@bymax-one/nest-queue 1.0.11 → 1.2.2

package/CHANGELOG.md

@@ -7,6 +7,78 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.2.2] — 2026-09-04
+
+**1.2.1 was tagged but never published**, so this release carries its documentation fix as well
+as the one below. `dist/` changes here for the first time since 1.2.0 — JSDoc reaches the emitted
+`.d.ts`, so a doc-block correction is a change to the published types.
+
+### Fixed
+
+- **The `enqueue` deduplication example asserted a safety property it did not provide.** It showed
+  `` `${tenantId}:reindex:${term}` `` and stated that "one tenant's term cannot suppress another's".
+  Two variable fields joined by a delimiter either may contain do not produce a unique key: with
+  `` `${tenantId}:${term}` ``, the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. The
+  guidance now percent-encodes every variable field, and the claim states what the construction
+  delivers. This is documentation a consumer copies into their own key-building code, which is why
+  the shape mattered more than whether `:reindex:` in particular was reachable.
+- Carried from 1.2.1: **the `MetricsService` example in `README.md` called two methods that do not
+  exist**, `getMetrics(name)` and `getAll([names])`, where the service exposes `get(name)` and a
+  no-argument `getAll()`.
+
+### Internal
+
+Not shipped, listed because the tag covers them: bullmq raised from 6.0.10 to 6.3.4 in the
+workspace override; `fast-uri`, `qs` and `fastify` floors raised past published advisories; the
+README-snippet gate now type-checks through receivers; `AGENTS.md` and its sync workflow added.
+
+## [1.2.1] — 2026-08-30
+
+Documentation only. `dist/` is byte-identical to `1.2.0`; the published tarball was unpacked and
+diffed against a fresh build to confirm it rather than assert it. The release exists because
+`README.md` ships inside the package, so a fix that stays on `main` leaves the npm page — where
+the example is actually read — still wrong.
+
+### Fixed
+
+- **The `MetricsService` example in `README.md` called two methods that do not exist.** It showed
+  `getMetrics(name)` and `getAll([names])`; the service exposes `get(name)` and a no-argument
+  `getAll()` returning `readonly QueueMetrics[]` for every queue currently cached by
+  `QueueService`. Code copied from that example failed to compile, and the wrong `getAll` signature
+  also implied a per-call queue filter the API does not offer. Every other call in the README was
+  checked against the source in the same pass and is correct.
+
+## [1.2.0] — 2026-08-10
+
+**Breaking, shipped as a minor by choice.** The peer ranges move to the next major of each
+Redis/BullMQ package and the `'paused'` job state is removed from the public status surface —
+changes that would normally warrant a major. They ship under a minor because the package has no
+downstream consumer yet; every breaking detail is called out below so a first adopter sees it.
+
+### Changed
+
+- **Peer dependencies migrated to the next major:** `bullmq` `^5` → `^6`, `bullmq-otel` `^1` →
+  `^2`, and `ioredis` `^5` → `^6`. A consumer must upgrade all three together. `ioredis` 6 keeps
+  `'legacy'` reply mapping by default, so BullMQ's reply-shape assumptions are unaffected; it does
+  require Node.js ≥ 20, already covered by this package's `engines`.
+
+### Removed
+
+- **`'paused'` is no longer a job status.** BullMQ 6 dropped `'paused'` from its job-state set —
+  jobs on a paused queue now live in `'wait'`. It is therefore removed from the `JobStatus` union,
+  from the `JOB_STATUS` constant (`JOB_STATUS.PAUSED` no longer exists), and from the
+  `getMetrics().counts` shape, which now reports the five remaining statuses (`waiting`, `active`,
+  `completed`, `failed`, `delayed`). The queue-lifecycle `'paused'`/`'resumed'` **events**
+  (`@OnQueueEvent`) and the `pauseQueue`/`resumeQueue` methods are unchanged — those describe the
+  queue, not a job.
