Summary

• expire counter series after five missed refreshes while preserving monotonic accumulation during brief gaps
• correctly pass gauges through and export newly observed counters immediately
• persist oversized MetricExporter snapshots in validated, bounded chunks with atomic generation switching and legacy-state migration
• surface GraphQL access errors and retry denied product queries hourly instead of every refresh interval
• recover the MetricExporter alarm loop after any uncaught handler failure so refreshes cannot silently stop
• add Vitest coverage, typechecking, and pull-request CI

Motivation

MetricExporter retained every counter label set it had ever observed and persisted the complete metrics/counter snapshot under one Durable Object storage value. Label churn could therefore cause unbounded memory/storage growth and eventually oversized writes.

A failed alarm could also exhaust Cloudflare's finite platform retries before the application scheduled its next alarm. The Worker would remain available but continue serving stale metrics indefinitely. The top-level alarm recovery path now schedules a fallback alarm one minute later after any unexpected failure. If fallback scheduling itself fails, the error is rethrown so platform retries still apply.

GraphQL products unavailable to an account were also treated as successful empty responses and queried every minute.

Testing

• bun install --frozen-lockfile
• bun run check
• bun run typecheck
• bun run test (34 tests)
• repeated alarm-failure regression (10 consecutive failures each schedule recovery)
• wrangler deploy --dry-run with a temporary valid KV namespace ID

Closes #28