@bymax-one/nest-queue 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -7,6 +7,26 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.8] — 2026-08-04
+
+**Runtime change.** `dist/` differs from `1.0.7`.
+
+### Security
+
+- The Redis credentials are no longer disclosed when a service that holds them is
+  serialized. `connection` moves from a plain field on the resolved options to a
+  non-enumerable accessor, and `ConnectionResolver` keeps the ioredis client and the
+  consumer's module options in ECMAScript private fields, as do the maps holding the
+  `Queue`, `Worker` and `QueueEvents` instances. Those objects were all reachable by
+  walking a service: a `url` carries the password inline, and an ioredis instance carries
+  `options.password` as a plain field, so `JSON.stringify`, object spread and
+  `util.inspect` on `QueueService` emitted the password in plaintext — which is what a
+  structured logger does when it renders a provider it was handed, and what an error
+  reporter does when it captures the scope of a throw.
+
+Reading on purpose is unchanged: `options.connection` resolves as before, and no public
+type or export changed.
+
 ## [1.0.7] — 2026-08-04
 
 **Runtime change.** `dist/` differs from `1.0.6`: the four decorators no longer carry
@@ -369,6 +389,7 @@ v6 peer range.
 
 ---
 
+[1.0.8]: https://github.com/bymaxone/nest-queue/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-queue/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.6
 [1.0.5]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.5

package/README.md

@@ -711,6 +711,14 @@ message, or an exception payload. `QueueException.details` carries only scalar
 configuration values (`{ actualValue, expectedValue, limit, received }`), never a
 connection object and never `job.data`.
 
+They are also not reachable by serializing the objects that hold them. The connection is
+attached to the resolved options as a non-enumerable accessor, and the resolver keeps the
+ioredis client — which carries `options.password` as a plain field — in a private field,
+as do the registries that hold the `Queue`, `Worker` and `QueueEvents` instances. So
+`JSON.stringify`, object spread, `util.inspect` and `util.inspect` with `showHidden` all
+come back without credentials, which is what matters when a structured logger renders a
+provider it was handed or an error reporter captures the scope of a throw.
+
 ### Job data is opaque
 
 The library treats `job.data` as a payload to transport, never to inspect. It is never
@@ -755,16 +763,16 @@ key will do it twice at some point.
 
 ## 🛡️ Security Table
 
-| Layer             | Implementation                                                                                             |
-| ----------------- | ---------------------------------------------------------------------------------------------------------- |
-| Credentials       | Injected options only; never read from `process.env`, never logged, never placed in an exception           |
-| Error payloads    | `QueueException.details` restricted to scalar configuration values — no `job.data`, no connection object   |
-| Job payloads      | Treated as opaque; never deep-merged (prototype-pollution guard), never logged                             |
-| Namespacing       | `prefix` applied uniformly to `Queue`, `Worker`, `QueueEvents` and `FlowProducer`                          |
-| Connection policy | `maxRetriesPerRequest: null` confined to duplicated consumer connections; producers keep fail-fast retries |
-| Delivery          | At-least-once with a bounded drain; unacknowledged work is re-queued by BullMQ's stalled check             |
-| Supply chain      | `dependencies: {}`; SHA-pinned Actions, OSV-Scanner, TruffleHog, OpenSSF Scorecard; npm publish over OIDC  |
-| Input validation  | Options validated at bootstrap; cron patterns validated by BullMQ's own parser, never a hand-rolled regex  |
+| Layer             | Implementation                                                                                                                                                                              |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Credentials       | Injected options only; never read from `process.env`, never logged, never placed in an exception; held in a non-enumerable accessor and private fields, so serializing a service omits them |
+| Error payloads    | `QueueException.details` restricted to scalar configuration values — no `job.data`, no connection object                                                                                    |
+| Job payloads      | Treated as opaque; never deep-merged (prototype-pollution guard), never logged                                                                                                              |
+| Namespacing       | `prefix` applied uniformly to `Queue`, `Worker`, `QueueEvents` and `FlowProducer`                                                                                                           |
+| Connection policy | `maxRetriesPerRequest: null` confined to duplicated consumer connections; producers keep fail-fast retries                                                                                  |
+| Delivery          | At-least-once with a bounded drain; unacknowledged work is re-queued by BullMQ's stalled check                                                                                              |
+| Supply chain      | `dependencies: {}`; SHA-pinned Actions, OSV-Scanner, TruffleHog, OpenSSF Scorecard; npm publish over OIDC                                                                                   |
+| Input validation  | Options validated at bootstrap; cron patterns validated by BullMQ's own parser, never a hand-rolled regex                                                                                   |
 
