@rdlabo/workers-hono-kit 0.10.1 → 0.10.3

package/README.md

@@ -84,14 +84,14 @@ npm install ai ai-gateway-provider    # createAiGatewayProvider
 | `createMaintenanceMiddleware(options)` / `createMaintenanceWaitHandler(options)` / `isMaintenanceEnabled(env)` / `MAINTENANCE_CODE` / `MAINTENANCE_WAIT_PATH` | Fleet maintenance short-circuit: when enabled (`MAINTENANCE=1`), every non-allowlisted request returns `503` + `{ statusCode, message, code: 'MAINTENANCE' }` **before** container/DB. Pair with `GET /public/maintenance/wait` SSE (`event: ping` / `event: ended`) so clients can auto-dismiss a lock UI. Mount after `cors`, before `containerMiddleware`. |
 | `ErrorReporter` / `ErrorReportContext` | Types for a `reportError`-style unhandled-error reporter (e.g. wired to Sentry), paired with `createHttpErrorHandler`'s `onUnhandledError`. |
 | `createSentryErrorReporter(sentry)` / `SentryExceptionReporterLike` | Build an `ErrorReporter` that forwards to Sentry with an optional `request_id` tag (no hard `@sentry/cloudflare` dependency). |
-| `DeferExecutor` / `defaultDefer` / `createWaitUntilDefer(ctx)` | Fire-and-forget executor for Workers: `defaultDefer` swallows rejections (tests); `createWaitUntilDefer` registers work via `ctx.waitUntil`. |
+| `DeferExecutor` / `defaultDefer` / `createWaitUntilDefer(ctx)` | Fire-and-forget executor for Workers: both variants log background rejections without propagating them; `createWaitUntilDefer` also registers work via `ctx.waitUntil`. |
 | `configureHibernationAutoResponse` / `upgradeHibernationWebSocket` / `broadcastHibernationWebSockets` | Hibernation WebSocket room primitives: runtime ping/pong without waking JavaScript, attachment-before-accept upgrade, and broadcast through sockets restored by `getWebSockets()`. |
 | `acknowledgeHibernationWebSocketClose` / `closeHibernationWebSocket` | Safe close helpers, including normalization of reserved received-only close codes. |
 | `retryDurableObjectOperation(operation, options?)` / `isRetryableDurableObjectError(error)` | Retry idempotent DO work only for `retryable && !overloaded`, with jittered exponential backoff. `operation` runs per attempt so callers create a fresh stub after an exception. |
 | `createIdempotencyInput(...)` / `runIdempotentMutation(...)` | Canonical payload hashing and a transaction-bound mutation state machine. Missing keys preserve legacy behavior; replay/conflict/in-flight semantics are shared while each app owns its schema and ORM adapter. |
 | `withIdempotencyHttpErrors(run)` | Maps only standard idempotency failures to 400/409/503 and rethrows unrelated failures. |
 | `createAiGatewayProvider(config)` / `AiGatewayConfig` / `AiGatewayProvider` | Route `@ai-sdk` models through the Cloudflare AI Gateway, via either a Workers `AI` binding or REST credentials (`accountId` / `gateway` / `token`). |
-| `KVCache` / `KVNamespace` / `KVCacheOptions` | Workers-KV cache-aside helper (key `appName+version+table_type_column`, sha256 for string ids, TTL clamped ≥60s). Set `appName` / `version` per application. |
+| `KVCache` / `KVNamespace` / `KVCacheOptions` / `KVCacheErrorContext` / `KVCacheOperation` | Workers-KV cache-aside helper (key `appName+version+table_type_column`, sha256 for string ids, TTL clamped ≥60s). Set `appName` / `version` per application; optional `onError(error, context)` observes fail-soft read/parse/serialize/write/delete failures. Context contains only the operation and logical table, not cache types, keys, ids, or values. |
 | `createStripeClient(secret, opts?)` / `verifyStripeWebhook(...)` / `CreateStripeClientOptions` | Workers-native Stripe client (fetch transport) + async webhook verification (SubtleCrypto). `apiVersion` optional (pin to a fixed Stripe API version). |
 | `extractStripeFailureReason(source)` / `StripeFailureReason` | Duck-type a Stripe `PaymentIntent` / `Invoice` / `{ paymentIntent?, invoice? }` / thrown error into a normalized `{ code, declineCode, message, paymentIntentId, invoiceId, subscriptionId }` (SDK-free), or `null`. |
 | `stripeFailureMessageJa(reason)` | Render a `StripeFailureReason` (or `null`) as a single user-facing Japanese sentence (`decline_code` > `code`; fraud codes masked; unknown → generic). |
@@ -481,8 +481,10 @@ Repos with a custom DB error classifier (e.g. odss-mobile) pass `classify` to
 ### Auth middleware
 
 Encodes the shared skeleton (read token header → verify → `getAppInfo` → resolve user id →
-set context, with `console.error` + a configurable failure on error). Inject your own
-verify/resolver, context-variable names, and failure mode.
+set context, with configurable reporting and response hooks). Inject your own verify/resolver,
+context-variable names, and failure mode. By default a missing header remains backward compatible
+and calls `verify('')`; set `rejectMissingToken: true` to reject missing/blank input first with
+`AuthTokenMissingError`.
 
 `createAuthMiddleware<Env, Verified, Id>` is generic over your Hono `Env`, so `c.set(...)` in
 `setContext` is type-checked against your `Variables`.
@@ -492,6 +494,7 @@ import { createAuthMiddleware, createIdentityAuthFailureBody } from '@rdlabo/wor
 
 // AuthGuard: verify + resolve (and provision) the DB user id.
 const userAuth = createAuthMiddleware<AppEnv, UserRecord, number>({
+  rejectMissingToken: true,
   verify: (token) => container.firebase.verifyIdToken(token),
   resolveUserId: (record, _c, appInfo) =>
     container.auth.getUserIdFromFirebase(record, appInfo).catch(() => container.auth.createUser(record)),
@@ -500,18 +503,28 @@ const userAuth = createAuthMiddleware<AppEnv, UserRecord, number>({
     c.set('userId', userId);
     c.set('appInfo', appInfo);
   },
-  onFailure: (_error, context) =>
+  reportFailure: (error, context, { stage, tokenPresent }) => {
+    // Suppress expected credential rejection; report dependency/internal failures without tokens.
+  },
+  onFailure: (_error, context, { stage }) =>
     context.json(createIdentityAuthFailureBody(), 401),
 });
 
