@crewhaus/durable-state 0.1.4 → 0.1.5

package/dist/index.d.ts

@@ -0,0 +1,168 @@
+import { CrewhausError } from "@crewhaus/errors";
+export declare class DurableStateError extends CrewhausError {
+    readonly name = "DurableStateError";
+    constructor(message: string, cause?: unknown);
+}
+export interface DedupStore {
+    /**
+     * Atomic check-and-record. Returns `true` when `key` was already recorded
+     * (caller should treat the event as a duplicate and skip it), `false` when
+     * this call recorded it first. MUST be atomic across concurrent callers —
+     * for the same key, exactly one concurrent `remember` returns `false`.
+     */
+    remember(key: string): Promise<boolean>;
+    /** Drop all recorded keys. Tests/operator tooling. */
+    clear(): Promise<void>;
+    /** Release any underlying resources. Idempotent. */
+    close(): Promise<void>;
+}
+export type InMemoryDedupStoreOptions = {
+    /** Max keys remembered before oldest-first eviction. Default 10 000. */
+    readonly capacity?: number;
+};
+/**
+ * Bounded insertion-ordered set — the exact structure the channel-bot
+ * gateway used inline. Volatile: restarts forget everything (the adapters'
+ * signature replay-windows bound that exposure).
+ */
+export declare class InMemoryDedupStore implements DedupStore {
+    private readonly seen;
+    private readonly capacity;
+    constructor(opts?: InMemoryDedupStoreOptions);
+    remember(key: string): Promise<boolean>;
+    clear(): Promise<void>;
+    close(): Promise<void>;
+}
+export type SqliteDedupStoreOptions = {
+    /** Database file path. All processes on the host must use the same path. */
+    readonly path: string;
+    /**
+     * How long a recorded key stays a duplicate. Default 24 h — comfortably
+     * past every adapter's signature replay-window, which is the window an
+     * attacker can replay a captured webhook within anyway.
+     */
+    readonly ttlMs?: number;
+    /** SQLite busy timeout — how long a writer waits for the lock. Default 5 s. */
+    readonly busyTimeoutMs?: number;
+    /** Test seam: clock. */
+    readonly _now?: () => number;
+};
+/**
+ * Cross-process dedup on one host. `remember` runs prune + insert in a
+ * single IMMEDIATE transaction: the write lock is held across both, so two
+ * processes racing on the same key serialize — exactly one inserts
+ * (`changes === 1`) and the other observes the existing row. The prune
+ * inside the same transaction also closes the check/prune/insert race the
+ * design review flagged.
+ */
+export declare class SqliteDedupStore implements DedupStore {
+    private readonly db;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly rememberTx;
+    private closed;
+    constructor(opts: SqliteDedupStoreOptions);
+    remember(key: string): Promise<boolean>;
+    clear(): Promise<void>;
+    close(): Promise<void>;
+}
+export type UsageDelta = {
+    readonly input: number;
+    readonly output: number;
+};
+export type BudgetLimits = {
+    readonly maxInputTokens: number;
+    readonly maxOutputTokens: number;
+};
+export type TryReserveResult = {
+    readonly ok: true;
+} | {
+    /** Which dimension exceeded, with the totals for the error message. */
+    readonly ok: false;
+    readonly reason: "input" | "output";
+    readonly total: number;
+    readonly limit: number;
+};
+export interface BudgetStore {
+    /**
+     * Atomically reserve `delta` for `tenantId` if recorded + reserved +
+     * delta stays under `limits` on BOTH dimensions; nothing is reserved on
+     * failure. MUST be atomic across concurrent callers — two reservations
+     * that individually fit but jointly exceed must not both succeed.
+     */
+    tryReserve(tenantId: string, delta: UsageDelta, limits: BudgetLimits): Promise<TryReserveResult>;
+    /** Release a reservation made by `tryReserve` (clamped at zero). */
+    release(tenantId: string, delta: UsageDelta): Promise<void>;
+    /** Add actual usage to the tenant's recorded running total. */
+    recordUsage(tenantId: string, delta: UsageDelta): Promise<void>;
+    /** Recorded usage (excludes in-flight reservations). */
+    usage(tenantId: string): Promise<{
+        input: number;
+        output: number;
+    }>;
+    /**
+     * Zero ALL reservations. Crash recovery for the durable backend: a process
+     * that died mid-request leaks its reservation. Call at boot when this
+     * process is the only writer, or from operator tooling after draining.
+     */
+    clearReservations(): Promise<void>;
+    /** Drop all state. Tests. */
+    clear(): Promise<void>;
+    /** Release any underlying resources. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * The exact recorded/reserved maps gateway-server used inline (PR #206),
+ * factored behind the interface. Single-process semantics are unchanged:
+ * synchronous map operations make every method trivially atomic.
+ */
+export declare class InMemoryBudgetStore implements BudgetStore {
+    private readonly recorded;
+    private readonly reserved;
+    tryReserve(tenantId: string, delta: UsageDelta, limits: BudgetLimits): Promise<TryReserveResult>;
+    release(tenantId: string, delta: UsageDelta): Promise<void>;
+    recordUsage(tenantId: string, delta: UsageDelta): Promise<void>;
+    usage(tenantId: string): Promise<{
+        input: number;
+        output: number;
+    }>;
+    clearReservations(): Promise<void>;
+    clear(): Promise<void>;
+    close(): Promise<void>;
+}
+export type SqliteBudgetStoreOptions = {
+    /** Database file path. All processes on the host must use the same path. */
+    readonly path: string;
+    /** SQLite busy timeout — how long a writer waits for the lock. Default 5 s. */
+    readonly busyTimeoutMs?: number;
+};
+/**
+ * Cross-process budget accounting on one host. `tryReserve` runs
+ * read-check-update in a single IMMEDIATE transaction, so two processes
+ * whose reservations individually fit but jointly exceed serialize on the
+ * write lock — the second sees the first's reservation and is refused.
