@daloyjs/core 1.3.0 → 1.3.1

package/dist/app.d.ts

@@ -1600,7 +1600,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * @param def - The task definition (schedule), same shape as {@link App.cron}.
      * @param job - The job to enqueue on each tick. `payload` defaults to
-     *   `{ scheduledFor: <ISO time of the tick> }`.
+     *   `{ scheduledFor: <ISO time of the tick slot> }`, floored to the same
+     *   slot the idempotency key uses so replicas ticking milliseconds apart
+     *   enqueue byte-identical payloads and dedupe instead of conflicting.
      * @returns This `App` instance for chaining.
      * @throws {@link JobConfigError} (`store_required`) when called before
      *   {@link App.useJobs} — fail fast at registration, not at the first tick.

package/dist/app.js

@@ -2161,7 +2161,9 @@ export class App {
      *
      * @param def - The task definition (schedule), same shape as {@link App.cron}.
      * @param job - The job to enqueue on each tick. `payload` defaults to
-     *   `{ scheduledFor: <ISO time of the tick> }`.
+     *   `{ scheduledFor: <ISO time of the tick slot> }`, floored to the same
+     *   slot the idempotency key uses so replicas ticking milliseconds apart
+     *   enqueue byte-identical payloads and dedupe instead of conflicting.
      * @returns This `App` instance for chaining.
      * @throws {@link JobConfigError} (`store_required`) when called before
      *   {@link App.useJobs} — fail fast at registration, not at the first tick.
@@ -2177,7 +2179,10 @@ export class App {
             const slot = Math.floor(scheduledFor.getTime() / granularityMs);
             await queue.enqueue({
                 name: job.name,
-                payload: job.payload ?? { scheduledFor: scheduledFor.toISOString() },
+                // Derive the default payload from the slot, not the raw tick time:
+                // replicas tick a few milliseconds apart, and an identical key with
+                // a different payload is a JobIdempotencyConflictError, not a dedup.
+                payload: job.payload ?? { scheduledFor: new Date(slot * granularityMs).toISOString() },
                 ...(job.queue !== undefined ? { queue: job.queue } : {}),
                 ...(job.priority !== undefined ? { priority: job.priority } : {}),
                 idempotencyKey: `cron:${encodeURIComponent(name)}:${slot}`,

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4d270580-4d68-58c8-b0b2-a9f70a933061",
+  "serialNumber": "urn:uuid:3be788cc-3073-595a-871d-593791c06327",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-28T11:08:31.801Z",
+    "timestamp": "2026-08-29T14:05:07.830Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.0"
+        "version": "1.3.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.1",
       "name": "@daloyjs/core",
-      "version": "1.3.0",
+      "version": "1.3.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.0",
+      "purl": "pkg:npm/@daloyjs/core@1.3.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.0",
+        "tagId": "swidtag--daloyjs-core-1.3.1",
         "name": "@daloyjs/core",
-        "version": "1.3.0",
+        "version": "1.3.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.0",
+      "ref": "pkg:npm/@daloyjs/core@1.3.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.0-4d270580-4d68-58c8-b0b2-a9f70a933061",
+  "name": "@daloyjs/core-1.3.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.1-3be788cc-3073-595a-871d-593791c06327",
   "creationInfo": {
-    "created": "2026-08-28T11:08:31.801Z",
+    "created": "2026-08-29T14:05:07.830Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.0",
+      "versionInfo": "1.3.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.1"
         }
       ]
     }

package/dist/scheduler.js

@@ -487,16 +487,21 @@ export class Scheduler {
             }, 0);
             return;
         }
-        const delay = this.#nextDelay(task);
-        task.nextRunAt = this.#now() + delay;
+        // One clock read anchors both the delay and nextRunAt: splitting them
+        // let a millisecond slip between the two reads push nextRunAt (and so
+        // the tick's scheduledFor) off the cron boundary by a per-process
+        // delta, which broke cronEnqueue's cross-replica payload dedup.
+        const now = this.#now();
+        const delay = this.#nextDelay(task, now);
+        task.nextRunAt = now + delay;
         task.timer = this.#timers.set(() => {
             void this.#tick(task);
         }, delay);
     }
-    #nextDelay(task) {
+    #nextDelay(task, now) {
         if (task.fields !== undefined) {
-            const next = nextCronRun(task.fields, new Date(this.#now()), task.def.timeZone);
-            return Math.max(0, next.getTime() - this.#now());
+            const next = nextCronRun(task.fields, new Date(now), task.def.timeZone);
+            return Math.max(0, next.getTime() - now);
         }
         return task.def.intervalMs;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {