@bymax-one/nest-queue 1.0.7 → 1.0.9

package/CHANGELOG.md

@@ -7,6 +7,42 @@ versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.0.9] — 2026-08-06
+
+**Published-artifact change, not a behavioural one.** `dist/` differs from `1.0.8` — this
+bundler preserves comments and the source gained mutation-suppression notes — but no runtime
+path changed. Measured by building both revisions and diffing the output.
+
+### Documentation
+
+- The mutation badge and README said **99.06%**; the measured score is **99.68%**.
+
+### Tests
+
+- The withheld Redis connection now has the shape of its guarantee asserted: that the property is
+  non-enumerable, that redefining it throws, and that the URL's password stays out of both
+  `JSON.stringify` and `inspect({ showHidden: true })`.
+
+## [1.0.8] — 2026-08-04
+
+**Runtime change.** `dist/` differs from `1.0.7`.
+
+### Security
+
+- The Redis credentials are no longer disclosed when a service that holds them is
+  serialized. `connection` moves from a plain field on the resolved options to a
+  non-enumerable accessor, and `ConnectionResolver` keeps the ioredis client and the
+  consumer's module options in ECMAScript private fields, as do the maps holding the
+  `Queue`, `Worker` and `QueueEvents` instances. Those objects were all reachable by
+  walking a service: a `url` carries the password inline, and an ioredis instance carries
+  `options.password` as a plain field, so `JSON.stringify`, object spread and
+  `util.inspect` on `QueueService` emitted the password in plaintext — which is what a
+  structured logger does when it renders a provider it was handed, and what an error
+  reporter does when it captures the scope of a throw.
+
+Reading on purpose is unchanged: `options.connection` resolves as before, and no public
+type or export changed.
+
 ## [1.0.7] — 2026-08-04
 
 **Runtime change.** `dist/` differs from `1.0.6`: the four decorators no longer carry
@@ -369,6 +405,8 @@ v6 peer range.
 
 ---
 
+[1.0.9]: https://github.com/bymaxone/nest-queue/compare/v1.0.8...v1.0.9
+[1.0.8]: https://github.com/bymaxone/nest-queue/compare/v1.0.7...v1.0.8
 [1.0.7]: https://github.com/bymaxone/nest-queue/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.6
 [1.0.5]: https://github.com/bymaxone/nest-queue/releases/tag/v1.0.5

package/README.md

@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/@bymax-one/nest-queue"><img src="https://img.shields.io/npm/dm/@bymax-one/nest-queue?style=flat-square&colorA=000000&colorB=000000" alt="npm downloads" /></a>
   <a href="https://github.com/bymaxone/nest-queue/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/bymaxone/nest-queue/ci.yml?branch=main&style=flat-square&colorA=000000&label=CI" alt="CI status" /></a>
   <a href="https://github.com/bymaxone/nest-queue/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square&colorA=000000" alt="coverage" /></a>
-  <a href="https://github.com/bymaxone/nest-queue/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.06%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
+  <a href="https://github.com/bymaxone/nest-queue/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-99.68%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/bymaxone/nest-queue"><img src="https://api.scorecard.dev/projects/github.com/bymaxone/nest-queue/badge?style=flat-square" alt="OpenSSF Scorecard" /></a>
   <a href="https://github.com/bymaxone/nest-queue/blob/main/LICENSE"><img src="https://img.shields.io/github/license/bymaxone/nest-queue?style=flat-square&colorA=000000&colorB=000000" alt="license" /></a>
   <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
@@ -711,6 +711,14 @@ message, or an exception payload. `QueueException.details` carries only scalar
 configuration values (`{ actualValue, expectedValue, limit, received }`), never a
 connection object and never `job.data`.
 
+They are also not reachable by serializing the objects that hold them. The connection is
+attached to the resolved options as a non-enumerable accessor, and the resolver keeps the
+ioredis client — which carries `options.password` as a plain field — in a private field,
+as do the registries that hold the `Queue`, `Worker` and `QueueEvents` instances. So
+`JSON.stringify`, object spread, `util.inspect` and `util.inspect` with `showHidden` all
+come back without credentials, which is what matters when a structured logger renders a
+provider it was handed or an error reporter captures the scope of a throw.
+
 ### Job data is opaque
 
 The library treats `job.data` as a payload to transport, never to inspect. It is never
@@ -755,16 +763,16 @@ key will do it twice at some point.
 