+
+### Internal
+
+- Dev-tooling bumps: `eslint` `^10`, `typescript` `^6`, `@types/node` `^26`, plus `@eslint/js`
+  `^10`. These do not ship and do not change `dist/`. The package's `engines` stays at Node ≥ 24.
+- Mutation gate tightened: Stryker `break`/`high` raised from 95/99 → **100** (the run is at 100%,
+  0 survivors).
+
 ## [1.0.11] — 2026-08-10
 
 **Documentation only.** The shipped declaration comments change (`dts` preserves them); no runtime
@@ -456,6 +528,9 @@ v6 peer range.
 
 ---
 
+[1.2.2]: https://github.com/bymaxone/nest-queue/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/bymaxone/nest-queue/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/bymaxone/nest-queue/compare/v1.0.11...v1.2.0
 [1.0.11]: https://github.com/bymaxone/nest-queue/compare/v1.0.10...v1.0.11
 [1.0.10]: https://github.com/bymaxone/nest-queue/compare/v1.0.9...v1.0.10
 [1.0.9]: https://github.com/bymaxone/nest-queue/compare/v1.0.8...v1.0.9

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <strong>Typed BullMQ queues for NestJS</strong><br />
-  <sub>BullMQ 5 · Workers · Flows · Job Schedulers · Deduplication · OpenTelemetry · Graceful Shutdown · Zero Runtime Dependencies</sub>
+  <sub>BullMQ 6 · Workers · Flows · Job Schedulers · Deduplication · OpenTelemetry · Graceful Shutdown · Zero Runtime Dependencies</sub>
 </p>
 
 <p align="center">
@@ -33,7 +33,7 @@
 
 ## ✨ Overview
 
-`@bymax-one/nest-queue` is a NestJS dynamic module that wraps **BullMQ 5** behind a typed,
+`@bymax-one/nest-queue` is a NestJS dynamic module that wraps **BullMQ 6** behind a typed,
 opinionated surface. Instead of wiring `ioredis` connections, per-queue registration, and
 `maxRetriesPerRequest` policy by hand, you install one library and get typed producers,
 decorator-based workers, flows, recurring **Job Schedulers**, native deduplication,
@@ -114,11 +114,11 @@ Both subpaths ship ESM **and** CommonJS with declarations for each format, so a
 
 ### Peer dependency matrix
 
-| Subpath      | Required peers                                                                                            |
-| ------------ | --------------------------------------------------------------------------------------------------------- |
-| `.` (server) | `@nestjs/common ^11.0.16`, `@nestjs/core ^11.1.18`, `bullmq ^5.16`, `ioredis ^5`, `reflect-metadata ^0.2` |
-| `./shared`   | None                                                                                                      |
-| Optional     | `bullmq-otel ^1` (OpenTelemetry)                                                                          |
+| Subpath      | Required peers                                                                                             |
+| ------------ | ---------------------------------------------------------------------------------------------------------- |
+| `.` (server) | `@nestjs/common ^11.0.16`, `@nestjs/core ^11.1.18`, `bullmq ^6.0`, `ioredis ^6.0`, `reflect-metadata ^0.2` |
+| `./shared`   | None                                                                                                       |
+| Optional     | `bullmq-otel ^2` (OpenTelemetry)                                                                           |
 
 > [!IMPORTANT]
 > `reflect-metadata` is a **global polyfill the application owns** — import it once at
@@ -400,8 +400,8 @@ BymaxQueueModule.forRoot({
 import { MetricsService } from '@bymax-one/nest-queue'
 import type { QueueMetrics } from '@bymax-one/nest-queue'
 
-const metrics: QueueMetrics = await this.metricsService.getMetrics('email')
-const all = await this.metricsService.getAll(['email', 'notifications'])
+const metrics: QueueMetrics = await this.metricsService.get('email')
+const all: readonly QueueMetrics[] = await this.metricsService.getAll()
 ```
 
 ---
@@ -785,11 +785,11 @@ key will do it twice at some point.
