D6 circuit-breaker; a refusal
+* repeats identically until somebody changes the world (runs a migration,
+* fixes a setting), so counting it toward the breaker only turns "waiting for
+* the operator" into a terminal `failed` with a stack trace nobody needed.
+* On 2026-10-17 twenty-eight addons refused on an unmigrated store, exited five
+* times in ten seconds and were marked `failed` as if they had crashed.
+*
+* The runner reports a refusal to its parent (see `runner-refusal.ts`); the
+* process service parks the runner in `refused` with the reason and retries it
+* only when an operator acts.
+*/
+var AddonRefusedError = class extends Error {
+	/** Stable, greppable cause, e.g. `unmigrated-settings`. */
+	code;
+	/** What the operator does about it. */
+	remedy;
+	constructor(code, message, remedy, options) {
+		super(message, options);
+		this.name = "AddonRefusedError";
+		this.code = code;
+		this.remedy = remedy;
+	}
+};
+/**
+* The refusal in `err`'s cause chain, if any. An addon that wraps the error it
+* got from the kernel (`new Error('init failed', { cause })`) is still refusing.
+*/
+function findAddonRefusal(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== null && current !== void 0 && !seen.has(current)) {
+		if (current instanceof AddonRefusedError) return current;
+		seen.add(current);
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return null;
+}
+//#endregion
 //#region src/kernel/moleculer/process-context.ts
 function createScopedProcessManager(broker, addonId) {
 	return {
@@ -27687,4 +27540,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, RecordsEngine, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -94,7 +94,6 @@ export type { LocalProviderResolver, BrokerCapCallOpts } from "./moleculer/trpc-
 export { createProcessService } from "./moleculer/process-service.js";
 export type { ProcessInfo } from "./moleculer/process-service.js";
 export { AddonRefusedError, findAddonRefusal } from "./addon-refused-error.js";
-export { UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UnmigratedSettingsError, assertLegacyBlobsMigrated, type LegacyGuardClient } from "./legacy-blob-guard.js";
 export type { RunnerRefusalReport } from "./moleculer/runner-refusal.js";
 export { signalAllRunnerGroups } from "./moleculer/runner-process-group.js";
 export { CapUsageRegistry, getCapUsageRegistry, PARENT_ROUTED_PROVIDER_ADDON_ID, __resetCapUsageRegistryForTests } from "./moleculer/cap-usage-registry.js";

package/dist/kernel/moleculer/runner-addon-settings.d.ts

@@ -6,7 +6,6 @@
 */
 import type { AddonStoreRead, StoredKeyRead } from "@camstack/types";
 import { type AddonSettingsDoor } from "../addon-settings-store.js";
-import type { LegacyGuardClient } from "../legacy-blob-guard.js";
 import { type SectionsDoor } from "../sections-store.js";
 import type { RunnerSettingsClient } from "./runner-device-settings.js";
 /** The client calls the addon-level adapter uses, on top of the device ones. */
@@ -17,10 +16,6 @@ export interface RunnerAddonSettingsClient extends RunnerSettingsClient {
 	readonly set: {
 		mutate: SectionsDoor["set"];
 	};
-	/** For the boot guard against unmigrated blobs (D870). */
-	readonly count: {
-		query: LegacyGuardClient["count"]["query"];
-	};
 }
 export interface RunnerAddonSettingsView {
 	readAddonStore(): Promise<Record<string, unknown>>;
@@ -31,4 +26,4 @@ export interface RunnerAddonSettingsView {
 	setSection(section: string, patch: Record<string, unknown>): Promise<void>;
 }
 /** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
-export declare function createRunnerAddonSettings(client: RunnerAddonSettingsClient | undefined, addonId: string, before?: () => Promise<void>): RunnerAddonSettingsView;
+export declare function createRunnerAddonSettings(client: RunnerAddonSettingsClient | undefined, addonId: string): RunnerAddonSettingsView;