@bymax-one/nest-cache 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -6,6 +6,46 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.0.5] - 2026-08-06
+
+**Documentation, tests and E2E only.** `dist/` is byte-identical to `1.0.4`.
+
+### Fixed
+
+- The Redis Cluster E2E was flaky at roughly one run in three, failing with `CLUSTERDOWN` or
+  "Too many Cluster redirections". The container log line proves `redis-cli --cluster create`
+  printed its coverage message, but what the client needs is the state each node serves on the
+  port the test dials. The helper now polls `CLUSTER INFO` on every node until all six report
+  `cluster_state:ok` and full slot coverage. Six consecutive runs of the previously flaky spec
+  pass, where it failed three times in nine before.
+
+### Documentation
+
+- The mutation badge said **100%**; the measured score is **99.78%**.
+
+### Tests
+
+- `findProvider` gained a spec of its own; it had only ever been exercised through the module
+  suites, where either half of its disjunction covered for the other.
+
+## [1.0.4] - 2026-08-04
+
+### Security
+
+- The Redis credentials are no longer disclosed when a service that holds the resolved
+  options is serialized. The three connection shapes — `connection`, `sentinel` and
+  `cluster` — move from plain fields on the resolved options to non-enumerable accessors,
+  and `ConnectionManager` keeps its client and the driver options built from them, as does
+  `PubSubService` with its subscriber, in ECMAScript private fields. A `url` carries the
+  password inline, the discrete forms carry it as a field, and an ioredis instance carries
+  `options.password` as a plain field, so `JSON.stringify`, object spread and
+  `util.inspect` on any holder emitted it in plaintext — which is what a structured logger
+  does when it renders a provider it was handed, and what an error reporter does when it
+  captures the scope of a throw.
+
+Reading on purpose is unchanged: `options.connection` resolves as before, and no public
+type or export moved.
+
 ## [1.0.3] - 2026-08-01
 
 ### Security
@@ -110,6 +150,8 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Published with npm OIDC provenance — no long-lived tokens
 - Zero direct runtime dependencies (`dependencies: {}`) — `ioredis` and NestJS via peer deps
 
+[1.0.5]: https://github.com/bymaxone/nest-cache/compare/v1.0.4...v1.0.5
+[1.0.4]: https://github.com/bymaxone/nest-cache/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.3
 [1.0.2]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.2
 [1.0.1]: https://github.com/bymaxone/nest-cache/releases/tag/v1.0.1

package/README.md

@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/@bymax-one/nest-cache"><img src="https://img.shields.io/npm/dm/@bymax-one/nest-cache?style=flat-square&colorA=000000&colorB=000000" alt="npm downloads" /></a>
   <a href="https://github.com/bymaxone/nest-cache/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/bymaxone/nest-cache/ci.yml?branch=main&style=flat-square&colorA=000000&label=CI" alt="CI status" /></a>
   <a href="https://github.com/bymaxone/nest-cache/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square&colorA=000000" alt="coverage" /></a>
-  <a href="https://github.com/bymaxone/nest-cache/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-100%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
+  <a href="https://github.com/bymaxone/nest-cache/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.78%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/bymaxone/nest-cache"><img src="https://api.scorecard.dev/projects/github.com/bymaxone/nest-cache/badge?style=flat-square" alt="OpenSSF Scorecard" /></a>
   <a href="https://github.com/bymaxone/nest-cache/blob/main/LICENSE"><img src="https://img.shields.io/github/license/bymaxone/nest-cache?style=flat-square&colorA=000000&colorB=000000" alt="license" /></a>
   <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
@@ -526,7 +526,7 @@ When integrating `@bymax-one/nest-cache` in production, verify each of the follo
 A cache is consulted on the hot path of every request that touches it, so the suite is held to a bar beyond "it runs" — every behavior is pinned so that a regression **fails a test**.
 
 - ✅ **100% line coverage** — statements, branches, functions, and lines, enforced by `jest.coverage.config.ts` as a pre-publish gate, not a target
-- ✅ **100% mutation score** — verified with [Stryker](https://stryker-mutator.io/) at `break: 95` and `ignoreStatic: false`: 433 seeded faults detected (427 killed, 6 timed out), **no survivors**
+- ✅ **99.78% mutation score** — verified with [Stryker](https://stryker-mutator.io/) at `break: 95` and `ignoreStatic: false`; the single survivor is `configurable: false` on the withheld connection accessor, equivalent here because the resolved options are frozen on the way out, and [documented as such](./docs/mutation_testing_results.md)
 - ✅ **Zero suppressions** — the production source carries no coverage or mutation directives; the one would-be equivalent mutant was refactored away rather than silenced, so the score is an accounting rather than a number
 - ✅ **No real Redis in unit tests** — `ioredis-mock` throughout; e2e tests exercise the wired module through `@nestjs/testing` and Testcontainers against a real Redis for connection lifecycle, Pub/Sub, and Lua scripts
 - ✅ **Published-package smoke test** — `scripts/dogfood-smoke-test.mjs` validates exports, tarball shape, and a consumer install before tagging