 
 - **Runtime:** Node.js 24+
 - **Framework:** NestJS 11 (`ConfigurableModuleBuilder` + `setExtras`)
-- **Queue engine:** BullMQ `^5.16` (peer) over `ioredis ^5` (peer)
-- **Telemetry:** `bullmq-otel ^1` (optional peer)
+- **Queue engine:** BullMQ `^6.0` (peer) over `ioredis ^6.0` (peer)
+- **Telemetry:** `bullmq-otel ^2` (optional peer)
 - **Build:** tsup — ESM + CJS per subpath, with `.d.ts` _and_ `.d.cts` declarations
 - **Tests:** Jest + `@testcontainers/redis` (E2E) + Stryker (mutation)
-- **TypeScript:** 5.x strict (`noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`), zero `any`
+- **TypeScript:** 6.x strict (`noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`), zero `any`
 
 ---
 
@@ -884,9 +884,9 @@ do not pick them up:
 
 - **NestJS only** — does not work with plain Express, standalone Fastify, or other frameworks.
 - **Node.js only** — Deno and Bun are not supported.
-- **BullMQ `^5.16` (1.x floor)** — v6 promotion is planned once the E2E suite is
-  green on the v5 + v6 matrix; see the BullMQ version policy in
-  [`CHANGELOG.md`](CHANGELOG.md).
+- **BullMQ `^6.0` only** — the library targets BullMQ 6 (with `bullmq-otel ^2` for telemetry)
+  and does not support BullMQ 5; the `'paused'` job state that v6 removed is no longer exposed.
+  See the BullMQ version policy in [`CHANGELOG.md`](CHANGELOG.md).
 - **No Redis Cluster sharding** — BullMQ's cluster support is not exercised by this library.
 - **No built-in DLQ helper** — use the `@OnWorkerEvent('failed')` pattern above.
 - **No Prometheus metrics export** — `getMetrics()` returns snapshots; publish them

package/dist/server/index.cjs

@@ -198,11 +198,22 @@ exports.ConnectionResolver = class ConnectionResolver {
       return;
     }
     this.mode = "mode-b-owned";
-    __privateSet(this, _client, "url" in cfg ? new ioredis.Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new ioredis.Redis({ ...cfg.options, lazyConnect: false }));
+    __privateSet(this, _client, "url" in cfg ? new ioredis.Redis(cfg.url, this.ownedOptions(cfg.options)) : new ioredis.Redis(this.ownedOptions(cfg.options)));
     await this.waitReady(
       __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
+  /**
+   * Merge the consumer's options with the owned-connection policy
+   * (`lazyConnect: false`, so the client connects eagerly and `init` can wait
+   * for `ready`) and narrow the result to the shape ioredis 6's constructor
+   * accepts. The runtime object is unchanged — the cast only drops the
+   * `undefined` that `RedisOptions.replyMapping` carries and the constructor
+   * rejects.
+   */
+  ownedOptions(options) {
+    return { ...options ?? {}, lazyConnect: false };
+  }
   /** The resolved Queue-role client. */
   getClient() {
     if (!__privateGet(this, _client)) {
@@ -381,7 +392,13 @@ exports.QueueService = class QueueService {
    * The deduplication `id` is a shared key across the queue, so a multi-tenant
    * producer MUST scope it by tenant: keyed on the value alone
    * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   * for the same term.
+   *
+   * Scoping alone is not enough. Two variable fields joined by a delimiter that
+   * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+   * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+   * every variable field so the delimiter cannot appear inside one:
+   * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
    *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -396,10 +413,11 @@ exports.QueueService = class QueueService {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-   *   carries the tenant so one tenant's term cannot suppress another's.
+   * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+   *   fields are percent-encoded, so no other tenant/term pair can build this key.
