@bymax-one/nest-config 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -11,6 +11,23 @@ as the GitHub Release body, so each released version needs a matching
 
 ## [Unreleased]
 
+## [1.0.1] - 2026-08-04
+
+### Security
+
+- `ConfigService` no longer discloses configured values when an instance is serialized.
+  The validated root and its flattened lookup moved from TypeScript `private` properties —
+  which are erased at runtime, leaving enumerable own properties — to ECMAScript private
+  fields. `JSON.stringify`, `Object.entries`, object spread and `util.inspect` (including
+  `showHidden`) previously emitted every secret the application declared in plaintext,
+  which is what code that renders an injected provider incidentally does: a logger
+  formatting its arguments, an error reporter capturing the scope of a throw.
+- `ConfigService.toJSON` reports the declared namespace names and nothing else, so a
+  serialized instance stays informative for debugging without carrying values.
+
+Reading on purpose is unchanged. `get`, `has` and `getAll` return the same values as
+before; only incidental serialization is affected. No API was removed.
+
 ## [1.0.0] - 2026-08-03
 
 First published release. Everything below ships in it.
@@ -103,4 +120,5 @@ have regressed from. They are kept because the reasoning is worth having.
   ever carried the permissive range. No runtime behaviour changed.
 
 [1.0.0]: https://github.com/bymaxone/nest-config/releases/tag/v1.0.0
-[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.0.0...HEAD
+[1.0.1]: https://github.com/bymaxone/nest-config/compare/v1.0.0...v1.0.1
+[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.0.1...HEAD

package/README.md

@@ -404,6 +404,16 @@ from the schema, the bound — and never the received value. `env-validator` and
 `report-formatter` each say so in their own contracts, and property-based tests hold them
 to it.
 
+### The service does not serialize its configuration
+
+`ConfigService` keeps the validated root in an ECMAScript private field, so
+`JSON.stringify`, `Object.entries`, object spread and `util.inspect` cannot reach the
+values. Those are the paths taken by code that renders an injected provider it was handed
+incidentally — a logger formatting its arguments, an error reporter capturing the scope of
+a throw. `toJSON` returns the declared namespace names, so the omission reads as deliberate
+rather than as an empty object. Reading on purpose is unaffected: `get`, `has` and the
+`getAll` escape hatch return the real values.
+
 ### Failing fast is the security property
 
 A service that starts with a missing `JWT_SECRET` and discovers it at the first login is a
@@ -437,6 +447,7 @@ schema includes a value, that message is printed as written.
 | Failure mode   | Refuse to start; the whole schema is validated before the context finishes building                                        |
 | Aggregation    | Every failure reported at once, so a fix cycle is one restart rather than one per variable                                 |
 | Immutability   | The validated result is frozen before it is provided                                                                       |
+| Service state  | The root lives in a private field; serializing the injected service yields namespace names only                            |
 | Sources        | `process.env` only — no file, no network, no remote provider                                                               |
 | Type surface   | Dot paths checked against the schema at compile time; a typo is a build error, not a runtime `undefined`                   |
 | Supply chain   | `dependencies: {}`; third-party Actions pinned by commit SHA (org-internal reusables by tag); CodeQL and OpenSSF Scorecard |