+ */
+export declare class SqliteBudgetStore implements BudgetStore {
+    private readonly db;
+    private readonly reserveTx;
+    private readonly releaseTx;
+    private closed;
+    constructor(opts: SqliteBudgetStoreOptions);
+    tryReserve(tenantId: string, delta: UsageDelta, limits: BudgetLimits): Promise<TryReserveResult>;
+    release(tenantId: string, delta: UsageDelta): Promise<void>;
+    recordUsage(tenantId: string, delta: UsageDelta): Promise<void>;
+    usage(tenantId: string): Promise<{
+        input: number;
+        output: number;
+    }>;
+    clearReservations(): Promise<void>;
+    clear(): Promise<void>;
+    close(): Promise<void>;
+}
+/** Build a DedupStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
+export declare function createDedupStore(spec: string, opts?: {
+    capacity?: number;
+    ttlMs?: number;
+}): DedupStore;
+/** Build a BudgetStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
+export declare function createBudgetStore(spec: string): BudgetStore;

package/dist/index.js

@@ -0,0 +1,314 @@
+/**
+ * `@crewhaus/durable-state` — pluggable dedup + budget stores (audit
+ * follow-up R3).
+ *
+ * Two pieces of security-relevant state were in-memory per process:
+ *
+ *   1. Webhook replay-dedup (the channel-bot gateway's LRU `Set` of
+ *      idempotency keys). A daemon restart or a second replica forgets every
+ *      seen key, so a captured webhook can be replayed against the fresh
+ *      process inside its signature replay-window.
+ *   2. Tenant budget accounting (gateway-server's recorded + in-flight
+ *      reservation maps, PR #206). Each replica enforces the budget against
+ *      its own counters only — N replicas multiply every tenant budget by N.
+ *
+ * This package defines the store interfaces those consumers now accept, plus
+ * two built-in backends:
+ *
+ *   - In-memory (default, behavior-preserving): exactly the structures the
+ *     consumers used inline, factored behind the interface.
+ *   - `bun:sqlite` (zero new dependencies — built into Bun): durable across
+ *     restarts and shared across processes ON ONE HOST. WAL journaling, a
+ *     busy timeout, and IMMEDIATE transactions make the check-and-record /
+ *     check-and-reserve operations atomic across concurrent processes (the
+ *     write lock is held across the read and the write).
+ *
+ * Multi-HOST deployments need a network store (Redis, Postgres); implement
+ * these interfaces against it — the consumers don't care. Follows the
+ * checkpoint-store pluggable-adapter pattern.
+ *
+ * Crash residual (documented): a process that dies between `tryReserve` and
+ * `release` leaks its reservation in the sqlite backend (in-memory state
+ * dies with the process; durable state doesn't). Reservations are
+ * request-scoped and small; single-writer deployments can call
+ * `clearReservations()` at boot, and operators can do the same from tooling
+ * after draining traffic.
+ */
+import { Database } from "bun:sqlite";
+import { CrewhausError } from "@crewhaus/errors";
+export class DurableStateError extends CrewhausError {
+    name = "DurableStateError";
+    constructor(message, cause) {
+        super("config", message, cause);
+    }
+}
+/**
+ * Bounded insertion-ordered set — the exact structure the channel-bot
+ * gateway used inline. Volatile: restarts forget everything (the adapters'
+ * signature replay-windows bound that exposure).
+ */
+export class InMemoryDedupStore {
+    seen = new Set();
+    capacity;
+    constructor(opts = {}) {
+        this.capacity = opts.capacity ?? 10_000;
+    }
+    async remember(key) {
+        if (this.seen.has(key))
+            return true;
+        this.seen.add(key);
+        if (this.seen.size > this.capacity) {
+            const oldest = this.seen.values().next().value;
+            if (oldest !== undefined)
+                this.seen.delete(oldest);
+        }
+        return false;
+    }
+    async clear() {
+        this.seen.clear();
+    }
+    async close() {
+        // nothing to release
+    }
+}
+/**
+ * Cross-process dedup on one host. `remember` runs prune + insert in a
+ * single IMMEDIATE transaction: the write lock is held across both, so two
+ * processes racing on the same key serialize — exactly one inserts
+ * (`changes === 1`) and the other observes the existing row. The prune
+ * inside the same transaction also closes the check/prune/insert race the
+ * design review flagged.
+ */
+export class SqliteDedupStore {
+    db;
+    ttlMs;
+    now;
+    rememberTx;
+    closed = false;
+    constructor(opts) {
+        this.db = new Database(opts.path);
+        this.db.run("PRAGMA journal_mode = WAL");
+        this.db.run(`PRAGMA busy_timeout = ${opts.busyTimeoutMs ?? 5000}`);
+        this.db.run("CREATE TABLE IF NOT EXISTS dedup (key TEXT PRIMARY KEY, expires_at INTEGER NOT NULL)");
+        this.ttlMs = opts.ttlMs ?? 24 * 60 * 60 * 1000;
+        this.now = opts._now ?? Date.now;
+        const prune = this.db.prepare("DELETE FROM dedup WHERE expires_at <= ?");
+        const insert = this.db.prepare("INSERT OR IGNORE INTO dedup (key, expires_at) VALUES (?, ?)");
+        const tx = this.db.transaction((key) => {
+            const t = this.now();
+            prune.run(t);
+            const r = insert.run(key, t + this.ttlMs);
+            return r.changes === 0; // 0 changes = row existed = already seen
+        });
+        this.rememberTx = (key) => tx.immediate(key);
+    }
+    async remember(key) {
+        return this.rememberTx(key);
+    }
+    async clear() {
+        this.db.run("DELETE FROM dedup");
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.db.close();
+    }
+}
+/**
+ * The exact recorded/reserved maps gateway-server used inline (PR #206),
+ * factored behind the interface. Single-process semantics are unchanged:
+ * synchronous map operations make every method trivially atomic.