 ## 🛡️ Security Table
 
-| Layer             | Implementation                                                                                             |
-| ----------------- | ---------------------------------------------------------------------------------------------------------- |
-| Credentials       | Injected options only; never read from `process.env`, never logged, never placed in an exception           |
-| Error payloads    | `QueueException.details` restricted to scalar configuration values — no `job.data`, no connection object   |
-| Job payloads      | Treated as opaque; never deep-merged (prototype-pollution guard), never logged                             |
-| Namespacing       | `prefix` applied uniformly to `Queue`, `Worker`, `QueueEvents` and `FlowProducer`                          |
-| Connection policy | `maxRetriesPerRequest: null` confined to duplicated consumer connections; producers keep fail-fast retries |
-| Delivery          | At-least-once with a bounded drain; unacknowledged work is re-queued by BullMQ's stalled check             |
-| Supply chain      | `dependencies: {}`; SHA-pinned Actions, OSV-Scanner, TruffleHog, OpenSSF Scorecard; npm publish over OIDC  |
-| Input validation  | Options validated at bootstrap; cron patterns validated by BullMQ's own parser, never a hand-rolled regex  |
+| Layer             | Implementation                                                                                                                                                                              |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Credentials       | Injected options only; never read from `process.env`, never logged, never placed in an exception; held in a non-enumerable accessor and private fields, so serializing a service omits them |
+| Error payloads    | `QueueException.details` restricted to scalar configuration values — no `job.data`, no connection object                                                                                    |
+| Job payloads      | Treated as opaque; never deep-merged (prototype-pollution guard), never logged                                                                                                              |
+| Namespacing       | `prefix` applied uniformly to `Queue`, `Worker`, `QueueEvents` and `FlowProducer`                                                                                                           |
+| Connection policy | `maxRetriesPerRequest: null` confined to duplicated consumer connections; producers keep fail-fast retries                                                                                  |
+| Delivery          | At-least-once with a bounded drain; unacknowledged work is re-queued by BullMQ's stalled check                                                                                              |
+| Supply chain      | `dependencies: {}`; SHA-pinned Actions, OSV-Scanner, TruffleHog, OpenSSF Scorecard; npm publish over OIDC                                                                                   |
+| Input validation  | Options validated at bootstrap; cron patterns validated by BullMQ's own parser, never a hand-rolled regex                                                                                   |
 
 > [!IMPORTANT]
 > **Delivery is at-least-once, and `prefix` is not an access boundary.** Handlers must be
@@ -788,7 +796,7 @@ key will do it twice at some point.
 ## 🧪 Testing & Quality
 
 - **100% line/branch coverage** on every implemented file (hard CI gate).
-- **Mutation score 99.06%** (Stryker `break 95`) — see [`docs/mutation_testing_results.md`](docs/mutation_testing_results.md).
+- **Mutation score 99.68%** (Stryker `break 95`) — see [`docs/mutation_testing_results.md`](docs/mutation_testing_results.md).
 - **Real-Redis E2E** via Testcontainers (workers, flows, schedulers, deduplication, retries,
   DLQ, graceful shutdown).
 - **Type-level API tests** (`pnpm test:types`) pin the published signatures, so a refactor

package/dist/server/index.cjs

@@ -6,7 +6,12 @@ var ioredis = require('ioredis');
 var bullmq = require('bullmq');
 var path = require('path');
 
+var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -15,6 +20,11 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/shared/constants/error-codes.ts
 var QUEUE_ERROR_CODES = {
@@ -111,8 +121,8 @@ var DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS = 3e4;
 
 // src/server/config/resolved-options.ts
 function applyDefaults(opts) {
+  const connection = opts.connection;
   const base = {
-    connection: opts.connection,
     defaultJobOptions: { ...DEFAULT_JOB_OPTIONS, ...opts.defaultJobOptions ?? {} },
     prefix: opts.prefix ?? "bull",
     queueOptions: opts.queueOptions ?? {},
@@ -128,6 +138,12 @@ function applyDefaults(opts) {
     connectionReadyTimeoutMs: opts.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
   };
   if (opts.telemetry !== void 0) base.telemetry = opts.telemetry;
+  Object.defineProperty(base, "connection", {
+    get: () => connection,
+    enumerable: false,
+    // Stryker disable next-line BooleanLiteral: equivalent HERE — this object is `Object.freeze`d on the way out, and freezing makes every property non-configurable regardless. The flag stays because it states the guarantee at the point the accessor is defined, and because the sibling packages that withhold secrets the same way are NOT frozen, where it is load-bearing
+    configurable: false
+  });
   return Object.freeze(base);
 }
 
