@bymax-one/nest-core 1.2.2 → 1.3.1

package/CHANGELOG.md

@@ -11,6 +11,59 @@ heading here.
 
 ## [Unreleased]
 
+## [1.3.1] - 2026-08-11
+
+A patch fixing a defect that existed only in the published artifact: `applyBymaxOpenApi` threw on
+every consumer boot, including consumers that never enabled the OpenAPI document. No API changed —
+the type declarations are byte-identical to `1.3.0` apart from one added documentation comment.
+
+**Apply to a derived backend:** `pnpm up @bymax-one/nest-core`. No code change on the consumer
+side; the DI token identities are internal to the package.
+
+### Fixed
+
+- **`applyBymaxOpenApi` resolves the options registered by `BymaxCoreModule` again.** The DI
+  tokens were minted with `Symbol()`. This package ships one bundle per published subpath with the
+  shared internals inlined into each, so `core.tokens` existed twice at runtime — once in
+  `dist/index.cjs`, once in `dist/openapi/index.cjs` — and `Symbol('X') !== Symbol('X')`. The
+  provider bound by the package root carried one identity and the `./openapi` helper looked up
+  another, so `app.get()` found nothing and the helper threw its "could not resolve
+  BYMAX_CORE_OPTIONS" error with `BymaxCoreModule` correctly registered. Under Nest's default
+  `abortOnError` that took down the process. The feature flag did not protect anyone: the helper
+  resolves the options before it reads `openapi.enabled`, so an application with the document
+  switched off failed exactly the same way. Every token is now minted with `Symbol.for` against the
+  runtime's global symbol registry, which is immune to bundle duplication by construction.
+  `./health`, `./metrics` and `./pagination` were audited and carry no DI token at all, so
+  `./openapi` was the only subpath where the defect could manifest; the remaining tokens are
+  converted anyway, so a future subpath that starts consuming one is safe before the fact.
+
+### Internal
+
+- **The consumer load gate now boots a real application against the packed tarball.** It registers
+  `BymaxCoreModule.forRootAsync` from the package root, calls `applyBymaxOpenApi` from the
+  `./openapi` subpath, and asserts all three outcomes — disabled, mounted outside production, and
+  refused in production — in ESM and in CommonJS. The unit suite structurally could not catch this
+  class of defect: under ts-jest every module is loaded once, so tokens shared between two entries
+  are the same object however they were minted, and the bug only exists once the code is bundled.
+  The gate fails against the `1.3.0` artifact and passes against this one.
+- The token specs assert that every exported token round-trips through `Symbol.for`, swept from the
+  module namespace rather than a hand-maintained list, so a token added later is covered without
+  anyone remembering to add it.
+
+## [1.3.0] - 2026-08-11
+
+Coordinated ecosystem release aligning every `@bymax-one/*` package after the ioredis 6 /
+bullmq 6 migration. **No source, runtime, or public-API change in this package** — the
+published `dist/` is byte-identical to `1.2.2`; the changes below are development
+and CI tooling only.
+
+### Changed
+
+- Bumped the `dev-dependencies` group with 3 updates. None of these reaches the published bundle.
+- Bumped the pinned `pnpm/action-setup` CI action from 6.0.9 to 6.0.10.
+- Bumped the pinned `github/codeql-action/upload-sarif` CI action from 4.37.4 to 4.37.6 in the
+  codeql group.
+
 ## [1.2.2] - 2026-08-10
 
 Remediation of a local audit's metrics-auth and pagination-bound findings (merged in #62). No
@@ -341,7 +394,9 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.0.1]: https://github.com/bymaxone/nest-core/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/bymaxone/nest-core/releases/tag/v1.0.0
 [1.1.1]: https://github.com/bymaxone/nest-core/compare/v1.1.0...v1.1.1
+[1.3.1]: https://github.com/bymaxone/nest-core/compare/v1.3.0...v1.3.1
+[1.3.0]: https://github.com/bymaxone/nest-core/compare/v1.2.2...v1.3.0
 [1.2.2]: https://github.com/bymaxone/nest-core/compare/v1.2.1...v1.2.2
 [1.2.1]: https://github.com/bymaxone/nest-core/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/bymaxone/nest-core/compare/v1.1.1...v1.2.0
-[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.2.2...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-core/compare/v1.3.1...HEAD

package/dist/index.cjs

@@ -127,12 +127,18 @@ function normalizeCoreOptions(raw) {
 normalizeCoreOptions();
 
