Deduplicate artifact bytes and deliver files by authenticated hash

src/lib/server/db/schema.sql

@@ -1,3 +1,13 @@
+-- Immutable file bodies are shared across versions, campaigns, betas and host commands.
+CREATE TABLE IF NOT EXISTS file_blobs (
+    sha256 TEXT PRIMARY KEY, size INTEGER NOT NULL, content BLOB NOT NULL
+);
+CREATE TABLE IF NOT EXISTS file_blob_references (
+    owner_type TEXT NOT NULL, owner_id TEXT NOT NULL, sha256 TEXT NOT NULL REFERENCES file_blobs(sha256),
+    PRIMARY KEY(owner_type,owner_id,sha256)
+);
+CREATE INDEX IF NOT EXISTS idx_file_blob_references_hash ON file_blob_references(sha256);
+
 -- Electric Cherry schema. Idempotent — safe to run at every boot via migrate.ts.
 -- The old betas/beta_scripts/beta_deploys tables are dropped in-code before this
 -- runs (see dropLegacyBetaTables in db/index.ts); the new script-centric model
@@ -134,7 +144,7 @@ CREATE TABLE IF NOT EXISTS script_versions (
     state        TEXT NOT NULL DEFAULT 'untested',   -- 'untested' | 'tested' | 'test-failed'
     kind         TEXT NOT NULL DEFAULT 'script',     -- denormalized from scripts.kind for join-free filtering
     uploaded_at  TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
-    content      BLOB NOT NULL,
+    content_hash      TEXT REFERENCES file_blobs(sha256),
     UNIQUE(script_id, version)
 );
 CREATE INDEX IF NOT EXISTS idx_script_versions_script ON script_versions(script_id);
@@ -201,7 +211,7 @@ CREATE TABLE IF NOT EXISTS beta_revision_files (
     version INTEGER NOT NULL,
     release_version TEXT,
     sha256 TEXT NOT NULL,
-    content BLOB NOT NULL,
+    content_hash TEXT REFERENCES file_blobs(sha256),
     PRIMARY KEY (beta_id, revision, script_id),
     FOREIGN KEY (beta_id, revision) REFERENCES beta_revisions(beta_id, revision) ON DELETE CASCADE
 );
@@ -306,7 +316,7 @@ CREATE TABLE IF NOT EXISTS beta_file_snapshots (
     beta_id       INTEGER NOT NULL REFERENCES betas(id) ON DELETE CASCADE,
     server        TEXT NOT NULL REFERENCES servers(name) ON DELETE CASCADE,
     rel_path      TEXT NOT NULL,
-    prior_content BLOB NOT NULL,
+    prior_content_hash TEXT REFERENCES file_blobs(sha256),
     prior_sha256  TEXT NOT NULL,
     prior_size    INTEGER NOT NULL,
     PRIMARY KEY (beta_id, server, rel_path)
@@ -364,8 +374,8 @@ CREATE TABLE IF NOT EXISTS deployment_files (
     rel_path       TEXT NOT NULL,
     sha256_before  TEXT,
     sha256_after   TEXT,
-    content_before BLOB,
-    content_after  BLOB,
+    content_before_hash TEXT REFERENCES file_blobs(sha256),
+    content_after_hash  TEXT REFERENCES file_blobs(sha256),
     -- An unknown before image is distinct from a confirmed absent file.
     snapshot_pending INTEGER NOT NULL DEFAULT 0
 );
@@ -382,7 +392,7 @@ CREATE TABLE IF NOT EXISTS staged_file_changes (
     server TEXT NOT NULL,
     kind TEXT NOT NULL,
     rel_path TEXT NOT NULL,
-    content BLOB,
+    content_hash TEXT REFERENCES file_blobs(sha256),
     script_version_id INTEGER,
     inventory_source TEXT NOT NULL,
     deployment_file_id INTEGER REFERENCES deployment_files(id) ON DELETE CASCADE,