+ */
+export class InMemoryBudgetStore {
+    recorded = new Map();
+    reserved = new Map();
+    async tryReserve(tenantId, delta, limits) {
+        const used = this.recorded.get(tenantId) ?? { input: 0, output: 0 };
+        const res = this.reserved.get(tenantId) ?? { input: 0, output: 0 };
+        const totalInput = used.input + res.input + delta.input;
+        const totalOutput = used.output + res.output + delta.output;
+        if (totalInput >= limits.maxInputTokens) {
+            return { ok: false, reason: "input", total: totalInput, limit: limits.maxInputTokens };
+        }
+        if (totalOutput >= limits.maxOutputTokens) {
+            return { ok: false, reason: "output", total: totalOutput, limit: limits.maxOutputTokens };
+        }
+        if (delta.input !== 0 || delta.output !== 0) {
+            this.reserved.set(tenantId, {
+                input: res.input + delta.input,
+                output: res.output + delta.output,
+            });
+        }
+        return { ok: true };
+    }
+    async release(tenantId, delta) {
+        if (delta.input === 0 && delta.output === 0)
+            return;
+        const cur = this.reserved.get(tenantId) ?? { input: 0, output: 0 };
+        const next = {
+            input: Math.max(0, cur.input - delta.input),
+            output: Math.max(0, cur.output - delta.output),
+        };
+        if (next.input === 0 && next.output === 0)
+            this.reserved.delete(tenantId);
+        else
+            this.reserved.set(tenantId, next);
+    }
+    async recordUsage(tenantId, delta) {
+        const cur = this.recorded.get(tenantId) ?? { input: 0, output: 0 };
+        this.recorded.set(tenantId, {
+            input: cur.input + delta.input,
+            output: cur.output + delta.output,
+        });
+    }
+    async usage(tenantId) {
+        return this.recorded.get(tenantId) ?? { input: 0, output: 0 };
+    }
+    async clearReservations() {
+        this.reserved.clear();
+    }
+    async clear() {
+        this.recorded.clear();
+        this.reserved.clear();
+    }
+    async close() {
+        // nothing to release
+    }
+}
+/**
+ * Cross-process budget accounting on one host. `tryReserve` runs
+ * read-check-update in a single IMMEDIATE transaction, so two processes
+ * whose reservations individually fit but jointly exceed serialize on the
+ * write lock — the second sees the first's reservation and is refused.
+ */
+export class SqliteBudgetStore {
+    db;
+    reserveTx;
+    releaseTx;
+    closed = false;
+    constructor(opts) {
+        this.db = new Database(opts.path);
+        this.db.run("PRAGMA journal_mode = WAL");
+        this.db.run(`PRAGMA busy_timeout = ${opts.busyTimeoutMs ?? 5000}`);
+        this.db.run(`CREATE TABLE IF NOT EXISTS budget (
+      tenant_id TEXT PRIMARY KEY,
+      recorded_input INTEGER NOT NULL DEFAULT 0,
+      recorded_output INTEGER NOT NULL DEFAULT 0,
+      reserved_input INTEGER NOT NULL DEFAULT 0,
+      reserved_output INTEGER NOT NULL DEFAULT 0
+    )`);
+        const select = this.db.prepare("SELECT recorded_input, recorded_output, reserved_input, reserved_output FROM budget WHERE tenant_id = ?");
+        const upsertReserve = this.db.prepare(`INSERT INTO budget
+        (tenant_id, reserved_input, reserved_output) VALUES (?, ?, ?)
+      ON CONFLICT(tenant_id) DO UPDATE SET
+        reserved_input = reserved_input + excluded.reserved_input,
+        reserved_output = reserved_output + excluded.reserved_output`);
+        const releaseUpdate = this.db.prepare(`UPDATE budget SET
+        reserved_input = MAX(0, reserved_input - ?),
+        reserved_output = MAX(0, reserved_output - ?)
+      WHERE tenant_id = ?`);
+        const reserveTxn = this.db.transaction((tenantId, delta, limits) => {
+            const row = select.get(tenantId) ?? {
+                recorded_input: 0,
+                recorded_output: 0,
+                reserved_input: 0,
+                reserved_output: 0,
+            };
+            const totalInput = row.recorded_input + row.reserved_input + delta.input;
+            const totalOutput = row.recorded_output + row.reserved_output + delta.output;
+            if (totalInput >= limits.maxInputTokens) {
+                return { ok: false, reason: "input", total: totalInput, limit: limits.maxInputTokens };
+            }
+            if (totalOutput >= limits.maxOutputTokens) {
+                return {
+                    ok: false,
+                    reason: "output",
+                    total: totalOutput,
+                    limit: limits.maxOutputTokens,
+                };
+            }
+            if (delta.input !== 0 || delta.output !== 0) {
+                upsertReserve.run(tenantId, delta.input, delta.output);
+            }
+            return { ok: true };
+        });
+        this.reserveTx = (tenantId, delta, limits) => reserveTxn.immediate(tenantId, delta, limits);
+        const releaseTxn = this.db.transaction((tenantId, delta) => {
+            releaseUpdate.run(delta.input, delta.output, tenantId);
+        });
+        this.releaseTx = (tenantId, delta) => {
+            releaseTxn.immediate(tenantId, delta);
+        };
+    }
+    async tryReserve(tenantId, delta, limits) {
+        return this.reserveTx(tenantId, delta, limits);
+    }
+    async release(tenantId, delta) {
+        if (delta.input === 0 && delta.output === 0)
+            return;
+        this.releaseTx(tenantId, delta);
+    }
+    async recordUsage(tenantId, delta) {
+        this.db
+            .prepare(`INSERT INTO budget
+        (tenant_id, recorded_input, recorded_output) VALUES (?, ?, ?)
+      ON CONFLICT(tenant_id) DO UPDATE SET
+        recorded_input = recorded_input + excluded.recorded_input,
+        recorded_output = recorded_output + excluded.recorded_output`)
+            .run(tenantId, delta.input, delta.output);
+    }
+    async usage(tenantId) {
+        const row = this.db
+            .prepare("SELECT recorded_input, recorded_output FROM budget WHERE tenant_id = ?")
+            .get(tenantId);
+        return row === null
+            ? { input: 0, output: 0 }
+            : { input: row.recorded_input, output: row.recorded_output };
+    }
+    async clearReservations() {
+        this.db.run("UPDATE budget SET reserved_input = 0, reserved_output = 0");
+    }
+    async clear() {
+        this.db.run("DELETE FROM budget");
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.db.close();
+    }
+}
+// ---------------------------------------------------------------------------
+// Spec-string factories — env-driven backend selection for generated daemons.
