@secondlayer/shared 8.0.0 → 9.0.0

package/dist/src/runtime/index.d.ts

@@ -155,13 +155,11 @@ declare function reportRuntimeStatus(input: {
 	coverage?: CoverageState | string
 }): RuntimeStatusReport;
 declare function actionFor(plane: StatusPlane, state: string): string;
-/**
-* Backup bundle — consistent DB, pinned config, encrypted keys, handler
-* manifests, and scope. Restore onto a wiped host must deep-verify green.
-*/
+declare const BACKUP_MANIFEST_VERSION = 1;
 declare const BACKUP_PARTS: readonly ["db", "config", "keys", "handlers", "scope"];
 type BackupPart = (typeof BACKUP_PARTS)[number];
 type BackupManifest = {
+	schema_version: number
 	created_at: string
 	network: string
 	parts: BackupPart[]
@@ -170,34 +168,90 @@ type BackupManifest = {
 		from_height: number
 		to_height: number | null
 	}
+	db: {
+		file: string
+		sha256: string
+		bytes: number
+		format: string
+	} | null
+	/** Never the secrets themselves — only how to check them. */
+	secrets: {
+		file: string
+		encrypted: boolean
+		canary: string
+	} | null
+	signature?: string
+	key_id?: string
 };
 type BackupPlan = {
-	ok: boolean
+	ok: true
 	manifest: BackupManifest
+} | {
+	ok: false
 	reason: string
 };
+/**
+* Validate a backup before any bytes are written. Refusing early is the whole
+* point: a bundle that omits the keys looks like a backup and is not one.
+*/
 declare function planBackup(input: {
 	network: string
-	encryptedKeys: boolean
 	fromHeight: number
 	toHeight?: number | null
+	includeSecrets: boolean
+	secretsEncrypted: boolean
+	canary?: string
 	now?: string
 }): BackupPlan;
-type RestoreResult = {
+/**
+* Seal the canary under an EXPLICIT key.
+*
+* Deliberately not reusing `crypto/secrets.ts`: that module resolves the key
+* from the ambient environment and, in OSS mode, generates and persists one as
+* a side effect when it is missing. Calling it here would mean a backup could
+* mint the very key it is supposed to be preserving.
+*/
+declare function sealKeyCanary(secretsKeyHex: string): string;
+/** True only when `secretsKeyHex` is the key the canary was sealed with. */
+declare function keyMatchesCanary(canaryBase64: string, secretsKeyHex: string): boolean;
+/**
+* Encrypt the secrets bundle under an operator passphrase.
+* Layout: `salt(16) || iv(12) || authTag(16) || ciphertext`.
+*/
+declare function encryptBundle(plaintext: string, passphrase: string): Buffer;
+declare function decryptBundle(envelope: Buffer, passphrase: string): string;
+type RestorePrecheck = {
 	ok: true
-	applied: boolean
-	deep_green: boolean
 } | {
 	ok: false
 	reason: string
+	fatal: boolean
 };
-declare function restoreBackup(plan: BackupPlan, opts?: {
-	apply?: boolean
-	deepVerify?: boolean
-}): RestoreResult;
+/**
+* Everything that must hold before a restore writes anything.
+*
+* `fatal` distinguishes "this bundle can never restore here" from "this needs
+* an explicit override" — the caller surfaces them differently.
+*/
+declare function precheckRestore(input: {
+	manifest: BackupManifest
+	targetNetwork: string
+	targetIsEmpty: boolean
+	force: boolean
+	secretsKeyHex?: string
+}): RestorePrecheck;
 /**
 * Upgrade contract — pin image, preflight schema/disk, backup first,
 * migrate, health/verify, document rollback limits.
+*
+* PLANNER ONLY — `applyUpgrade` returns `{applied:true}` without pulling an
+* image, running a preflight, or migrating anything. Nothing in the product
+* calls it. The upgrade operators actually perform is `docker compose pull &&
+* up -d`, with migrations applied at boot by the runtime entrypoint.
+*
+* Same caution as the sibling backup planner: this step list was published as
+* an operator procedure in the self-host docs until 2026-08-15. Make it do the
+* work before presenting it as one.
 */
 declare const UPGRADE_STEPS: readonly ["pin", "preflight", "backup", "migrate", "health", "verify"];
 type UpgradeStep = (typeof UPGRADE_STEPS)[number];
@@ -227,6 +281,13 @@ declare function applyUpgrade(plan: UpgradePlan, opts?: {
 /**
 * Resource guardrails — preflight RAM/disk/Postgres and estimate growth.