package/dist/server/index.cjs

@@ -4,6 +4,9 @@ var common = require('@nestjs/common');
 var ioredis = require('ioredis');
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -12,6 +15,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/server/bymax-cache.constants.ts
 var BYMAX_CACHE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CACHE_OPTIONS");
@@ -215,8 +222,17 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     scripts: options.scripts
   };
+  for (const key of ["connection", "sentinel", "cluster"]) {
+    const value = Object.getOwnPropertyDescriptor(resolved, key)?.value;
+    Object.defineProperty(resolved, key, {
+      get: () => value,
+      enumerable: false,
+      configurable: false
+    });
+  }
   return Object.freeze(resolved);
 }
+var _client, _redisOptionsResolved;
 exports.ConnectionManager = class ConnectionManager {
   /**
    * @param options - Resolved module options (frozen).
@@ -226,19 +242,29 @@ exports.ConnectionManager = class ConnectionManager {
   constructor(options, events) {
     this.options = options;
     this.events = events;
-    this.client = null;
+    /**
+     * The live Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which is
+     * erased at runtime: an ioredis instance carries `options.password` as a plain
+     * field, so leaving it enumerable puts the credentials one `JSON.stringify`
+     * away from any service that holds this manager.
+     */
+    __privateAdd(this, _client, null);
+    /** The driver options built from the connection config; they carry the password. */
+    __privateAdd(this, _redisOptionsResolved);
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     this.defaultRetryStrategy = (times) => Math.min(times * DEFAULT_RETRY_BASE_MS, DEFAULT_RETRY_MAX_MS);
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
     this.defaultReconnectOnError = (err) => err.message.includes("READONLY");
-    this.redisOptionsResolved = this.buildRedisOptions(options);
+    __privateSet(this, _redisOptionsResolved, this.buildRedisOptions(options));
   }
   /** Opens the main client and waits for readiness unless `lazyConnect`. */
   async onModuleInit() {
-    this.client = this.createClient();
-    this.registerListeners(this.client, "main");
+    __privateSet(this, _client, this.createClient());
+    this.registerListeners(__privateGet(this, _client), "main");
     if (!this.options.connection?.lazyConnect) {
-      await this.waitUntilReady(this.client);
+      await this.waitUntilReady(__privateGet(this, _client));
     }
   }
   /**
@@ -248,11 +274,11 @@ exports.ConnectionManager = class ConnectionManager {
    * @returns The shared main client.
    */
   getClient() {
-    if (!this.client) {
-      this.client = this.createClient();
-      this.registerListeners(this.client, "main");
+    if (!__privateGet(this, _client)) {
+      __privateSet(this, _client, this.createClient());
+      this.registerListeners(__privateGet(this, _client), "main");
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /**
    * Creates a brand-new dedicated connection for subscriber mode (a subscriber
@@ -278,7 +304,7 @@ exports.ConnectionManager = class ConnectionManager {
   }
   /** Quits the main client gracefully, forcing `disconnect()` on timeout. */
   async onModuleDestroy() {
-    const client = this.client;
+    const client = __privateGet(this, _client);
     if (!client) {
       return;
     }
@@ -306,7 +332,7 @@ exports.ConnectionManager = class ConnectionManager {
       client.disconnect();
     } finally {
       clearTimeout(timer);
-      this.client = null;
+      __privateSet(this, _client, null);
     }
   }
   // ─── Private ──────────────────────────────────────────────────────────────
@@ -324,7 +350,7 @@ exports.ConnectionManager = class ConnectionManager {
         throw new CacheException(CACHE_ERROR_CODES.SENTINEL_MISCONFIGURED, { mode: "sentinel" });
       }
       return new ioredis.Redis({
-        ...this.redisOptionsResolved,
+        ...__privateGet(this, _redisOptionsResolved),
         ...overrides,
         sentinels: sentinel.sentinels,
         name: sentinel.name,
@@ -347,7 +373,7 @@ exports.ConnectionManager = class ConnectionManager {
       }
       return new ioredis.Cluster(cluster.nodes, cluster.options ?? {});
     }
-    return new ioredis.Redis({ ...this.redisOptionsResolved, ...overrides });
+    return new ioredis.Redis({ ...__privateGet(this, _redisOptionsResolved), ...overrides });
   }
   /** Merges connection options with defaults; URL fields take precedence. */
   buildRedisOptions(opts) {
@@ -413,6 +439,8 @@ exports.ConnectionManager = class ConnectionManager {
     });
   }
 };
+_client = new WeakMap();
+_redisOptionsResolved = new WeakMap();
 exports.ConnectionManager = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_CACHE_OPTIONS)),
@@ -1259,6 +1287,7 @@ exports.CacheService = __decorateClass([
   __decorateParam(4, common.Optional()),
   __decorateParam(4, common.Inject(exports.ScriptManagerService))
 ], exports.CacheService);
+var _subscriber;
 exports.PubSubService = class PubSubService {
   /**
    * @param options - Resolved module options. Supplies the serializer.
@@ -1276,7 +1305,13 @@ exports.PubSubService = class PubSubService {
     this.keyBuilder = keyBuilder;
     this.events = events;
     /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    this.subscriber = null;
+    /**
+     * The dedicated subscriber connection.
+     *
+     * Private for the same reason as the manager's client: an ioredis instance
+     * carries `options.password` as a plain field.
+     */
+    __privateAdd(this, _subscriber, null);
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     this.channelRefs = /* @__PURE__ */ new Map();
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */
@@ -1379,11 +1414,11 @@ exports.PubSubService = class PubSubService {
   }
   /** Closes the subscriber connection gracefully, forcing disconnect on failure. */
   async onModuleDestroy() {
-    if (!this.subscriber) {
+    if (!__privateGet(this, _subscriber)) {
       return;
     }
-    const subscriber = this.subscriber;
-    this.subscriber = null;
+    const subscriber = __privateGet(this, _subscriber);
+    __privateSet(this, _subscriber, null);
     try {
       await subscriber.quit();
     } catch {
@@ -1401,10 +1436,10 @@ exports.PubSubService = class PubSubService {
    * experimental passthrough per the spec).
    */
   ensureSubscriber() {
-    if (!this.subscriber) {
-      this.subscriber = this.connection.createSubscriberClient();
+    if (!__privateGet(this, _subscriber)) {
+      __privateSet(this, _subscriber, this.connection.createSubscriberClient());
     }
-    return this.subscriber;
+    return __privateGet(this, _subscriber);
   }
   /**
    * Subscribes the target (channel or pattern) only when it gains its FIRST
@@ -1483,6 +1518,7 @@ exports.PubSubService = class PubSubService {
     }
   }
 };
+_subscriber = new WeakMap();
 exports.PubSubService = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_CACHE_OPTIONS)),