 > [!IMPORTANT]
 > **Delivery is at-least-once, and `prefix` is not an access boundary.** Handlers must be

package/dist/server/index.cjs

@@ -6,7 +6,12 @@ var ioredis = require('ioredis');
 var bullmq = require('bullmq');
 var path = require('path');
 
+var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -15,6 +20,11 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/shared/constants/error-codes.ts
 var QUEUE_ERROR_CODES = {
@@ -111,8 +121,8 @@ var DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS = 3e4;
 
 // src/server/config/resolved-options.ts
 function applyDefaults(opts) {
+  const connection = opts.connection;
   const base = {
-    connection: opts.connection,
     defaultJobOptions: { ...DEFAULT_JOB_OPTIONS, ...opts.defaultJobOptions ?? {} },
     prefix: opts.prefix ?? "bull",
     queueOptions: opts.queueOptions ?? {},
@@ -128,6 +138,11 @@ function applyDefaults(opts) {
     connectionReadyTimeoutMs: opts.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
   };
   if (opts.telemetry !== void 0) base.telemetry = opts.telemetry;
+  Object.defineProperty(base, "connection", {
+    get: () => connection,
+    enumerable: false,
+    configurable: false
+  });
   return Object.freeze(base);
 }
 
@@ -157,34 +172,44 @@ function duplicateConnection(client) {
 }
 
 // src/server/services/connection-resolver.service.ts
+var _client, _options;
 exports.ConnectionResolver = class ConnectionResolver {
   constructor(options) {
-    this.options = options;
+    /**
+     * The resolved Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which
+     * is erased at runtime: an ioredis instance carries `options.password` as a
+     * plain field, so leaving this enumerable would let anything that serializes
+     * a service holding this resolver walk into the credentials.
+     */
+    __privateAdd(this, _client);
+    /** The consumer's module options, which carry the Redis credentials. */
+    __privateAdd(this, _options);
+    __publicField(this, "mode");
+    __privateSet(this, _options, options);
   }
-  options;
-  client;
-  mode;
   /** Resolve and validate the connection. Call once during module bootstrap. */
   async init() {
-    const cfg = this.options.connection;
+    const cfg = __privateGet(this, _options).connection;
     if ("client" in cfg) {
       this.initModeA(cfg.client);
       return;
     }
     this.mode = "mode-b-owned";
-    this.client = "url" in cfg ? new ioredis.Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new ioredis.Redis({ ...cfg.options, lazyConnect: false });
+    __privateSet(this, _client, "url" in cfg ? new ioredis.Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new ioredis.Redis({ ...cfg.options, lazyConnect: false }));
     await this.waitReady(
-      this.options.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
+      __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
   /** The resolved Queue-role client. */
   getClient() {
-    if (!this.client) {
+    if (!__privateGet(this, _client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, {
         reason: "not initialized"
       });
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /** The resolved connection mode. */
   getMode() {
@@ -201,8 +226,8 @@ exports.ConnectionResolver = class ConnectionResolver {
   }
   /** Close the library-owned connection on shutdown; never touch a BYO client. */
   async teardown() {
-    if (this.isOwned() && this.client) {
-      const client = this.client;
+    if (this.isOwned() && __privateGet(this, _client)) {
+      const client = __privateGet(this, _client);
       await client.quit().catch(() => {
         client.disconnect();
       });
@@ -211,7 +236,7 @@ exports.ConnectionResolver = class ConnectionResolver {
   /** Validate and adopt a bring-your-own client for the Queue role. */
   initModeA(client) {
     this.mode = "mode-a-byo";