+// ---------------------------------------------------------------------------
+function parseSpec(spec) {
+    if (spec === "memory")
+        return { backend: "memory" };
+    if (spec.startsWith("sqlite:")) {
+        const path = spec.slice("sqlite:".length);
+        if (path === "") {
+            throw new DurableStateError(`invalid store spec "${spec}": sqlite: needs a file path`);
+        }
+        return { backend: "sqlite", path };
+    }
+    throw new DurableStateError(`invalid store spec "${spec}": expected "memory" or "sqlite:<path>"`);
+}
+/** Build a DedupStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
+export function createDedupStore(spec, opts = {}) {
+    const parsed = parseSpec(spec);
+    if (parsed.backend === "memory") {
+        return new InMemoryDedupStore(opts.capacity !== undefined ? { capacity: opts.capacity } : {});
+    }
+    return new SqliteDedupStore({
+        path: parsed.path,
+        ...(opts.ttlMs !== undefined ? { ttlMs: opts.ttlMs } : {}),
+    });
+}
+/** Build a BudgetStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
+export function createBudgetStore(spec) {
+    const parsed = parseSpec(spec);
+    if (parsed.backend === "memory")
+        return new InMemoryBudgetStore();
+    return new SqliteBudgetStore({ path: parsed.path });
+}

package/package.json

@@ -1,18 +1,21 @@
 {
   "name": "@crewhaus/durable-state",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "Pluggable dedup + budget stores (audit follow-up R3) — in-memory defaults, bun:sqlite cross-process backend",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.4"
+    "@crewhaus/errors": "0.1.5"
   },
   "license": "Apache-2.0",
   "author": {
@@ -32,5 +35,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -1,236 +0,0 @@
-/**
- * Audit follow-up R3 — store contract tests. The SAME behavioral suite runs
- * against both backends so the sqlite store is interchangeable with the
- * in-memory default; sqlite-only suites then cover what the in-memory store
- * can't promise: cross-instance (cross-process) visibility and atomicity.
- */
-import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import * as path from "node:path";
-import {
-  type BudgetStore,
-  type DedupStore,
-  InMemoryBudgetStore,
-  InMemoryDedupStore,
-  SqliteBudgetStore,
-  SqliteDedupStore,
-  createBudgetStore,
-  createDedupStore,
-} from "./index";
-
-let tmp: string | undefined;
-const opened: Array<DedupStore | BudgetStore> = [];
-
-afterEach(async () => {
-  while (opened.length > 0) {
-    await opened.pop()?.close();
-  }
-  if (tmp !== undefined) {
-    rmSync(tmp, { recursive: true, force: true });
-    tmp = undefined;
-  }
-});
-
-function dbPath(name: string): string {
-  if (tmp === undefined) tmp = mkdtempSync(path.join(tmpdir(), "durable-state-"));
-  return path.join(tmp, name);
-}
-
-function track<T extends DedupStore | BudgetStore>(store: T): T {
-  opened.push(store);
-  return store;
-}
-
-const LIMITS = { maxInputTokens: 100, maxOutputTokens: 100 };
-
-// ---------------------------------------------------------------------------
-// Backend-agnostic contracts
-// ---------------------------------------------------------------------------
-
-const dedupBackends: Array<[string, () => DedupStore]> = [
-  ["InMemoryDedupStore", () => track(new InMemoryDedupStore())],
-  ["SqliteDedupStore", () => track(new SqliteDedupStore({ path: dbPath("dedup.db") }))],
-];
-
-describe.each(dedupBackends)("DedupStore contract — %s", (_name, make) => {
-  test("first remember returns false, repeat returns true", async () => {
-    const store = make();
-    expect(await store.remember("evt_1")).toBe(false);
-    expect(await store.remember("evt_1")).toBe(true);
-    expect(await store.remember("evt_2")).toBe(false);
-  });
-
-  test("clear() forgets recorded keys", async () => {
-    const store = make();
-    await store.remember("evt_1");
-    await store.clear();
-    expect(await store.remember("evt_1")).toBe(false);
-  });
-});
-
-const budgetBackends: Array<[string, () => BudgetStore]> = [
-  ["InMemoryBudgetStore", () => track(new InMemoryBudgetStore())],
-  ["SqliteBudgetStore", () => track(new SqliteBudgetStore({ path: dbPath("budget.db") }))],
-];
-
-describe.each(budgetBackends)("BudgetStore contract — %s", (_name, make) => {
-  test("reserve within limits succeeds; usage stays recorded-only", async () => {
-    const store = make();
-    expect(await store.tryReserve("t1", { input: 40, output: 10 }, LIMITS)).toEqual({ ok: true });
-    expect(await store.usage("t1")).toEqual({ input: 0, output: 0 });
-  });
-
-  test("recorded + reserved + delta over the limit is refused with totals", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 60, output: 0 });
-    expect(await store.tryReserve("t1", { input: 30, output: 0 }, LIMITS)).toEqual({ ok: true });
-    const refused = await store.tryReserve("t1", { input: 20, output: 0 }, LIMITS);
-    expect(refused).toEqual({ ok: false, reason: "input", total: 110, limit: 100 });
-  });
-
-  test("a refused reserve reserves NOTHING", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 95, output: 0 });
-    expect((await store.tryReserve("t1", { input: 50, output: 0 }, LIMITS)).ok).toBe(false);
-    // A small reserve that fits must still succeed — nothing leaked.
-    expect(await store.tryReserve("t1", { input: 2, output: 0 }, LIMITS)).toEqual({ ok: true });
-  });
-
-  test("a zero-delta reserve still refuses when recorded usage is at the cap", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 100, output: 0 });
-    const refused = await store.tryReserve("t1", { input: 0, output: 0 }, LIMITS);
-    expect(refused).toEqual({ ok: false, reason: "input", total: 100, limit: 100 });
-  });
-
-  test("the output dimension is enforced independently", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 0, output: 99 });
-    const refused = await store.tryReserve("t1", { input: 1, output: 5 }, LIMITS);
-    expect(refused).toEqual({ ok: false, reason: "output", total: 104, limit: 100 });
-  });
-
-  test("release frees reserved capacity and clamps at zero", async () => {
-    const store = make();
-    expect(await store.tryReserve("t1", { input: 90, output: 0 }, LIMITS)).toEqual({ ok: true });
-    expect((await store.tryReserve("t1", { input: 90, output: 0 }, LIMITS)).ok).toBe(false);
-    await store.release("t1", { input: 90, output: 0 });
-    expect(await store.tryReserve("t1", { input: 90, output: 0 }, LIMITS)).toEqual({ ok: true });
-    // Over-release must clamp, not go negative.