 // src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CORE_OPTIONS");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol("BYMAX_CORRELATION_PROVIDER");
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol("BYMAX_TIMING_SINK");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol("BYMAX_HEALTH_INDICATORS");
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol("BYMAX_METRICS_REGISTRY");
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol("BYMAX_TRACE_CONTEXT");
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
 
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
@@ -201,7 +207,7 @@ async function resolveTraceContextProvider(options) {
 var DEFAULT_MONOTONIC_CLOCK = {
   now: () => performance.now()
 };
-var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol("BYMAX_TIMING_CLOCK");
+var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-clock");
 
 // src/defaults.providers.ts
 var NoopCorrelationIdProvider = class {

package/dist/index.d.cts

@@ -295,6 +295,43 @@ declare class BymaxCoreModule extends BymaxCoreModuleBase {
  * @fileoverview Dependency-injection tokens for `@bymax-one/nest-core`.
  * Every token is a `Symbol`, so the container never collides with a consumer's
  * string tokens and the public contracts stay explicit at every injection site.
+ *
+ * Every token is minted with `Symbol.for`, never `Symbol()`. This package ships
+ * one bundle per published subpath and the bundler inlines shared modules into
+ * each of them, so this file exists once per bundle at runtime: a `Symbol()`
+ * token would mint a *different* identity in `dist/index.cjs` than in
+ * `dist/openapi/index.cjs`, and a provider registered from the package root
+ * would be unreachable from a subpath that injects "the same" token. That is not
+ * hypothetical — it is the 1.3.0 defect that made `applyBymaxOpenApi` throw on
+ * every consumer boot. `Symbol.for` resolves through the runtime's global symbol
+ * registry, so all copies converge on one identity no matter how many bundles
+ * carry them. The same reasoning keeps the health marker's metadata key a
+ * literal; see `health/health.marker.ts`.
+ *
+ * The registry keys below are therefore part of the package's public contract,
+ * as binding as the export names: changing one is a breaking change even though
+ * no signature moves. They are namespaced with the full npm package name because
+ * the registry is process-global and shared with every other library in the
+ * application — the package name is the one string guaranteed not to collide.
+ *
+ * The keys carry no version, which is a deliberate choice with a consequence
+ * worth stating plainly. Every copy of this package loaded into one process
+ * shares these identities, whatever its version. Within a major that is exactly
+ * what is wanted: two resolved instances of the same major agree on what each
+ * token binds, so sharing one identity is what makes a duplicated install
+ * harmless rather than broken. Across majors it is a hazard: a consumer of one
+ * major would resolve, without complaint, a value registered by another against
+ * a contract it does not know, and fail later on an unexpected shape instead of
+ * immediately on an unresolvable token.
+ *
+ * That hazard is not specific to the options snapshot. Each token below binds
+ * its own contract — the correlation provider, the timing sink, the health
+ * indicator array, the metrics registry, the trace-context reader — and every
+ * one of them is now shared across majors by the same mechanism. So this belongs
+ * on the major-release checklist, not in a comment nobody reads at the right
+ * moment: **a major that changes the contract behind any token here must change
+ * that token's key in the same commit.** Changing a key is already a breaking
+ * change, which is precisely why a major is the only place it can happen.
  * @layer Constants
  */
 /**

