Content-addressed media

Every file in //SCHEMA is stored under the SHA-256 of its bytes. That one decision explains how uploads work, why deduplication is free, and why media is never public.

A file's name is its hash#

When //SCHEMA stores a file, its location is derived from the SHA-256 of its contents — not from its filename, not from the release it belongs to, not from the catalog. The same bytes always end up in the same place, and different bytes never collide.

Deduplication for free#

Labels reuse files constantly: one cover image for the single, the EP and the album; one master on the original release and three compilations. Since identical bytes have an identical address, each is stored once.

This is why requestUpload can answer alreadyPresent: true. If //SCHEMA holds those bytes — from any earlier delivery — there is nothing to upload, and the resource is backed immediately.

Why you declare the hash before uploading#

The address is the hash, so //SCHEMA has to know the hash before it can say where the bytes go — and it wants to know that without receiving the bytes itself. So the client hashes the file and declares the digest, and //SCHEMA signs an upload URL for exactly that address.

The signature includes the checksum. Storage recomputes the digest of what you send and refuses a mismatch. This matters more than it first appears: a file stored under the wrong address would be wrong for every resource that references that address. Binding the upload to the declared hash makes that impossible.

Then completeUpload asks storage whether the object is really there before recording anything. A resource can never point at bytes that do not exist.

Why media is never public#

The storage itself is private; the only way to read a file is a short-lived signed URL from Resource.url. And a file's address carries no catalog — so knowing an address is not permission to read it. Before //SCHEMA signs a URL, it has already established that the resource belongs to your catalog, and it requires the media_read scope on top of catalog_read, because reading metadata and downloading masters are different grants.

Files are not deleted with resources#

Removing a resource from a release does not delete its file: the same bytes may back other resources.