package/dist/server/index.d.cts

@@ -356,10 +356,9 @@ type ResolvedOptions = Required<Pick<BymaxCacheModuleOptions, 'mode' | 'namespac
 /** The two client flavors this manager can produce. */
 type AnyRedis = Redis | Cluster;
 declare class ConnectionManager implements OnModuleInit, OnModuleDestroy {
+    #private;
     private readonly options;
     private readonly events?;
-    private client;
-    private readonly redisOptionsResolved;
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     private readonly defaultRetryStrategy;
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
@@ -991,11 +990,10 @@ type IPubSubPatternHandler<T> = (message: T, channel: string, pattern: string) =
 /** Detaches a subscription's listener and unsubscribes its channel/pattern. */
 type Unsubscribe = () => Promise<void>;
 declare class PubSubService implements OnModuleDestroy {
+    #private;
     private readonly connection;
     private readonly keyBuilder;
     private readonly events?;
-    /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    private subscriber;
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     private readonly channelRefs;
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */

package/dist/server/index.d.ts

@@ -356,10 +356,9 @@ type ResolvedOptions = Required<Pick<BymaxCacheModuleOptions, 'mode' | 'namespac
 /** The two client flavors this manager can produce. */
 type AnyRedis = Redis | Cluster;
 declare class ConnectionManager implements OnModuleInit, OnModuleDestroy {
+    #private;
     private readonly options;
     private readonly events?;
-    private client;
-    private readonly redisOptionsResolved;
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     private readonly defaultRetryStrategy;
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
@@ -991,11 +990,10 @@ type IPubSubPatternHandler<T> = (message: T, channel: string, pattern: string) =
 /** Detaches a subscription's listener and unsubscribes its channel/pattern. */
 type Unsubscribe = () => Promise<void>;
 declare class PubSubService implements OnModuleDestroy {
+    #private;
     private readonly connection;
     private readonly keyBuilder;
     private readonly events?;
-    /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    private subscriber;
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     private readonly channelRefs;
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */

package/dist/server/index.mjs

@@ -2,6 +2,9 @@ import { ConfigurableModuleBuilder, HttpStatus, Injectable, Inject, Optional, Mo
 import { Redis, Cluster } from 'ioredis';
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -10,6 +13,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/server/bymax-cache.constants.ts
 var BYMAX_CACHE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CACHE_OPTIONS");
@@ -213,8 +220,17 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     scripts: options.scripts
   };
+  for (const key of ["connection", "sentinel", "cluster"]) {
+    const value = Object.getOwnPropertyDescriptor(resolved, key)?.value;
+    Object.defineProperty(resolved, key, {
+      get: () => value,
+      enumerable: false,
+      configurable: false
+    });
+  }
   return Object.freeze(resolved);
 }
+var _client, _redisOptionsResolved;
 var ConnectionManager = class {
   /**
    * @param options - Resolved module options (frozen).
@@ -224,19 +240,29 @@ var ConnectionManager = class {
   constructor(options, events) {
     this.options = options;
     this.events = events;
-    this.client = null;
+    /**
+     * The live Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which is
+     * erased at runtime: an ioredis instance carries `options.password` as a plain
+     * field, so leaving it enumerable puts the credentials one `JSON.stringify`
+     * away from any service that holds this manager.
+     */
+    __privateAdd(this, _client, null);
+    /** The driver options built from the connection config; they carry the password. */
+    __privateAdd(this, _redisOptionsResolved);
     /** Default backoff: grow 50 ms per attempt, capped at 2 s. */
     this.defaultRetryStrategy = (times) => Math.min(times * DEFAULT_RETRY_BASE_MS, DEFAULT_RETRY_MAX_MS);
     /** Default reconnect policy: reconnect only on a `READONLY` replica failover. */
     this.defaultReconnectOnError = (err) => err.message.includes("READONLY");
-    this.redisOptionsResolved = this.buildRedisOptions(options);
+    __privateSet(this, _redisOptionsResolved, this.buildRedisOptions(options));
   }
   /** Opens the main client and waits for readiness unless `lazyConnect`. */
   async onModuleInit() {
-    this.client = this.createClient();
-    this.registerListeners(this.client, "main");
+    __privateSet(this, _client, this.createClient());
+    this.registerListeners(__privateGet(this, _client), "main");
     if (!this.options.connection?.lazyConnect) {
-      await this.waitUntilReady(this.client);
+      await this.waitUntilReady(__privateGet(this, _client));
     }
   }
   /**
@@ -246,11 +272,11 @@ var ConnectionManager = class {
    * @returns The shared main client.
    */
   getClient() {
-    if (!this.client) {
-      this.client = this.createClient();
-      this.registerListeners(this.client, "main");
+    if (!__privateGet(this, _client)) {
+      __privateSet(this, _client, this.createClient());
+      this.registerListeners(__privateGet(this, _client), "main");
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /**
    * Creates a brand-new dedicated connection for subscriber mode (a subscriber
@@ -276,7 +302,7 @@ var ConnectionManager = class {
   }
   /** Quits the main client gracefully, forcing `disconnect()` on timeout. */
   async onModuleDestroy() {
-    const client = this.client;
+    const client = __privateGet(this, _client);
     if (!client) {
       return;
     }
@@ -304,7 +330,7 @@ var ConnectionManager = class {
       client.disconnect();
     } finally {
       clearTimeout(timer);
-      this.client = null;
+      __privateSet(this, _client, null);
     }
   }
   // ─── Private ──────────────────────────────────────────────────────────────
@@ -322,7 +348,7 @@ var ConnectionManager = class {
         throw new CacheException(CACHE_ERROR_CODES.SENTINEL_MISCONFIGURED, { mode: "sentinel" });
       }
       return new Redis({
-        ...this.redisOptionsResolved,
+        ...__privateGet(this, _redisOptionsResolved),
         ...overrides,
         sentinels: sentinel.sentinels,
         name: sentinel.name,
@@ -345,7 +371,7 @@ var ConnectionManager = class {
       }
       return new Cluster(cluster.nodes, cluster.options ?? {});
     }
-    return new Redis({ ...this.redisOptionsResolved, ...overrides });
+    return new Redis({ ...__privateGet(this, _redisOptionsResolved), ...overrides });
   }
   /** Merges connection options with defaults; URL fields take precedence. */
   buildRedisOptions(opts) {
@@ -411,6 +437,8 @@ var ConnectionManager = class {
     });
   }
 };
+_client = new WeakMap();