 * Constrained fixtures fail early.
+*
+* The disk numbers here were wrong by 3-6x until 2026-08-15: they promised a
+* full-history mainnet index would fit in 80 GB, and estimated growth at 1 GB
+* per 100k blocks. The reference index measured 504 GB at height 8,771,873.
+* An operator who sized a box from these figures would have filled the disk
+* partway through their first bootstrap, so every constant below now cites what
+* it was measured against.
 */
 type ResourceSnapshot = {
 	ramMb: number
@@ -234,23 +295,81 @@ type ResourceSnapshot = {
 	postgresMaxConnections: number
 	postgresSharedBuffersMb?: number
 };
+type DiskEstimates = {
+	/** blocks + transactions + events, no decoded plane. */
+	diskGbPer100kBlocks: number
+	/** Same, plus a broad decoder set writing `decoded_events`. */
+	diskGbPer100kBlocksDecoded: number
+};
 type GuardrailResult = {
 	ok: true
-	estimates: {
-		diskGbPer100kBlocks: number
-	}
+	estimates: DiskEstimates
 } | {
 	ok: false
 	errors: string[]
 };
+type GuardrailNetwork = "mainnet" | "testnet" | "devnet";
 declare const FLOORS: {
 	readonly appRamMb: 4096
 	readonly fullRamMb: 98304
+	/**
+	* Mainnet full history: 504 GB measured today, growing ~0.5 GB/day at the
+	* observed block rate. 600 leaves roughly six months of headroom, which is
+	* the point of a floor — a box that fits exactly today fails within weeks.
+	*/
+	readonly mainnetAppDiskGb: 600
+	/**
+	* Testnet/devnet carry a fraction of mainnet's history. Unmeasured; retained
+	* as the long-standing default rather than replaced with a fresh guess.
+	*/
 	readonly appDiskGb: 80
+	/**
+	* Bundled node on mainnet. The Stacks chainstate alone measured 1.3 TB on
+	* the reference node (2026-08-15), and the index adds ~500 GB; bitcoind is
+	* additional and not measured here. The previous 1.5 TB floor was below the
+	* two components we HAVE measured.
+	*/
+	readonly mainnetFullDiskGb: 2500
+	/** Bundled node, non-mainnet. Unmeasured; retained default. */
 	readonly fullDiskGb: 1500
 	readonly postgresMaxConnections: 50
 };
-declare function preflightResources(snap: ResourceSnapshot, mode: "external" | "stacks" | "full"): GuardrailResult;
+/** The disk floor that applies to a given mode and network. */
+declare function diskFloorGb(mode: "external" | "stacks" | "full", network: GuardrailNetwork): number;
+/**
+* A dimension the caller could not measure is absent, not zero. Skipping it
+* keeps an unreadable `statfs` from presenting as a 0 GB disk and refusing a
+* perfectly adequate box.
+*/
+declare function preflightResources(snap: Partial<ResourceSnapshot>, mode: "external" | "stacks" | "full", network?: GuardrailNetwork): GuardrailResult;
+type MeasuredResources = {
+	snapshot: Partial<ResourceSnapshot>
+	/** Dimensions we could not read, with why. Never guessed at. */
+	unknown: string[]
+};
+declare function measureResources(input: {
+	dataDir: string
+	query?: (sql: string) => Promise<Array<Record<string, unknown>>>
+}): Promise<MeasuredResources>;
+declare const UNDERSIZED_OVERRIDE = "SECONDLAYER_ALLOW_UNDERSIZED";
+type PreflightDecision = {
+	action: "pass" | "warn" | "refuse"
+	messages: string[]
+};
+declare function decidePreflight(input: {
+	measured: MeasuredResources
+	mode: "external" | "stacks" | "full"
+	network: GuardrailNetwork
+	env?: Record<string, string | undefined>
+}): PreflightDecision;
+/** Measure this box and decide. Returns the decision; the caller exits. */
+declare function runPreflight(input: {
+	dataDir: string
+	mode: "external" | "stacks" | "full"
+	network: GuardrailNetwork
+	query?: (sql: string) => Promise<Array<Record<string, unknown>>>
+	env?: Record<string, string | undefined>
+}): Promise<PreflightDecision>;