package/dist/internal/index.cjs

@@ -4,6 +4,9 @@ var common = require('@nestjs/common');
 var zod = require('zod');
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -12,6 +15,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/config.tokens.ts
 var BYMAX_CONFIG_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CONFIG_OPTIONS");
@@ -275,6 +282,7 @@ var bymaxConfigProvider = {
   useFactory: createValidatedConfig,
   inject: [BYMAX_CONFIG_OPTIONS]
 };
+var _config, _leaves;
 exports.ConfigService = class ConfigService {
   /**
    * Bind the accessor to the frozen configuration object.
@@ -286,14 +294,53 @@ exports.ConfigService = class ConfigService {
    * @param config - The validated, deep-frozen config injected via {@link BYMAX_CONFIG}.
    */
   constructor(config) {
-    this.config = config;
+    /**
+     * The frozen configuration root.
+     *
+     * Held in an ECMAScript private field rather than a TypeScript `private`
+     * property: `private` is erased at runtime, leaving an enumerable own
+     * property that `JSON.stringify`, `Object.entries`, object spread and
+     * `util.inspect` all walk into. This object aggregates every secret the
+     * application declared, so any code that incidentally serializes the
+     * injected service — a logger that renders its arguments, an observability
+     * SDK capturing the scope of a thrown error, a stray `console.log` — would
+     * emit them in plaintext. A `#` field is unreachable to all of those.
+     */
+    __privateAdd(this, _config);
+    /**
+     * Precomputed `namespace.leaf` to value lookup, built once at construction.
+     *
+     * An ECMAScript private field for the same reason as the config root: it
+     * holds the same values, flattened.
+     */
+    __privateAdd(this, _leaves);
+    __privateSet(this, _config, config);
     const leaves = /* @__PURE__ */ new Map();
     for (const [namespace, value] of Object.entries(config)) {
       for (const [leaf, leafValue] of Object.entries(value)) {
         leaves.set(`${namespace}.${leaf}`, leafValue);
       }
     }
-    this.leaves = leaves;
+    __privateSet(this, _leaves, leaves);
+  }
+  /**
+   * Describe the service for serialization without disclosing any value.
+   *
+   * `JSON.stringify` on an instance would otherwise yield `{}`, which reads as
+   * a bug rather than as a deliberate omission. Returning the namespace names
+   * keeps the output useful for debugging while the values stay unreachable.
+   *
+   * @returns The declared namespace names, never their contents.
+   * @example
+   * ```typescript
+   * JSON.stringify(config); // {"service":"ConfigService","namespaces":["server","database"]}
+   * ```
+   */
+  toJSON() {
+    return {
+      service: "ConfigService",
+      namespaces: Object.keys(__privateGet(this, _config))
+    };
   }
   /**
    * Read a leaf value by its `namespace.leaf` dot-path.
@@ -328,7 +375,7 @@ exports.ConfigService = class ConfigService {
    * ```
    */
   getAll() {
-    return this.config;
+    return __privateGet(this, _config);
   }
   /**
    * Report whether a declared path resolves to a defined value.
@@ -357,9 +404,11 @@ exports.ConfigService = class ConfigService {
    * @returns The leaf value as `unknown`, or `undefined` when the leaf is unset.
    */
   resolve(path) {
-    return this.leaves.get(String(path));
+    return __privateGet(this, _leaves).get(String(path));
   }
 };
+_config = new WeakMap();
+_leaves = new WeakMap();
 exports.ConfigService = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_CONFIG))