 // TokenGuard (login): verify only — omit resolveUserId. Override the failure if needed.
 const tokenAuth = createAuthMiddleware<AppEnv, UserRecord>({
+  rejectMissingToken: true,
   verify: (token) => container.firebase.verifyIdToken(token),
   setContext: (c, { verified }) => c.set('userRecord', verified),
   onFailure: (_e, c) => c.json(createIdentityAuthFailureBody(), 401),
 });
 ```
 
+`reportFailure(error, context, details)` receives only the stage (`token`, `verify`, `appInfo`,
+`resolveUserId`, or `setContext`) and a `tokenPresent` boolean; raw token data is never included in
+`details`. If the hook is omitted, the historical `console.error(error)` behavior remains. A reporting
+hook failure is logged but cannot change the authentication response. `onFailure` receives the same
+details as its third argument and may be asynchronous.
+
 Authentication failures use three explicit scopes. Only `identity` permits a client to purge its
 global authenticated session, offline replica boundary, and outbox. `reauthentication` means the
 identity remains valid but a recent sign-in is required; `credential` belongs to a domain feature
@@ -613,6 +626,17 @@ await cache.set('users', 'byId', userId, user, 600);
 const hit = await cache.get<User>('users', 'byId', userId);
 ```
 
+Cache failures remain fail-soft. To report them without changing caller behavior, configure the
+optional observer (for example, to forward the raw error to Sentry). Kit-generated context is
+limited to `operation` and `table`; it never adds the cache type, generated key, id, or value.
+
+```ts
+const cache = new KVCache(env.CACHE, {
+  appName: 'myapp',
+  onError: (error, context) => reportError(error, context),
+});
+```
+
 ### Stripe (Workers-native)
 
 ```ts

package/dist/cache/kv-cache.d.ts

@@ -4,7 +4,9 @@
  * Provides a thin, JSON-serializing wrapper around a {@link KVNamespace} for the common
  * "look in cache, fall back to the source of truth" pattern. Reads and writes are best-effort:
  * any KV error, serialization failure, or oversized key is swallowed so callers transparently
- * fall through to their backing store instead of throwing.
+ * fall through to their backing store instead of throwing. An optional error reporter makes
+ * operational failures observable; kit-generated context omits cache types, keys, identifiers,
+ * and values.
  *
  * Cache keys are namespaced as `<appName><version><table>_<type>_<id>`, where a string `id` is
  * hashed with SHA-256 (hex) and a numeric `id` is used verbatim.
@@ -57,6 +59,15 @@ export interface KVNamespace {
      */
     delete(key: string): Promise<void>;
 }
+/** The cache stage that failed while performing a fail-soft operation. */
+export type KVCacheOperation = 'read' | 'parse' | 'serialize' | 'write' | 'delete';
+/** Non-sensitive context supplied to {@link KVCacheOptions.onError}. */
+export interface KVCacheErrorContext {
+    /** The cache stage that failed. */
+    operation: KVCacheOperation;
+    /** Logical table name; cache types, raw keys, identifiers, and values are intentionally omitted. */
+    table: string;
+}
 /**
  * Configuration for a {@link KVCache} instance.
  */
@@ -81,6 +92,11 @@ export interface KVCacheOptions {
      * Defaults to `600`.
      */
     defaultLifetime?: number;
+    /**
+     * Optional synchronous observer for failures that the cache intentionally handles as misses.
+     * Reporter failures are isolated from cache callers and logged separately.
+     */
+    onError?: (error: unknown, context: KVCacheErrorContext) => void;
 }
 /**
  * A single entry to store via {@link KVCache.setMany}.
@@ -145,8 +161,8 @@ export declare class KVCache {
      * JSON-serialize and store a value.
      *
      * Falsy `data` is ignored. The effective TTL is `max(minTtlSeconds, lifetime ?? defaultLifetime)`,
-     * honoring the KV 60-second floor. Oversized keys and serialization/write failures are silently
-     * skipped.
+     * honoring the KV 60-second floor. Oversized keys are skipped; serialization/write failures are
+     * skipped and reported when an observer is configured.
      *
      * @param table - Logical table or entity name.
      * @param type - Sub-key discriminator.
@@ -198,7 +214,7 @@ export declare class KVCache {
     /**
      * Remove a cached entry.
      *
-     * Oversized keys and delete failures are silently ignored.
+     * Oversized keys are ignored. Delete failures are reported when an observer is configured.
      *
      * @param table - Logical table or entity name.
      * @param type - Sub-key discriminator.

package/dist/cache/kv-cache.js

@@ -4,7 +4,9 @@
  * Provides a thin, JSON-serializing wrapper around a {@link KVNamespace} for the common
  * "look in cache, fall back to the source of truth" pattern. Reads and writes are best-effort:
  * any KV error, serialization failure, or oversized key is swallowed so callers transparently
- * fall through to their backing store instead of throwing.
+ * fall through to their backing store instead of throwing. An optional error reporter makes
+ * operational failures observable; kit-generated context omits cache types, keys, identifiers,
+ * and values.
  *
  * Cache keys are namespaced as `<appName><version><table>_<type>_<id>`, where a string `id` is
  * hashed with SHA-256 (hex) and a numeric `id` is used verbatim.
@@ -56,6 +58,7 @@ export class KVCache {
     #version;
     #minTtl;
     #defaultLifetime;
+    #onError;
     /**
      * Create a cache bound to a specific KV namespace.
      *
@@ -68,6 +71,16 @@ export class KVCache {
         this.#version = options.version ?? 'v8_';
         this.#minTtl = options.minTtlSeconds ?? 60;
         this.#defaultLifetime = options.defaultLifetime ?? 600;
+        this.#onError = options.onError;
+    }
+    /** Report an operational failure without letting observer code break the fail-soft contract. */
+    #reportError(error, context) {
+        try {
+            this.#onError?.(error, context);
+        }
+        catch (reporterError) {
+            console.error('[KVCache] error reporter failed', reporterError);
+        }
     }
     /**
      * Build the fully namespaced KV key for the given coordinates.
@@ -108,14 +121,22 @@ export class KVCache {
         if (!key) {
             return undefined;
         }
+        let data;
+        try {
+            data = await this.#kv.get(key);
+        }
+        catch (error) {
+            this.#reportError(error, { operation: 'read', table });
+            return undefined;
+        }
+        if (!data) {
+            return undefined;
+        }
         try {
-            const data = await this.#kv.get(key);
-            if (!data) {
-                return undefined;
-            }
             return JSON.parse(data);
         }
-        catch {
+        catch (error) {
+            this.#reportError(error, { operation: 'parse', table });
             return undefined;
         }
     }
@@ -123,8 +144,8 @@ export class KVCache {
      * JSON-serialize and store a value.
      *
      * Falsy `data` is ignored. The effective TTL is `max(minTtlSeconds, lifetime ?? defaultLifetime)`,
-     * honoring the KV 60-second floor. Oversized keys and serialization/write failures are silently