+_redisOptionsResolved = new WeakMap();
 ConnectionManager = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_CACHE_OPTIONS)),
@@ -1257,6 +1285,7 @@ CacheService = __decorateClass([
   __decorateParam(4, Optional()),
   __decorateParam(4, Inject(ScriptManagerService))
 ], CacheService);
+var _subscriber;
 var PubSubService = class {
   /**
    * @param options - Resolved module options. Supplies the serializer.
@@ -1274,7 +1303,13 @@ var PubSubService = class {
     this.keyBuilder = keyBuilder;
     this.events = events;
     /** Lazily-created dedicated subscriber connection (null until first subscribe). */
-    this.subscriber = null;
+    /**
+     * The dedicated subscriber connection.
+     *
+     * Private for the same reason as the manager's client: an ioredis instance
+     * carries `options.password` as a plain field.
+     */
+    __privateAdd(this, _subscriber, null);
     /** Live-listener ref-count per namespaced channel; UNSUBSCRIBE fires on the last. */
     this.channelRefs = /* @__PURE__ */ new Map();
     /** Live-listener ref-count per namespaced pattern; PUNSUBSCRIBE fires on the last. */
@@ -1377,11 +1412,11 @@ var PubSubService = class {
   }
   /** Closes the subscriber connection gracefully, forcing disconnect on failure. */
   async onModuleDestroy() {
-    if (!this.subscriber) {
+    if (!__privateGet(this, _subscriber)) {
       return;
     }
-    const subscriber = this.subscriber;
-    this.subscriber = null;
+    const subscriber = __privateGet(this, _subscriber);
+    __privateSet(this, _subscriber, null);
     try {
       await subscriber.quit();
     } catch {
@@ -1399,10 +1434,10 @@ var PubSubService = class {
    * experimental passthrough per the spec).
    */
   ensureSubscriber() {
-    if (!this.subscriber) {
-      this.subscriber = this.connection.createSubscriberClient();
+    if (!__privateGet(this, _subscriber)) {
+      __privateSet(this, _subscriber, this.connection.createSubscriberClient());
     }
-    return this.subscriber;
+    return __privateGet(this, _subscriber);
   }
   /**
    * Subscribes the target (channel or pattern) only when it gains its FIRST
@@ -1481,6 +1516,7 @@ var PubSubService = class {
     }
   }
 };
+_subscriber = new WeakMap();
 PubSubService = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_CACHE_OPTIONS)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-cache",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Typed Redis cache for NestJS based on ioredis 5, with namespace strategy, Pub/Sub and Lua script management.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -53,6 +53,29 @@
       ]
     }
   },
+  "scripts": {
+    "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
+    "lint": "eslint src scripts",
+    "lint:fix": "eslint src scripts --fix",
+    "mutation": "stryker run",
+    "mutation:dry-run": "stryker run --dryRunOnly",
+    "mutation:incremental": "stryker run --incremental",
+    "prepare": "husky",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm test:types && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "release": "npm publish --provenance --access public",
+    "size": "node scripts/check-size.mjs",
+    "test": "jest",
+    "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
+    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
+    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
+    "test:types": "tsc --noEmit -p tsconfig.typetest.json",
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
+  },
   "lint-staged": {
     "*.{ts,tsx,js,mjs,cjs}": [
       "eslint --fix",
@@ -116,32 +139,12 @@
     "pubsub",
     "lua"
   ],
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24.0.0"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
-  },
-  "scripts": {
-    "build": "pnpm clean && tsup",
-    "check:exports": "attw --pack .",
-    "check:published": "node scripts/check-published-surface.mjs",
-    "clean": "rm -rf dist coverage",
-    "lint": "eslint src scripts",
-    "lint:fix": "eslint src scripts --fix",
-    "mutation": "stryker run",
-    "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
-    "release": "pnpm publish --provenance",
-    "size": "node scripts/check-size.mjs",
-    "test": "jest",
-    "test:all": "pnpm test && pnpm test:e2e",
-    "test:cov": "jest --coverage",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "test:e2e": "jest --config jest.e2e.config.ts --runInBand",
-    "test:types": "tsc --noEmit -p tsconfig.typetest.json",
-    "test:watch": "jest --watch",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   }
-}
+}