+   *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: dedupId, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {
@@ -471,8 +489,7 @@ exports.QueueService = class QueueService {
       "active",
       "completed",
       "failed",
-      "delayed",
-      "paused"
+      "delayed"
     );
     return {
       queue: queueName,
@@ -1341,9 +1358,9 @@ QueueLifecycle = __decorateClass([
 
 // src/server/bymax-queue.module.ts
 var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
-  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
-  // error output, never compared against anything. Mutation testing reports it as surviving for
-  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  // The `moduleName` shapes the generated option token's identifier — `BYMAX_QUEUE_MODULE_OPTIONS`,
+  // which the module spec asserts by value; emptying the name would degrade it to an opaque
+  // `CONFIGURABLE_MODULE_OPTIONS[<hash>]`, so the argument is a caught regression, not a free label.
   new common.ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
     ...definition,
     global: extras.isGlobal
@@ -1548,8 +1565,7 @@ var JOB_STATUS = {
   ACTIVE: "active",
   COMPLETED: "completed",
   FAILED: "failed",
-  DELAYED: "delayed",
-  PAUSED: "paused"
+  DELAYED: "delayed"
 };
 
 exports.BYMAX_QUEUE_CONNECTION_MODE = BYMAX_QUEUE_CONNECTION_MODE;

package/dist/server/index.d.cts

@@ -269,7 +269,7 @@ interface BulkJob<TData = unknown> {
  * @example
  * const status: JobStatus = 'waiting'
  */
-type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'paused';
+type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed';
 
 /**
  * @fileoverview Instantaneous queue metrics snapshot type.
@@ -282,14 +282,14 @@ type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'pa
  * @example
  * const metrics: QueueMetrics = {
  *   queue: 'email',
- *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0, paused: 0 },
+ *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0 },
  *   collectedAt: '2026-06-26T12:00:00.000Z',
  * }
  */
 interface QueueMetrics {
     /** Queue name the snapshot was taken from. */
     queue: string;
-    /** Number of jobs in each of the six BullMQ statuses. */
+    /** Number of jobs in each of the five BullMQ statuses. */
     counts: Record<JobStatus, number>;
     /** ISO 8601 UTC timestamp when the snapshot was collected. */
     collectedAt: string;
@@ -359,6 +359,15 @@ declare class ConnectionResolver {
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
     init(): Promise<void>;
+    /**
+     * Merge the consumer's options with the owned-connection policy
+     * (`lazyConnect: false`, so the client connects eagerly and `init` can wait
+     * for `ready`) and narrow the result to the shape ioredis 6's constructor
+     * accepts. The runtime object is unchanged — the cast only drops the
+     * `undefined` that `RedisOptions.replyMapping` carries and the constructor
+     * rejects.
+     */
+    private ownedOptions;
     /** The resolved Queue-role client. */
     getClient(): Redis;
     /** The resolved connection mode. */
@@ -424,7 +433,13 @@ declare class QueueService {
      * The deduplication `id` is a shared key across the queue, so a multi-tenant
      * producer MUST scope it by tenant: keyed on the value alone
      * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     * for the same term.
+     *
+     * Scoping alone is not enough. Two variable fields joined by a delimiter that
+     * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+     * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+     * every variable field so the delimiter cannot appear inside one:
+     * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
      *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -439,10 +454,11 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-     *   carries the tenant so one tenant's term cannot suppress another's.
+     * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+     *   fields are percent-encoded, so no other tenant/term pair can build this key.