-     * skipped.
+     * honoring the KV 60-second floor. Oversized keys are skipped; serialization/write failures are
+     * skipped and reported when an observer is configured.
      *
      * @param table - Logical table or entity name.
      * @param type - Sub-key discriminator.
@@ -149,11 +170,18 @@ export class KVCache {
         try {
             payload = JSON.stringify(data);
         }
-        catch {
+        catch (error) {
+            this.#reportError(error, { operation: 'serialize', table });
+            return;
+        }
+        if (payload === undefined) {
+            this.#reportError(new TypeError('Cache value is not JSON-serializable'), { operation: 'serialize', table });
             return;
         }
         const ttl = Math.max(this.#minTtl, lifetime ?? this.#defaultLifetime);
-        await this.#kv.put(key, payload, { expirationTtl: ttl }).catch(() => undefined);
+        await this.#kv.put(key, payload, { expirationTtl: ttl }).catch((error) => {
+            this.#reportError(error, { operation: 'write', table });
+        });
     }
     /**
      * Store many values concurrently.
@@ -199,7 +227,7 @@ export class KVCache {
     /**
      * Remove a cached entry.
      *
-     * Oversized keys and delete failures are silently ignored.
+     * Oversized keys are ignored. Delete failures are reported when an observer is configured.
      *
      * @param table - Logical table or entity name.
      * @param type - Sub-key discriminator.
@@ -215,6 +243,8 @@ export class KVCache {
         if (!key) {
             return;
         }
-        await this.#kv.delete(key).catch(() => undefined);
+        await this.#kv.delete(key).catch((error) => {
+            this.#reportError(error, { operation: 'delete', table });
+        });
     }
 }

package/dist/firebase/jose-firebase-verifier.d.ts

@@ -22,6 +22,18 @@ type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array | JWTVerifyGetKey;
  * be verified against Google's rotating public keys.
  */
 export declare const SECURETOKEN_JWK_URL = "https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com";
+/** Expected rejection for Firebase-specific claims that passed JOSE signature/claim verification. */
+export declare class FirebaseIdTokenValidationError extends Error {
+    readonly claim: 'subject' | 'exp' | 'iat' | 'auth_time';
+    /** Stable machine-readable code for authentication failure classifiers. */
+    readonly code = "ERR_FIREBASE_ID_TOKEN_INVALID";
+    /**
+     * Create a Firebase ID-token validation rejection.
+     *
+     * @param claim - Firebase-specific claim which failed validation.
+     */
+    constructor(claim: 'subject' | 'exp' | 'iat' | 'auth_time');
+}
 /**
  * Verifies Firebase ID tokens with `jose` RS256 against Google's securetoken JWKS, and
  * optionally looks up or deletes users via the Google Identity Toolkit REST API.

package/dist/firebase/jose-firebase-verifier.js

@@ -8,6 +8,22 @@ import { jwtVerify } from 'jose';
  * be verified against Google's rotating public keys.
  */
 export const SECURETOKEN_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
+/** Expected rejection for Firebase-specific claims that passed JOSE signature/claim verification. */
+export class FirebaseIdTokenValidationError extends Error {
+    claim;
+    /** Stable machine-readable code for authentication failure classifiers. */
+    code = 'ERR_FIREBASE_ID_TOKEN_INVALID';
+    /**
+     * Create a Firebase ID-token validation rejection.
+     *
+     * @param claim - Firebase-specific claim which failed validation.
+     */
+    constructor(claim) {
+        super(`Firebase ID token has an invalid ${claim}`);
+        this.claim = claim;
+        this.name = 'FirebaseIdTokenValidationError';
+    }
+}
 /**
  * Verifies Firebase ID tokens with `jose` RS256 against Google's securetoken JWKS, and
  * optionally looks up or deletes users via the Google Identity Toolkit REST API.
@@ -74,18 +90,18 @@ export class JoseFirebaseVerifier {
         const { payload } = typeof key === 'function' ? await jwtVerify(idToken, key, options) : await jwtVerify(idToken, key, options);
         // Apply Firebase's documented checks beyond signature/iss/aud/exp.
         if (!payload.sub || typeof payload.sub !== 'string' || payload.sub.length > 128) {
-            throw new Error('Firebase ID token has an invalid subject');
+            throw new FirebaseIdTokenValidationError('subject');
         }
         if (!Number.isFinite(payload.exp)) {
-            throw new Error('Firebase ID token has an invalid exp');
+            throw new FirebaseIdTokenValidationError('exp');
         }
         const issuedAt = payload.iat;
         if (typeof issuedAt !== 'number' || !Number.isFinite(issuedAt) || issuedAt > now) {
-            throw new Error('Firebase ID token has an invalid iat');
+            throw new FirebaseIdTokenValidationError('iat');
         }
         const authTime = payload.auth_time;
         if (typeof authTime !== 'number' || !Number.isFinite(authTime) || authTime > now) {
-            throw new Error('Firebase ID token has an invalid auth_time');
+            throw new FirebaseIdTokenValidationError('auth_time');
         }
         return { ...payload, uid: payload.sub, email: payload.email };
     }

package/dist/http/defer.d.ts

@@ -9,8 +9,8 @@ import type { ExecutionContextLike } from './execution-context.js';
  */
 export type DeferExecutor = (promise: Promise<unknown>) => void;
 /**
- * Default defer implementation (NestJS `void promise` equivalent). Swallows rejections.
- * Used when no `ExecutionContext` is available (tests, partial scheduled paths).
+ * Default defer implementation (NestJS `void promise` equivalent). Reports rejections without
+ * propagating them. Used when no `ExecutionContext` is available (tests, partial scheduled paths).
  */
 export declare const defaultDefer: DeferExecutor;
 /**

package/dist/http/defer.js

@@ -1,9 +1,12 @@
+const reportDeferFailure = (error) => {
+    console.error('[defer] background task failed', error);
+};
 /**
- * Default defer implementation (NestJS `void promise` equivalent). Swallows rejections.
- * Used when no `ExecutionContext` is available (tests, partial scheduled paths).
+ * Default defer implementation (NestJS `void promise` equivalent). Reports rejections without
+ * propagating them. Used when no `ExecutionContext` is available (tests, partial scheduled paths).
  */
 export const defaultDefer = (promise) => {
-    void promise.catch(() => undefined);
+    void promise.catch(reportDeferFailure);
 };
 /**
  * Build a {@link DeferExecutor} that keeps the worker alive until `promise` settles.
@@ -12,6 +15,6 @@ export const defaultDefer = (promise) => {
  */
 export function createWaitUntilDefer(ctx) {
     return (promise) => {
-        ctx.waitUntil(promise.catch(() => undefined));
+        ctx.waitUntil(promise.catch(reportDeferFailure));
     };
 }

package/dist/http/http-error.d.ts

@@ -71,7 +71,7 @@ export interface HttpErrorHandlerOptions<E extends Env = Env> {
     isHttpError?: (err: unknown) => err is HttpErrorLike;
     /**
      * Hook invoked before an unexpected (non-HTTP) error is returned as a 500, typically used to report the