 declare const MODULE_COMMANDS: Record<ModuleId, readonly string[]>;
 declare function commandFor(id: ModuleId): readonly string[];
-export { restoreBackup, reportRuntimeStatus, preflightResources, planUpgrade, planBackup, parseRuntimeConfig, migrateEmbedded, isolateHandler, isModuleId, emptyHealth, createSupervisor, createMemoryModule, createMemoryMigrationRunner, commandFor, applyUpgrade, actionFor, UpgradeStep, UpgradePlan, UPGRADE_STEPS, SupervisorHealth, Supervisor, StatusPlane, STATUS_PLANES, SECRET_KEYS, RuntimeStatusReport, RuntimeNetwork, RuntimeModule, RuntimeConfig, RestoreResult, ResourceSnapshot, RequiredConfigKey, REQUIRED_KEYS, PlaneStatus, PUBLISHER_PROFILE, OPTIONAL_KEYS, NodeMode, NODE_MODES, NETWORKS, ModuleState, ModuleId, ModuleHealth, MigrationRunner, MODULE_STATES, MODULE_IDS, MODULE_COMMANDS, MIGRATION_LOCK_KEY, IsolationResult, IsolationOomError, IsolationNetworkError, IsolationLimits, IsolationKillError, IsolationFault, ISOLATION_FAULTS, GuardrailResult, FLOORS, EmbeddedMigration, DEFAULT_PROFILE, ConfigResult, BackupPlan, BackupPart, BackupManifest, BACKUP_PARTS };
+export { sealKeyCanary, runPreflight, reportRuntimeStatus, preflightResources, precheckRestore, planUpgrade, planBackup, parseRuntimeConfig, migrateEmbedded, measureResources, keyMatchesCanary, isolateHandler, isModuleId, encryptBundle, emptyHealth, diskFloorGb, decryptBundle, decidePreflight, createSupervisor, createMemoryModule, createMemoryMigrationRunner, commandFor, applyUpgrade, actionFor, UpgradeStep, UpgradePlan, UPGRADE_STEPS, UNDERSIZED_OVERRIDE, SupervisorHealth, Supervisor, StatusPlane, STATUS_PLANES, SECRET_KEYS, RuntimeStatusReport, RuntimeNetwork, RuntimeModule, RuntimeConfig, RestorePrecheck, ResourceSnapshot, RequiredConfigKey, REQUIRED_KEYS, PreflightDecision, PlaneStatus, PUBLISHER_PROFILE, OPTIONAL_KEYS, NodeMode, NODE_MODES, NETWORKS, ModuleState, ModuleId, ModuleHealth, MigrationRunner, MeasuredResources, MODULE_STATES, MODULE_IDS, MODULE_COMMANDS, MIGRATION_LOCK_KEY, IsolationResult, IsolationOomError, IsolationNetworkError, IsolationLimits, IsolationKillError, IsolationFault, ISOLATION_FAULTS, GuardrailResult, GuardrailNetwork, FLOORS, EmbeddedMigration, DiskEstimates, DEFAULT_PROFILE, ConfigResult, BackupPlan, BackupPart, BackupManifest, BACKUP_PARTS, BACKUP_MANIFEST_VERSION };

package/dist/src/runtime/index.js

@@ -337,7 +337,11 @@ var KNOWN = new Set([
   "SUBGRAPH_INDEX_API_URL",
   "SBTC_DECODER_ENABLED",
   "POX4_DECODER_ENABLED",
-  "BNS_DECODER_ENABLED"
+  "BNS_DECODER_ENABLED",
+  "ARCHIVE_DIR",
+  "ARCHIVE_PUBLIC_DIR",
+  "SECONDLAYER_ALLOW_UNDERSIZED",
+  "SECONDLAYER_SYNC_START_HEIGHT"
 ]);
 var OWN_PREFIXES = [
   "SECONDLAYER_",
@@ -499,6 +503,14 @@ function actionFor(plane, state) {
   return "inspect logs";
 }
 // src/runtime/backup.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync,
+  timingSafeEqual
+} from "node:crypto";
+var BACKUP_MANIFEST_VERSION = 1;
 var BACKUP_PARTS = [
   "db",
   "config",
@@ -506,55 +518,149 @@ var BACKUP_PARTS = [
   "handlers",
   "scope"
 ];
+var CANARY_PLAINTEXT = "secondlayer-secrets-key-canary-v1";
+var IV_LEN = 12;
+var TAG_LEN = 16;
+var SALT_LEN = 16;
+var SCRYPT_COST = 2 ** 15;
+var SCRYPT_MAXMEM = 64 * 1024 * 1024;
+var SCRYPT_OPTS = { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM };
 function planBackup(input) {
-  if (!input.encryptedKeys) {
+  if (input.fromHeight < 0) {
+    return { ok: false, reason: "scope from_height must be >= 0" };
+  }
+  if (input.toHeight !== null && input.toHeight !== undefined && input.toHeight < input.fromHeight) {
+    return { ok: false, reason: "scope to_height is below from_height" };
+  }
+  if (input.includeSecrets && !input.secretsEncrypted) {
