Module blob 

Op-layer for the backup-blob byte transport (GET/POST /backup/blob/{id}).

The token-gated state machine that moves the staged .vtabak bytes — GET streams an export bundle (one-shot, delete-before-flip), POST accepts an import upload (size + SHA-256 verified) — lives here. The HTTP route adapters in routes/backup_blob.rs handle only transport concerns (path/header parsing, body cap, response framing) and delegate the state machine to these two functions.

See docs/05-design-notes/backup-descriptor-pattern.md for the full state machine, and §“Auth model” for why the bearer token — not a JWT — is the authenticator.

Functions

read_export_blob

Download the encrypted bytes of an export bundle. One-shot: on success the record transitions to ExportDownloaded (terminal) and the bytes are removed from disk.

write_import_blob

Accept the encrypted upload for an import bundle. The body’s SHA-256 must match the record’s expected_sha256; the byte count must match expected_size_bytes. On success the state moves to ImportReceived (no further uploads accepted against this bundle_id).