@@ -157,34 +173,44 @@ function duplicateConnection(client) {
 }
 
 // src/server/services/connection-resolver.service.ts
+var _client, _options;
 exports.ConnectionResolver = class ConnectionResolver {
   constructor(options) {
-    this.options = options;
+    /**
+     * The resolved Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which
+     * is erased at runtime: an ioredis instance carries `options.password` as a
+     * plain field, so leaving this enumerable would let anything that serializes
+     * a service holding this resolver walk into the credentials.
+     */
+    __privateAdd(this, _client);
+    /** The consumer's module options, which carry the Redis credentials. */
+    __privateAdd(this, _options);
+    __publicField(this, "mode");
+    __privateSet(this, _options, options);
   }
-  options;
-  client;
-  mode;
   /** Resolve and validate the connection. Call once during module bootstrap. */
   async init() {
-    const cfg = this.options.connection;
+    const cfg = __privateGet(this, _options).connection;
     if ("client" in cfg) {
       this.initModeA(cfg.client);
       return;
     }
     this.mode = "mode-b-owned";
-    this.client = "url" in cfg ? new ioredis.Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new ioredis.Redis({ ...cfg.options, lazyConnect: false });
+    __privateSet(this, _client, "url" in cfg ? new ioredis.Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new ioredis.Redis({ ...cfg.options, lazyConnect: false }));
     await this.waitReady(
-      this.options.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
+      __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
   /** The resolved Queue-role client. */
   getClient() {
-    if (!this.client) {
+    if (!__privateGet(this, _client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, {
         reason: "not initialized"
       });
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /** The resolved connection mode. */
   getMode() {
@@ -201,8 +227,8 @@ exports.ConnectionResolver = class ConnectionResolver {
   }
   /** Close the library-owned connection on shutdown; never touch a BYO client. */
   async teardown() {
-    if (this.isOwned() && this.client) {
-      const client = this.client;
+    if (this.isOwned() && __privateGet(this, _client)) {
+      const client = __privateGet(this, _client);
       await client.quit().catch(() => {
         client.disconnect();
       });
@@ -211,7 +237,7 @@ exports.ConnectionResolver = class ConnectionResolver {
   /** Validate and adopt a bring-your-own client for the Queue role. */
   initModeA(client) {
     this.mode = "mode-a-byo";
-    this.client = client;
+    __privateSet(this, _client, client);
     if (!isClientUsable(client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, { status: client.status });
     }
@@ -249,6 +275,8 @@ exports.ConnectionResolver = class ConnectionResolver {
     });
   }
 };
+_client = new WeakMap();
+_options = new WeakMap();
 exports.ConnectionResolver = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(BYMAX_QUEUE_OPTIONS))
@@ -297,15 +325,16 @@ var MAX_BULK_SIZE = 1e3;
 function isOperationalError(err) {
   return typeof err?.code === "string";
 }
+var _queues;
 exports.QueueService = class QueueService {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.QueueService.name));
+    __privateAdd(this, _queues, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.QueueService.name);
-  queues = /* @__PURE__ */ new Map();
   /**
    * Return the cached `Queue` for `queueName`, or create one with the module
    * defaults applied. Subsequent calls with the same name return the same
@@ -315,7 +344,7 @@ exports.QueueService = class QueueService {
    * @param overrides - Optional per-queue option overrides.
    */
   getOrCreateQueue(queueName, overrides) {
-    const existing = this.queues.get(queueName);
+    const existing = __privateGet(this, _queues).get(queueName);
     if (existing) return existing;
     const queue = new bullmq.Queue(queueName, {
       connection: this.connection.getClient(),
@@ -326,7 +355,7 @@ exports.QueueService = class QueueService {
       ...overrides
     });
     attachDefaultErrorListener(queue, this.logger, "Queue", queueName);
-    this.queues.set(queueName, queue);
+    __privateGet(this, _queues).set(queueName, queue);
     return queue;
   }
   /** Resolve the raw cached queue (default generics) for internal delegation. */
@@ -530,7 +559,7 @@ exports.QueueService = class QueueService {
   }
   /** Return a read-only view of the cached queues. */
   getCachedQueues() {
-    return this.queues;
+    return __privateGet(this, _queues);
   }
   /**
    * Close every cached queue (swallowing per-queue errors) and clear the cache.
@@ -542,12 +571,13 @@ exports.QueueService = class QueueService {
    * exists to prevent. `QueueLifecycle` is the only caller.
    */
   async closeAll() {
-    for (const queue of this.queues.values()) {
+    for (const queue of __privateGet(this, _queues).values()) {
       await queue.close().catch(() => void 0);
     }
-    this.queues.clear();
+    __privateGet(this, _queues).clear();
   }
 };
+_queues = new WeakMap();
 exports.QueueService = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),
@@ -704,15 +734,16 @@ exports.MetricsService = class MetricsService {
