Protect private bank configuration from drift reconciliation (Refs #152)

src/lib/server/db/file-blobs.ts

@@ -1,3 +1,4 @@
+import { isPrivateConfigEvidencePath } from '../fleet/private-config.js';
 import { createHash } from 'node:crypto';
 import type Database from 'better-sqlite3';
 import { db } from './index.js';
@@ -22,7 +23,18 @@ export function putFileBlob(
     return sha256;
 }
 
+export function isPrivateFileBlob(sha256: string, handle: Database.Database = db()): boolean {
+    const rows = handle
+        .prepare(
+            `SELECT rel_path FROM deployment_files
+        WHERE content_before_hash=? OR content_after_hash=?`
+        )
+        .all(sha256, sha256) as { rel_path: string }[];
+    return rows.some((row) => isPrivateConfigEvidencePath(row.rel_path));
+}
+
 export function getFileBlob(sha256: string, handle: Database.Database = db()): Buffer {
+    if (isPrivateFileBlob(sha256, handle)) throw new Error('Private file content is unavailable.');
     const row = handle.prepare('SELECT content FROM file_blobs WHERE sha256=?').get(sha256) as
         { content: Buffer } | undefined;
     if (!row) throw new Error('File content is unavailable or has expired.');
@@ -58,6 +70,12 @@ export function packFileJson(
     if (Array.isArray(value))
         return { value: value.map((item) => packFileJson(item, handle, hashes).value), hashes };
     if (!value || typeof value !== 'object') return { value, hashes };
+    if (
+        'path' in value &&
+        typeof value.path === 'string' &&
+        isPrivateConfigEvidencePath(value.path)
+    )
+        return { value: { path: value.path, redacted: true }, hashes };
     const result: Record<string, unknown> = {};
     for (const [key, item] of Object.entries(value)) {
         if (