sqlstore

Overview ¶

manager.go is the PER-TENANT selector over the treasury Store: it resolves each request to its OWN Hanzo Base (SQLite) file instead of a process-wide singleton, so one tenant's finance/ledger writes can NEVER appear in another tenant's reads. This is the storage side of the standing Hanzo rule — Postgres stays a supported option (Formance, one layer up), but every tenant's books run live on its own Base file.

TWO file classes, one opener:

• the HOUSE ledger — the platform's OWN reserve fund (fund:reserve, revenue:*, payout:*): a SINGLE single-writer, overdraw-guarded file. It CANNOT be split per tenant (the reserve overdraw guard is one atomic balance), so it is one fixed file — the pre-existing {DataDir}/treasury.db, kept verbatim so live reserve capital is never orphaned by a path change.
• a CUSTOMER ledger — one isolated file per tenant at {DataDir}/finance/{slug}.db, opened on first use and cached.

It CONSUMES the treasury's canonical Base opener (Open, over github.com/hanzoai/ sqlite — the ONE Hanzo Base driver) rather than importing ledgercore's per-tenant opener: that opener is a test-only helper deliberately kept unexported because it registers modernc's database/sql "sqlite" driver, which would COLLIDE with the hanzoai/sqlite registration this store already carries. ledgercore's own contract is "production callers supply their own *bun.DB to New" — which Open does — so the per-tenant file selection lives HERE, over Open, and the slug guard matches ledgercore's per-tenant guard exactly.

Package sqlstore backs the treasury ledger.Store/ledger.Tx port with ledgercore — the ONE Hanzo double-entry engine (github.com/hanzo-fi/ledger) — over a single per-deployment SQLite file. It carries the storage concern the core deliberately does not, and NOTHING else.

THE CONVERGENCE: the treasury no longer hand-rolls its own double-entry SQL. The accounting truth — every account balance and the reserve overdraw guard — is computed by ledgercore (postings -> moves -> balances + a hash-chained log), the SAME engine the ledger's own store uses, so there is exactly one double-entry implementation across the stack. This adapter only translates the treasury's vocabulary (int64 cents, a Kind/Program/Ref idempotency key, a signed-Posting Entry) onto ledgercore, and holds the revenue-share policy — which is Hanzo config, NOT accounting — in a small side table.

The treasury's engine (clients/treasury/ledger) and its on-chain Root (a commitment over Entries) are UNCHANGED: this adapter round-trips each Entry verbatim (stored as ledgercore transaction metadata), so the Root is identical to the previous hand-rolled store's, independent of how ledgercore derives its own postings and balances.

It imports the core (ledger), the ONE engine (ledgercore), and the one Hanzo SQLite driver — never cloud, zip, or IAM — so it stays Base-compatible and travels with the core when it is lifted to hanzoai/finance.