Module backup 

Portable backup / restore of the WellFair data subtree (T3.3 release-hardening slice).

A backup is a single archive — lz4(cbor(BackupArchive)) — of every file under <storage_root>/wellfair/: the journal, receipts, sync outbox/inbox, consent + blob stores, and the encrypted Sanctuary vault. The Sanctuary vault is already AEAD-encrypted at rest, so it stays encrypted inside the archive; the rest carries the same at-rest posture as on disk (an optional passphrase wrapper over the whole archive is a clean follow-up).

Restore is path-traversal-safe: every archive key must be a relative path whose components are all Normal (no .., no root, no drive prefix), so a malicious archive can never write outside the target wellfair/ directory.

Structs

BackupArchive

The decoded archive: a version + creation stamp + a map of relative path → file bytes.

BackupReport

A count of what an export/import moved.

Functions

build_archive

Build an in-memory archive of the wellfair/ subtree under storage_root.

create_backup

Convenience: build + encode a backup of storage_root’s WellFair data.

decode_archive

Decode an archive from its on-disk form.

encode_archive

Encode an archive to its on-disk form: lz4(cbor(archive)).

restore_archive

Restore an archive into the wellfair/ subtree under storage_root (creating directories).

restore_backup

Convenience: decode + restore a backup into storage_root.

wellfair_data_stats

Cheap (file count, total bytes) of the wellfair/ data subtree — metadata only, no file reads.