-     * error (e.g. to Sentry). Any exception thrown by this hook is swallowed so reporting cannot alter the
+     * error (e.g. to Sentry). Any exception thrown by this hook is logged and kept from altering the
      * error response.
      */
     onUnhandledError?: (err: unknown, c: Context<E>) => void;

package/dist/http/http-error.js

@@ -78,8 +78,10 @@ export function createHttpErrorHandler(options = {}) {
         try {
             onUnhandledError?.(err, c);
         }
-        catch {
-            // Reporting must never change the behavior of the error response.
+        catch (reportingError) {
+            // Reporting must never change the behavior of the error response, but its own failure must
+            // stay visible so a broken observability integration does not go unnoticed.
+            console.error('[httpError] onUnhandledError failed', reportingError);
         }
         if (findMysqlDriverError(err)) {
             logMysqlDriverError(err, 500);

package/dist/http/query-failed-error.js

@@ -40,8 +40,9 @@ export function createQueryFailedErrorHandler(options) {
                 try {
                     onUnhandledError?.(err, c);
                 }
-                catch {
-                    // Reporting must never change the error response.
+                catch (reportingError) {
+                    // Reporting must never change the error response, but a broken reporter must remain visible.
+                    console.error('[queryFailedError] onUnhandledError failed', reportingError);
                 }
             }
             return c.json({ statusCode: classified.statusCode, message: classified.message }, classified.statusCode);

package/dist/idempotency/idempotency.d.ts

@@ -45,6 +45,49 @@ export type IdempotencyReservation<TResponse> = {
     kind: 'replay';
     response: TResponse;
 };
+/** Locked persistence state for one leased idempotency key. */
+export type LeasedIdempotencyRecord<TResponse> = {
+    /** The operation is currently owned by one processing token. */
+    state: 'processing';
+    /** Canonical payload hash stored with the key. */
+    payloadHash: string;
+    /** Token of the current processing owner. */
+    processingToken: string;
+    /** Whether the current owner's lease may be reclaimed. */
+    leaseExpired: boolean;
+} | {
+    /** The operation completed and its response is replayable. */
+    state: 'completed';
+    /** Canonical payload hash stored with the key. */
+    payloadHash: string;
+    /** Persisted response returned to retries. */
+    response: TResponse;
+};
+/** Persistence primitives used by the shared leased-idempotency state machine. */
+export interface LeasedIdempotencyStore<TScope extends IdempotencyScope, TResponse> {
+    /** Insert a processing row if the scoped key does not already exist. */
+    insertProcessing(input: IdempotencyInput<TScope>, processingToken: string): Promise<void>;
+    /** Lock and return the scoped key after the insert attempt. */
+    lock(input: IdempotencyInput<TScope>): Promise<LeasedIdempotencyRecord<TResponse>>;
+    /** Atomically replace an expired processing token and restart its lease. */
+    reclaim(input: IdempotencyInput<TScope>, previousToken: string, processingToken: string): Promise<boolean>;
+    /** Persist the response only while `processingToken` still owns the key. */
+    complete(input: IdempotencyInput<TScope>, processingToken: string, response: TResponse): Promise<boolean>;
+    /** Remove an uncommitted reservation only while `processingToken` still owns it. */
+    release(input: IdempotencyInput<TScope>, processingToken: string): Promise<void>;
+}
+/** Result of reserving a leased idempotency key. */
+export type LeasedIdempotencyReservation<TResponse> = {
+    kind: 'acquired';
+    processingToken: string;
+} | {
+    kind: 'replay';
+    response: TResponse;
+};
+/** Reserve, replay, or safely reclaim one leased idempotency key. */
+export declare function reserveLeasedIdempotency<TScope extends IdempotencyScope, TResponse>(store: LeasedIdempotencyStore<TScope, TResponse>, input: IdempotencyInput<TScope>): Promise<LeasedIdempotencyReservation<TResponse>>;
+/** Complete a leased idempotent operation without accepting a stale owner. */
+export declare function completeLeasedIdempotency<TScope extends IdempotencyScope, TResponse>(store: LeasedIdempotencyStore<TScope, TResponse>, input: IdempotencyInput<TScope>, processingToken: string, response: TResponse): Promise<void>;
 /** Transaction-bound persistence operations required by {@link runIdempotentMutation}. */
 export interface IdempotentMutationStore<TScope extends IdempotencyScope, TResponse> {
     /** Atomically reserve a key or return its previously completed response. */

package/dist/idempotency/idempotency.js

@@ -27,6 +27,34 @@ export class IdempotencyInFlightError extends Error {
         this.name = 'IdempotencyInFlightError';
     }
 }
+/** Reserve, replay, or safely reclaim one leased idempotency key. */
+export async function reserveLeasedIdempotency(store, input) {
+    const processingToken = crypto.randomUUID();
+    await store.insertProcessing(input, processingToken);
+    const record = await store.lock(input);
+    if (record.payloadHash !== input.payloadHash) {
+        throw new IdempotencyConflictError();
+    }
+    if (record.state === 'completed') {
+        return { kind: 'replay', response: record.response };
+    }
+    if (record.processingToken === processingToken) {
+        return { kind: 'acquired', processingToken };
+    }
+    if (!record.leaseExpired) {
+        throw new IdempotencyInFlightError();
+    }
+    if (!(await store.reclaim(input, record.processingToken, processingToken))) {
+        throw new IdempotencyInFlightError('Idempotent request ownership changed during lease reclaim');
+    }
+    return { kind: 'acquired', processingToken };
+}
+/** Complete a leased idempotent operation without accepting a stale owner. */
+export async function completeLeasedIdempotency(store, input, processingToken, response) {
+    if (!(await store.complete(input, processingToken, response))) {
+        throw new IdempotencyInFlightError('Idempotent request ownership was lost before completion');
+    }
+}
 /** Deterministically serialize JSON data with locale-independent, UTF-16 code-unit key ordering. */
 export function canonicalJson(value) {
     try {

package/dist/index.d.ts

@@ -14,8 +14,8 @@ export { validate, createValidate } from './middleware/validation.js';
 export { createSentryValidate } from './middleware/validation.js';
 export type { ValidateOptions, ValidationTarget, ZodErrorLike, SentryLike, SentryScopeLike, } from './middleware/validation.js';
 export { zNum, zNumNullable, zNumOptional, zNumWithDefault } from './middleware/zod-coerce.js';
-export { createAuthMiddleware } from './middleware/auth.js';
-export type { AuthMiddlewareOptions } from './middleware/auth.js';
+export { AuthTokenMissingError, createAuthMiddleware } from './middleware/auth.js';
+export type { AuthMiddlewareFailureDetails, AuthMiddlewareFailureStage, AuthMiddlewareOptions, } from './middleware/auth.js';
 export { perfLog } from './middleware/perf-log.js';
 export type { PerfLogOptions, AnalyticsEngineDatasetLike } from './middleware/perf-log.js';