-    await store.release("t1", { input: 9999, output: 9999 });
-    expect((await store.tryReserve("t1", { input: 99, output: 0 }, LIMITS)).ok).toBe(true);
-  });
-
-  test("recordUsage accumulates and usage() reads it back", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 10, output: 5 });
-    await store.recordUsage("t1", { input: 7, output: 3 });
-    expect(await store.usage("t1")).toEqual({ input: 17, output: 8 });
-    expect(await store.usage("other")).toEqual({ input: 0, output: 0 });
-  });
-
-  test("tenants are isolated", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 99, output: 0 });
-    expect(await store.tryReserve("t2", { input: 50, output: 0 }, LIMITS)).toEqual({ ok: true });
-  });
-
-  test("clearReservations frees in-flight capacity but keeps recorded usage", async () => {
-    const store = make();
-    await store.recordUsage("t1", { input: 50, output: 0 });
-    expect(await store.tryReserve("t1", { input: 49, output: 0 }, LIMITS)).toEqual({ ok: true });
-    expect((await store.tryReserve("t1", { input: 49, output: 0 }, LIMITS)).ok).toBe(false);
-    await store.clearReservations();
-    expect(await store.tryReserve("t1", { input: 49, output: 0 }, LIMITS)).toEqual({ ok: true });
-    expect(await store.usage("t1")).toEqual({ input: 50, output: 0 });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// SQLite-only: cross-instance (stand-in for cross-process) guarantees
-// ---------------------------------------------------------------------------
-
-describe("SqliteDedupStore — cross-instance", () => {
-  test("a key remembered by one instance is a duplicate for another on the same file", async () => {
-    const file = dbPath("shared-dedup.db");
-    const a = track(new SqliteDedupStore({ path: file }));
-    const b = track(new SqliteDedupStore({ path: file }));
-    expect(await a.remember("evt_shared")).toBe(false);
-    expect(await b.remember("evt_shared")).toBe(true);
-  });
-
-  test("concurrent remember on the same key: exactly one instance wins", async () => {
-    const file = dbPath("race-dedup.db");
-    const a = track(new SqliteDedupStore({ path: file }));
-    const b = track(new SqliteDedupStore({ path: file }));
-    const results = await Promise.all([a.remember("evt_race"), b.remember("evt_race")]);
-    expect(results.filter((seen) => seen === false).length).toBe(1);
-  });
-
-  test("expired keys can be remembered again (TTL prune inside the txn)", async () => {
-    let t = 1_000_000;
-    const store = track(
-      new SqliteDedupStore({ path: dbPath("ttl-dedup.db"), ttlMs: 60_000, _now: () => t }),
-    );
-    expect(await store.remember("evt_ttl")).toBe(false);
-    expect(await store.remember("evt_ttl")).toBe(true);
-    t += 60_001; // past expiry
-    expect(await store.remember("evt_ttl")).toBe(false);
-  });
-
-  test("survives instance restart (durability)", async () => {
-    const file = dbPath("restart-dedup.db");
-    const first = new SqliteDedupStore({ path: file });
-    await first.remember("evt_durable");
-    await first.close();
-    const second = track(new SqliteDedupStore({ path: file }));
-    expect(await second.remember("evt_durable")).toBe(true);
-  });
-});
-
-describe("SqliteBudgetStore — cross-instance", () => {
-  test("usage recorded by one instance bounds reservations in another", async () => {
-    const file = dbPath("shared-budget.db");
-    const a = track(new SqliteBudgetStore({ path: file }));
-    const b = track(new SqliteBudgetStore({ path: file }));
-    await a.recordUsage("t1", { input: 80, output: 0 });
-    const refused = await b.tryReserve("t1", { input: 30, output: 0 }, LIMITS);
-    expect(refused).toEqual({ ok: false, reason: "input", total: 110, limit: 100 });
-  });
-
-  test("jointly-exceeding concurrent reserves: at most one succeeds", async () => {
-    const file = dbPath("race-budget.db");
-    const a = track(new SqliteBudgetStore({ path: file }));
-    const b = track(new SqliteBudgetStore({ path: file }));
-    // Each fits alone (60 < 100); together they exceed (120 >= 100). The
-    // IMMEDIATE transaction serializes them: the loser sees the winner's
-    // reservation.
-    const results = await Promise.all([
-      a.tryReserve("t1", { input: 60, output: 0 }, LIMITS),
-      b.tryReserve("t1", { input: 60, output: 0 }, LIMITS),
-    ]);
-    expect(results.filter((r) => r.ok).length).toBe(1);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Spec-string factories
-// ---------------------------------------------------------------------------
-
-describe("createDedupStore / createBudgetStore", () => {
-  test('"memory" builds the in-memory backends', () => {
-    expect(track(createDedupStore("memory"))).toBeInstanceOf(InMemoryDedupStore);
-    expect(track(createBudgetStore("memory"))).toBeInstanceOf(InMemoryBudgetStore);
-  });
-
-  test('"sqlite:<path>" builds the sqlite backends', () => {
-    expect(track(createDedupStore(`sqlite:${dbPath("f1.db")}`))).toBeInstanceOf(SqliteDedupStore);
-    expect(track(createBudgetStore(`sqlite:${dbPath("f2.db")}`))).toBeInstanceOf(SqliteBudgetStore);
-  });
-
-  test("unknown specs fail closed with a clear error", () => {
-    expect(() => createDedupStore("redis://nope")).toThrow(/expected "memory" or "sqlite:<path>"/);
-    expect(() => createBudgetStore("sqlite:")).toThrow(/needs a file path/);
-  });
-});

package/src/index.ts

@@ -1,463 +0,0 @@
-/**
- * `@crewhaus/durable-state` — pluggable dedup + budget stores (audit
- * follow-up R3).