     return {
       ok: false,
-      manifest: emptyManifest(input),
-      reason: "keys must be encrypted"
+      reason: "refusing to write plaintext secrets; supply a passphrase or pass the explicit plaintext override"
     };
   }
-  if (input.fromHeight < 0) {
+  if (input.includeSecrets && !input.canary) {
     return {
       ok: false,
-      manifest: emptyManifest(input),
-      reason: "scope from_height must be >= 0"
+      reason: "secrets bundle requires a key canary so a restore can prove the key matches"
     };
   }
+  const parts = input.includeSecrets ? [...BACKUP_PARTS] : BACKUP_PARTS.filter((p) => p !== "keys");
   return {
     ok: true,
     manifest: {
-      created_at: input.now ?? "1970-01-01T00:00:00.000Z",
+      schema_version: BACKUP_MANIFEST_VERSION,
+      created_at: input.now ?? new Date().toISOString(),
       network: input.network,
-      parts: [...BACKUP_PARTS],
-      encrypted: true,
+      parts,
+      encrypted: input.secretsEncrypted,
       scope: {
         from_height: input.fromHeight,
         to_height: input.toHeight ?? null
-      }
-    },
-    reason: "dry-run backup bundle"
+      },
+      db: null,
+      secrets: null
+    }
   };
 }
-function restoreBackup(plan, opts) {
-  if (!plan.ok)
-    return { ok: false, reason: plan.reason };
-  if (!opts?.apply)
-    return { ok: true, applied: false, deep_green: false };
-  return {
-    ok: true,
-    applied: true,
-    deep_green: opts.deepVerify !== false
-  };
+function secretsKeyBuffer(hexKey) {
+  const key = Buffer.from(hexKey.trim(), "hex");
+  if (key.length !== 32) {
+    throw new Error("SECONDLAYER_SECRETS_KEY must be 32 bytes hex");
+  }
+  return key;
 }
-function emptyManifest(input) {
-  return {
-    created_at: input.now ?? "1970-01-01T00:00:00.000Z",
-    network: input.network,
-    parts: [],
-    encrypted: false,
-    scope: { from_height: input.fromHeight, to_height: input.toHeight ?? null }
-  };
+function sealKeyCanary(secretsKeyHex) {
+  const key = secretsKeyBuffer(secretsKeyHex);
+  const iv = randomBytes(IV_LEN);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(CANARY_PLAINTEXT, "utf8"),
+    cipher.final()
+  ]);
+  return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64");
+}
+function keyMatchesCanary(canaryBase64, secretsKeyHex) {
+  try {
+    const key = secretsKeyBuffer(secretsKeyHex);
+    const envelope = Buffer.from(canaryBase64, "base64");
+    const iv = envelope.subarray(0, IV_LEN);
+    const tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);
+    const ciphertext = envelope.subarray(IV_LEN + TAG_LEN);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    const expected = Buffer.from(CANARY_PLAINTEXT, "utf8");
+    return plaintext.length === expected.length && timingSafeEqual(plaintext, expected);
+  } catch {
+    return false;
+  }
+}
+function encryptBundle(plaintext, passphrase) {
+  if (!passphrase)
+    throw new Error("passphrase is required");
+  const salt = randomBytes(SALT_LEN);
+  const key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);
+  const iv = randomBytes(IV_LEN);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  return Buffer.concat([salt, iv, cipher.getAuthTag(), ciphertext]);
+}
+function decryptBundle(envelope, passphrase) {
+  const salt = envelope.subarray(0, SALT_LEN);
+  const iv = envelope.subarray(SALT_LEN, SALT_LEN + IV_LEN);
+  const tag = envelope.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + TAG_LEN);
+  const ciphertext = envelope.subarray(SALT_LEN + IV_LEN + TAG_LEN);
+  const key = scryptSync(passphrase, salt, 32, SCRYPT_OPTS);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(ciphertext).toString("utf8") + decipher.final("utf8");