+     *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: dedupId, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;
@@ -1402,7 +1418,6 @@ declare const JOB_STATUS: {
     readonly COMPLETED: "completed";
     readonly FAILED: "failed";
     readonly DELAYED: "delayed";
-    readonly PAUSED: "paused";
 };
 
 export { BYMAX_QUEUE_CONNECTION_MODE, BYMAX_QUEUE_OPTIONS, BYMAX_QUEUE_REDIS_CLIENT, BYMAX_QUEUE_RESOLVED_OPTIONS, type BulkJob, BymaxQueueModule, type BymaxQueueModuleAsyncOptions, type BymaxQueueModuleOptions, type BymaxQueueOptionsFactory, ConnectionResolver, DEFAULT_JOB_OPTIONS, DEFAULT_METRICS_CACHE_TTL_MS, DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS, DEFAULT_WORKER_CONCURRENCY, FlowService, JOB_STATUS, type JobSchedulerRepeatOptions, type JobStatus, MAX_WORKER_CONCURRENCY, MetricsService, OnQueueEvent, OnWorkerEvent, Process, type ProcessHandlerMetadata, Processor, type ProcessorMetadata, type ProgrammaticWorkerConfig, QUEUE_ERROR_CODES, QUEUE_ERROR_MESSAGES, type QueueConnectionConfig, type QueueConnectionMode, type QueueErrorCode, type QueueEventListenerMetadata, type QueueEventName, QueueEventsRegistry, QueueException, QueueLifecycle, type QueueMetrics, QueueService, type SandboxedWorkerConfig, type WorkerEventName, type WorkerOptions, WorkerRegistry };

package/dist/server/index.d.ts

@@ -269,7 +269,7 @@ interface BulkJob<TData = unknown> {
  * @example
  * const status: JobStatus = 'waiting'
  */
-type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'paused';
+type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed';
 
 /**
  * @fileoverview Instantaneous queue metrics snapshot type.
@@ -282,14 +282,14 @@ type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'pa
  * @example
  * const metrics: QueueMetrics = {
  *   queue: 'email',
- *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0, paused: 0 },
+ *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0 },
  *   collectedAt: '2026-06-26T12:00:00.000Z',
  * }
  */
 interface QueueMetrics {
     /** Queue name the snapshot was taken from. */
     queue: string;
-    /** Number of jobs in each of the six BullMQ statuses. */
+    /** Number of jobs in each of the five BullMQ statuses. */
     counts: Record<JobStatus, number>;
     /** ISO 8601 UTC timestamp when the snapshot was collected. */
     collectedAt: string;
@@ -359,6 +359,15 @@ declare class ConnectionResolver {
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
     init(): Promise<void>;
+    /**
+     * Merge the consumer's options with the owned-connection policy
+     * (`lazyConnect: false`, so the client connects eagerly and `init` can wait
+     * for `ready`) and narrow the result to the shape ioredis 6's constructor
+     * accepts. The runtime object is unchanged — the cast only drops the
+     * `undefined` that `RedisOptions.replyMapping` carries and the constructor
+     * rejects.
+     */
+    private ownedOptions;
     /** The resolved Queue-role client. */
     getClient(): Redis;
     /** The resolved connection mode. */
@@ -424,7 +433,13 @@ declare class QueueService {
      * The deduplication `id` is a shared key across the queue, so a multi-tenant
      * producer MUST scope it by tenant: keyed on the value alone
      * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-     * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+     * for the same term.
+     *
+     * Scoping alone is not enough. Two variable fields joined by a delimiter that
+     * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+     * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+     * every variable field so the delimiter cannot appear inside one:
+     * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
      *
      * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
      *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -439,10 +454,11 @@ declare class QueueService {
      * @param data - Typed job payload.
      * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
      * @returns The created job.
-     * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-     *   carries the tenant so one tenant's term cannot suppress another's.
+     * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+     *   fields are percent-encoded, so no other tenant/term pair can build this key.