 exports.MetricsService = __decorateClass([
   common.Injectable()
 ], exports.MetricsService);
+var _entries;
 exports.WorkerRegistry = class WorkerRegistry {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.WorkerRegistry.name));
+    __privateAdd(this, _entries, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.WorkerRegistry.name);
-  entries = /* @__PURE__ */ new Map();
   /**
    * Register an in-process worker with a handler function. The BullMQ `Worker`
    * constructor is synchronous — no Redis handshake is performed at registration
@@ -743,7 +774,7 @@ exports.WorkerRegistry = class WorkerRegistry {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -782,7 +813,7 @@ exports.WorkerRegistry = class WorkerRegistry {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -793,11 +824,11 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @param queueName - The queue whose worker should be removed.
    */
   async unregister(queueName) {
-    const entry = this.entries.get(queueName);
+    const entry = __privateGet(this, _entries).get(queueName);
     if (!entry) return;
     await entry.worker.close();
     await this.closeConnection(entry.connection);
-    this.entries.delete(queueName);
+    __privateGet(this, _entries).delete(queueName);
   }
   /**
    * Returns the queue names of all currently registered workers.
@@ -805,7 +836,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.entries.keys());
+    return Array.from(__privateGet(this, _entries).keys());
   }
   /**
    * Returns a read-only view of the registered workers keyed by queue name.
@@ -815,7 +846,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    */
   getAll() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.worker])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.worker])
     );
   }
   /**
@@ -828,7 +859,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    */
   getConnections() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.connection])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.connection])
     );
   }
   /**
@@ -851,7 +882,7 @@ exports.WorkerRegistry = class WorkerRegistry {
    * @throws {QueueException} `DUPLICATE_PROCESSOR` if the queue is already registered.
    */
   guardDuplicate(queueName) {
-    if (this.entries.has(queueName)) {
+    if (__privateGet(this, _entries).has(queueName)) {
       throw new QueueException(QUEUE_ERROR_CODES.DUPLICATE_PROCESSOR, 500, { queueName });
     }
   }
@@ -960,21 +991,23 @@ exports.WorkerRegistry = class WorkerRegistry {
     return result;
   }
 };
+_entries = new WeakMap();
 exports.WorkerRegistry = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),
   __decorateParam(1, common.Inject(BYMAX_QUEUE_RESOLVED_OPTIONS))
 ], exports.WorkerRegistry);
+var _events, _connections;
 exports.QueueEventsRegistry = class QueueEventsRegistry {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new common.Logger(exports.QueueEventsRegistry.name));
+    __privateAdd(this, _events, /* @__PURE__ */ new Map());
+    __privateAdd(this, _connections, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new common.Logger(exports.QueueEventsRegistry.name);
-  events = /* @__PURE__ */ new Map();
-  connections = /* @__PURE__ */ new Map();
   /**
    * Returns the cached `QueueEvents` for `queueName`, creating one on first
    * call. Subsequent calls for the same name return the same instance without
@@ -984,7 +1017,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns The `QueueEvents` instance for the queue.
    */
   getOrCreate(queueName) {
-    const existing = this.events.get(queueName);
+    const existing = __privateGet(this, _events).get(queueName);
     if (existing) return existing;
     const conn = duplicateConnection(this.connection.getClient());
     let qe;
@@ -995,8 +1028,8 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
       throw err;
     }
     attachDefaultErrorListener(qe, this.logger, "QueueEvents", queueName);
-    this.events.set(queueName, qe);
-    this.connections.set(queueName, conn);
+    __privateGet(this, _events).set(queueName, qe);
+    __privateGet(this, _connections).set(queueName, conn);
     return qe;
   }
   /**
@@ -1005,7 +1038,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.events.keys());
+    return Array.from(__privateGet(this, _events).keys());
   }
   /**
    * Returns the live `QueueEvents` map. Intended for the shutdown orchestrator.
@@ -1013,7 +1046,7 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns A read-only view of the internal map.
    */
   getAll() {
-    return this.events;
+    return __privateGet(this, _events);
   }
   /**
    * Returns a read-only view of the duplicated connections the library opened
@@ -1029,9 +1062,11 @@ exports.QueueEventsRegistry = class QueueEventsRegistry {
    * @returns A read-only snapshot of queue name to duplicated connection.
    */
   getConnections() {
-    return new Map(this.connections);
+    return new Map(__privateGet(this, _connections));
   }
 };
+_events = new WeakMap();
+_connections = new WeakMap();
 exports.QueueEventsRegistry = __decorateClass([
   common.Injectable(),
   __decorateParam(0, common.Inject(exports.ConnectionResolver)),
@@ -1299,10 +1334,15 @@ QueueLifecycle = __decorateClass([
 ], QueueLifecycle);
 