- *
- * Two pieces of security-relevant state were in-memory per process:
- *
- *   1. Webhook replay-dedup (the channel-bot gateway's LRU `Set` of
- *      idempotency keys). A daemon restart or a second replica forgets every
- *      seen key, so a captured webhook can be replayed against the fresh
- *      process inside its signature replay-window.
- *   2. Tenant budget accounting (gateway-server's recorded + in-flight
- *      reservation maps, PR #206). Each replica enforces the budget against
- *      its own counters only — N replicas multiply every tenant budget by N.
- *
- * This package defines the store interfaces those consumers now accept, plus
- * two built-in backends:
- *
- *   - In-memory (default, behavior-preserving): exactly the structures the
- *     consumers used inline, factored behind the interface.
- *   - `bun:sqlite` (zero new dependencies — built into Bun): durable across
- *     restarts and shared across processes ON ONE HOST. WAL journaling, a
- *     busy timeout, and IMMEDIATE transactions make the check-and-record /
- *     check-and-reserve operations atomic across concurrent processes (the
- *     write lock is held across the read and the write).
- *
- * Multi-HOST deployments need a network store (Redis, Postgres); implement
- * these interfaces against it — the consumers don't care. Follows the
- * checkpoint-store pluggable-adapter pattern.
- *
- * Crash residual (documented): a process that dies between `tryReserve` and
- * `release` leaks its reservation in the sqlite backend (in-memory state
- * dies with the process; durable state doesn't). Reservations are
- * request-scoped and small; single-writer deployments can call
- * `clearReservations()` at boot, and operators can do the same from tooling
- * after draining traffic.
- */
-import { Database } from "bun:sqlite";
-import { CrewhausError } from "@crewhaus/errors";
-
-export class DurableStateError extends CrewhausError {
-  override readonly name = "DurableStateError";
-  constructor(message: string, cause?: unknown) {
-    super("config", message, cause);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Dedup store
-// ---------------------------------------------------------------------------
-
-export interface DedupStore {
-  /**
-   * Atomic check-and-record. Returns `true` when `key` was already recorded
-   * (caller should treat the event as a duplicate and skip it), `false` when
-   * this call recorded it first. MUST be atomic across concurrent callers —
-   * for the same key, exactly one concurrent `remember` returns `false`.
-   */
-  remember(key: string): Promise<boolean>;
-  /** Drop all recorded keys. Tests/operator tooling. */
-  clear(): Promise<void>;
-  /** Release any underlying resources. Idempotent. */
-  close(): Promise<void>;
-}
-
-export type InMemoryDedupStoreOptions = {
-  /** Max keys remembered before oldest-first eviction. Default 10 000. */
-  readonly capacity?: number;
-};
-
-/**
- * Bounded insertion-ordered set — the exact structure the channel-bot
- * gateway used inline. Volatile: restarts forget everything (the adapters'
- * signature replay-windows bound that exposure).
- */
-export class InMemoryDedupStore implements DedupStore {
-  private readonly seen = new Set<string>();
-  private readonly capacity: number;
-
-  constructor(opts: InMemoryDedupStoreOptions = {}) {
-    this.capacity = opts.capacity ?? 10_000;
-  }
-
-  async remember(key: string): Promise<boolean> {
-    if (this.seen.has(key)) return true;
-    this.seen.add(key);
-    if (this.seen.size > this.capacity) {
-      const oldest = this.seen.values().next().value as string | undefined;
-      if (oldest !== undefined) this.seen.delete(oldest);
-    }
-    return false;
-  }
-
-  async clear(): Promise<void> {
-    this.seen.clear();
-  }
-
-  async close(): Promise<void> {
-    // nothing to release
-  }
-}
-
-export type SqliteDedupStoreOptions = {
-  /** Database file path. All processes on the host must use the same path. */
-  readonly path: string;
-  /**
-   * How long a recorded key stays a duplicate. Default 24 h — comfortably
-   * past every adapter's signature replay-window, which is the window an
-   * attacker can replay a captured webhook within anyway.
-   */
-  readonly ttlMs?: number;
-  /** SQLite busy timeout — how long a writer waits for the lock. Default 5 s. */
-  readonly busyTimeoutMs?: number;
-  /** Test seam: clock. */
-  readonly _now?: () => number;
-};
-
-/**
- * Cross-process dedup on one host. `remember` runs prune + insert in a
- * single IMMEDIATE transaction: the write lock is held across both, so two
- * processes racing on the same key serialize — exactly one inserts
- * (`changes === 1`) and the other observes the existing row. The prune
- * inside the same transaction also closes the check/prune/insert race the
- * design review flagged.
- */
-export class SqliteDedupStore implements DedupStore {
-  private readonly db: Database;
-  private readonly ttlMs: number;
-  private readonly now: () => number;
-  private readonly rememberTx: (key: string) => boolean;
-  private closed = false;
-
-  constructor(opts: SqliteDedupStoreOptions) {
-    this.db = new Database(opts.path);
-    this.db.run("PRAGMA journal_mode = WAL");
-    this.db.run(`PRAGMA busy_timeout = ${opts.busyTimeoutMs ?? 5000}`);
-    this.db.run(
-      "CREATE TABLE IF NOT EXISTS dedup (key TEXT PRIMARY KEY, expires_at INTEGER NOT NULL)",
-    );
-    this.ttlMs = opts.ttlMs ?? 24 * 60 * 60 * 1000;
-    this.now = opts._now ?? Date.now;
-    const prune = this.db.prepare("DELETE FROM dedup WHERE expires_at <= ?");
-    const insert = this.db.prepare("INSERT OR IGNORE INTO dedup (key, expires_at) VALUES (?, ?)");
-    const tx = this.db.transaction((key: string): boolean => {
-      const t = this.now();
-      prune.run(t);
-      const r = insert.run(key, t + this.ttlMs);
-      return r.changes === 0; // 0 changes = row existed = already seen
-    });
-    this.rememberTx = (key) => tx.immediate(key) as boolean;
-  }
-
-  async remember(key: string): Promise<boolean> {
-    return this.rememberTx(key);
-  }
-
-  async clear(): Promise<void> {
-    this.db.run("DELETE FROM dedup");
-  }
-
-  async close(): Promise<void> {
-    if (this.closed) return;
-    this.closed = true;
-    this.db.close();
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Budget store
-// ---------------------------------------------------------------------------
-
-export type UsageDelta = {
-  readonly input: number;
-  readonly output: number;
-};
-
-export type BudgetLimits = {
-  readonly maxInputTokens: number;
-  readonly maxOutputTokens: number;
-};
-
-export type TryReserveResult =
-  | { readonly ok: true }
-  | {
-      /** Which dimension exceeded, with the totals for the error message. */
-      readonly ok: false;
-      readonly reason: "input" | "output";
-      readonly total: number;
-      readonly limit: number;
-    };
-
-export interface BudgetStore {
-  /**
-   * Atomically reserve `delta` for `tenantId` if recorded + reserved +
-   * delta stays under `limits` on BOTH dimensions; nothing is reserved on
-   * failure. MUST be atomic across concurrent callers — two reservations
-   * that individually fit but jointly exceed must not both succeed.