-    this.client = client;
+    __privateSet(this, _client, client);
     if (!isClientUsable(client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, { status: client.status });
     }
@@ -249,6 +274,8 @@ exports.ConnectionResolver = class ConnectionResolver {
     });
   }
 };
+_client = new WeakMap();
+_options = new WeakMap();
 exports.ConnectionResolver = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_QUEUE_OPTIONS))
@@ -297,15 +324,16 @@ var MAX_BULK_SIZE = 1e3;
 function isOperationalError(err) {
   return typeof err?.code === "string";
 }
+var _queues;
 exports.QueueService = class QueueService {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.QueueService.name));
+    __privateAdd(this, _queues, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.QueueService.name);
-  queues = /* @__PURE__ */ new Map();
   /**
    * Return the cached `Queue` for `queueName`, or create one with the module
    * defaults applied. Subsequent calls with the same name return the same
@@ -315,7 +343,7 @@ exports.QueueService = class QueueService {
    * @param overrides - Optional per-queue option overrides.
    */
   getOrCreateQueue(queueName, overrides) {
-    const existing = this.queues.get(queueName);
+    const existing = __privateGet(this, _queues).get(queueName);
     if (existing) return existing;
     const queue = new bullmq.Queue(queueName, {
       connection: this.connection.getClient(),
@@ -326,7 +354,7 @@ exports.QueueService = class QueueService {
       ...overrides
     });
     attachDefaultErrorListener(queue, this.logger, "Queue", queueName);
-    this.queues.set(queueName, queue);
+    __privateGet(this, _queues).set(queueName, queue);
     return queue;
   }
   /** Resolve the raw cached queue (default generics) for internal delegation. */
@@ -530,7 +558,7 @@ exports.QueueService = class QueueService {
   }
   /** Return a read-only view of the cached queues. */
   getCachedQueues() {
-    return this.queues;
+    return __privateGet(this, _queues);
   }
   /**
    * Close every cached queue (swallowing per-queue errors) and clear the cache.
@@ -542,12 +570,13 @@ exports.QueueService = class QueueService {
    * exists to prevent. `QueueLifecycle` is the only caller.
    */
   async closeAll() {
-    for (const queue of this.queues.values()) {
+    for (const queue of __privateGet(this, _queues).values()) {
       await queue.close().catch(() => void 0);
     }
-    this.queues.clear();
+    __privateGet(this, _queues).clear();
   }
 };
+_queues = new WeakMap();
 exports.QueueService = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),
@@ -704,15 +733,16 @@ exports.MetricsService = class MetricsService {
 exports.MetricsService = __decorateClass([
   common.Injectable()
 ], exports.MetricsService);
+var _entries;
 exports.WorkerRegistry = class WorkerRegistry {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.WorkerRegistry.name));
+    __privateAdd(this, _entries, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.WorkerRegistry.name);
-  entries = /* @__PURE__ */ new Map();
   /**
    * Register an in-process worker with a handler function. The BullMQ `Worker`
    * constructor is synchronous — no Redis handshake is performed at registration
@@ -743,7 +773,7 @@ exports.WorkerRegistry = class WorkerRegistry {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -782,7 +812,7 @@ exports.WorkerRegistry = class WorkerRegistry {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -793,11 +823,11 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @param queueName - The queue whose worker should be removed.
    */
   async unregister(queueName) {
-    const entry = this.entries.get(queueName);
+    const entry = __privateGet(this, _entries).get(queueName);
     if (!entry) return;
     await entry.worker.close();
     await this.closeConnection(entry.connection);