+     *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
      *   await queueService.enqueue('search', 'reindex', { term }, {
-     *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+     *     deduplication: { id: dedupId, ttl: 5_000 },
      *   })
      */
     enqueue<TData = unknown, TResult = unknown>(queueName: string, jobName: string, data: TData, options?: JobsOptions): Promise<TypedJob<TData, TResult>>;
@@ -1402,7 +1418,6 @@ declare const JOB_STATUS: {
     readonly COMPLETED: "completed";
     readonly FAILED: "failed";
     readonly DELAYED: "delayed";
-    readonly PAUSED: "paused";
 };
 
 export { BYMAX_QUEUE_CONNECTION_MODE, BYMAX_QUEUE_OPTIONS, BYMAX_QUEUE_REDIS_CLIENT, BYMAX_QUEUE_RESOLVED_OPTIONS, type BulkJob, BymaxQueueModule, type BymaxQueueModuleAsyncOptions, type BymaxQueueModuleOptions, type BymaxQueueOptionsFactory, ConnectionResolver, DEFAULT_JOB_OPTIONS, DEFAULT_METRICS_CACHE_TTL_MS, DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS, DEFAULT_WORKER_CONCURRENCY, FlowService, JOB_STATUS, type JobSchedulerRepeatOptions, type JobStatus, MAX_WORKER_CONCURRENCY, MetricsService, OnQueueEvent, OnWorkerEvent, Process, type ProcessHandlerMetadata, Processor, type ProcessorMetadata, type ProgrammaticWorkerConfig, QUEUE_ERROR_CODES, QUEUE_ERROR_MESSAGES, type QueueConnectionConfig, type QueueConnectionMode, type QueueErrorCode, type QueueEventListenerMetadata, type QueueEventName, QueueEventsRegistry, QueueException, QueueLifecycle, type QueueMetrics, QueueService, type SandboxedWorkerConfig, type WorkerEventName, type WorkerOptions, WorkerRegistry };

package/dist/server/index.mjs

@@ -196,11 +196,22 @@ var ConnectionResolver = class {
       return;
     }
     this.mode = "mode-b-owned";
-    __privateSet(this, _client, "url" in cfg ? new Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new Redis({ ...cfg.options, lazyConnect: false }));
+    __privateSet(this, _client, "url" in cfg ? new Redis(cfg.url, this.ownedOptions(cfg.options)) : new Redis(this.ownedOptions(cfg.options)));
     await this.waitReady(
       __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
+  /**
+   * Merge the consumer's options with the owned-connection policy
+   * (`lazyConnect: false`, so the client connects eagerly and `init` can wait
+   * for `ready`) and narrow the result to the shape ioredis 6's constructor
+   * accepts. The runtime object is unchanged — the cast only drops the
+   * `undefined` that `RedisOptions.replyMapping` carries and the constructor
+   * rejects.
+   */
+  ownedOptions(options) {
+    return { ...options ?? {}, lazyConnect: false };
+  }
   /** The resolved Queue-role client. */
   getClient() {
     if (!__privateGet(this, _client)) {
@@ -379,7 +390,13 @@ var QueueService = class {
    * The deduplication `id` is a shared key across the queue, so a multi-tenant
    * producer MUST scope it by tenant: keyed on the value alone
    * (`` `reindex:${term}` ``), tenant A enqueuing a term suppresses tenant B's job
-   * for the same term. Include the tenant (`` `${tenantId}:reindex:${term}` ``).
+   * for the same term.
+   *
+   * Scoping alone is not enough. Two variable fields joined by a delimiter that
+   * either may contain do not produce a unique key: with `` `${tenantId}:${term}` ``,
+   * the pairs `('a', 'b:c')` and `('a:b', 'c')` both yield `a:b:c`. Percent-encode
+   * every variable field so the delimiter cannot appear inside one:
+   * `` `${encodeURIComponent(tenantId)}:${encodeURIComponent(term)}` ``.
    *
    * Deduplication modes (`deduplication: { id, ttl?, extend?, replace?, keepLastIfActive? }`):
    *  - Simple `{ id }` — collapse duplicates until the in-flight job completes or fails.
@@ -394,10 +411,11 @@ var QueueService = class {
    * @param data - Typed job payload.
    * @param options - Per-job BullMQ options (priority, delay, `jobId`, `deduplication`, ...).
    * @returns The created job.