 // src/server/bymax-queue.module.ts
-var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = new common.ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
-  ...definition,
-  global: extras.isGlobal
-})).build();
+var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
+  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
+  // error output, never compared against anything. Mutation testing reports it as surviving for
+  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  new common.ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
+    ...definition,
+    global: extras.isGlobal
+  })).build()
+);
 exports.BymaxQueueModule = class BymaxQueueModule extends ConfigurableModuleClass {
   /**
    * Synchronous registration. Validates options, resolves defaults, and wires the

package/dist/server/index.d.cts

@@ -354,8 +354,7 @@ type JobSchedulerRepeatOptions = {
  *   for `ready`, closing it on shutdown.
  */
 declare class ConnectionResolver {
-    private readonly options;
-    private client;
+    #private;
     private mode;
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
@@ -390,10 +389,10 @@ type CleanableStatus = 'completed' | 'failed' | 'delayed' | 'wait' | 'active' |
  * enqueueing, inspection, metrics, and lifecycle control.
  */
 declare class QueueService {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly queues;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Return the cached `Queue` for `queueName`, or create one with the module
@@ -792,10 +791,10 @@ interface SandboxedWorkerConfig {
  * })
  */
 declare class WorkerRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly entries;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Register an in-process worker with a handler function. The BullMQ `Worker`
@@ -937,11 +936,10 @@ declare class WorkerRegistry {
  * qe.on('completed', ({ jobId }) => console.log(jobId))
  */
 declare class QueueEventsRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly events;
-    private readonly connections;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Returns the cached `QueueEvents` for `queueName`, creating one on first

package/dist/server/index.d.ts

@@ -354,8 +354,7 @@ type JobSchedulerRepeatOptions = {
  *   for `ready`, closing it on shutdown.
  */
 declare class ConnectionResolver {
-    private readonly options;
-    private client;
+    #private;
     private mode;
     constructor(options: BymaxQueueModuleOptions);
     /** Resolve and validate the connection. Call once during module bootstrap. */
@@ -390,10 +389,10 @@ type CleanableStatus = 'completed' | 'failed' | 'delayed' | 'wait' | 'active' |
  * enqueueing, inspection, metrics, and lifecycle control.
  */
 declare class QueueService {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly queues;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Return the cached `Queue` for `queueName`, or create one with the module
@@ -792,10 +791,10 @@ interface SandboxedWorkerConfig {
  * })
  */
 declare class WorkerRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly entries;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Register an in-process worker with a handler function. The BullMQ `Worker`
@@ -937,11 +936,10 @@ declare class WorkerRegistry {
  * qe.on('completed', ({ jobId }) => console.log(jobId))
  */
 declare class QueueEventsRegistry {
+    #private;
     private readonly connection;
     private readonly options;
     private readonly logger;
-    private readonly events;
-    private readonly connections;
     constructor(connection: ConnectionResolver, options: ResolvedQueueOptions);
     /**
      * Returns the cached `QueueEvents` for `queueName`, creating one on first

package/dist/server/index.mjs

@@ -4,7 +4,12 @@ import { Redis } from 'ioredis';
 import { Worker, QueueEvents, Queue, FlowProducer } from 'bullmq';
 import { isAbsolute, extname } from 'path';
 
