How to validate backup and restore operations using Bun's file I/O APIs?

When designing a backup‑and‑restore workflow you can gain confidence that the backup is exact and that the restore reproduces the original state by combining three techniques: (1) streaming checksum calculation, (2) comparison of the stored checksum after restore, and (3) atomic replacement of the live files. The following steps assume that Bun provides file‑I/O primitives similar to Node.js (e.g., Bun.file for reading/writing streams) and that Bun’s standard library includes a crypto module for hash functions. Adjust the code to match the actual Bun API you have.

1. Prepare the source
   • Identify the files or directory you want to back up.
   • Optionally create a manifest that lists each file’s relative path.
2. Create the backup stream
   • Open a destination file (e.g., backup.tar) for writing with Bun.file.
   • Create a hash object (e.g., SHA‑256) using Bun’s crypto API.
   • Pipe the source data through the hash update step while simultaneously writing to the destination file. This can be done with a custom transform stream or by using Bun.file’s createReadStream and createWriteStream together with a hash‑updating pipe.
3. Finalize and store the checksum
   • When the backup stream ends, call hash.digest('hex') to obtain the checksum.
   • Write this checksum to a separate file (e.g., backup.tar.sha256) or embed it in metadata.
4. Verify the backup immediately (optional)
   • Re‑read the backup file, recompute the hash, and compare it to the stored checksum. If they differ, delete the backup and alert the operator.
5. Restore procedure
   • Read the backup file and compute its hash on the fly.
   • Compare the computed hash with the stored checksum. If they match, proceed; otherwise abort and report a corrupt backup.
   • Extract the backup to a temporary location (e.g., a folder named restore_tmp).
   • Once extraction is complete, replace the live files atomically: move each restored file over the original using a rename operation (Bun.file rename or equivalent) after writing to a temporary name, then rename the temporary name to the final path. This ensures that either the old version or the new version is fully present, never a half‑written file.
6. Rollback on failure
   • If any step of the restore fails (hash mismatch, extraction error, or rename error), delete the temporary restore files and leave the original files untouched.
   • Optionally keep the failed backup for forensic analysis, but do not use it for further restores.

By continuously updating a hash while streaming data, you avoid reading the backup twice. Atomic rename guarantees that a crash or power loss leaves the system in a consistent state. Adjust the specific Bun API calls (e.g., Bun.file.open, Bun.crypto.createHash) to match the version you are using.