-    this.entries.delete(queueName);
+    __privateGet(this, _entries).delete(queueName);
   }
   /**
    * Returns the queue names of all currently registered workers.
@@ -805,7 +835,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.entries.keys());
+    return Array.from(__privateGet(this, _entries).keys());
   }
   /**
    * Returns a read-only view of the registered workers keyed by queue name.
@@ -815,7 +845,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    */
   getAll() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.worker])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.worker])
     );
   }
   /**
@@ -828,7 +858,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    */
   getConnections() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.connection])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.connection])
     );
   }
   /**
@@ -851,7 +881,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @throws {QueueException} `DUPLICATE_PROCESSOR` if the queue is already registered.
    */
   guardDuplicate(queueName) {
-    if (this.entries.has(queueName)) {
+    if (__privateGet(this, _entries).has(queueName)) {
       throw new QueueException(QUEUE_ERROR_CODES.DUPLICATE_PROCESSOR, 500, { queueName });
     }
   }
@@ -960,21 +990,23 @@ exports.WorkerRegistry = class WorkerRegistry {
     return result;
   }
 };
+_entries = new WeakMap();
 exports.WorkerRegistry = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),
   __decorateParam(1, common.Inject(BYMAX_QUEUE_RESOLVED_OPTIONS))
 ], exports.WorkerRegistry);
+var _events, _connections;
 exports.QueueEventsRegistry = class QueueEventsRegistry {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.QueueEventsRegistry.name));
+    __privateAdd(this, _events, /* @__PURE__ */ new Map());
+    __privateAdd(this, _connections, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.QueueEventsRegistry.name);
-  events = /* @__PURE__ */ new Map();
-  connections = /* @__PURE__ */ new Map();
   /**
    * Returns the cached `QueueEvents` for `queueName`, creating one on first
    * call. Subsequent calls for the same name return the same instance without
@@ -984,7 +1016,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns The `QueueEvents` instance for the queue.
    */
   getOrCreate(queueName) {
-    const existing = this.events.get(queueName);
+    const existing = __privateGet(this, _events).get(queueName);
     if (existing) return existing;
     const conn = duplicateConnection(this.connection.getClient());
     let qe;
@@ -995,8 +1027,8 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
       throw err;
     }
     attachDefaultErrorListener(qe, this.logger, "QueueEvents", queueName);
-    this.events.set(queueName, qe);
-    this.connections.set(queueName, conn);
+    __privateGet(this, _events).set(queueName, qe);
+    __privateGet(this, _connections).set(queueName, conn);
     return qe;
   }
   /**
@@ -1005,7 +1037,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.events.keys());
+    return Array.from(__privateGet(this, _events).keys());
   }
   /**
    * Returns the live `QueueEvents` map. Intended for the shutdown orchestrator.
@@ -1013,7 +1045,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns A read-only view of the internal map.
    */
   getAll() {
-    return this.events;
+    return __privateGet(this, _events);
   }
   /**
    * Returns a read-only view of the duplicated connections the library opened
@@ -1029,9 +1061,11 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns A read-only snapshot of queue name to duplicated connection.
    */
   getConnections() {
-    return new Map(this.connections);
+    return new Map(__privateGet(this, _connections));
   }
 };
+_events = new WeakMap();
+_connections = new WeakMap();
 exports.QueueEventsRegistry = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),

