Deduplicate artifact bytes and deliver files by authenticated hash

src/lib/server/fleet/rollback.ts

@@ -1,3 +1,4 @@
+import { putFileBlob, blobContent } from '../db/file-blobs.js';
 import type { ArtifactKind } from '../config.js';
 import { db } from '../db/index.js';
 import { emit } from '../pipeline/bus.js';
@@ -101,7 +102,7 @@ export async function rollbackPromoteDeployment(promoteId: string): Promise<Roll
 
     const fileRows = db()
         .prepare(
-            `SELECT f.id, f.server, f.verb, f.rel_path, f.sha256_before, f.sha256_after, f.content_before, f.content_after, f.snapshot_pending
+            `SELECT f.id, f.server, f.verb, f.rel_path, f.sha256_before, f.sha256_after, ${blobContent('f.content_before_hash')} AS content_before, ${blobContent('f.content_after_hash')} AS content_after, f.snapshot_pending
              FROM deployment_files f JOIN deployment_servers ds ON ds.deployment_id = f.deployment_id AND ds.server = f.server
              JOIN servers s ON s.name = f.server
              WHERE f.deployment_id = ? AND ds.server_deleted_at IS NULL AND s.destroyed_at IS NULL ORDER BY f.server, f.rel_path`
@@ -184,7 +185,7 @@ export async function rollbackPromoteDeployment(promoteId: string): Promise<Roll
     );
     const insertDepFile = db().prepare(
         `INSERT INTO deployment_files
-         (deployment_id, server, verb, rel_path, sha256_before, sha256_after, content_before, content_after)
+         (deployment_id, server, verb, rel_path, sha256_before, sha256_after, content_before_hash, content_after_hash)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
     );
 
@@ -226,8 +227,8 @@ export async function rollbackPromoteDeployment(promoteId: string): Promise<Roll
                     f.rel_path,
                     f.sha256_after,
                     f.sha256_before,
-                    f.content_after,
-                    f.content_before
+                    putFileBlob(f.content_after),
+                    putFileBlob(f.content_before)
                 );
                 const owningScript = scriptByTarget.get(f.rel_path);
                 const priorVersion = owningScript?.prior_version_id ? getVersion(owningScript.prior_version_id) : null;