@bymax-one/nest-config 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -11,6 +11,60 @@ as the GitHub Release body, so each released version needs a matching
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-08-07
+
+**Documentation and tooling.** `dist/` differs from `1.0.2` only in the text of the comments
+described below; no runtime code changed.
+
+### Changed
+
+- **Equivalent mutants are documented in the source instead of only in the report.** Ten of
+  the eleven now carry `// Stryker disable next-line <Mutator>: <reason>` on the line they
+  apply to, which is the convention now shared across the `@bymax-one/nest-*` libraries. The
+  measured score moves from **95.74%** to **99.59%** — no test and no production logic
+  changed; Stryker excludes an ignored mutant from the denominator instead of counting it as
+  one the suite failed to kill.
+
+  Two needed the block `disable`/`restore` form, because `next-line` binds to the following
+  statement and those mutants do not sit on one.
+
+  The eleventh stays a **counted survivor**. A directive on the line above it was measured,
+  not assumed, to do nothing — one does not attach to a `.replace()` inside a method chain,
+  and the mutant still reported as surviving. Silencing it would take a block directive
+  spanning the neighbouring `.replace()`, whose own regex mutants the suite does kill, and a
+  killable mutant is never disabled to raise a number. It is argued in a plain comment at the
+  line and counted in the report.
+
+- The README claimed **Zero suppressions** as a rule. It states what is true now: every
+  suppression carries its reason, in the grammar Stryker parses.
+
+### Security
+
+- **`js-yaml` is floored at the patched release** (GHSA-5p4m-2wfm-xmqj, CVSS 7.5), which was
+  open as a Dependabot alert. It reaches this repo only through `jest` ->
+  `babel-plugin-istanbul` -> `@istanbuljs/load-nyc-config`; this package declares
+  `"dependencies": {}`, so `js-yaml` is never installed beside it and no consumer was
+  exposed. `dist/` is unaffected. (Landed separately, recorded here because it ships in this
+  version.)
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the parser's own regular expression, rejecting a reason
+  written after `--` instead of a colon, a reason wrapped onto a second comment line, a
+  stray comma in the mutator list, and a mutator name Stryker does not know, which matches
+  nothing and so silences nothing. Wired into CI and `prepublishOnly`.
+
+## [1.0.2] - 2026-08-06
+
+**Documentation only.** `dist/` is byte-identical to `1.0.1`.
+
+### Documentation
+
+- The mutation badge said **95.72%**; the re-measured score is **95.74%**. The report gains a
+  dated re-run recording that three of the eleven documented equivalents were re-verified by
+  running the mutants rather than by reading them.
+
 ## [1.0.1] - 2026-08-04
 
 ### Security
@@ -120,5 +174,7 @@ have regressed from. They are kept because the reasoning is worth having.
   ever carried the permissive range. No runtime behaviour changed.
 
 [1.0.0]: https://github.com/bymaxone/nest-config/releases/tag/v1.0.0
+[1.0.2]: https://github.com/bymaxone/nest-config/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/bymaxone/nest-config/compare/v1.0.0...v1.0.1
-[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.0.1...HEAD
+[1.0.3]: https://github.com/bymaxone/nest-config/compare/v1.0.2...v1.0.3
+[Unreleased]: https://github.com/bymaxone/nest-config/compare/v1.0.3...HEAD

package/README.md

@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/@bymax-one/nest-config"><img src="https://img.shields.io/npm/dm/@bymax-one/nest-config?style=flat-square&colorA=000000&colorB=000000" alt="npm downloads" /></a>
   <a href="https://github.com/bymaxone/nest-config/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/bymaxone/nest-config/ci.yml?branch=main&style=flat-square&colorA=000000&label=CI" alt="CI status" /></a>
   <a href="https://github.com/bymaxone/nest-config/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square&colorA=000000" alt="coverage" /></a>
-  <a href="https://github.com/bymaxone/nest-config/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-95.72%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
+  <a href="https://github.com/bymaxone/nest-config/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.59%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/bymaxone/nest-config"><img src="https://api.scorecard.dev/projects/github.com/bymaxone/nest-config/badge?style=flat-square" alt="OpenSSF Scorecard" /></a>
   <a href="https://github.com/bymaxone/nest-config/blob/main/LICENSE"><img src="https://img.shields.io/github/license/bymaxone/nest-config?style=flat-square&colorA=000000&colorB=000000" alt="license" /></a>
   <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
@@ -477,9 +477,10 @@ Configuration decides whether a process may start at all, so the suite is held t
 beyond "the tests pass".
 
 - ✅ **100% line coverage** — statements, branches, functions and lines, enforced as a gate
-- ✅ **95.72% mutation score** — verified with [Stryker](https://stryker-mutator.io/) at
-  `break: 95`; the eleven survivors are provable equivalents, documented in the
-  [report](./docs/mutation_testing_results.md)
+- ✅ **99.59% mutation score** — verified with [Stryker](https://stryker-mutator.io/) at
+  `break: 95`; ten provable equivalents carry their reason inline, and the one survivor left
+  is an equivalent no directive can reach, so it stays counted rather than silenced
+  ([report](./docs/mutation_testing_results.md))
 - ✅ **The value-free guarantee is tested, not assumed** — a sentinel secret is placed in a
   source and the assertion is that it appears nowhere in the rendered report or in the thrown
   error, because a guarantee about what is _absent_ is the one thing an ordinary assertion
@@ -487,7 +488,11 @@ beyond "the tests pass".
 - ✅ **Published-artifact gates** — `check:exports` resolves the types the way each module
   system does, `check:runtime` loads every subpath from the packed tarball in ESM and
   CommonJS, and `check:published` compiles this README's snippets against `dist/`
-- ✅ **Zero suppressions** — no coverage or mutation directives in the production source
+- ✅ **Every suppression carries its reason** — no coverage directives anywhere; each
+  `// Stryker disable` in the production source names, after the `:` Stryker reads it from,
+  why the mutant it silences is behaviour-preserving, and `check:mutants` proves those
+  reasons parse so they reach the mutation report rather than the `Ignored using a comment`
+  fallback
 
 ```bash
 pnpm test          # unit suite

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-config",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Typed and validated environment configuration entry point for NestJS 11 applications, built on Zod v4.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -56,6 +56,7 @@
   "scripts": {
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack . --profile strict",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "check:runtime": "node scripts/check-consumer-runtime.mjs",
     "clean": "node -e \"const fs=require('node:fs');for(const d of ['dist','coverage'])fs.rmSync(d,{recursive:true,force:true})\"",
@@ -66,7 +67,7 @@
     "mutation:dry-run": "stryker run --dryRunOnly",
     "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
-    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm test:cov:all && pnpm build && pnpm size && pnpm check:published",
+    "prepublishOnly": "pnpm typecheck && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm size && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "test": "jest",
@@ -127,17 +128,6 @@
     "typescript": "^5.9.3",
     "zod": "^4.0.0"
   },
-  "pnpm": {
-    "overrides": {
-      "brace-expansion@1": "^1.1.17",
-      "brace-expansion@2": "^2.1.3",
-      "brace-expansion@5": "^5.0.8",
-      "esbuild": "^0.28.1",
-      "fast-uri": "^3.1.4",
-      "protobufjs": "^7.6.5",
-      "qs": "^6.15.2"
-    }
-  },
   "keywords": [
     "nestjs",
     "config",
@@ -150,7 +140,7 @@
     "fail-fast",
     "configuration"
   ],
-  "packageManager": "pnpm@10.8.1",
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24.0.0"
   },