aeat.adapters.persistence.storage.bucket._sealed_archive_writer module

Sealed bucket-export archive writer.

Writes a gzipped tar archive carrying the plaintext ExportArchiveHeader followed by the encrypted payload bytes and an optional recovery-wrap member. Metadata for every tar member is normalised at write time (timestamps pinned to the header’s created_at, mode pinned to 0o400, ownership cleared) so two same-bucket exports differ only in the header’s created_at field.

Authority: 2026-06-03-bucket-sealed-archive-adr.

write_sealed_archive(target_path, *, header, payload_envelope_bytes, recovery_wrap_bytes=None)[source]

Write the sealed archive at target_path.

Parameters:

  • target_path (Path) – Operator-specified output path. Must be writable and must not exist (the writer refuses to overwrite a sealed archive to avoid accidental clobber; remove the file first if a re-export is intended).

  • header (ExportArchiveHeader) – Strict-validated ExportArchiveHeader. The writer serialises it to UTF-8 JSON as the first archive member.

  • payload_envelope_bytes (bytes) – The encrypted payload bytes (already wrapped in an Envelope by the caller). Written as the second archive member.

  • recovery_wrap_bytes (bytes | None) – Optional recovery-wrap material. When present the header MUST carry recovery_wrap_present = True; when None the header MUST carry recovery_wrap_present = False.

Raises:

SealedArchiveWriteError – When target_path exists, the header’s recovery_wrap_present flag disagrees with recovery_wrap_bytes, or the underlying IO write fails.

Return type:

None