 export { createMaintenanceMiddleware, createMaintenanceWaitHandler, isMaintenanceEnabled, MAINTENANCE_BODY, MAINTENANCE_CODE, MAINTENANCE_WAIT_PATH, } from './middleware/maintenance.js';
@@ -49,8 +49,8 @@ export { createSentryErrorReporter } from './http/http-error.js';
 export type { SentryExceptionReporterLike } from './http/http-error.js';
 export { AUTH_FAILURE_SCOPES, AUTH_IDENTITY_INVALID_CODE, createAuthFailureBody, createIdentityAuthFailureBody, createLegacyIdentityAuthFailureBody, } from './http/auth-failure.js';
 export type { AuthFailureBody, AuthFailureScope } from './http/auth-failure.js';
-export { canonicalJson, createIdempotencyInput, IdempotencyConflictError, IdempotencyInFlightError, IdempotencyKeyValidationError, IdempotencyPayloadValidationError, runIdempotentMutation, sha256CanonicalJson, withIdempotencyHttpErrors, } from './idempotency/idempotency.js';
-export type { CreateIdempotencyInputOptions, IdempotencyInput, IdempotencyReservation, IdempotencyScope, IdempotencyScopeValue, IdempotentMutationStore, } from './idempotency/idempotency.js';
+export { canonicalJson, completeLeasedIdempotency, createIdempotencyInput, IdempotencyConflictError, IdempotencyInFlightError, IdempotencyKeyValidationError, IdempotencyPayloadValidationError, runIdempotentMutation, reserveLeasedIdempotency, sha256CanonicalJson, withIdempotencyHttpErrors, } from './idempotency/idempotency.js';
+export type { CreateIdempotencyInputOptions, IdempotencyInput, LeasedIdempotencyRecord, LeasedIdempotencyReservation, LeasedIdempotencyStore, IdempotencyReservation, IdempotencyScope, IdempotencyScopeValue, IdempotentMutationStore, } from './idempotency/idempotency.js';
 export { acknowledgeHibernationWebSocketClose, broadcastHibernationWebSockets, closeHibernationWebSocket, configureHibernationAutoResponse, upgradeHibernationWebSocket, } from './realtime/hibernation.js';
 export type { HibernationAutoResponseOptions, HibernationUpgradeOptions, HibernationWebSocketLike, HibernationWebSocketStateLike, WebSocketAutoResponsePairFactory, WebSocketPairFactory, } from './realtime/hibernation.js';
 export { isRetryableDurableObjectError, retryDurableObjectOperation } from './realtime/retry.js';
@@ -60,7 +60,7 @@ export type { DurableObjectFetchRequest, DurableObjectFetchStubLike, InvokeDurab
 export { parseRealtimeWebSocketProtocolOffer, parseWebSocketProtocols } from './realtime/protocol.js';
 export type { ParseRealtimeWebSocketProtocolOptions, RealtimeWebSocketProtocolOffer } from './realtime/protocol.js';
 export { KVCache } from './cache/kv-cache.js';
-export type { KVNamespace, KVCacheOptions } from './cache/kv-cache.js';
+export type { KVNamespace, KVCacheErrorContext, KVCacheOperation, KVCacheOptions } from './cache/kv-cache.js';
 export { createStripeClient, verifyStripeWebhook } from './stripe/client.js';
 export type { CreateStripeClientOptions } from './stripe/client.js';
 export { extractStripeFailureReason, stripeFailureMessageJa, serializePaymentFailure, serializeIapFailureReason, parsePaymentFailure, PaymentDeclinedError, toPaymentDeclinedError, } from './stripe/failure.js';
@@ -90,7 +90,7 @@ export { getCloudFrontSignedUrl } from './aws/cloudfront.js';
 export { getTemporaryCredentials } from './aws/sts.js';
 export type { GetTemporaryCredentialsOptions, StsCredentials } from './aws/sts.js';
 export type { DecodedIdToken, FirebaseVerifier } from './firebase/firebase-verifier.js';
-export { JoseFirebaseVerifier, SECURETOKEN_JWK_URL } from './firebase/jose-firebase-verifier.js';
+export { FirebaseIdTokenValidationError, JoseFirebaseVerifier, SECURETOKEN_JWK_URL, } from './firebase/jose-firebase-verifier.js';
 export { IdentityToolkit } from './firebase/identity-toolkit.js';
 export type { ServiceAccount } from './firebase/identity-toolkit.js';
 export { createRemoteFirebaseVerifier, createServiceAccountVerifier } from './firebase/remote-verifier.js';

package/dist/index.js

@@ -16,7 +16,7 @@ export { validate, createValidate } from './middleware/validation.js';
 // eslint-disable-next-line @typescript-eslint/no-deprecated -- intentional public re-export
 export { createSentryValidate } from './middleware/validation.js';
 export { zNum, zNumNullable, zNumOptional, zNumWithDefault } from './middleware/zod-coerce.js';
-export { createAuthMiddleware } from './middleware/auth.js';
+export { AuthTokenMissingError, createAuthMiddleware } from './middleware/auth.js';
 export { perfLog } from './middleware/perf-log.js';
 export { createMaintenanceMiddleware, createMaintenanceWaitHandler, isMaintenanceEnabled, MAINTENANCE_BODY, MAINTENANCE_CODE, MAINTENANCE_WAIT_PATH, } from './middleware/maintenance.js';
 export { createIsolateMemo } from './container/isolate-memo.js';
@@ -37,7 +37,7 @@ export { defaultDefer, createWaitUntilDefer } from './http/defer.js';
 export { createSentryErrorReporter } from './http/http-error.js';
 export { AUTH_FAILURE_SCOPES, AUTH_IDENTITY_INVALID_CODE, createAuthFailureBody, createIdentityAuthFailureBody, createLegacyIdentityAuthFailureBody, } from './http/auth-failure.js';
 // idempotency
-export { canonicalJson, createIdempotencyInput, IdempotencyConflictError, IdempotencyInFlightError, IdempotencyKeyValidationError, IdempotencyPayloadValidationError, runIdempotentMutation, sha256CanonicalJson, withIdempotencyHttpErrors, } from './idempotency/idempotency.js';
+export { canonicalJson, completeLeasedIdempotency, createIdempotencyInput, IdempotencyConflictError, IdempotencyInFlightError, IdempotencyKeyValidationError, IdempotencyPayloadValidationError, runIdempotentMutation, reserveLeasedIdempotency, sha256CanonicalJson, withIdempotencyHttpErrors, } from './idempotency/idempotency.js';
 // realtime
 export { acknowledgeHibernationWebSocketClose, broadcastHibernationWebSockets, closeHibernationWebSocket, configureHibernationAutoResponse, upgradeHibernationWebSocket, } from './realtime/hibernation.js';
 export { isRetryableDurableObjectError, retryDurableObjectOperation } from './realtime/retry.js';
@@ -67,6 +67,6 @@ export { createAiGatewayProvider } from './ai/gateway.js';
 export { getAuthenticationSecret } from './aws/secrets-manager.js';
 export { getCloudFrontSignedUrl } from './aws/cloudfront.js';
 export { getTemporaryCredentials } from './aws/sts.js';
-export { JoseFirebaseVerifier, SECURETOKEN_JWK_URL } from './firebase/jose-firebase-verifier.js';
+export { FirebaseIdTokenValidationError, JoseFirebaseVerifier, SECURETOKEN_JWK_URL, } from './firebase/jose-firebase-verifier.js';
 export { IdentityToolkit } from './firebase/identity-toolkit.js';
 export { createRemoteFirebaseVerifier, createServiceAccountVerifier } from './firebase/remote-verifier.js';

package/dist/middleware/auth.d.ts

@@ -1,6 +1,21 @@
 import type { Context, Env, MiddlewareHandler } from 'hono';
 import type { ContentfulStatusCode } from 'hono/utils/http-status';
 import type { AppInfo } from '../http/app-info.js';
+/** Processing stage at which authentication middleware failed. */
+export type AuthMiddlewareFailureStage = 'token' | 'verify' | 'appInfo' | 'resolveUserId' | 'setContext';
+/** Safe metadata describing an authentication middleware failure without including the token. */
+export interface AuthMiddlewareFailureDetails {