package/dist/server/index.d.cts

@@ -354,8 +354,7 @@ type JobSchedulerRepeatOptions = {
  *   for `ready`, closing it on shutdown.
  */
 declare class ConnectionResolver {
-    private readonly options;
-    private client;
+    #private;
     private mode;
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
@@ -390,10 +389,10 @@ type CleanableStatus = 'completed' | 'failed' | 'delayed' | 'wait' | 'active' |
  * enqueueing, inspection, metrics, and lifecycle control.
  */
 declare class QueueService {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly queues;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Return the cached `Queue` for `queueName`, or create one with the module
@@ -792,10 +791,10 @@ interface SandboxedWorkerConfig {
  * })
  */
 declare class WorkerRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly entries;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Register an in-process worker with a handler function. The BullMQ `Worker`
@@ -937,11 +936,10 @@ declare class WorkerRegistry {
  * qe.on('completed', ({ jobId }) => console.log(jobId))
  */
 declare class QueueEventsRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly events;
-    private readonly connections;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Returns the cached `QueueEvents` for `queueName`, creating one on first

package/dist/server/index.d.ts

@@ -354,8 +354,7 @@ type JobSchedulerRepeatOptions = {
  *   for `ready`, closing it on shutdown.
  */
 declare class ConnectionResolver {
-    private readonly options;
-    private client;
+    #private;
     private mode;
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
@@ -390,10 +389,10 @@ type CleanableStatus = 'completed' | 'failed' | 'delayed' | 'wait' | 'active' |
  * enqueueing, inspection, metrics, and lifecycle control.
  */
 declare class QueueService {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly queues;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Return the cached `Queue` for `queueName`, or create one with the module
@@ -792,10 +791,10 @@ interface SandboxedWorkerConfig {
  * })
  */
 declare class WorkerRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly entries;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Register an in-process worker with a handler function. The BullMQ `Worker`
@@ -937,11 +936,10 @@ declare class WorkerRegistry {
  * qe.on('completed', ({ jobId }) => console.log(jobId))
  */
 declare class QueueEventsRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly events;
-    private readonly connections;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Returns the cached `QueueEvents` for `queueName`, creating one on first

package/dist/server/index.mjs

@@ -4,7 +4,12 @@ import { Redis } from 'ioredis';
 import { Worker, QueueEvents, Queue, FlowProducer } from 'bullmq';
 import { isAbsolute, extname } from 'path';
 
+var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -13,6 +18,11 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/shared/constants/error-codes.ts
 var QUEUE_ERROR_CODES = {
@@ -109,8 +119,8 @@ var DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS = 3e4;
 
 // src/server/config/resolved-options.ts
 function applyDefaults(opts) {
+  const connection = opts.connection;
   const base = {
-    connection: opts.connection,
     defaultJobOptions: { ...DEFAULT_JOB_OPTIONS, ...opts.defaultJobOptions ?? {} },
     prefix: opts.prefix ?? "bull",
     queueOptions: opts.queueOptions ?? {},
@@ -126,6 +136,11 @@ function applyDefaults(opts) {
     connectionReadyTimeoutMs: opts.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
   };
   if (opts.telemetry !== void 0) base.telemetry = opts.telemetry;
+  Object.defineProperty(base, "connection", {
+    get: () => connection,
+    enumerable: false,
+    configurable: false
+  });
   return Object.freeze(base);
 }
 