-   */
-  tryReserve(tenantId: string, delta: UsageDelta, limits: BudgetLimits): Promise<TryReserveResult>;
-  /** Release a reservation made by `tryReserve` (clamped at zero). */
-  release(tenantId: string, delta: UsageDelta): Promise<void>;
-  /** Add actual usage to the tenant's recorded running total. */
-  recordUsage(tenantId: string, delta: UsageDelta): Promise<void>;
-  /** Recorded usage (excludes in-flight reservations). */
-  usage(tenantId: string): Promise<{ input: number; output: number }>;
-  /**
-   * Zero ALL reservations. Crash recovery for the durable backend: a process
-   * that died mid-request leaks its reservation. Call at boot when this
-   * process is the only writer, or from operator tooling after draining.
-   */
-  clearReservations(): Promise<void>;
-  /** Drop all state. Tests. */
-  clear(): Promise<void>;
-  /** Release any underlying resources. Idempotent. */
-  close(): Promise<void>;
-}
-
-/**
- * The exact recorded/reserved maps gateway-server used inline (PR #206),
- * factored behind the interface. Single-process semantics are unchanged:
- * synchronous map operations make every method trivially atomic.
- */
-export class InMemoryBudgetStore implements BudgetStore {
-  private readonly recorded = new Map<string, { input: number; output: number }>();
-  private readonly reserved = new Map<string, { input: number; output: number }>();
-
-  async tryReserve(
-    tenantId: string,
-    delta: UsageDelta,
-    limits: BudgetLimits,
-  ): Promise<TryReserveResult> {
-    const used = this.recorded.get(tenantId) ?? { input: 0, output: 0 };
-    const res = this.reserved.get(tenantId) ?? { input: 0, output: 0 };
-    const totalInput = used.input + res.input + delta.input;
-    const totalOutput = used.output + res.output + delta.output;
-    if (totalInput >= limits.maxInputTokens) {
-      return { ok: false, reason: "input", total: totalInput, limit: limits.maxInputTokens };
-    }
-    if (totalOutput >= limits.maxOutputTokens) {
-      return { ok: false, reason: "output", total: totalOutput, limit: limits.maxOutputTokens };
-    }
-    if (delta.input !== 0 || delta.output !== 0) {
-      this.reserved.set(tenantId, {
-        input: res.input + delta.input,
-        output: res.output + delta.output,
-      });
-    }
-    return { ok: true };
-  }
-
-  async release(tenantId: string, delta: UsageDelta): Promise<void> {
-    if (delta.input === 0 && delta.output === 0) return;
-    const cur = this.reserved.get(tenantId) ?? { input: 0, output: 0 };
-    const next = {
-      input: Math.max(0, cur.input - delta.input),
-      output: Math.max(0, cur.output - delta.output),
-    };
-    if (next.input === 0 && next.output === 0) this.reserved.delete(tenantId);
-    else this.reserved.set(tenantId, next);
-  }
-
-  async recordUsage(tenantId: string, delta: UsageDelta): Promise<void> {
-    const cur = this.recorded.get(tenantId) ?? { input: 0, output: 0 };
-    this.recorded.set(tenantId, {
-      input: cur.input + delta.input,
-      output: cur.output + delta.output,
-    });
-  }
-
-  async usage(tenantId: string): Promise<{ input: number; output: number }> {
-    return this.recorded.get(tenantId) ?? { input: 0, output: 0 };
-  }
-
-  async clearReservations(): Promise<void> {
-    this.reserved.clear();
-  }
-
-  async clear(): Promise<void> {
-    this.recorded.clear();
-    this.reserved.clear();
-  }
-
-  async close(): Promise<void> {
-    // nothing to release
-  }
-}
-
-export type SqliteBudgetStoreOptions = {
-  /** Database file path. All processes on the host must use the same path. */
-  readonly path: string;
-  /** SQLite busy timeout — how long a writer waits for the lock. Default 5 s. */
-  readonly busyTimeoutMs?: number;
-};
-
-/**
- * Cross-process budget accounting on one host. `tryReserve` runs
- * read-check-update in a single IMMEDIATE transaction, so two processes
- * whose reservations individually fit but jointly exceed serialize on the
- * write lock — the second sees the first's reservation and is refused.