+var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -13,6 +18,11 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
 
 // src/shared/constants/error-codes.ts
 var QUEUE_ERROR_CODES = {
@@ -109,8 +119,8 @@ var DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS = 3e4;
 
 // src/server/config/resolved-options.ts
 function applyDefaults(opts) {
+  const connection = opts.connection;
   const base = {
-    connection: opts.connection,
     defaultJobOptions: { ...DEFAULT_JOB_OPTIONS, ...opts.defaultJobOptions ?? {} },
     prefix: opts.prefix ?? "bull",
     queueOptions: opts.queueOptions ?? {},
@@ -126,6 +136,12 @@ function applyDefaults(opts) {
     connectionReadyTimeoutMs: opts.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
   };
   if (opts.telemetry !== void 0) base.telemetry = opts.telemetry;
+  Object.defineProperty(base, "connection", {
+    get: () => connection,
+    enumerable: false,
+    // Stryker disable next-line BooleanLiteral: equivalent HERE — this object is `Object.freeze`d on the way out, and freezing makes every property non-configurable regardless. The flag stays because it states the guarantee at the point the accessor is defined, and because the sibling packages that withhold secrets the same way are NOT frozen, where it is load-bearing
+    configurable: false
+  });
   return Object.freeze(base);
 }
 
@@ -155,34 +171,44 @@ function duplicateConnection(client) {
 }
 
 // src/server/services/connection-resolver.service.ts
+var _client, _options;
 var ConnectionResolver = class {
   constructor(options) {
-    this.options = options;
+    /**
+     * The resolved Redis client.
+     *
+     * An ECMAScript private field rather than a TypeScript `private` one, which
+     * is erased at runtime: an ioredis instance carries `options.password` as a
+     * plain field, so leaving this enumerable would let anything that serializes
+     * a service holding this resolver walk into the credentials.
+     */
+    __privateAdd(this, _client);
+    /** The consumer's module options, which carry the Redis credentials. */
+    __privateAdd(this, _options);
+    __publicField(this, "mode");
+    __privateSet(this, _options, options);
   }
-  options;
-  client;
-  mode;
   /** Resolve and validate the connection. Call once during module bootstrap. */
   async init() {
-    const cfg = this.options.connection;
+    const cfg = __privateGet(this, _options).connection;
     if ("client" in cfg) {
       this.initModeA(cfg.client);
       return;
     }
     this.mode = "mode-b-owned";
-    this.client = "url" in cfg ? new Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new Redis({ ...cfg.options, lazyConnect: false });
+    __privateSet(this, _client, "url" in cfg ? new Redis(cfg.url, { ...cfg.options ?? {}, lazyConnect: false }) : new Redis({ ...cfg.options, lazyConnect: false }));
     await this.waitReady(
-      this.options.connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
+      __privateGet(this, _options).connectionReadyTimeoutMs ?? DEFAULT_CONNECTION_READY_TIMEOUT_MS
     );
   }
   /** The resolved Queue-role client. */
   getClient() {
-    if (!this.client) {
+    if (!__privateGet(this, _client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, {
         reason: "not initialized"
       });
     }
-    return this.client;
+    return __privateGet(this, _client);
   }
   /** The resolved connection mode. */
   getMode() {
@@ -199,8 +225,8 @@ var ConnectionResolver = class {
   }
   /** Close the library-owned connection on shutdown; never touch a BYO client. */
   async teardown() {
-    if (this.isOwned() && this.client) {
-      const client = this.client;
+    if (this.isOwned() && __privateGet(this, _client)) {
+      const client = __privateGet(this, _client);
       await client.quit().catch(() => {
         client.disconnect();
       });
@@ -209,7 +235,7 @@ var ConnectionResolver = class {
   /** Validate and adopt a bring-your-own client for the Queue role. */
   initModeA(client) {
     this.mode = "mode-a-byo";
-    this.client = client;
+    __privateSet(this, _client, client);
     if (!isClientUsable(client)) {
       throw new QueueException(QUEUE_ERROR_CODES.CONNECTION_INVALID, 500, { status: client.status });
     }
@@ -247,6 +273,8 @@ var ConnectionResolver = class {
     });
   }
 };
+_client = new WeakMap();
+_options = new WeakMap();
 ConnectionResolver = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(BYMAX_QUEUE_OPTIONS))