+    /** Stage which rejected or failed. */
+    stage: AuthMiddlewareFailureStage;
+    /** Whether the configured token header contained a non-blank value. */
+    tokenPresent: boolean;
+}
+/** Expected rejection raised when the configured authentication header is absent or blank. */
+export declare class AuthTokenMissingError extends Error {
+    /** Stable machine-readable code for application classifiers. */
+    readonly code = "AUTH_TOKEN_MISSING";
+    constructor();
+}
 /**
  * Configuration for {@link createAuthMiddleware}.
  *
@@ -11,10 +26,19 @@ import type { AppInfo } from '../http/app-info.js';
 export interface AuthMiddlewareOptions<E extends Env, Verified, Id = unknown> {
     /** Header carrying the ID token. Defaults to `'x-amz-security-token'`. */
     tokenHeader?: string;
+    /**
+     * Reject an absent or blank token before calling {@link AuthMiddlewareOptions.verify}.
+     *
+     * @remarks
+     * Defaults to `false` for backward compatibility: existing consumers historically receive an
+     * empty string in `verify` when the header is absent. Enable this when the application wants a
+     * typed {@link AuthTokenMissingError} and does not use an empty token as custom input.
+     */
+    rejectMissingToken?: boolean;
     /**
      * Verify the raw token and return the decoded value or user record.
      *
-     * @param token - The raw token read from {@link AuthMiddlewareOptions.tokenHeader} (empty string if absent).
+     * @param token - The raw token, or an empty string when absent unless `rejectMissingToken` is enabled.
      * @param c - The current Hono context.
      * @returns The verified value passed to {@link AuthMiddlewareOptions.resolveUserId}/{@link AuthMiddlewareOptions.setContext}.
      * @throws If the token is invalid; rejecting/throwing triggers the failure path.
@@ -59,7 +83,17 @@ export interface AuthMiddlewareOptions<E extends Env, Verified, Id = unknown> {
      * @param c - The current Hono context.
      * @returns The failure response to send.
      */
-    onFailure?: (err: unknown, c: Context<E>) => Response;
+    onFailure?: (err: unknown, c: Context<E>, details: AuthMiddlewareFailureDetails) => Response | Promise<Response>;
+    /**
+     * Report a failed authentication attempt.
+     *
+     * @remarks
+     * When omitted, the historical behavior (`console.error(err)`) is preserved. Applications should
+     * provide this hook to suppress expected credential rejections while reporting dependency and
+     * internal failures through their normal observability path. The hook must never include raw
+     * authentication tokens in logs or telemetry.
+     */
+    reportFailure?: (err: unknown, c: Context<E>, details: AuthMiddlewareFailureDetails) => void | Promise<void>;
     /** Status used by the default `onFailure`. Defaults to `403`. */
     failureStatus?: ContentfulStatusCode;
     /** Message used by the default `onFailure`. Defaults to `'Forbidden resource'`. */
@@ -69,7 +103,7 @@ export interface AuthMiddlewareOptions<E extends Env, Verified, Id = unknown> {
  * Create an authentication middleware equivalent to a NestJS `AuthGuard` / `TokenGuard`.
  *
  * The middleware runs a fixed skeleton — read the token header, `verify`, `getAppInfo`,
- * `resolveUserId`, `setContext`, and on error `console.error` then `onFailure` — while the
+ * `resolveUserId`, `setContext`, and on error `reportFailure` then `onFailure` — while the
  * application injects the variable parts (token verification, user-id resolution, context variable
  * names, and the failure response). Omitting {@link AuthMiddlewareOptions.resolveUserId} yields a
  * token-only middleware.

package/dist/middleware/auth.js

@@ -1,10 +1,19 @@
 import { HTTPException } from 'hono/http-exception';
 import { getAppInfo } from '../http/app-info.js';
+/** Expected rejection raised when the configured authentication header is absent or blank. */
+export class AuthTokenMissingError extends Error {
+    /** Stable machine-readable code for application classifiers. */
+    code = 'AUTH_TOKEN_MISSING';
+    constructor() {
+        super('Authentication token is missing');
+        this.name = 'AuthTokenMissingError';
+    }
+}
 /**
  * Create an authentication middleware equivalent to a NestJS `AuthGuard` / `TokenGuard`.
  *
  * The middleware runs a fixed skeleton — read the token header, `verify`, `getAppInfo`,
- * `resolveUserId`, `setContext`, and on error `console.error` then `onFailure` — while the
+ * `resolveUserId`, `setContext`, and on error `reportFailure` then `onFailure` — while the
  * application injects the variable parts (token verification, user-id resolution, context variable
  * names, and the failure response). Omitting {@link AuthMiddlewareOptions.resolveUserId} yields a
  * token-only middleware.
@@ -30,22 +39,42 @@ import { getAppInfo } from '../http/app-info.js';
  * ```
  */
 export function createAuthMiddleware(options) {
-    const { tokenHeader = 'x-amz-security-token', verify, resolveUserId, setContext, onFailure, failureStatus = 403, failureMessage = 'Forbidden resource', } = options;
+    const { tokenHeader = 'x-amz-security-token', rejectMissingToken = false, verify, resolveUserId, setContext, onFailure, reportFailure, failureStatus = 403, failureMessage = 'Forbidden resource', } = options;
     return async (c, next) => {
+        let stage = 'token';
+        let tokenPresent = false;
         try {
             const token = c.req.header(tokenHeader) ?? '';
+            tokenPresent = token.trim().length > 0;
+            if (!tokenPresent && rejectMissingToken) {
+                throw new AuthTokenMissingError();
+            }
+            stage = 'verify';
             const verified = await verify(token, c);
+            stage = 'appInfo';
             const appInfo = getAppInfo(c);
+            stage = 'resolveUserId';
             const userId = resolveUserId ? await resolveUserId(verified, c, appInfo) : undefined;
+            stage = 'setContext';
             setContext(c, { verified, appInfo, userId });
         }
         catch (e) {
-            // Equivalent to a guard returning false → ForbiddenException('Forbidden resource'). Log the
-            // cause and, by default, throw so the app's onError renders the error body (callers can
-            // override with onFailure to return a custom response instead).
-            console.error(e);
+            const details = { stage, tokenPresent };
+            if (reportFailure) {
+                try {
+                    await reportFailure(e, c, details);
+                }
+                catch (reportingError) {
+                    // Observability must never alter the authentication response.
+                    console.error(reportingError);
+                }
+            }
+            else {
+                // Preserve the historical default for consumers that have not adopted classified reporting.
+                console.error(e);
+            }
             if (onFailure) {
-                return onFailure(e, c);
+                return onFailure(e, c, details);
             }
             throw new HTTPException(failureStatus, { message: failureMessage });
         }