-   * @example Throttle: at most one reindex per term every 5 seconds. The dedup key
-   *   carries the tenant so one tenant's term cannot suppress another's.
+   * @example Throttle: at most one reindex per term every 5 seconds. Both variable
+   *   fields are percent-encoded, so no other tenant/term pair can build this key.
+   *   const dedupId = `${encodeURIComponent(tenantId)}:reindex:${encodeURIComponent(term)}`
    *   await queueService.enqueue('search', 'reindex', { term }, {
-   *     deduplication: { id: `${tenantId}:reindex:${term}`, ttl: 5_000 },
+   *     deduplication: { id: dedupId, ttl: 5_000 },
    *   })
    */
   async enqueue(queueName, jobName, data, options) {
@@ -469,8 +487,7 @@ var QueueService = class {
       "active",
       "completed",
       "failed",
-      "delayed",
-      "paused"
+      "delayed"
     );
     return {
       queue: queueName,
@@ -1339,9 +1356,9 @@ QueueLifecycle = __decorateClass([
 
 // src/server/bymax-queue.module.ts
 var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
-  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
-  // error output, never compared against anything. Mutation testing reports it as surviving for
-  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  // The `moduleName` shapes the generated option token's identifier — `BYMAX_QUEUE_MODULE_OPTIONS`,
+  // which the module spec asserts by value; emptying the name would degrade it to an opaque
+  // `CONFIGURABLE_MODULE_OPTIONS[<hash>]`, so the argument is a caught regression, not a free label.
   new ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
     ...definition,
     global: extras.isGlobal
@@ -1546,8 +1563,7 @@ var JOB_STATUS = {
   ACTIVE: "active",
   COMPLETED: "completed",
   FAILED: "failed",
-  DELAYED: "delayed",
-  PAUSED: "paused"
+  DELAYED: "delayed"
 };
 
 export { BYMAX_QUEUE_CONNECTION_MODE, BYMAX_QUEUE_OPTIONS, BYMAX_QUEUE_REDIS_CLIENT, BYMAX_QUEUE_RESOLVED_OPTIONS, BymaxQueueModule, ConnectionResolver, DEFAULT_JOB_OPTIONS, DEFAULT_METRICS_CACHE_TTL_MS, DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS, DEFAULT_WORKER_CONCURRENCY, FlowService, JOB_STATUS, MAX_WORKER_CONCURRENCY, MetricsService, OnQueueEvent, OnWorkerEvent, Process, Processor, QUEUE_ERROR_CODES, QUEUE_ERROR_MESSAGES, QueueEventsRegistry, QueueException, QueueService, WorkerRegistry };

package/dist/shared/index.cjs

@@ -6,8 +6,7 @@ var JOB_STATUS = {
   ACTIVE: "active",
   COMPLETED: "completed",
   FAILED: "failed",
-  DELAYED: "delayed",
-  PAUSED: "paused"
+  DELAYED: "delayed"
 };
 
 // src/shared/constants/error-codes.ts

package/dist/shared/index.d.cts

@@ -9,7 +9,7 @@
  * @example
  * const status: JobStatus = 'waiting'
  */
-type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'paused';
+type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed';
 
 /**
  * @fileoverview Instantaneous queue metrics snapshot type.
@@ -22,14 +22,14 @@ type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'pa
  * @example
  * const metrics: QueueMetrics = {
  *   queue: 'email',
- *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0, paused: 0 },
+ *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0 },
  *   collectedAt: '2026-06-26T12:00:00.000Z',
  * }
  */
 interface QueueMetrics {
     /** Queue name the snapshot was taken from. */
     queue: string;
-    /** Number of jobs in each of the six BullMQ statuses. */
+    /** Number of jobs in each of the five BullMQ statuses. */
     counts: Record<JobStatus, number>;
     /** ISO 8601 UTC timestamp when the snapshot was collected. */
     collectedAt: string;
@@ -94,7 +94,6 @@ declare const JOB_STATUS: {
     readonly COMPLETED: "completed";
     readonly FAILED: "failed";
     readonly DELAYED: "delayed";
-    readonly PAUSED: "paused";
 };
 
 /**

package/dist/shared/index.d.ts

@@ -9,7 +9,7 @@
  * @example
  * const status: JobStatus = 'waiting'
  */
-type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'paused';
+type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed';
 
 /**
  * @fileoverview Instantaneous queue metrics snapshot type.