+}
+function precheckRestore(input) {
+  if (input.manifest.schema_version !== BACKUP_MANIFEST_VERSION) {
+    return {
+      ok: false,
+      fatal: true,
+      reason: `bundle schema_version ${input.manifest.schema_version} is not supported (expected ${BACKUP_MANIFEST_VERSION})`
+    };
+  }
+  if (input.manifest.network !== input.targetNetwork) {
+    return {
+      ok: false,
+      fatal: true,
+      reason: `bundle is ${input.manifest.network}; this instance is ${input.targetNetwork}`
+    };
+  }
+  if (!input.targetIsEmpty && !input.force) {
+    return {
+      ok: false,
+      fatal: false,
+      reason: "target database already holds chain data; restoring would overwrite it"
+    };
+  }
+  const secrets = input.manifest.secrets;
+  if (secrets) {
+    if (!input.secretsKeyHex) {
+      return {
+        ok: false,
+        fatal: false,
+        reason: "bundle carries encrypted columns but no secrets key was supplied; restoring now would leave them unreadable"
+      };
+    }
+    if (!keyMatchesCanary(secrets.canary, input.secretsKeyHex)) {
+      return {
+        ok: false,
+        fatal: true,
+        reason: "the supplied SECONDLAYER_SECRETS_KEY does not match the one this backup was taken with; encrypted columns would be permanently unreadable"
+      };
+    }
+  }
+  return { ok: true };
 }
 // src/runtime/upgrade.ts
 var UPGRADE_STEPS = [
@@ -634,29 +740,133 @@ function applyUpgrade(plan, opts) {
   return { ok: true, applied: true, reason: "upgrade applied" };
 }
 // src/runtime/guardrails.ts
+var MEASURED_DISK = {
+  diskGbPer100kBlocks: 3,
+  diskGbPer100kBlocksDecoded: 6
+};
 var FLOORS = {
   appRamMb: 4096,
   fullRamMb: 98304,
+  mainnetAppDiskGb: 600,
   appDiskGb: 80,
+  mainnetFullDiskGb: 2500,
   fullDiskGb: 1500,
   postgresMaxConnections: 50
 };
-function preflightResources(snap, mode) {
+function diskFloorGb(mode, network) {
+  if (mode === "full") {
+    return network === "mainnet" ? FLOORS.mainnetFullDiskGb : FLOORS.fullDiskGb;
+  }
+  return network === "mainnet" ? FLOORS.mainnetAppDiskGb : FLOORS.appDiskGb;
+}
+function preflightResources(snap, mode, network = "mainnet") {
   const errors = [];
   const ramFloor = mode === "full" ? FLOORS.fullRamMb : FLOORS.appRamMb;
-  const diskFloor = mode === "full" ? FLOORS.fullDiskGb : FLOORS.appDiskGb;
-  if (snap.ramMb < ramFloor) {
+  const diskFloor = diskFloorGb(mode, network);
+  if (snap.ramMb !== undefined && snap.ramMb < ramFloor) {
     errors.push(`RAM ${snap.ramMb}MB below ${ramFloor}MB for NODE_MODE=${mode}`);
   }
-  if (snap.diskGb < diskFloor) {
-    errors.push(`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode}`);
+  if (snap.diskGb !== undefined && snap.diskGb < diskFloor) {
+    errors.push(`disk ${snap.diskGb}GB below ${diskFloor}GB for NODE_MODE=${mode} on ${network}`);
   }
-  if (snap.postgresMaxConnections < FLOORS.postgresMaxConnections) {
+  if (snap.postgresMaxConnections !== undefined && snap.postgresMaxConnections < FLOORS.postgresMaxConnections) {
     errors.push(`Postgres max_connections ${snap.postgresMaxConnections} below ${FLOORS.postgresMaxConnections}`);
   }
   if (errors.length > 0)
     return { ok: false, errors };
-  return { ok: true, estimates: { diskGbPer100kBlocks: 1 } };
+  return { ok: true, estimates: MEASURED_DISK };
+}
+// src/runtime/resources.ts
+import { statfs } from "node:fs/promises";
+import { totalmem } from "node:os";
+var BYTES_PER_MB = 1024 * 1024;
+var BYTES_PER_GB = 1024 * 1024 * 1024;
+async function measureRamMb() {
+  try {
+    const total = totalmem();
+    return total > 0 ? Math.floor(total / BYTES_PER_MB) : null;
+  } catch {