package/dist/internal/index.d.cts

@@ -351,9 +351,7 @@ declare class BymaxConfigModule extends ConfigurableModuleClass {
  * ```
  */
 declare class ConfigService<TConfig> {
-    private readonly config;
-    /** Precomputed `namespace.leaf` to value lookup, built once at construction. */
-    private readonly leaves;
+    #private;
     /**
      * Bind the accessor to the frozen configuration object.
      *
@@ -364,6 +362,23 @@ declare class ConfigService<TConfig> {
      * @param config - The validated, deep-frozen config injected via {@link BYMAX_CONFIG}.
      */
     constructor(config: Readonly<TConfig>);
+    /**
+     * Describe the service for serialization without disclosing any value.
+     *
+     * `JSON.stringify` on an instance would otherwise yield `{}`, which reads as
+     * a bug rather than as a deliberate omission. Returning the namespace names
+     * keeps the output useful for debugging while the values stay unreachable.
+     *
+     * @returns The declared namespace names, never their contents.
+     * @example
+     * ```typescript
+     * JSON.stringify(config); // {"service":"ConfigService","namespaces":["server","database"]}
+     * ```
+     */
+    toJSON(): {
+        readonly service: string;
+        readonly namespaces: readonly string[];
+    };
     /**
      * Read a leaf value by its `namespace.leaf` dot-path.
      *

package/dist/internal/index.d.ts

@@ -351,9 +351,7 @@ declare class BymaxConfigModule extends ConfigurableModuleClass {
  * ```
  */
 declare class ConfigService<TConfig> {
-    private readonly config;
-    /** Precomputed `namespace.leaf` to value lookup, built once at construction. */
-    private readonly leaves;
+    #private;
     /**
      * Bind the accessor to the frozen configuration object.
      *
@@ -364,6 +362,23 @@ declare class ConfigService<TConfig> {
      * @param config - The validated, deep-frozen config injected via {@link BYMAX_CONFIG}.
      */
     constructor(config: Readonly<TConfig>);
+    /**
+     * Describe the service for serialization without disclosing any value.
+     *
+     * `JSON.stringify` on an instance would otherwise yield `{}`, which reads as
+     * a bug rather than as a deliberate omission. Returning the namespace names
+     * keeps the output useful for debugging while the values stay unreachable.
+     *
+     * @returns The declared namespace names, never their contents.
+     * @example
+     * ```typescript
+     * JSON.stringify(config); // {"service":"ConfigService","namespaces":["server","database"]}
+     * ```
+     */
+    toJSON(): {
+        readonly service: string;
+        readonly namespaces: readonly string[];
+    };
     /**
      * Read a leaf value by its `namespace.leaf` dot-path.
      *