@@ -22,14 +22,14 @@ type JobStatus = 'waiting' | 'active' | 'completed' | 'failed' | 'delayed' | 'pa
  * @example
  * const metrics: QueueMetrics = {
  *   queue: 'email',
- *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0, paused: 0 },
+ *   counts: { waiting: 3, active: 1, completed: 120, failed: 2, delayed: 0 },
  *   collectedAt: '2026-06-26T12:00:00.000Z',
  * }
  */
 interface QueueMetrics {
     /** Queue name the snapshot was taken from. */
     queue: string;
-    /** Number of jobs in each of the six BullMQ statuses. */
+    /** Number of jobs in each of the five BullMQ statuses. */
     counts: Record<JobStatus, number>;
     /** ISO 8601 UTC timestamp when the snapshot was collected. */
     collectedAt: string;
@@ -94,7 +94,6 @@ declare const JOB_STATUS: {
     readonly COMPLETED: "completed";
     readonly FAILED: "failed";
     readonly DELAYED: "delayed";
-    readonly PAUSED: "paused";
 };
 
 /**

package/dist/shared/index.mjs

@@ -4,8 +4,7 @@ var JOB_STATUS = {
   ACTIVE: "active",
   COMPLETED: "completed",
   FAILED: "failed",
-  DELAYED: "delayed",
-  PAUSED: "paused"
+  DELAYED: "delayed"
 };
 
 // src/shared/constants/error-codes.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.11",
+  "version": "1.2.2",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -82,9 +82,9 @@
   "peerDependencies": {
     "@nestjs/common": "^11.0.16",
     "@nestjs/core": "^11.1.18",
-    "bullmq": "^5.16.0",
-    "bullmq-otel": "^1.0.0",
-    "ioredis": "^5.0.0",
+    "bullmq": "^6.0.0",
+    "bullmq-otel": "^2.0.0",
+    "ioredis": "^6.0.0",
     "reflect-metadata": "^0.2.0"
   },
   "peerDependenciesMeta": {
@@ -96,20 +96,19 @@
     "@arethetypeswrong/cli": "^0.18.5",
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
-    "@eslint/js": "^9.39.5",
+    "@eslint/js": "^10.0.1",
     "@nestjs/common": "^11.1.28",
     "@nestjs/core": "^11.1.28",
     "@nestjs/testing": "^11.1.28",
-    "@stryker-mutator/core": "^9.6.1",
-    "@stryker-mutator/jest-runner": "^9.6.1",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/jest-runner": "^10.0.0",
     "@types/jest": "^30.0.0",
-    "@types/node": "^24.13.3",
-    "bullmq": "^5.81.2",
-    "eslint": "^9.39.5",
+    "@types/node": "^26.2.0",
+    "bullmq": "^6.0.0",
+    "eslint": "^10.8.1",
     "eslint-config-prettier": "^10.1.8",
     "husky": "^9.1.7",
-    "ioredis": "5.11.1",
-    "ioredis-mock": "^8.9.0",
+    "ioredis": "^6.0.0",
     "jest": "^30.0.0",
     "jest-environment-node": "^30.4.1",
     "lint-staged": "^17.2.0",
@@ -119,7 +118,7 @@
     "testcontainers": "^12.0.4",
     "ts-jest": "^29.4.12",
     "tsup": "^8.3.0",
-    "typescript": "^5.6.0",
+    "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0"
   },
   "keywords": [