package/dist/middleware/validation.d.ts

@@ -23,8 +23,8 @@ export interface ValidateOptions {
      *
      * @remarks
      * This never changes validation behavior — the response is always a NestJS `ValidationPipe`-shaped
-     * 400. Exceptions thrown by the hook are swallowed. The default is a no-op (4xx errors are not
-     * reported); pass a hook to forward failures to an error tracker.
+     * 400. Exceptions thrown by the hook are logged without changing the response. The default is a
+     * no-op (4xx errors are not reported); pass a hook to forward failures to an error tracker.
      *
      * @param error - The zod error describing the failed validation.
      * @param c - The Hono context for the failing request.

package/dist/middleware/validation.js

@@ -55,8 +55,9 @@ export function validate(target, schema, options) {
             try {
                 options?.onValidationError?.(result.error, c);
             }
-            catch {
-                // Reporting must never change validation error behavior.
+            catch (reportingError) {
+                // Reporting must never change validation behavior, but a broken reporter must remain visible.
+                console.error('[validation] onValidationError failed', reportingError);
             }
             return c.json({ statusCode: 400, message: messages, error: 'Bad Request' }, 400);
         }

package/dist/offline/index.d.ts

@@ -12,3 +12,5 @@ export { defineRestDbMethodConverter } from './rest-db-method-converter.js';
 export type { CompleteRestDbTableScheme, RestDbMethodConverter } from './rest-db-method-converter.js';
 export { decodeOfflineSnapshotCursor, encodeOfflineSnapshotCursor } from './snapshot-cursor.js';
 export type { OfflineSnapshotCursor } from './snapshot-cursor.js';
+export { assertOfflineJournalCursorRetained, compactOfflineJournal, OfflineJournalRebaselineRequiredError, } from './journal-retention.js';
+export type { CompactOfflineJournalOptions, OfflineJournalRetentionCandidate, OfflineJournalRetentionStore, OfflineJournalRetentionTransaction, } from './journal-retention.js';

