Crate vta_backup 

Backup/restore subsystem for the VTA, extracted from vta-service.

• backup_bundle_store — the sealed backup-bundle store (bundle records + on-disk blobs for the two-phase export/import trust tasks).
• backup_bundle_sweeper — TTL sweep of expired backup bundles.
• ops — the encrypted full-state export/import operations (Argon2id + AES-256-GCM), the compatibility check, and the two-phase descriptor flow.

The operations take narrow dependencies (keyspace handles, config, a vta_keyspaces::Keyspaces bundle) rather than a &AppState. The two vta-service-specific glue points stay in vta-service:

• DescriptorDeps / apply_import are borrowed from AppState there via free constructors (operations::descriptor_deps_from_app_state).
• TEE KMS re-encryption during import is injected through the [BootstrapReEncryptor] trait, whose only implementation wraps vta-service’s tee::kms_bootstrap::re_encrypt_bootstrap_secrets.

Modules

backup_bundle_store

Fjall-backed storage for in-flight backup bundles.

backup_bundle_sweeper

Background pruning of expired + terminal backup bundles.

ops

VTA backup export and import operations.