80b3b6d917
Review findings applied across the group: - storage hub: stale disposers no longer remove a successor registration; the package now default-exports the Storage service class per the service-package export shape. - json backend: failed publishes roll back the authoritative memory state (a rejected write can no longer resurface via get() or ride the next publish); close() drains in-flight writes and blocks in-flight opens; double-open rejects as a plain caller error instead of malformed-medium. - sqlite backend: loadAll builds records on a null prototype (__proto__ keys round-trip instead of polluting), user_version is stamped only after the schema is fully created, and corrupt record JSON rejects as malformed-medium instead of a bare SyntaxError. - domain form: writes persist before mutating authoritative memory or emitting; DomainChanged is a put/deleted discriminated union. - workspace: attach/detach idempotence decided on the write chain (stale snapshots no longer short-circuit), create() requires a directory, and startup fails loud on duplicate stored paths. Eleven regression tests pin the fixed behaviors.
@deepseek-ai/dsh-storage-sqlite
SQLite backend for the storage hub: registers as backend sqlite, serving the kv facet over one node:sqlite database file (or :memory:). Design and trade-offs: domain KV storage Agent Note.
Storage model
Document-per-row: each unit table becomes a physical "u_<unit>_<table>" (key TEXT PRIMARY KEY, value TEXT) STRICT table whose value is the record's JSON text, so one key updates one row (the reason to route a high-churn domain here instead of the JSON backend). Unit identity lives in two metadata tables — units stamps each unit's format version at first open and rejects a differing descriptor with version-mismatch; unit_globals holds each unit's global singleton row. The physical layout version lives in PRAGMA user_version; any other stamped value rejects (unreleased format, no migrations). Unit and table names are validated against the hub's UNIT_NAME_RE before they reach DDL, so no external input is ever interpolated into SQL identifiers.
Every write primitive is a single prepared statement — SQLite's per-statement atomicity satisfies the KV contract without explicit transactions, and write ordering stays the caller's responsibility (the domain layer's write chain). Missing directories and database files are created owner-only (0o700/0o600), matching the session-persistence SQLite backend, whose open sequence this package copies verbatim until the planned media-layer extraction.
Configuration (schemastery)
interface Config {
path: string // SQLite database file path, or ':memory:' for an in-process DB
journalMode?: 'wal' | 'delete' | 'truncate' | 'persist' // journal_mode pragma; default 'wal'
}
Model Experience
What the model sees
Nothing. This backend contributes no prompt, tool, or schema; it persists non-session domain data for host-side consumers.
Token effect
Zero live-request tokens.
KV Cache effect
None — no live request prefixes are touched.
Known Limitations and Deferred Work
DatabaseSyncis synchronous — each write blocks the event loop for its (single-statement) duration; acceptable at domain-data scale.- No busy-wait or retry policy — another connection holding a write transaction rejects the operation immediately; multi-process write protection is on the design's future-work list.
- Only the current
STORAGE_SQLITE_SCHEMA_VERSIONopens — any other stamped version is rejected rather than migrated (pre-release stance). openDatabaseduplicates the session-persistence SQLite open sequence — extraction into a shared media layer is deferred to the planned session-backend migration (see the Agent Note's reuse audit).