package/dist/offline/index.js

@@ -10,3 +10,4 @@ export { fromTinyIntFlag, replicaTimestampMs, toReplicaDateOnly, toReplicaIsoDat
 export { replicaNowIso } from './clock.js';
 export { defineRestDbMethodConverter } from './rest-db-method-converter.js';
 export { decodeOfflineSnapshotCursor, encodeOfflineSnapshotCursor } from './snapshot-cursor.js';
+export { assertOfflineJournalCursorRetained, compactOfflineJournal, OfflineJournalRebaselineRequiredError, } from './journal-retention.js';

package/dist/offline/journal-retention.d.ts

@@ -0,0 +1,49 @@
+/** One retained product journal row considered for bounded cleanup. */
+export interface OfflineJournalRetentionCandidate<TScope> {
+    /** Monotonic journal position that becomes a client delta cursor. */
+    readonly cursor: number;
+    /** Product-defined authorization and retention partition. */
+    readonly scope: TScope;
+}
+/** Storage operations that must share one database transaction. */
+export interface OfflineJournalRetentionTransaction<TScope> {
+    /** Selects the oldest bounded cleanup candidates. */
+    listCandidates(cutoff: Date, limit: number): Promise<readonly OfflineJournalRetentionCandidate<TScope>[]>;
+    /** Locks existing scopes against concurrent pull floor validation. */
+    lockScopes(scopes: readonly TScope[]): Promise<readonly TScope[]>;
+    /** Monotonically advances each scope's retained-history floor. */
+    advanceFloors(floors: readonly {
+        scope: TScope;
+        cursor: number;
+    }[]): Promise<void>;
+    /** Deletes the complete candidate set, including rows for scopes that no longer exist. */
+    deleteCandidates(cursors: readonly number[]): Promise<void>;
+}
+/** Product adapter that owns schema-specific persistence and transaction creation. */
+export interface OfflineJournalRetentionStore<TScope> {
+    /** Runs the complete retention state machine in one database transaction. */
+    transaction<T>(operation: (tx: OfflineJournalRetentionTransaction<TScope>) => Promise<T>): Promise<T>;
+}
+/** Inputs for one bounded offline journal compaction pass. */
+export interface CompactOfflineJournalOptions<TScope> {
+    /** Product adapter that owns persistence and transaction creation. */
+    readonly store: OfflineJournalRetentionStore<TScope>;
+    /** Exclusive upper time boundary of journal rows eligible for cleanup. */
+    readonly cutoff: Date;
+    /** Maximum number of journal rows compacted in one pass. */
+    readonly limit: number;
+    /** Canonical identity used to deduplicate and compare product scopes. */
+    readonly scopeKey: (scope: TScope) => string;
+}
+/** Raised when a delta cursor predates the retained journal and must restart from a snapshot. */
+export declare class OfflineJournalRebaselineRequiredError extends Error {
+}
+/** Fail closed before reading deltas whose tombstones may already have been compacted. */
+export declare function assertOfflineJournalCursorRetained(cursor: number, floor: number): void;
+/**
+ * Advances retention floors and deletes one bounded journal batch atomically.
+ *
+ * Product adapters provide schema-specific queries. This state machine owns the
+ * safety order: candidates -> ordered opposing locks -> floors -> deletion.
+ */
+export declare function compactOfflineJournal<TScope>(options: CompactOfflineJournalOptions<TScope>): Promise<number>;

package/dist/offline/journal-retention.js

@@ -0,0 +1,68 @@
+/** Raised when a delta cursor predates the retained journal and must restart from a snapshot. */
+export class OfflineJournalRebaselineRequiredError extends Error {
+}
+/** Fail closed before reading deltas whose tombstones may already have been compacted. */
+export function assertOfflineJournalCursorRetained(cursor, floor) {
+    if (!Number.isSafeInteger(cursor) || cursor < 0 || !Number.isSafeInteger(floor) || floor < 0) {
+        throw new RangeError('Offline journal cursor and retention floor must be non-negative safe integers.');
+    }
+    if (cursor < floor) {
+        throw new OfflineJournalRebaselineRequiredError('Offline journal cursor predates retained history.');
+    }
+}
+/**
+ * Advances retention floors and deletes one bounded journal batch atomically.
+ *
+ * Product adapters provide schema-specific queries. This state machine owns the
+ * safety order: candidates -> ordered opposing locks -> floors -> deletion.
+ */
+export function compactOfflineJournal(options) {
+    if (!Number.isSafeInteger(options.limit) || options.limit <= 0) {
+        throw new RangeError('Offline journal retention limit must be a positive safe integer.');
+    }
+    if (Number.isNaN(options.cutoff.getTime())) {
+        throw new RangeError('Offline journal retention cutoff must be a valid date.');
+    }
+    return options.store.transaction(async (tx) => {
+        const candidates = await tx.listCandidates(options.cutoff, options.limit);
+        if (candidates.length === 0) {
+            return 0;
+        }
+        assertCandidates(candidates);
+        const scopeByKey = new Map(candidates.map((candidate) => [options.scopeKey(candidate.scope), candidate.scope]));
+        const scopes = [...scopeByKey.entries()]
+            .sort(([left], [right]) => compareCanonicalKeys(left, right))
+            .map(([, scope]) => scope);
+        const lockedKeys = new Set((await tx.lockScopes(scopes)).map(options.scopeKey));
+        const floorByKey = new Map();
+        for (const candidate of candidates) {
+            const key = options.scopeKey(candidate.scope);
+            if (!lockedKeys.has(key)) {
+                continue;
+            }
+            const current = floorByKey.get(key);
+            if (!current || candidate.cursor > current.cursor) {
+                floorByKey.set(key, { scope: candidate.scope, cursor: candidate.cursor });
+            }
+        }
+        if (floorByKey.size > 0) {
+            await tx.advanceFloors([...floorByKey.entries()]
+                .sort(([left], [right]) => compareCanonicalKeys(left, right))
+                .map(([, floor]) => floor));
+        }
+        await tx.deleteCandidates(candidates.map((candidate) => candidate.cursor));
+        return candidates.length;
+    });
+}
+function compareCanonicalKeys(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function assertCandidates(candidates) {
+    const cursors = new Set();
+    for (const candidate of candidates) {
+        if (!Number.isSafeInteger(candidate.cursor) || candidate.cursor <= 0 || cursors.has(candidate.cursor)) {
+            throw new Error('Offline journal retention candidates must have unique positive safe-integer cursors.');
+        }
+        cursors.add(candidate.cursor);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "private": false,
   "publishConfig": {
     "access": "public"