@@ -155,34 +170,44 @@ function duplicateConnection(client) {
 }
 
 // src/server/services/connection-resolver.service.ts
+var _client, _options;
 var ConnectionResolver = class {
   constructor(options) {
-    this.options = options;
+    /**
+     * The resolved Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which
+     * is erased at runtime: an ioredis instance carries `options.password` as a
+     * plain field, so leaving this enumerable would let anything that serializes
+     * a service holding this resolver walk into the credentials.
+     */
+    __privateAdd(this, _client);
+    /** The consumer's module options, which carry the Redis credentials. */
+    __privateAdd(this, _options);
+    __publicField(this, "mode");
+    __privateSet(this, _options, options);
   }
-  options;
-  client;
-  mode;
   /** Resolve and validate the connection. Call once during module bootstrap. */
   async init() {
-    const cfg = this.options.connection;
+    const cfg = __privateGet(this, _options).connection;
     if ("client" in cfg) {
       this.initModeA(cfg.client);
       return;
     }
     this.mode = "mode-b-owned";
-    this.client = "url" in cfg ? new Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new Redis({ ...cfg.options, lazyConnect: false });
+    __privateSet(this, _client, "url" in cfg ? new Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new Redis({ ...cfg.options, lazyConnect: false }));
     await this.waitReady(
-      this.options.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
+      __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
   /** The resolved Queue-role client. */
   getClient() {
-    if (!this.client) {
+    if (!__privateGet(this, _client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, {
         reason: "not initialized"
       });
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /** The resolved connection mode. */
   getMode() {
@@ -199,8 +224,8 @@ var ConnectionResolver = class {
   }
   /** Close the library-owned connection on shutdown; never touch a BYO client. */
   async teardown() {
-    if (this.isOwned() && this.client) {
-      const client = this.client;
+    if (this.isOwned() && __privateGet(this, _client)) {
+      const client = __privateGet(this, _client);
       await client.quit().catch(() => {
         client.disconnect();
       });
@@ -209,7 +234,7 @@ var ConnectionResolver = class {
   /** Validate and adopt a bring-your-own client for the Queue role. */
   initModeA(client) {
     this.mode = "mode-a-byo";
-    this.client = client;
+    __privateSet(this, _client, client);
     if (!isClientUsable(client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, { status: client.status });
     }
@@ -247,6 +272,8 @@ var ConnectionResolver = class {
     });
   }
 };
+_client = new WeakMap();
+_options = new WeakMap();
 ConnectionResolver = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_QUEUE_OPTIONS))
@@ -295,15 +322,16 @@ var MAX_BULK_SIZE = 1e3;
 function isOperationalError(err) {
   return typeof err?.code === "string";
 }
+var _queues;
 var QueueService = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(QueueService.name));
+    __privateAdd(this, _queues, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(QueueService.name);
-  queues = /* @__PURE__ */ new Map();
   /**
    * Return the cached `Queue` for `queueName`, or create one with the module
    * defaults applied. Subsequent calls with the same name return the same
@@ -313,7 +341,7 @@ var QueueService = class {
    * @param overrides - Optional per-queue option overrides.
    */
   getOrCreateQueue(queueName, overrides) {
-    const existing = this.queues.get(queueName);
+    const existing = __privateGet(this, _queues).get(queueName);
     if (existing) return existing;
     const queue = new Queue(queueName, {
       connection: this.connection.getClient(),
@@ -324,7 +352,7 @@ var QueueService = class {
       ...overrides
     });
     attachDefaultErrorListener(queue, this.logger, "Queue", queueName);
-    this.queues.set(queueName, queue);
+    __privateGet(this, _queues).set(queueName, queue);
     return queue;
   }
   /** Resolve the raw cached queue (default generics) for internal delegation. */
@@ -528,7 +556,7 @@ var QueueService = class {
   }
   /** Return a read-only view of the cached queues. */
   getCachedQueues() {
-    return this.queues;
+    return __privateGet(this, _queues);
   }
   /**
    * Close every cached queue (swallowing per-queue errors) and clear the cache.
@@ -540,12 +568,13 @@ var QueueService = class {
    * exists to prevent. `QueueLifecycle` is the only caller.
    */
   async closeAll() {
-    for (const queue of this.queues.values()) {
+    for (const queue of __privateGet(this, _queues).values()) {
       await queue.close().catch(() => void 0);
     }
-    this.queues.clear();
+    __privateGet(this, _queues).clear();
   }
 };
+_queues = new WeakMap();