@@ -295,15 +323,16 @@ var MAX_BULK_SIZE = 1e3;
 function isOperationalError(err) {
   return typeof err?.code === "string";
 }
+var _queues;
 var QueueService = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(QueueService.name));
+    __privateAdd(this, _queues, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(QueueService.name);
-  queues = /* @__PURE__ */ new Map();
   /**
    * Return the cached `Queue` for `queueName`, or create one with the module
    * defaults applied. Subsequent calls with the same name return the same
@@ -313,7 +342,7 @@ var QueueService = class {
    * @param overrides - Optional per-queue option overrides.
    */
   getOrCreateQueue(queueName, overrides) {
-    const existing = this.queues.get(queueName);
+    const existing = __privateGet(this, _queues).get(queueName);
     if (existing) return existing;
     const queue = new Queue(queueName, {
       connection: this.connection.getClient(),
@@ -324,7 +353,7 @@ var QueueService = class {
       ...overrides
     });
     attachDefaultErrorListener(queue, this.logger, "Queue", queueName);
-    this.queues.set(queueName, queue);
+    __privateGet(this, _queues).set(queueName, queue);
     return queue;
   }
   /** Resolve the raw cached queue (default generics) for internal delegation. */
@@ -528,7 +557,7 @@ var QueueService = class {
   }
   /** Return a read-only view of the cached queues. */
   getCachedQueues() {
-    return this.queues;
+    return __privateGet(this, _queues);
   }
   /**
    * Close every cached queue (swallowing per-queue errors) and clear the cache.
@@ -540,12 +569,13 @@ var QueueService = class {
    * exists to prevent. `QueueLifecycle` is the only caller.
    */
   async closeAll() {
-    for (const queue of this.queues.values()) {
+    for (const queue of __privateGet(this, _queues).values()) {
       await queue.close().catch(() => void 0);
     }
-    this.queues.clear();
+    __privateGet(this, _queues).clear();
   }
 };
+_queues = new WeakMap();
 QueueService = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),
@@ -702,15 +732,16 @@ var MetricsService = class {
 MetricsService = __decorateClass([
   Injectable()
 ], MetricsService);
+var _entries;
 var WorkerRegistry = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(WorkerRegistry.name));
+    __privateAdd(this, _entries, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(WorkerRegistry.name);
-  entries = /* @__PURE__ */ new Map();
   /**
    * Register an in-process worker with a handler function. The BullMQ `Worker`
    * constructor is synchronous — no Redis handshake is performed at registration
@@ -741,7 +772,7 @@ var WorkerRegistry = class {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -780,7 +811,7 @@ var WorkerRegistry = class {
       });
     }
     attachDefaultErrorListener(worker, this.logger, "Worker", queueName);
-    this.entries.set(queueName, { worker, connection: conn });
+    __privateGet(this, _entries).set(queueName, { worker, connection: conn });
     return worker;
   }
   /**
@@ -791,11 +822,11 @@ var WorkerRegistry = class {
    * @param queueName - The queue whose worker should be removed.
    */
   async unregister(queueName) {
-    const entry = this.entries.get(queueName);
+    const entry = __privateGet(this, _entries).get(queueName);
     if (!entry) return;
     await entry.worker.close();
     await this.closeConnection(entry.connection);
-    this.entries.delete(queueName);
+    __privateGet(this, _entries).delete(queueName);
   }
   /**
    * Returns the queue names of all currently registered workers.
@@ -803,7 +834,7 @@ var WorkerRegistry = class {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.entries.keys());
+    return Array.from(__privateGet(this, _entries).keys());
   }
   /**
    * Returns a read-only view of the registered workers keyed by queue name.
@@ -813,7 +844,7 @@ var WorkerRegistry = class {
    */
   getAll() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.worker])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.worker])
     );
   }
   /**
@@ -826,7 +857,7 @@ var WorkerRegistry = class {
    */
   getConnections() {
     return new Map(
-      Array.from(this.entries, ([name, entry]) => [name, entry.connection])
+      Array.from(__privateGet(this, _entries), ([name, entry]) => [name, entry.connection])
     );
   }
   /**
@@ -849,7 +880,7 @@ var WorkerRegistry = class {
    * @throws {QueueException} `DUPLICATE_PROCESSOR` if the queue is already registered.
    */
