Module ops 

VTA backup export and import operations.

Export: reads all keyspaces + seed, assembles a BackupPayload, encrypts with Argon2id + AES-256-GCM, and wraps in a BackupEnvelope.

Import: decrypts the envelope, validates the payload, optionally previews, then replaces all keyspace data and updates the seed store.

Sub-modules

• descriptors — the 3-phase descriptor-pattern op layer for the trust-task slice. Wraps the inline export_backup / preview_import / apply_import functions below, decoupling bulk byte transport from the JSON envelope. See docs/05-design-notes/backup-descriptor-pattern.md.

Modules

blob

Op-layer for the backup-blob byte transport (GET/POST /backup/blob/{id}).

descriptors

Op-layer for the backup-descriptor pattern (spec/vta/backup/*).

Constants

IMPORT_IN_PROGRESS_KEY

Key under which apply_import records that a destructive import is in flight. Written (and persisted) before the keyspaces are cleared and removed only after every record is back; if a crash interrupts the import, this survives and boot refuses to start on the resulting hybrid state (see vta-service’s server::run). Lives in the keys keyspace under a prefix no clear/scan touches.

Functions

apply_import

Apply an import: clears all keyspaces and writes the backup data.

decrypt_backup

Decrypt a backup envelope and return the payload.

export_backup

Assemble and encrypt a backup of the entire VTA state.

preview_import

Decrypt and validate a backup, returning a preview without modifying state.