 QueueService = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),
@@ -702,15 +731,16 @@ var MetricsService = class {
 MetricsService = __decorateClass([
   Injectable()
 ], MetricsService);
+var _entries;
 var WorkerRegistry = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(WorkerRegistry.name));
+    __privateAdd(this, _entries, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(WorkerRegistry.name);
-  entries = /* @__PURE__ */ new Map();
   /**
    * Register an in-process worker with a handler function. The BullMQ `Worker`
    * constructor is synchronous — no Redis handshake is performed at registration
@@ -741,7 +771,7 @@ var WorkerRegistry = class {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -780,7 +810,7 @@ var WorkerRegistry = class {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -791,11 +821,11 @@ var WorkerRegistry = class {
    * @param queueName - The queue whose worker should be removed.
    */
   async unregister(queueName) {
-    const entry = this.entries.get(queueName);
+    const entry = __privateGet(this, _entries).get(queueName);
     if (!entry) return;
     await entry.worker.close();
     await this.closeConnection(entry.connection);
-    this.entries.delete(queueName);
+    __privateGet(this, _entries).delete(queueName);
   }
   /**
    * Returns the queue names of all currently registered workers.
@@ -803,7 +833,7 @@ var WorkerRegistry = class {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.entries.keys());
+    return Array.from(__privateGet(this, _entries).keys());
   }
   /**
    * Returns a read-only view of the registered workers keyed by queue name.
@@ -813,7 +843,7 @@ var WorkerRegistry = class {
    */
   getAll() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.worker])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.worker])
     );
   }
   /**
@@ -826,7 +856,7 @@ var WorkerRegistry = class {
    */
   getConnections() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.connection])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.connection])
     );
   }
   /**
@@ -849,7 +879,7 @@ var WorkerRegistry = class {
    * @throws {QueueException} `DUPLICATE_PROCESSOR` if the queue is already registered.
    */
   guardDuplicate(queueName) {
-    if (this.entries.has(queueName)) {
+    if (__privateGet(this, _entries).has(queueName)) {
       throw new QueueException(QUEUE_ERROR_CODES.DUPLICATE_PROCESSOR, 500, { queueName });
     }
   }
@@ -958,21 +988,23 @@ var WorkerRegistry = class {
     return result;
   }
 };
+_entries = new WeakMap();
 WorkerRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),
   __decorateParam(1, Inject(BYMAX_QUEUE_RESOLVED_OPTIONS))
 ], WorkerRegistry);
+var _events, _connections;
 var QueueEventsRegistry = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(QueueEventsRegistry.name));
+    __privateAdd(this, _events, /* @__PURE__ */ new Map());
+    __privateAdd(this, _connections, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(QueueEventsRegistry.name);
-  events = /* @__PURE__ */ new Map();
-  connections = /* @__PURE__ */ new Map();
   /**
    * Returns the cached `QueueEvents` for `queueName`, creating one on first
    * call. Subsequent calls for the same name return the same instance without
@@ -982,7 +1014,7 @@ var QueueEventsRegistry = class {
    * @returns The `QueueEvents` instance for the queue.
    */
   getOrCreate(queueName) {
-    const existing = this.events.get(queueName);
+    const existing = __privateGet(this, _events).get(queueName);
     if (existing) return existing;
     const conn = duplicateConnection(this.connection.getClient());
     let qe;
@@ -993,8 +1025,8 @@ var QueueEventsRegistry = class {
       throw err;
     }
     attachDefaultErrorListener(qe, this.logger, "QueueEvents", queueName);
-    this.events.set(queueName, qe);
-    this.connections.set(queueName, conn);
+    __privateGet(this, _events).set(queueName, qe);
+    __privateGet(this, _connections).set(queueName, conn);
     return qe;
   }
   /**
@@ -1003,7 +1035,7 @@ var QueueEventsRegistry = class {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.events.keys());
+    return Array.from(__privateGet(this, _events).keys());
   }
   /**
    * Returns the live `QueueEvents` map. Intended for the shutdown orchestrator.
@@ -1011,7 +1043,7 @@ var QueueEventsRegistry = class {
    * @returns A read-only view of the internal map.
    */
   getAll() {
-    return this.events;
+    return __privateGet(this, _events);
   }
   /**
    * Returns a read-only view of the duplicated connections the library opened
@@ -1027,9 +1059,11 @@ var QueueEventsRegistry = class {
    * @returns A read-only snapshot of queue name to duplicated connection.
    */
   getConnections() {
-    return new Map(this.connections);
+    return new Map(__privateGet(this, _connections));
   }
 };
+_events = new WeakMap();
+_connections = new WeakMap();
 QueueEventsRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",