   guardDuplicate(queueName) {
-    if (this.entries.has(queueName)) {
+    if (__privateGet(this, _entries).has(queueName)) {
       throw new QueueException(QUEUE_ERROR_CODES.DUPLICATE_PROCESSOR, 500, { queueName });
     }
   }
@@ -958,21 +989,23 @@ var WorkerRegistry = class {
     return result;
   }
 };
+_entries = new WeakMap();
 WorkerRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),
   __decorateParam(1, Inject(BYMAX_QUEUE_RESOLVED_OPTIONS))
 ], WorkerRegistry);
+var _events, _connections;
 var QueueEventsRegistry = class {
   constructor(connection, options) {
     this.connection = connection;
     this.options = options;
+    __publicField(this, "logger", new Logger(QueueEventsRegistry.name));
+    __privateAdd(this, _events, /* @__PURE__ */ new Map());
+    __privateAdd(this, _connections, /* @__PURE__ */ new Map());
   }
   connection;
   options;
-  logger = new Logger(QueueEventsRegistry.name);
-  events = /* @__PURE__ */ new Map();
-  connections = /* @__PURE__ */ new Map();
   /**
    * Returns the cached `QueueEvents` for `queueName`, creating one on first
    * call. Subsequent calls for the same name return the same instance without
@@ -982,7 +1015,7 @@ var QueueEventsRegistry = class {
    * @returns The `QueueEvents` instance for the queue.
    */
   getOrCreate(queueName) {
-    const existing = this.events.get(queueName);
+    const existing = __privateGet(this, _events).get(queueName);
     if (existing) return existing;
     const conn = duplicateConnection(this.connection.getClient());
     let qe;
@@ -993,8 +1026,8 @@ var QueueEventsRegistry = class {
       throw err;
     }
     attachDefaultErrorListener(qe, this.logger, "QueueEvents", queueName);
-    this.events.set(queueName, qe);
-    this.connections.set(queueName, conn);
+    __privateGet(this, _events).set(queueName, qe);
+    __privateGet(this, _connections).set(queueName, conn);
     return qe;
   }
   /**
@@ -1003,7 +1036,7 @@ var QueueEventsRegistry = class {
    * @returns An immutable array of queue names.
    */
   list() {
-    return Array.from(this.events.keys());
+    return Array.from(__privateGet(this, _events).keys());
   }
   /**
    * Returns the live `QueueEvents` map. Intended for the shutdown orchestrator.
@@ -1011,7 +1044,7 @@ var QueueEventsRegistry = class {
    * @returns A read-only view of the internal map.
    */
   getAll() {
-    return this.events;
+    return __privateGet(this, _events);
   }
   /**
    * Returns a read-only view of the duplicated connections the library opened
@@ -1027,9 +1060,11 @@ var QueueEventsRegistry = class {
    * @returns A read-only snapshot of queue name to duplicated connection.
    */
   getConnections() {
-    return new Map(this.connections);
+    return new Map(__privateGet(this, _connections));
   }
 };
+_events = new WeakMap();
+_connections = new WeakMap();
 QueueEventsRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(ConnectionResolver)),
@@ -1297,10 +1332,15 @@ QueueLifecycle = __decorateClass([
 ], QueueLifecycle);
 
 // src/server/bymax-queue.module.ts
-var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = new ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
-  ...definition,
-  global: extras.isGlobal
-})).build();
+var { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE, ASYNC_OPTIONS_TYPE } = (
+  // The `moduleName` shapes the generated token's description only — a label read in Nest's DI
+  // error output, never compared against anything. Mutation testing reports it as surviving for
+  // that reason; no Stryker directive attaches inside this builder chain, so the note lives here.
+  new ConfigurableModuleBuilder({ moduleName: "BymaxQueue" }).setClassMethodName("forRoot").setFactoryMethodName("createQueueOptions").setExtras({ isGlobal: true }, (definition, extras) => ({
+    ...definition,
+    global: extras.isGlobal
+  })).build()
+);
 var BymaxQueueModule = class extends ConfigurableModuleClass {
   /**
    * Synchronous registration. Validates options, resolves defaults, and wires the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-queue",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "NestJS dynamic module wrapping BullMQ — typed jobs, flows, job schedulers, deduplication, OpenTelemetry, graceful shutdown",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -146,7 +146,7 @@
       "prettier --write"
     ]
   },
-  "packageManager": "pnpm@11.0.0",
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24.0.0"
   },