- */
-export class SqliteBudgetStore implements BudgetStore {
-  private readonly db: Database;
-  private readonly reserveTx: (
-    tenantId: string,
-    delta: UsageDelta,
-    limits: BudgetLimits,
-  ) => TryReserveResult;
-  private readonly releaseTx: (tenantId: string, delta: UsageDelta) => void;
-  private closed = false;
-
-  constructor(opts: SqliteBudgetStoreOptions) {
-    this.db = new Database(opts.path);
-    this.db.run("PRAGMA journal_mode = WAL");
-    this.db.run(`PRAGMA busy_timeout = ${opts.busyTimeoutMs ?? 5000}`);
-    this.db.run(`CREATE TABLE IF NOT EXISTS budget (
-      tenant_id TEXT PRIMARY KEY,
-      recorded_input INTEGER NOT NULL DEFAULT 0,
-      recorded_output INTEGER NOT NULL DEFAULT 0,
-      reserved_input INTEGER NOT NULL DEFAULT 0,
-      reserved_output INTEGER NOT NULL DEFAULT 0
-    )`);
-
-    const select = this.db.prepare(
-      "SELECT recorded_input, recorded_output, reserved_input, reserved_output FROM budget WHERE tenant_id = ?",
-    );
-    const upsertReserve = this.db.prepare(`INSERT INTO budget
-        (tenant_id, reserved_input, reserved_output) VALUES (?, ?, ?)
-      ON CONFLICT(tenant_id) DO UPDATE SET
-        reserved_input = reserved_input + excluded.reserved_input,
-        reserved_output = reserved_output + excluded.reserved_output`);
-    const releaseUpdate = this.db.prepare(`UPDATE budget SET
-        reserved_input = MAX(0, reserved_input - ?),
-        reserved_output = MAX(0, reserved_output - ?)
-      WHERE tenant_id = ?`);
-
-    type Row = {
-      recorded_input: number;
-      recorded_output: number;
-      reserved_input: number;
-      reserved_output: number;
-    };
-
-    const reserveTxn = this.db.transaction(
-      (tenantId: string, delta: UsageDelta, limits: BudgetLimits): TryReserveResult => {
-        const row = (select.get(tenantId) as Row | null) ?? {
-          recorded_input: 0,
-          recorded_output: 0,
-          reserved_input: 0,
-          reserved_output: 0,
-        };
-        const totalInput = row.recorded_input + row.reserved_input + delta.input;
-        const totalOutput = row.recorded_output + row.reserved_output + delta.output;
-        if (totalInput >= limits.maxInputTokens) {
-          return { ok: false, reason: "input", total: totalInput, limit: limits.maxInputTokens };
-        }
-        if (totalOutput >= limits.maxOutputTokens) {
-          return {
-            ok: false,
-            reason: "output",
-            total: totalOutput,
-            limit: limits.maxOutputTokens,
-          };
-        }
-        if (delta.input !== 0 || delta.output !== 0) {
-          upsertReserve.run(tenantId, delta.input, delta.output);
-        }
-        return { ok: true };
-      },
-    );
-    this.reserveTx = (tenantId, delta, limits) =>
-      reserveTxn.immediate(tenantId, delta, limits) as TryReserveResult;
-
-    const releaseTxn = this.db.transaction((tenantId: string, delta: UsageDelta): void => {
-      releaseUpdate.run(delta.input, delta.output, tenantId);
-    });
-    this.releaseTx = (tenantId, delta) => {
-      releaseTxn.immediate(tenantId, delta);
-    };
-  }
-
-  async tryReserve(
-    tenantId: string,
-    delta: UsageDelta,
-    limits: BudgetLimits,
-  ): Promise<TryReserveResult> {
-    return this.reserveTx(tenantId, delta, limits);
-  }
-
-  async release(tenantId: string, delta: UsageDelta): Promise<void> {
-    if (delta.input === 0 && delta.output === 0) return;
-    this.releaseTx(tenantId, delta);
-  }
-
-  async recordUsage(tenantId: string, delta: UsageDelta): Promise<void> {
-    this.db
-      .prepare(`INSERT INTO budget
-        (tenant_id, recorded_input, recorded_output) VALUES (?, ?, ?)
-      ON CONFLICT(tenant_id) DO UPDATE SET
-        recorded_input = recorded_input + excluded.recorded_input,
-        recorded_output = recorded_output + excluded.recorded_output`)
-      .run(tenantId, delta.input, delta.output);
-  }
-
-  async usage(tenantId: string): Promise<{ input: number; output: number }> {
-    const row = this.db
-      .prepare("SELECT recorded_input, recorded_output FROM budget WHERE tenant_id = ?")
-      .get(tenantId) as { recorded_input: number; recorded_output: number } | null;
-    return row === null
-      ? { input: 0, output: 0 }
-      : { input: row.recorded_input, output: row.recorded_output };
-  }
-
-  async clearReservations(): Promise<void> {
-    this.db.run("UPDATE budget SET reserved_input = 0, reserved_output = 0");
-  }
-
-  async clear(): Promise<void> {
-    this.db.run("DELETE FROM budget");
-  }
-
-  async close(): Promise<void> {
-    if (this.closed) return;
-    this.closed = true;
-    this.db.close();
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Spec-string factories — env-driven backend selection for generated daemons.
-// ---------------------------------------------------------------------------
-
-function parseSpec(spec: string): { backend: "memory" } | { backend: "sqlite"; path: string } {
-  if (spec === "memory") return { backend: "memory" };
-  if (spec.startsWith("sqlite:")) {
-    const path = spec.slice("sqlite:".length);
-    if (path === "") {
-      throw new DurableStateError(`invalid store spec "${spec}": sqlite: needs a file path`);
-    }
-    return { backend: "sqlite", path };
-  }
-  throw new DurableStateError(`invalid store spec "${spec}": expected "memory" or "sqlite:<path>"`);
-}
-
-/** Build a DedupStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
-export function createDedupStore(
-  spec: string,
-  opts: { capacity?: number; ttlMs?: number } = {},
-): DedupStore {
-  const parsed = parseSpec(spec);
-  if (parsed.backend === "memory") {
-    return new InMemoryDedupStore(opts.capacity !== undefined ? { capacity: opts.capacity } : {});
-  }
-  return new SqliteDedupStore({
-    path: parsed.path,
-    ...(opts.ttlMs !== undefined ? { ttlMs: opts.ttlMs } : {}),
-  });
-}
-
-/** Build a BudgetStore from a spec string: `"memory"` or `"sqlite:<path>"`. */
-export function createBudgetStore(spec: string): BudgetStore {
-  const parsed = parseSpec(spec);
-  if (parsed.backend === "memory") return new InMemoryBudgetStore();
-  return new SqliteBudgetStore({ path: parsed.path });
-}