package/dist/internal/index.mjs

@@ -2,6 +2,9 @@ import { ConfigurableModuleBuilder, Injectable, Inject, Module } from '@nestjs/c
 import { z } from 'zod';
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -10,6 +13,10 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/config.tokens.ts
 var BYMAX_CONFIG_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CONFIG_OPTIONS");
@@ -273,6 +280,7 @@ var bymaxConfigProvider = {
   useFactory: createValidatedConfig,
   inject: [BYMAX_CONFIG_OPTIONS]
 };
+var _config, _leaves;
 var ConfigService = class {
   /**
    * Bind the accessor to the frozen configuration object.
@@ -284,14 +292,53 @@ var ConfigService = class {
    * @param config - The validated, deep-frozen config injected via {@link BYMAX_CONFIG}.
    */
   constructor(config) {
-    this.config = config;
+    /**
+     * The frozen configuration root.
+     *
+     * Held in an ECMAScript private field rather than a TypeScript `private`
+     * property: `private` is erased at runtime, leaving an enumerable own
+     * property that `JSON.stringify`, `Object.entries`, object spread and
+     * `util.inspect` all walk into. This object aggregates every secret the
+     * application declared, so any code that incidentally serializes the
+     * injected service — a logger that renders its arguments, an observability
+     * SDK capturing the scope of a thrown error, a stray `console.log` — would
+     * emit them in plaintext. A `#` field is unreachable to all of those.
+     */
+    __privateAdd(this, _config);
+    /**
+     * Precomputed `namespace.leaf` to value lookup, built once at construction.
+     *
+     * An ECMAScript private field for the same reason as the config root: it
+     * holds the same values, flattened.
+     */
+    __privateAdd(this, _leaves);
+    __privateSet(this, _config, config);
     const leaves = /* @__PURE__ */ new Map();
     for (const [namespace, value] of Object.entries(config)) {
       for (const [leaf, leafValue] of Object.entries(value)) {
         leaves.set(`${namespace}.${leaf}`, leafValue);
       }
     }
-    this.leaves = leaves;
+    __privateSet(this, _leaves, leaves);
+  }
+  /**
+   * Describe the service for serialization without disclosing any value.
+   *
+   * `JSON.stringify` on an instance would otherwise yield `{}`, which reads as
+   * a bug rather than as a deliberate omission. Returning the namespace names
+   * keeps the output useful for debugging while the values stay unreachable.
+   *
+   * @returns The declared namespace names, never their contents.
+   * @example
+   * ```typescript
+   * JSON.stringify(config); // {"service":"ConfigService","namespaces":["server","database"]}
+   * ```
+   */
+  toJSON() {
+    return {
+      service: "ConfigService",
+      namespaces: Object.keys(__privateGet(this, _config))
+    };
   }
   /**
    * Read a leaf value by its `namespace.leaf` dot-path.
@@ -326,7 +373,7 @@ var ConfigService = class {
    * ```
    */
   getAll() {
-    return this.config;
+    return __privateGet(this, _config);
   }
   /**
    * Report whether a declared path resolves to a defined value.
@@ -355,9 +402,11 @@ var ConfigService = class {
    * @returns The leaf value as `unknown`, or `undefined` when the leaf is unset.
    */
   resolve(path) {
-    return this.leaves.get(String(path));
+    return __privateGet(this, _leaves).get(String(path));
   }
 };
+_config = new WeakMap();
+_leaves = new WeakMap();
 ConfigService = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_CONFIG))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-config",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Typed and validated environment configuration entry point for NestJS 11 applications, built on Zod v4.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -53,6 +53,29 @@
     },
     "./package.json": "./package.json"
   },
+  "scripts": {
+    "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack . --profile strict",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "check:runtime": "node scripts/check-consumer-runtime.mjs",
+    "clean": "node -e \"const fs=require('node:fs');for(const d of ['dist','coverage'])fs.rmSync(d,{recursive:true,force:true})\"",
+    "dogfood": "node scripts/dogfood-smoke-test.mjs",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "mutation": "stryker run",
+    "mutation:dry-run": "stryker run --dryRunOnly",
+    "mutation:incremental": "stryker run --incremental",
+    "prepare": "husky",
+    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm test:cov:all && pnpm build && pnpm size && pnpm check:published",
+    "release": "npm publish --provenance --access public",
+    "size": "node scripts/check-size.mjs",
+    "test": "jest",
+    "test:cov": "jest --coverage",
+    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
+    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.build.json"
+  },
   "lint-staged": {
     "*.{ts,tsx,js,mjs,cjs}": [
       "eslint --fix",
@@ -104,6 +127,17 @@
     "typescript": "^5.9.3",
     "zod": "^4.0.0"
   },
+  "pnpm": {
+    "overrides": {
+      "brace-expansion@1": "^1.1.17",
+      "brace-expansion@2": "^2.1.3",
+      "brace-expansion@5": "^5.0.8",
+      "esbuild": "^0.28.1",
+      "fast-uri": "^3.1.4",
+      "protobufjs": "^7.6.5",
+      "qs": "^6.15.2"
+    }
+  },
   "keywords": [
     "nestjs",
     "config",
@@ -116,6 +150,7 @@
     "fail-fast",
     "configuration"
   ],
+  "packageManager": "pnpm@10.8.1",
   "engines": {
     "node": ">=24.0.0"
   },
@@ -136,26 +171,5 @@
         "./dist/internal/index.d.cts"
       ]
     }
-  },
-  "scripts": {
-    "build": "pnpm clean && tsup",
-    "check:exports": "attw --pack . --profile strict",
-    "check:published": "node scripts/check-published-surface.mjs",
-    "check:runtime": "node scripts/check-consumer-runtime.mjs",
-    "clean": "node -e \"const fs=require('node:fs');for(const d of ['dist','coverage'])fs.rmSync(d,{recursive:true,force:true})\"",
-    "dogfood": "node scripts/dogfood-smoke-test.mjs",
-    "lint": "eslint src",
-    "lint:fix": "eslint src --fix",
-    "mutation": "stryker run",
-    "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
-    "release": "npm publish --provenance --access public",
-    "size": "node scripts/check-size.mjs",
-    "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
-    "test:e2e": "jest --config jest.e2e.config.ts",
-    "test:watch": "jest --watch",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.build.json"
   }
-}
+}