+    return null;
+  }
+}
+async function measureDiskGb(path) {
+  try {
+    const stats = await statfs(path);
+    const totalBytes = Number(stats.blocks) * Number(stats.bsize);
+    return totalBytes > 0 ? Math.floor(totalBytes / BYTES_PER_GB) : null;
+  } catch {
+    return null;
+  }
+}
+async function measurePostgresMaxConnections(query) {
+  try {
+    const rows = await query("SHOW max_connections");
+    const raw = rows[0]?.max_connections;
+    const value = Number(raw);
+    return Number.isFinite(value) && value > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function measureResources(input) {
+  const unknown = [];
+  const snapshot = {};
+  const ramMb = await measureRamMb();
+  if (ramMb === null)
+    unknown.push("RAM");
+  else
+    snapshot.ramMb = ramMb;
+  const diskGb = await measureDiskGb(input.dataDir);
+  if (diskGb === null)
+    unknown.push(`disk (${input.dataDir} unreadable)`);
+  else
+    snapshot.diskGb = diskGb;
+  if (input.query) {
+    const conns = await measurePostgresMaxConnections(input.query);
+    if (conns === null)
+      unknown.push("Postgres max_connections");
+    else
+      snapshot.postgresMaxConnections = conns;
+  } else {
+    unknown.push("Postgres max_connections (no database handle)");
+  }
+  return { snapshot, unknown };
+}
+
+// src/runtime/preflight.ts
+var UNDERSIZED_OVERRIDE = "SECONDLAYER_ALLOW_UNDERSIZED";
+function isOverridden(env) {
+  return env[UNDERSIZED_OVERRIDE]?.trim().toLowerCase() === "true";
+}
+function decidePreflight(input) {
+  const env = input.env ?? {};
+  const result = preflightResources(input.measured.snapshot, input.mode, input.network);
+  const messages = [];
+  if (input.measured.unknown.length > 0) {
+    messages.push(`resource preflight could not measure: ${input.measured.unknown.join(", ")}`);
+  }
+  if (result.ok) {
+    return { action: messages.length > 0 ? "warn" : "pass", messages };
+  }
+  messages.push(...result.errors);
+  if (isOverridden(env)) {
+    messages.push(`${UNDERSIZED_OVERRIDE}=true — starting anyway. This box is below the documented floor; expect to run out of disk as history accumulates.`);
+    return { action: "warn", messages };
+  }
+  messages.push(`Refusing to start. Resize the box, or set ${UNDERSIZED_OVERRIDE}=true to proceed at your own risk. Sizing guidance: https://www.secondlayer.tools/docs/self-host#guardrails`);
+  return { action: "refuse", messages };
+}
+async function runPreflight(input) {
+  const measured = await measureResources({
+    dataDir: input.dataDir,
+    query: input.query
+  });
+  return decidePreflight({
+    measured,
+    mode: input.mode,
+    network: input.network,
+    env: input.env
+  });
 }
 // src/runtime/commands.ts
 var MODULE_COMMANDS = {
@@ -676,16 +886,24 @@ function commandFor(id) {
   return MODULE_COMMANDS[id];
 }
 export {
-  restoreBackup,
+  sealKeyCanary,
+  runPreflight,
   reportRuntimeStatus,
   preflightResources,
+  precheckRestore,
   planUpgrade,
   planBackup,
   parseRuntimeConfig,
   migrateEmbedded,
+  measureResources,
+  keyMatchesCanary,
   isolateHandler,
   isModuleId,
+  encryptBundle,
   emptyHealth,
+  diskFloorGb,
+  decryptBundle,
+  decidePreflight,
   createSupervisor,
   createMemoryModule,
   createMemoryMigrationRunner,
@@ -693,6 +911,7 @@ export {
   applyUpgrade,
   actionFor,
   UPGRADE_STEPS,
+  UNDERSIZED_OVERRIDE,
   STATUS_PLANES,
   SECRET_KEYS,
   REQUIRED_KEYS,
@@ -710,8 +929,9 @@ export {
   ISOLATION_FAULTS,
   FLOORS,
   DEFAULT_PROFILE,
-  BACKUP_PARTS
+  BACKUP_PARTS,
+  BACKUP_MANIFEST_VERSION
 };
 
-//# debugId=0C264B17247A3CFD64756E2164756E21
+//# debugId=CDAC30CBB14C2F1364756E2164756E21
 //# sourceMappingURL=index.js.map