package/dist/index.d.ts

@@ -295,6 +295,43 @@ declare class BymaxCoreModule extends BymaxCoreModuleBase {
  * @fileoverview Dependency-injection tokens for `@bymax-one/nest-core`.
  * Every token is a `Symbol`, so the container never collides with a consumer's
  * string tokens and the public contracts stay explicit at every injection site.
+ *
+ * Every token is minted with `Symbol.for`, never `Symbol()`. This package ships
+ * one bundle per published subpath and the bundler inlines shared modules into
+ * each of them, so this file exists once per bundle at runtime: a `Symbol()`
+ * token would mint a *different* identity in `dist/index.cjs` than in
+ * `dist/openapi/index.cjs`, and a provider registered from the package root
+ * would be unreachable from a subpath that injects "the same" token. That is not
+ * hypothetical — it is the 1.3.0 defect that made `applyBymaxOpenApi` throw on
+ * every consumer boot. `Symbol.for` resolves through the runtime's global symbol
+ * registry, so all copies converge on one identity no matter how many bundles
+ * carry them. The same reasoning keeps the health marker's metadata key a
+ * literal; see `health/health.marker.ts`.
+ *
+ * The registry keys below are therefore part of the package's public contract,
+ * as binding as the export names: changing one is a breaking change even though
+ * no signature moves. They are namespaced with the full npm package name because
+ * the registry is process-global and shared with every other library in the
+ * application — the package name is the one string guaranteed not to collide.
+ *
+ * The keys carry no version, which is a deliberate choice with a consequence
+ * worth stating plainly. Every copy of this package loaded into one process
+ * shares these identities, whatever its version. Within a major that is exactly
+ * what is wanted: two resolved instances of the same major agree on what each
+ * token binds, so sharing one identity is what makes a duplicated install
+ * harmless rather than broken. Across majors it is a hazard: a consumer of one
+ * major would resolve, without complaint, a value registered by another against
+ * a contract it does not know, and fail later on an unexpected shape instead of
+ * immediately on an unresolvable token.
+ *
+ * That hazard is not specific to the options snapshot. Each token below binds
+ * its own contract — the correlation provider, the timing sink, the health
+ * indicator array, the metrics registry, the trace-context reader — and every
+ * one of them is now shared across majors by the same mechanism. So this belongs
+ * on the major-release checklist, not in a comment nobody reads at the right
+ * moment: **a major that changes the contract behind any token here must change
+ * that token's key in the same commit.** Changing a key is already a breaking
+ * change, which is precisely why a major is the only place it can happen.
  * @layer Constants
  */
 /**

package/dist/index.mjs

@@ -125,12 +125,18 @@ function normalizeCoreOptions(raw) {
 normalizeCoreOptions();
 
 // src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CORE_OPTIONS");
-var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol("BYMAX_CORRELATION_PROVIDER");
-var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol("BYMAX_TIMING_SINK");
-var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol("BYMAX_HEALTH_INDICATORS");
-var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol("BYMAX_METRICS_REGISTRY");
-var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol("BYMAX_TRACE_CONTEXT");
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
+var BYMAX_CORRELATION_PROVIDER = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:correlation-provider"
+);
+var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-sink");
+var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-indicators"
+);
+var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:metrics-registry"
+);
+var BYMAX_TRACE_CONTEXT = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:trace-context");
 
 // src/optional-peer.ts
 function isMissingModuleError(cause) {
@@ -199,7 +205,7 @@ async function resolveTraceContextProvider(options) {
 var DEFAULT_MONOTONIC_CLOCK = {
   now: () => performance.now()
 };
-var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol("BYMAX_TIMING_CLOCK");
+var BYMAX_TIMING_CLOCK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-clock");
 
 // src/defaults.providers.ts
 var NoopCorrelationIdProvider = class {

package/dist/openapi/index.cjs

@@ -5,7 +5,7 @@ var common = require('@nestjs/common');
 // src/openapi/openapi.bootstrap.ts
 
 // src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CORE_OPTIONS");
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
 
 // src/runtime.environment.ts
 var NON_PRODUCTION_ENVIRONMENTS = /* @__PURE__ */ new Set(["development", "test"]);

package/dist/openapi/index.mjs

@@ -3,7 +3,7 @@ import { Logger } from '@nestjs/common';
 // src/openapi/openapi.bootstrap.ts
 
 // src/core.tokens.ts
-var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol("BYMAX_CORE_OPTIONS");
+var BYMAX_CORE_OPTIONS = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:core-options");
 
 // src/runtime.environment.ts
 var NON_PRODUCTION_ENVIRONMENTS = /* @__PURE__ */ new Set(["development", "test"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-core",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "Zero-dependency NestJS 11 application foundation kit: error-envelope exception filter, request-timing interceptor, pagination helpers, health endpoints with indicator discovery, an optional Prometheus metrics endpoint with a contribution contract, OpenAPI documents in development, and OpenTelemetry trace correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",